agentworkshop 0.8.6 → 0.8.8

package/server/services/workshop/agents/adapters/line-spawn.ts

@@ -1,144 +1,148 @@
-/**
- * 受控子进程拉起工具(harness 适配器共用)。
- *
- * 安全约束:
- *  - 永不走 shell —— 除一种 Windows 特例:.cmd/.bat shim(如 npm 全局安装的
- *    codex.cmd)不能被 CreateProcess 直接执行,须经固定的 'cmd.exe' /d /s /c
- *    包装;此时逐参数做严格校验(拒绝引号与控制字符)并全量引号包裹,参数面
- *    仍是结构化且无元字符的,不存在可注入的自由文本。
- *  - 包装器是字面量 'cmd.exe',不由环境变量或请求决定;
- *  - 命令先经 assertPlainExecutable(拒绝 shell 元字符)与 PATH 解析
- *    (必须解析为磁盘上真实存在的文件)才可拉起。
- */
-import { spawn as launchChildProcess, type ChildProcess } from 'node:child_process'
-import { existsSync, statSync } from 'node:fs'
-import { join } from 'node:path'
-
-const SHELL_META = /[\r\n;&|`<>$]/
-
-/**
- * 平台自身凭据:不得随 process.env 继承给 harness 子进程。
- * 引擎需要的 provider key 与 AW_ 身份变量由各 impl 的显式 env 传入(cleanEnv 或 bridgeEnv),
- * 这里只剥离"平台会话/管理员口令/隧道令牌"这类与引擎无关的秘密。
- */
-const PLATFORM_SECRET_ENV = [
-  'NUXT_SESSION_PASSWORD',
-  'AW_ADMIN_PASSWORD',
-  'AW_E2E_ADMIN_PASSWORD',
-  'AW_E2E_PASSWORD',
-  'AW_E2E_TOKEN',
-  'AW_E2E_ADMIN_TOKEN',
-  'SCHED_E2E_PASSWORD',
-  'AW_TUI_PASSWORD',
-  'ADMIN_TOKEN',
-  'CLOUDFLARE_TUNNEL_TOKEN',
-] as const
-
-function scrubPlatformSecrets(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
-  const deny = new Set<string>(PLATFORM_SECRET_ENV)
-  return Object.fromEntries(Object.entries(env).filter(([k]) => !deny.has(k)))
-}
-
-/** 拒绝 shell 元字符(命令只能是纯可执行路径) */
-export function assertPlainExecutable(command: string): string {
-  if (!command || SHELL_META.test(command)) {
-    throw new Error(`非法 harness 命令(含 shell 元字符或为空): ${JSON.stringify(command.slice(0, 80))}`)
-  }
-  return command
-}
-
-/** PATH + PATHEXT 解析裸命令名 → 绝对路径(win32;非 Windows 返回 null)。带扩展名优先,裸名(sh 脚本)最后。
- *  导出:harness 可用性探测(harness-availability.ts)复用同一解析规则,保证「探测可用」与「真实拉起」同源。 */
-export function resolveOnPath(command: string): string | null {
-  if (process.platform !== 'win32') return null
-  const isFile = (p: string): boolean => {
-    try {
-      return existsSync(p) && statSync(p).isFile()
-    }
-    catch {
-      return false
-    }
-  }
-  const hasDir = command.includes('/') || command.includes('\\') || /^[A-Za-z]:/.test(command)
-  const exts = ((process.env.PATHEXT ?? process.env.PathExt)?.split(';').filter(Boolean) ?? ['.EXE', '.CMD', '.BAT', '.COM']).map(e => e.toLowerCase())
-  const bases = hasDir
-    ? [command]
-    : (process.env.PATH ?? process.env.Path ?? '').split(';').filter(Boolean).map(dir => join(dir, command))
-  // PATHEXT 顺序(.exe → .cmd → …)优先;裸名兜底(npm sh 脚本,win 上不可执行,仅最后回退)
-  for (const base of bases) {
-    for (const ext of exts) {
-      const full = base + ext
-      if (isFile(full)) return full
-    }
-  }
-  for (const base of bases) {
-    if (isFile(base)) return base
-  }
-  return null
-}
-
-/**
- * 命令解析:裸名经 PATH 解析,返回磁盘上的绝对路径;.cmd/.bat 标记 needsCmd。
- */
-function resolveExecutable(command: string): { file: string, needsCmd: boolean } {
-  assertPlainExecutable(command)
-  const file = resolveOnPath(command) ?? command
-  if (process.platform === 'win32') {
-    const lower = file.toLowerCase()
-    if (lower.endsWith('.cmd') || lower.endsWith('.bat')) return { file, needsCmd: true }
-  }
-  return { file, needsCmd: false }
-}
-
-export interface LineSpawnOptions {
-  cwd?: string
-  env?: Record<string, string>
-  /** true = 完全替换环境变量(白名单语义,不继承 process.env —— Agent 可控代码的子进程必须用) */
-  cleanEnv?: boolean
-}
-
-/** .cmd 包装时的逐参数校验(引号/控制字符会改变 cmd 解析,拒绝) */
-function assertCmdSafeArg(arg: string): string {
-  if (/["\r\n\0]/.test(arg)) {
-    throw new Error(`参数含引号/控制字符,拒绝经 cmd 包装执行: ${JSON.stringify(arg.slice(0, 80))}`)
-  }
-  return arg
-}
-
-/** 拉起逐行 stdio 子进程(命令已经 resolveExecutable 校验) */
-export function spawnLineProcess(command: string, args: string[], options: LineSpawnOptions = {}): ChildProcess {
-  const { file, needsCmd } = resolveExecutable(command)
-  const env = options.cleanEnv
-    ? { ...options.env }
-    : scrubPlatformSecrets({ ...process.env, ...options.env })
-  if (needsCmd) {
-    // Windows .cmd shim:固定包装器 'cmd.exe' + /d /s /c。
-    // 可执行文件路径无条件引号包裹:无空格路径裸奔时,/s 模式的 cmd 会吞掉
-    // 路径中的反斜杠(C:\Users\... → C:Users...),引擎进程立即退出(code=1)。
-    // 整条命令行再包一层引号:/s 语义下 cmd 剥离最外层引号后执行剩余部分,
-    // 内层引号(带空格的参数)原样保留 —— 否则「尾带引号参数」会让 cmd 把
-    // 整行误解析为一个命令名(典型报错:不是内部或外部命令)。
-    // 参数仍逐个经 assertCmdSafeArg 校验(拒绝引号与控制字符),引号包裹不引入注入面。
-    const line = [
-      `"${[`"${file}"`, ...args.map(a => assertCmdSafeArg(a)).map((token) => {
-        token = token.replace(/[\];&`<>$]/g, '^$1')
-        return token.includes(' ') ? `"${token}"` : token
-      })].join(' ')}"`,
-    ]
-    return launchChildProcess('cmd.exe', ['/d', '/s', '/c', ...line], {
-      stdio: ['pipe', 'pipe', 'pipe'],
-      cwd: options.cwd ?? process.cwd(),
-      env,
-      windowsHide: true,
-      shell: false,
-      windowsVerbatimArguments: true,
-    })
-  }
-  return launchChildProcess(file, args, {
-    stdio: ['pipe', 'pipe', 'pipe'],
-    cwd: options.cwd ?? process.cwd(),
-    env,
-    windowsHide: true,
-    shell: false,
-  })
-}
+/**
+ * 受控子进程拉起工具(harness 适配器共用)。
+ *
+ * 安全约束:
+ *  - 永不走 shell —— 除一种 Windows 特例:.cmd/.bat shim(如 npm 全局安装的
+ *    codex.cmd)不能被 CreateProcess 直接执行,须经固定的 'cmd.exe' /d /s /c
+ *    包装;此时逐参数做严格校验(拒绝引号与控制字符)并全量引号包裹,参数面
+ *    仍是结构化且无元字符的,不存在可注入的自由文本。
+ *  - 包装器是字面量 'cmd.exe',不由环境变量或请求决定;
+ *  - 命令先经 assertPlainExecutable(拒绝 shell 元字符)与 PATH 解析
+ *    (必须解析为磁盘上真实存在的文件)才可拉起。
+ */
+import { spawn as launchChildProcess, type ChildProcess } from 'node:child_process'
+import { existsSync, statSync } from 'node:fs'
+import { join } from 'node:path'
+
+const SHELL_META = /[\r\n;&|`<>$]/
+
+/**
+ * 平台自身凭据:不得随 process.env 继承给 harness 子进程。
+ * 引擎需要的 provider key 与 AW_ 身份变量由各 impl 的显式 env 传入(cleanEnv 或 bridgeEnv),
+ * 这里只剥离"平台会话/管理员口令/隧道令牌"这类与引擎无关的秘密。
+ */
+const PLATFORM_SECRET_ENV = [
+  'NUXT_SESSION_PASSWORD',
+  'AW_ADMIN_PASSWORD',
+  'AW_E2E_ADMIN_PASSWORD',
+  'AW_E2E_PASSWORD',
+  'AW_E2E_TOKEN',
+  'AW_E2E_ADMIN_TOKEN',
+  'SCHED_E2E_PASSWORD',
+  'AW_TUI_PASSWORD',
+  'ADMIN_TOKEN',
+  'CLOUDFLARE_TUNNEL_TOKEN',
+] as const
+
+/**
+ * 剥离平台自身秘密(会话口令/管理员口令/隧道令牌)。
+ * 导出给不经 spawnLineProcess 的启动器(omp RPC 客户端)复用,避免两套口径。
+ */
+export function scrubPlatformSecrets(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
+  const deny = new Set<string>(PLATFORM_SECRET_ENV)
+  return Object.fromEntries(Object.entries(env).filter(([k]) => !deny.has(k)))
+}
+
+/** 拒绝 shell 元字符(命令只能是纯可执行路径) */
+export function assertPlainExecutable(command: string): string {
+  if (!command || SHELL_META.test(command)) {
+    throw new Error(`非法 harness 命令(含 shell 元字符或为空): ${JSON.stringify(command.slice(0, 80))}`)
+  }
+  return command
+}
+
+/** PATH + PATHEXT 解析裸命令名 → 绝对路径(win32;非 Windows 返回 null)。带扩展名优先,裸名(sh 脚本)最后。
+ *  导出:harness 可用性探测(harness-availability.ts)复用同一解析规则,保证「探测可用」与「真实拉起」同源。 */
+export function resolveOnPath(command: string): string | null {
+  if (process.platform !== 'win32') return null
+  const isFile = (p: string): boolean => {
+    try {
+      return existsSync(p) && statSync(p).isFile()
+    }
+    catch {
+      return false
+    }
+  }
+  const hasDir = command.includes('/') || command.includes('\\') || /^[A-Za-z]:/.test(command)
+  const exts = ((process.env.PATHEXT ?? process.env.PathExt)?.split(';').filter(Boolean) ?? ['.EXE', '.CMD', '.BAT', '.COM']).map(e => e.toLowerCase())
+  const bases = hasDir
+    ? [command]
+    : (process.env.PATH ?? process.env.Path ?? '').split(';').filter(Boolean).map(dir => join(dir, command))
+  // PATHEXT 顺序(.exe → .cmd → …)优先;裸名兜底(npm sh 脚本,win 上不可执行,仅最后回退)
+  for (const base of bases) {
+    for (const ext of exts) {
+      const full = base + ext
+      if (isFile(full)) return full
+    }
+  }
+  for (const base of bases) {
+    if (isFile(base)) return base
+  }
+  return null
+}
+
+/**
+ * 命令解析:裸名经 PATH 解析,返回磁盘上的绝对路径;.cmd/.bat 标记 needsCmd。
+ */
+function resolveExecutable(command: string): { file: string, needsCmd: boolean } {
+  assertPlainExecutable(command)
+  const file = resolveOnPath(command) ?? command
+  if (process.platform === 'win32') {
+    const lower = file.toLowerCase()
+    if (lower.endsWith('.cmd') || lower.endsWith('.bat')) return { file, needsCmd: true }
+  }
+  return { file, needsCmd: false }
+}
+
+export interface LineSpawnOptions {
+  cwd?: string
+  env?: Record<string, string>
+  /** true = 完全替换环境变量(白名单语义,不继承 process.env —— Agent 可控代码的子进程必须用) */
+  cleanEnv?: boolean
+}
+
+/** .cmd 包装时的逐参数校验(引号/控制字符会改变 cmd 解析,拒绝) */
+function assertCmdSafeArg(arg: string): string {
+  if (/["\r\n\0]/.test(arg)) {
+    throw new Error(`参数含引号/控制字符,拒绝经 cmd 包装执行: ${JSON.stringify(arg.slice(0, 80))}`)
+  }
+  return arg
+}
+
+/** 拉起逐行 stdio 子进程(命令已经 resolveExecutable 校验) */
+export function spawnLineProcess(command: string, args: string[], options: LineSpawnOptions = {}): ChildProcess {
+  const { file, needsCmd } = resolveExecutable(command)
+  const env = options.cleanEnv
+    ? { ...options.env }
+    : scrubPlatformSecrets({ ...process.env, ...options.env })
+  if (needsCmd) {
+    // Windows .cmd shim:固定包装器 'cmd.exe' + /d /s /c。
+    // 可执行文件路径无条件引号包裹:无空格路径裸奔时,/s 模式的 cmd 会吞掉
+    // 路径中的反斜杠(C:\Users\... → C:Users...),引擎进程立即退出(code=1)。
+    // 整条命令行再包一层引号:/s 语义下 cmd 剥离最外层引号后执行剩余部分,
+    // 内层引号(带空格的参数)原样保留 —— 否则「尾带引号参数」会让 cmd 把
+    // 整行误解析为一个命令名(典型报错:不是内部或外部命令)。
+    // 参数仍逐个经 assertCmdSafeArg 校验(拒绝引号与控制字符),引号包裹不引入注入面。
+    const line = [
+      `"${[`"${file}"`, ...args.map(a => assertCmdSafeArg(a)).map((token) => {
+        token = token.replace(/[\];&`<>$]/g, '^$1')
+        return token.includes(' ') ? `"${token}"` : token
+      })].join(' ')}"`,
+    ]
+    return launchChildProcess('cmd.exe', ['/d', '/s', '/c', ...line], {
+      stdio: ['pipe', 'pipe', 'pipe'],
+      cwd: options.cwd ?? process.cwd(),
+      env,
+      windowsHide: true,
+      shell: false,
+      windowsVerbatimArguments: true,
+    })
+  }
+  return launchChildProcess(file, args, {
+    stdio: ['pipe', 'pipe', 'pipe'],
+    cwd: options.cwd ?? process.cwd(),
+    env,
+    windowsHide: true,
+    shell: false,
+  })
+}

package/server/services/workshop/agents/adapters/omp-rpc-client/start.ts

@@ -6,6 +6,7 @@ import { OmpRpcClientUsage } from './usage'
 import type { AgentSessionEvent } from './types'
 import { STDERR_CAP } from './helpers'
 import { spawn } from 'node:child_process'
+import { scrubPlatformSecrets } from '../line-spawn'
 
 export abstract class OmpRpcClientStart extends OmpRpcClientUsage {
   /** spawn omp 子进程,等待 ready frame */
@@ -17,7 +18,10 @@ export abstract class OmpRpcClientStart extends OmpRpcClientUsage {
     this.child = spawn(command, args, {
       stdio: ['pipe', 'pipe', 'pipe'],
       cwd: this.options.cwd ?? process.cwd(),
-      env: { ...process.env, ...this.options.env },
+      // 平台会话/管理员凭据不得泄入引擎子进程(与 spawnLineProcess 同一清洗函数,
+      // 避免"其余 harness 清洗、omp 全量继承"的双标)。omp 自身需要的 provider key
+      // 由引擎配置文件/显式 options.env 提供。
+      env: scrubPlatformSecrets({ ...process.env, ...this.options.env }),
       windowsHide: true,
     })
 

package/server/services/workshop/agents/agent-interface.ts

@@ -63,6 +63,8 @@ export interface AgentWorkspace {
   reportTask(input: { taskId: string, progress?: number, artifact?: A2AArtifact, message?: string }): Promise<WorkspaceTask>
   /** 完成任务 */
   completeTask(taskId: string, artifacts?: A2AArtifact[]): Promise<WorkspaceTask>
+  /** (lead)显式替代:把 FAILED/CANCELED 子任务分支标记为被 replacement 覆盖(收口前置处置) */
+  supersedeTask(taskId: string, replacementTaskId: string, reason?: string): Promise<WorkspaceTask>
   /** 查看自己的任务队列(待执行 FIFO / 执行中 / 已完成)——每个 agent 自己的任务管理系统 */
   myQueue(): Promise<AgentTaskQueueView>
   /** (lead)全员状态 + 队列总览:统一调度与最优调配的观察面 */

package/server/services/workshop/agents/base-agent.ts

@@ -97,7 +97,7 @@ export abstract class BaseAgentImpl implements AgentInterface {
   }
 
   protected refreshIdentity(): void {
-    this.bridgeCtx.identity = { agentId: this.selfAgentId, channelId: this.channelId, role: this.agentRole, name: this.agentName }
+    this.bridgeCtx.identity = { agentId: this.selfAgentId, channelId: this.channelId, role: this.agentRole, name: this.agentName, harness: this.harnessId }
     this.roster = this.makeRoster()
   }
 
@@ -110,8 +110,8 @@ export abstract class BaseAgentImpl implements AgentInterface {
     this.refreshIdentity()
   }
 
-  dispatchHostTool(toolName: string, args: Record<string, unknown>): Promise<{ text: string, isError?: boolean }> {
-    return dispatchHostTool(this.bridgeCtx, { toolName, arguments: args })
+  dispatchHostTool(toolName: string, args: Record<string, unknown>, activeRootTaskId?: string): Promise<{ text: string, isError?: boolean }> {
+    return dispatchHostTool(this.bridgeCtx, { toolName, arguments: args }, activeRootTaskId)
   }
 
   /** HITL:默认无程序化审批面(有审批能力的引擎覆盖;能力面如实声明) */

package/server/services/workshop/agents/binding-authz.ts

@@ -22,15 +22,21 @@
 import type { AgentNodeBinding } from './node-bindings.repo'
 import { getDaqController } from '../daq/daq-controller'
 import { getDcwController } from '../dcw/dcw-controller'
+import { getDcwLineRepo } from '../dcw/dcw-line.repo'
 import { lineMode } from '../permissions'
 import { AppError, ErrorCodes } from '../../../utils/errors'
 
-/** 绑定 → 所属产线 id(节点/配方不存在返回 null;recipe 绑定的 nodeId 字段 = 配方 id) */
+/** 绑定 → 所属产线 id(节点/配方/产线不存在返回 null;recipe 绑定的 nodeId 字段 = 配方 id,
+ *  line-recipe 绑定的 nodeId 字段 = 产线 id 本身) */
 export function lineIdOfBinding(binding: Pick<AgentNodeBinding, 'nodeId' | 'kind'>): string | null | undefined {
   if (binding.kind === 'daq') return getDaqController().byId(binding.nodeId)?.lineId
   if (binding.kind === 'recipe') {
     return getDcwController().listRecipes().find(r => r.id === binding.nodeId)?.lineId ?? null
   }
+  if (binding.kind === 'line-recipe') {
+    // 产线管理权:nodeId 即产线 id;产线已删除 → 悬空(404,不构成任何授权)
+    return getDcwLineRepo().byId(binding.nodeId) ? binding.nodeId : null
+  }
   return getDcwController().byId(binding.nodeId)?.lineId
 }
 

package/server/services/workshop/agents/governance-harness-audit.ts

@@ -0,0 +1,216 @@
+import { AsyncLocalStorage } from 'node:async_hooks'
+import { createHash, randomUUID } from 'node:crypto'
+import { closeSync, fsyncSync, openSync, writeFileSync } from 'node:fs'
+import { isAbsolute, resolve } from 'node:path'
+import type { HostToolBridgeContext, HostToolCall, HostToolResult } from './host-tool-bridge/types'
+
+export interface ToolInvocation {
+  runId: string
+  invocationId: string
+  harness: string
+  agentId: string
+  role: 'lead' | 'worker'
+  channelId: string
+  taskId: string | null
+  tool: string
+}
+
+interface AuditSink {
+  path: string
+  runId: string
+  sequence: number
+  failure: string | null
+}
+
+interface InvocationContext extends ToolInvocation {
+  sink: AuditSink
+}
+
+const invocationStorage = new AsyncLocalStorage<InvocationContext>()
+const sinks = new Map<string, AuditSink>()
+const sensitiveKey = /(token|password|secret|api[-_]?key|authorization|cookie|credential)/i
+
+function redact(value: unknown, key = ''): unknown {
+  if (sensitiveKey.test(key)) return '[REDACTED]'
+  if (Array.isArray(value)) return value.map(item => redact(item))
+  if (value && typeof value === 'object') {
+    return Object.fromEntries(Object.entries(value as Record<string, unknown>).map(([k, v]) => [k, redact(v, k)]))
+  }
+  if (typeof value !== 'string') return value
+  return value
+    .replace(/\bBearer\s+[A-Za-z0-9._~+/-]+=*/gi, 'Bearer [REDACTED]')
+    .replace(/\b(?:sk[-_]|rk_live_|AKIA|ASIA|AIza|gh[pousr]_|github_pat_|xox[a-z]-)[A-Za-z0-9_-]{12,}\b/gi, '[REDACTED]')
+    .replace(/\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g, '[REDACTED]')
+    .replace(/((?:token|password|secret|api[-_]?key|authorization)\s*[:=]\s*)[^\s,;]+/gi, '$1[REDACTED]')
+}
+
+export class GovernanceHarnessAuditError extends Error {
+  constructor(readonly phase: string, message: string) {
+    super(`governance Harness audit ${phase}: ${message}`)
+    this.name = 'GovernanceHarnessAuditError'
+  }
+}
+
+function append(sink: AuditSink, phase: string, record: Record<string, unknown>): void {
+  if (sink.failure) throw new GovernanceHarnessAuditError(phase, sink.failure)
+  let fd: number | undefined
+  try {
+    const sequence = ++sink.sequence
+    const data = {
+      schema_version: 1,
+      run_id: sink.runId,
+      event_id: `${process.pid}:${sequence}:${randomUUID()}`,
+      source_seq: sequence,
+      at_utc: new Date().toISOString(),
+      monotonic_ns: process.hrtime.bigint().toString(),
+      process_id: process.pid,
+      ...record,
+    }
+    fd = openSync(sink.path, 'a')
+    writeFileSync(fd, `${JSON.stringify(redact(data))}\n`, 'utf8')
+    fsyncSync(fd)
+  }
+  catch (error) {
+    sink.failure = String(redact(error instanceof Error ? error.message : String(error)))
+  }
+  finally {
+    if (fd !== undefined) {
+      try {
+        closeSync(fd)
+      }
+      catch (error) { sink.failure ??= String(redact(error instanceof Error ? error.message : String(error))) }
+    }
+  }
+  if (sink.failure) throw new GovernanceHarnessAuditError(phase, sink.failure)
+}
+
+function configuredSink(): AuditSink | undefined {
+  const path = process.env.AW_GOV_HARNESS_EVENT_LOG?.trim()
+  if (!path) return undefined
+  const runId = process.env.AW_GOV_HARNESS_RUN_ID?.trim() ?? ''
+  if (!/^[a-zA-Z0-9_-]{8,80}$/.test(runId)) {
+    throw new GovernanceHarnessAuditError('configuration', 'AW_GOV_HARNESS_RUN_ID must contain 8–80 safe characters')
+  }
+  if (!isAbsolute(path)) throw new GovernanceHarnessAuditError('configuration', 'AW_GOV_HARNESS_EVENT_LOG must be absolute')
+  const key = JSON.stringify([path, runId])
+  let sink = sinks.get(key)
+  if (!sink) {
+    sink = { path, runId, sequence: 0, failure: null }
+    sinks.set(key, sink)
+    append(sink, 'capture_ready', {
+      source: 'aw-shared-host-tool-dispatch',
+      event_type: 'capture_ready',
+      aw_mode: process.env.AW_MODE ?? null,
+      aw_home_sha256: process.env.AW_HOME ? createHash('sha256').update(resolve(process.env.AW_HOME)).digest('hex') : null,
+    })
+  }
+  return sink
+}
+
+/** Trusted server invocation context; never derived from tool arguments. */
+export function currentToolInvocation(): ToolInvocation | undefined {
+  const context = invocationStorage.getStore()
+  if (!context) return undefined
+  const { sink: _sink, ...invocation } = context
+  return invocation
+}
+
+function identityFields(context?: ToolInvocation) {
+  return {
+    invocation_id: context?.invocationId ?? null,
+    actor_agent_id: context?.agentId ?? null,
+    actor_role: context?.role ?? null,
+    harness: context?.harness ?? null,
+    channel_id: context?.channelId ?? null,
+    task_id: context?.taskId ?? null,
+    tool: context?.tool ?? null,
+  }
+}
+
+/** Separate opt-in sink; P12's OMP adapter capture remains independent. */
+export async function withGovernanceHarnessToolAudit(
+  ctx: HostToolBridgeContext,
+  req: HostToolCall,
+  activeRootTaskId: string | undefined,
+  execute: () => Promise<HostToolResult>,
+): Promise<HostToolResult> {
+  const sink = configuredSink()
+  if (!sink) return execute()
+  if (!ctx.identity.harness || !ctx.identity.agentId || !ctx.identity.channelId) {
+    throw new GovernanceHarnessAuditError('tool_start', 'actual harness, agent and channel identity are required')
+  }
+  const context: InvocationContext = {
+    sink,
+    runId: sink.runId,
+    invocationId: randomUUID(),
+    harness: ctx.identity.harness,
+    agentId: ctx.identity.agentId,
+    role: ctx.identity.role,
+    channelId: ctx.identity.channelId,
+    taskId: ctx.state.currentTaskId ?? activeRootTaskId ?? null,
+    tool: req.toolName,
+  }
+  append(sink, 'tool_start', { source: 'aw-shared-host-tool-dispatch', ...identityFields(context), event_type: 'tool_invocation_start', request: req.arguments })
+  return invocationStorage.run(context, async () => {
+    let result: HostToolResult
+    try {
+      result = await execute()
+    }
+    catch (error) {
+      if (error instanceof GovernanceHarnessAuditError && sink.failure) throw error
+      append(sink, 'tool_end', {
+        source: 'aw-shared-host-tool-dispatch', ...identityFields(context), event_type: 'tool_invocation_end',
+        is_error: true, response: { error: error instanceof Error ? error.message : String(error) },
+      })
+      throw error
+    }
+    append(sink, 'tool_end', {
+      source: 'aw-shared-host-tool-dispatch', ...identityFields(context), event_type: 'tool_invocation_end',
+      is_error: result.isError === true, response: result,
+    })
+    return result
+  })
+}
+
+interface DriverCallAudit {
+  sink: AuditSink
+  invocation?: InvocationContext
+  driverCallId: string
+  fields: Record<string, unknown>
+}
+
+export function beginGovernanceDriverCall(fields: {
+  node_id: string
+  line_id: string | null
+  driver: string
+  requested_value: number
+  plc_value: number
+  tolerance: number
+  recipe_run_id: string | null
+  driver_config: Record<string, unknown>
+}): DriverCallAudit | undefined {
+  const invocation = invocationStorage.getStore()
+  const sink = invocation?.sink ?? configuredSink()
+  if (!sink) return undefined
+  const call = { sink, invocation, driverCallId: randomUUID(), fields }
+  append(sink, 'driver_start', {
+    source: 'aw-dcw-driver', ...identityFields(invocation), ...fields,
+    event_type: 'driver_call_start', driver_call_id: call.driverCallId,
+  })
+  return call
+}
+
+export function endGovernanceDriverCall(call: DriverCallAudit | undefined, outcome: unknown): void {
+  if (!call) return
+  append(call.sink, 'driver_end', {
+    source: 'aw-dcw-driver', ...identityFields(call.invocation), ...call.fields,
+    event_type: 'driver_call_end', driver_call_id: call.driverCallId, outcome,
+  })
+}
+
+// Emit the boot marker when configured before server startup. Dispatch still
+// checks the same sticky sink failure before allowing any tool to execute.
+try {
+  configuredSink()
+}
+catch { /* A configured but unavailable sink is reported by the first dispatch. */ }

package/server/services/workshop/agents/host-tool-bridge/catalog.ts

@@ -106,6 +106,7 @@ export const OBSERVER_COLLAB_TOOL_NAMES = new Set([
   'send_cross_channel_message',
   'submit_task',
   'complete_task',
+  'supersede_task',
   'report_progress',
   'refuse_task',
   'cancel_task',