approval-md 0.1.0 → 0.2.0

package/dist/src/core/protected-path-guard.js

@@ -17,20 +17,21 @@
  * party under oversight to report its own oversight, which SPEC.md §11 rules
  * out on principle. So this one never talks to a session. It takes two commits,
  * asks git which protected paths changed between them, and requires — for each
- * one — evidence in the committed hash-chained log that a human saw that edit.
- * A change with no evidence fails the pull request. Session wiring is not an
- * input.
+ * one — exact evidence in the committed hash-chained log that either a human
+ * granted that edit or the runtime recorded that policy authorized its
+ * execution. A change with no evidence fails the pull request. Session wiring
+ * is not an input.
  *
  * ## What counts as evidence
  *
  * Evidence is about the CHANGE, not about the path (APRV-202). The guard reads
  * the blob at both commits, reduces the difference to the lines this pull
- * request adds and removes, and requires every one of them to trace back to the
- * bound material of some grant. A path that was granted last Tuesday and edited
- * again today has a grant naming it and no grant covering today's lines, and
- * that fails. Naming remains necessary; it stopped being sufficient.
+ * request adds and removes, and requires every one of them to trace back to
+ * bound material in an authorization record. A path authorized last Tuesday
+ * and edited again today has evidence naming it and none covering today's
+ * lines, and that fails. Naming remains necessary; it stopped being sufficient.
  *
- * Three verdicts pass, and they are ordered by how much they prove:
+ * Four verdicts pass:
  *
  * 1. `attested` — the policy file, and the gate's ORGANS. `approval policy
  *    amend --commit` appends `policy.updated` carrying `{policy_path, sha256}`,
@@ -52,7 +53,14 @@
  *    match: a digest attested for one organ is not evidence for another, which
  *    is why the organ record carries a whole relative path where the policy
  *    record carries a basename.
- * 2. `granted-file` — a file-tool edit. The hook binds the CHANGE rather than
+ * 2. `policy-authorized-file` — an exact Edit or Write whose verified
+ *    `execution.started` is preceded by its unique matching registration and no
+ *    approval request. The registration, start and recomputed stored payload
+ *    must agree on task, action, class and hash. The start must precede the
+ *    change and the recorded class must be the class this path is routed to.
+ *    This records authorization to execute, not successful completion; the
+ *    exact hunk checks below establish whether those bytes landed.
+ * 3. `granted-file` — a file-tool edit. The hook binds the CHANGE rather than
  *    the touch (APRV-124), so the bound material carries `file` plus the exact
  *    edit: `{before, after}` for an Edit, `{content}` for a Write. That is
  *    HUNK-level evidence, and it is used as such. The granted `after` bytes
@@ -62,7 +70,7 @@
  *    in head is a grant for something that did not land, and covers nothing.
  *    Some payloads carry the `{input}` fallback shape instead, which describes
  *    no bytes; those name the path and cover nothing.
- * 3. `granted-command` — a shell edit. The bound material is `{command, cwd}`
+ * 4. `granted-command` — a shell edit. The bound material is `{command, cwd}`
  *    or `{argv, cwd}`, and the guard re-runs the runtime's own
  *    {@link classifyCommand} over it, requiring a segment that classifies as a
  *    granting class BECAUSE of a word naming this path. A mention is not a
@@ -191,7 +199,9 @@
  * git plumbing and file reads live in the caller.
  */
 import { organAttestationOf } from "./attest.js";
-import { classifyCommand, isGateOrganPath, isProtectedPath, normalizePathSpelling, POLICY_EDIT_SUBCLASS, } from "./command-class.js";
+import { parseApplyPatch } from "./apply-patch.js";
+import { classifyCommand, isGateOrganPath, isProtectedPath, normalizePathSpelling, POLICY_EDIT_SUBCLASS, protectedPathClass, } from "./command-class.js";
+import { payloadHash } from "./payload.js";
 /**
  * Classes whose grant authorizes a protected-path write.
  *
@@ -288,6 +298,10 @@ export const DEFAULT_LOOKBACK_MS = 7 * 24 * 60 * 60 * 1000;
  * fresh approval, which costs one tap.
  */
 export const DEFAULT_COMMAND_ATTRIBUTION_MS = 6 * 60 * 60 * 1000;
+/** Fail-closed resource bounds for exact protected-edit reconstruction. */
+export const EXACT_REPLAY_MAX_CANDIDATES = 128;
+export const EXACT_REPLAY_MAX_STATES = 2_048;
+export const EXACT_REPLAY_MAX_EXAMINED_BYTES = 64 * 1024 * 1024;
 /** Split on either separator, dropping empties and `.` noise. */
 function segmentsOf(candidate) {
     return candidate.split(/[/\\]+/u).filter((part) => part.length > 0 && part !== ".");
@@ -413,6 +427,31 @@ function evidenceFor(material, path, policyProtectedPaths) {
     if (typeof material !== "object" || material === null || Array.isArray(material))
         return null;
     const map = material;
+    // Codex apply_patch is tagged explicitly. Parse it before the generic
+    // command fallback so patch text is never mistaken for a shell command and
+    // never receives time-based command attribution. Until a patch-to-blob
+    // proof exists, this is deliberately naming-only evidence and covers no
+    // bytes; it remains useful diagnosis without weakening the guard.
+    if (map["tool"] === "apply_patch" && typeof map["command"] === "string") {
+        const parsed = parseApplyPatch(map["command"]);
+        if (parsed.ok) {
+            const operation = parsed.operations.find((candidate) => endsWithSegments(candidate.path, path) ||
+                (candidate.kind === "update" &&
+                    candidate.moveTo !== undefined &&
+                    endsWithSegments(candidate.moveTo, path)));
+            if (operation !== undefined) {
+                return {
+                    kind: "granted-file",
+                    detail: `the granted material is a Codex apply_patch operation naming ${path}; patch bytes are not yet guard coverage`,
+                    after: null,
+                    before: null,
+                    whole: false,
+                    command: false,
+                };
+            }
+        }
+        return null;
+    }
     const file = map["file"];
     if (typeof file === "string" && endsWithSegments(file, path)) {
         const tool = typeof map["tool"] === "string" ? map["tool"] : "a file tool";
@@ -476,6 +515,396 @@ function evidenceFor(material, path, policyProtectedPaths) {
     }
     return null;
 }
+/** Every declaration of this action key that existed before the start. */
+function precedingBindings(records, start) {
+    const actionKey = start.action_key;
+    if (actionKey === undefined)
+        return [];
+    const found = [];
+    for (const record of records) {
+        if (record.seq >= start.seq || record.event !== "task.registered")
+            continue;
+        const actions = payloadOf(record)["actions"];
+        if (!Array.isArray(actions))
+            continue;
+        for (const raw of actions) {
+            if (typeof raw !== "object" || raw === null || Array.isArray(raw))
+                continue;
+            const action = raw;
+            if (action["idempotency_key"] !== actionKey)
+                continue;
+            const cls = action["class"];
+            const hash = action["payload_hash"];
+            // Count malformed declarations too. A malformed entry sharing the key is
+            // ambiguity, never something a later well-formed entry can hide.
+            found.push({
+                record,
+                task: record.task ?? null,
+                actionKey,
+                cls: typeof cls === "string" ? cls : null,
+                payloadHash: typeof hash === "string" ? hash : null,
+            });
+        }
+    }
+    return found;
+}
+/** Exact file bytes, excluding fallback, command and apply_patch material. */
+function policyFileEvidence(material, path, policyProtectedPaths) {
+    if (typeof material !== "object" || material === null || Array.isArray(material))
+        return null;
+    const map = material;
+    const tool = map["tool"];
+    const file = map["file"];
+    if (typeof file !== "string" ||
+        file.startsWith("/") ||
+        file.includes("\\"))
+        return null;
+    const named = segmentsOf(file);
+    if (named.includes("..") || named.join("/") !== segmentsOf(path).join("/"))
+        return null;
+    const keys = Object.keys(map);
+    const hasOnly = (allowed) => keys.every((key) => allowed.includes(key));
+    if (tool === "Edit") {
+        if (!hasOnly(["tool", "rule", "file", "before", "after", "replace_all"]) ||
+            (map["rule"] !== undefined && typeof map["rule"] !== "string") ||
+            typeof map["before"] !== "string" ||
+            typeof map["after"] !== "string" ||
+            (map["replace_all"] !== undefined && typeof map["replace_all"] !== "boolean"))
+            return null;
+    }
+    else if (tool === "Write") {
+        if (!hasOnly(["tool", "rule", "file", "content"]) ||
+            (map["rule"] !== undefined && typeof map["rule"] !== "string") ||
+            typeof map["content"] !== "string")
+            return null;
+    }
+    else {
+        return null;
+    }
+    const match = evidenceFor(material, path, policyProtectedPaths);
+    if (match === null || match.command || (match.after === null && match.before === null))
+        return null;
+    return {
+        ...match,
+        kind: "policy-authorized-file",
+        detail: match.detail.replace(/^the granted material is/u, "the policy-authorized material is"),
+    };
+}
+/** Differing applicable routes in an unlabeled policy union carry no single class. */
+function hasAmbiguousRoute(path, policyProtectedPaths) {
+    const candidate = segmentsOf(path);
+    const classes = new Set();
+    for (const entry of policyProtectedPaths) {
+        const raw = typeof entry === "string" ? entry : entry.path;
+        const trimmed = raw.trim();
+        if (trimmed.length === 0 || trimmed.startsWith("/"))
+            continue;
+        const wanted = segmentsOf(trimmed);
+        if (wanted.includes("..") || wanted.length === 0 || wanted.length > candidate.length)
+            continue;
+        const directory = /[/\\]$/u.test(trimmed);
+        const matches = directory
+            ? candidate.some((_, start) => start + wanted.length <= candidate.length &&
+                wanted.every((segment, offset) => candidate[start + offset] === segment))
+            : wanted.every((segment, offset) => candidate[candidate.length - wanted.length + offset] === segment);
+        if (matches)
+            classes.add(typeof entry === "string" ? "policy.edit" : entry.class);
+    }
+    return classes.size > 1;
+}
+/**
+ * Exact-file evidence from an unattended execution authorized by policy.
+ *
+ * The start must reproduce the one declaration that preceded it, and the
+ * committed payload must hash back to that declaration. A prior request means
+ * the action entered the human-decision path, so this tier cannot carry it.
+ */
+function policyAuthorizedEvidence(records, start, path, policyProtectedPaths, payloadFor, anchorMs, lookbackMs) {
+    if (start.event !== "execution.started")
+        return null;
+    const task = start.task;
+    const actionKey = start.action_key;
+    if (task === undefined || actionKey === undefined)
+        return null;
+    const started = payloadOf(start);
+    const harnessStart = started["execution"] === "harness";
+    const coreStart = !Object.hasOwn(started, "execution");
+    if ((!harnessStart && !coreStart) ||
+        Object.hasOwn(started, "grant_seq") ||
+        Object.hasOwn(started, "token_sha256"))
+        return null;
+    const cls = started["class"];
+    const hash = started["payload_hash"];
+    if (typeof cls !== "string" || typeof hash !== "string")
+        return null;
+    // The exact routed class is authority. Merely living in policy.edit.* is not.
+    if (hasAmbiguousRoute(path, policyProtectedPaths))
+        return null;
+    const routed = protectedPathClass(path, policyProtectedPaths);
+    if (routed === null || routed === "policy.core" || routed === "log.mutate" || cls !== routed) {
+        return null;
+    }
+    const bindings = precedingBindings(records, start);
+    if (bindings.length !== 1)
+        return null;
+    const binding = bindings[0];
+    if (binding.task !== task ||
+        binding.actionKey !== actionKey ||
+        binding.cls !== cls ||
+        binding.payloadHash !== hash)
+        return null;
+    if (records.some((record) => record.seq < start.seq &&
+        record.action_key === actionKey &&
+        record.event === "approval.requested"))
+        return null;
+    // A start cannot authorize a change that already happened. This tier also
+    // requires a usable commit timestamp; missing temporal evidence fails closed.
+    if (anchorMs === null)
+        return null;
+    const at = Date.parse(start.ts);
+    if (Number.isNaN(at) || at > anchorMs || anchorMs - at > lookbackMs)
+        return null;
+    const material = payloadFor(hash);
+    if (material === null)
+        return null;
+    try {
+        if (payloadHash(material) !== hash)
+            return null;
+    }
+    catch {
+        return null;
+    }
+    return policyFileEvidence(material, path, policyProtectedPaths);
+}
+/** The closed, repository-relative Edit shape eligible for byte replay. */
+function exactReplayEdit(material, path) {
+    if (typeof material !== "object" || material === null || Array.isArray(material))
+        return null;
+    const map = material;
+    const keys = Object.keys(map);
+    const allowed = ["tool", "rule", "file", "before", "after", "replace_all"];
+    if (keys.some((key) => !allowed.includes(key)))
+        return null;
+    if (map["tool"] !== "Edit" ||
+        typeof map["file"] !== "string" ||
+        map["file"].startsWith("/") ||
+        map["file"].includes("\\") ||
+        (map["rule"] !== undefined && typeof map["rule"] !== "string") ||
+        typeof map["before"] !== "string" ||
+        map["before"].length === 0 ||
+        typeof map["after"] !== "string" ||
+        map["before"] === map["after"] ||
+        (map["replace_all"] !== undefined && map["replace_all"] !== false))
+        return null;
+    const named = segmentsOf(map["file"]);
+    const changed = segmentsOf(path);
+    if (named.includes("..") ||
+        named.length !== changed.length ||
+        !named.every((segment, index) => segment === changed[index]))
+        return null;
+    return { before: map["before"], after: map["after"] };
+}
+/** The one token or harness spend that proves this manual grant actually ran. */
+function startForReplayGrant(candidate, records, anchorMs, lookbackMs, path, policyProtectedPaths) {
+    if (anchorMs === null)
+        return null;
+    const grant = candidate.record;
+    const task = grant.task;
+    const actionKey = grant.action_key;
+    if (task === undefined || actionKey === undefined)
+        return null;
+    const granted = payloadOf(grant);
+    const cls = granted["class"];
+    const hash = granted["payload_hash"];
+    if (typeof cls !== "string" || typeof hash !== "string" || hash !== candidate.payloadHash)
+        return null;
+    if (hasAmbiguousRoute(path, policyProtectedPaths))
+        return null;
+    const routed = protectedPathClass(path, policyProtectedPaths);
+    if (routed === null || routed === "policy.core" || routed === "log.mutate" || cls !== routed) {
+        return null;
+    }
+    try {
+        if (payloadHash(candidate.material) !== hash)
+            return null;
+    }
+    catch {
+        return null;
+    }
+    const grantToken = granted["token_sha256"];
+    const starts = records.filter((record) => {
+        if (record.event !== "execution.started" ||
+            record.seq <= grant.seq ||
+            record.task !== task ||
+            record.action_key !== actionKey)
+            return false;
+        const started = payloadOf(record);
+        if (started["class"] !== cls || started["payload_hash"] !== hash)
+            return false;
+        if (Object.hasOwn(started, "execution") && started["execution"] !== "harness")
+            return false;
+        const hasGrantLink = Object.hasOwn(started, "grant_seq");
+        const hasTokenLink = Object.hasOwn(started, "token_sha256");
+        if (!hasGrantLink && !hasTokenLink)
+            return false;
+        if (hasGrantLink && started["grant_seq"] !== grant.seq)
+            return false;
+        if (hasTokenLink &&
+            (typeof grantToken !== "string" || started["token_sha256"] !== grantToken))
+            return false;
+        const at = Date.parse(record.ts);
+        return !Number.isNaN(at) && at <= anchorMs && anchorMs - at <= lookbackMs;
+    });
+    if (starts.length !== 1)
+        return null;
+    const start = starts[0];
+    const bindings = precedingBindings(records, start);
+    if (bindings.length !== 1)
+        return null;
+    const binding = bindings[0];
+    if (binding.record.seq >= grant.seq ||
+        binding.task !== task ||
+        binding.actionKey !== actionKey ||
+        binding.cls !== cls ||
+        binding.payloadHash !== hash)
+        return null;
+    const requested = records.some((record) => {
+        if (record.event !== "approval.requested" ||
+            record.seq <= binding.record.seq ||
+            record.seq >= grant.seq ||
+            record.task !== task ||
+            record.action_key !== actionKey)
+            return false;
+        const payload = payloadOf(record);
+        return payload["class"] === cls && payload["payload_hash"] === hash;
+    });
+    return requested ? start : null;
+}
+/**
+ * Replay authorized exact edits in execution order and demand byte equality.
+ *
+ * The log may contain older edits whose anchors survive in BASE but which did
+ * not produce this change. Search deterministic ordered subsequences: skip a
+ * candidate first, and apply it only when its anchor occurs exactly once in the
+ * current state. An ambiguous candidate cannot be applied, but it does not make
+ * an independent later proof ambiguous. Only a non-empty sequence that turns
+ * BASE into HEAD byte for byte is evidence; there is no reordering, substring
+ * credit, or partial result.
+ *
+ * Search is bounded by candidate count, distinct states, and cumulative bytes
+ * examined. Crossing any bound refuses the fallback rather than pruning a
+ * potentially valid branch and claiming the remaining search was complete.
+ */
+function exactEditReplay(candidates, records, base, head, anchorMs, lookbackMs, path, policyProtectedPaths) {
+    if (base === null ||
+        head === null ||
+        base.includes("\uFFFD") ||
+        head.includes("\uFFFD"))
+        return { steps: null, bound: null };
+    const gathered = [];
+    for (const candidate of candidates) {
+        try {
+            if (payloadHash(candidate.material) !== candidate.payloadHash)
+                continue;
+        }
+        catch {
+            continue;
+        }
+        const edit = exactReplayEdit(candidate.material, path);
+        if (edit === null)
+            continue;
+        const start = candidate.source === "policy"
+            ? candidate.record
+            : startForReplayGrant(candidate, records, anchorMs, lookbackMs, path, policyProtectedPaths);
+        if (start !== null)
+            gathered.push({ candidate, start, ...edit });
+    }
+    gathered.sort((left, right) => left.start.seq - right.start.seq);
+    // A verified execution record can authorize at most one application. Collapse
+    // duplicate evidence views of the same binding. If two views give one start
+    // conflicting edit bytes, neither representation of that start is usable.
+    const byStart = new Map();
+    const conflictingStarts = new Set();
+    for (const step of gathered) {
+        const prior = byStart.get(step.start.seq);
+        if (prior === undefined) {
+            byStart.set(step.start.seq, step);
+            continue;
+        }
+        if (prior.before !== step.before || prior.after !== step.after) {
+            conflictingStarts.add(step.start.seq);
+        }
+    }
+    const steps = [...byStart.values()].filter((step) => !conflictingStarts.has(step.start.seq));
+    if (steps.length > EXACT_REPLAY_MAX_CANDIDATES) {
+        return { steps: null, bound: "candidate-limit" };
+    }
+    const headBytes = Buffer.byteLength(head, "utf8");
+    let examinedBytes = Buffer.byteLength(base, "utf8") + headBytes;
+    if (examinedBytes > EXACT_REPLAY_MAX_EXAMINED_BYTES) {
+        return { steps: null, bound: "byte-limit" };
+    }
+    let visitedStates = 0;
+    let exceeded = null;
+    // State equality is exact string equality, not a digest or lossy cache key.
+    // Empty/non-empty histories stay distinct because an empty replay is never
+    // evidence even when BASE already equals HEAD.
+    const visited = Array.from({ length: steps.length + 1 }, () => [new Set(), new Set()]);
+    const search = (index, replayed, applied) => {
+        if (exceeded !== null)
+            return null;
+        const replayedBytes = Buffer.byteLength(replayed, "utf8");
+        // Charge exact-state hashing/equality and the HEAD comparison before either
+        // can retain or accept this state.
+        const stateBytes = replayedBytes + headBytes;
+        if (examinedBytes + stateBytes > EXACT_REPLAY_MAX_EXAMINED_BYTES) {
+            exceeded = "byte-limit";
+            return null;
+        }
+        examinedBytes += stateBytes;
+        const seen = visited[index]?.[applied.length === 0 ? 0 : 1];
+        if (seen === undefined || seen.has(replayed))
+            return null;
+        seen.add(replayed);
+        visitedStates += 1;
+        if (visitedStates > EXACT_REPLAY_MAX_STATES) {
+            exceeded = "state-limit";
+            return null;
+        }
+        if (applied.length > 0 && replayed === head)
+            return [...applied];
+        if (index === steps.length)
+            return null;
+        // Deterministic skip-first DFS finds a late witness quickly and
+        // prevents irrelevant historical edits from polluting a valid proof.
+        const skipped = search(index + 1, replayed, applied);
+        if (skipped !== null || exceeded !== null)
+            return skipped;
+        const step = steps[index];
+        const scanBytes = replayedBytes * 2 +
+            Buffer.byteLength(step.before, "utf8");
+        if (examinedBytes + scanBytes > EXACT_REPLAY_MAX_EXAMINED_BYTES) {
+            exceeded = "byte-limit";
+            return null;
+        }
+        examinedBytes += scanBytes;
+        const first = replayed.indexOf(step.before);
+        if (first === -1 || replayed.indexOf(step.before, first + 1) !== -1)
+            return null;
+        // Bound the next allocation before constructing it. `replayed + after` is
+        // a conservative upper bound because the replacement removes `before`.
+        const prospectiveBytes = replayedBytes + Buffer.byteLength(step.after, "utf8");
+        if (examinedBytes + prospectiveBytes > EXACT_REPLAY_MAX_EXAMINED_BYTES) {
+            exceeded = "byte-limit";
+            return null;
+        }
+        examinedBytes += prospectiveBytes;
+        const next = `${replayed.slice(0, first)}${step.after}${replayed.slice(first + step.before.length)}`;
+        return search(index + 1, next, [...applied, step]);
+    };
+    const proof = search(0, base, []);
+    return { steps: proof, bound: exceeded };
+}
 /** A blob's lines, with the empty tail a trailing newline leaves dropped. */
 function linesOf(text) {
     const parts = text.split("\n");
@@ -667,7 +1096,7 @@ function attributeRun(grant, runs, anchorMs, attributionMs) {
  * spelled: two different (path, digest) pairs cannot collide into one key.
  */
 function organKey(organPath, sha256) {
-    return `${normalizePathSpelling(organPath)}${sha256}`;
+    return `${normalizePathSpelling(organPath)}\0${sha256}`;
 }
 /** The ordering rule, stated identically on every failure that could be lag. */
 const ORDERING_RULE = "the committed log trails the primary checkout's live log, so if this edit WAS granted, " +
@@ -844,8 +1273,21 @@ export function evaluateProtectedPaths(input) {
                 stale.push(grant);
                 continue;
             }
-            candidates.push({ grant, match: found });
+            candidates.push({ record: grant, match: found, source: "grant", material, payloadHash: hash });
+        }
+        for (const start of records) {
+            const found = policyAuthorizedEvidence(records, start, path, input.policyProtectedPaths, input.payloadFor, anchorMs, lookbackMs);
+            const hash = payloadOf(start)["payload_hash"];
+            if (found !== null && typeof hash === "string") {
+                const material = input.payloadFor(hash);
+                if (material !== null) {
+                    candidates.push({ record: start, match: found, source: "policy", material, payloadHash: hash });
+                }
+            }
         }
+        const evidenceNoun = candidates.every((candidate) => candidate.source === "grant")
+            ? `grant${candidates.length === 1 ? "" : "s"}`
+            : `evidence record${candidates.length === 1 ? "" : "s"}`;
         /** Distance from the change commit, or 0 when there is no anchor to measure from. */
         const distance = (grant) => {
             if (anchorMs === null)
@@ -853,9 +1295,9 @@ export function evaluateProtectedPaths(input) {
             const at = Date.parse(grant.ts);
             return Number.isNaN(at) ? Number.POSITIVE_INFINITY : Math.abs(at - anchorMs);
         };
-        const rank = (kind) => (kind === "granted-file" ? 0 : 1);
+        const rank = (kind) => kind === "granted-file" ? 0 : kind === "policy-authorized-file" ? 1 : 2;
         candidates.sort((left, right) => rank(left.match.kind) - rank(right.match.kind) ||
-            distance(left.grant) - distance(right.grant));
+            distance(left.record) - distance(right.record));
         // The change this pull request makes to the path. Read before any coverage
         // is attempted, and a failure to read it is a failure: a change the guard
         // cannot see is not a change it has checked (APRV-202).
@@ -865,7 +1307,7 @@ export function evaluateProtectedPaths(input) {
                 path,
                 ok: false,
                 code: "change-unreadable",
-                detail: `${path} is a protected path and changed between ${input.window.base} and ${input.window.head}, and its bytes could not be read at both commits (git could not show the blob, or it is binary), so no grant could be checked against the change. ${candidates.length} grant${candidates.length === 1 ? "" : "s"} name this path in the window, and naming is not coverage. ${ORDERING_RULE}.`,
+                detail: `${path} is a protected path and changed between ${input.window.base} and ${input.window.head}, and its bytes could not be read at both commits (git could not show the blob, or it is binary), so no evidence could be checked against the change. ${candidates.length} ${evidenceNoun} name this path in the window, and naming is not coverage. ${ORDERING_RULE}.`,
             });
             continue;
         }
@@ -881,14 +1323,21 @@ export function evaluateProtectedPaths(input) {
         const removedCover = new Set();
         let whole = false;
         for (const candidate of candidates) {
-            const { grant, match } = candidate;
-            const at = `the grant at seq ${grant.seq}`;
+            const { record, match, source } = candidate;
+            // An execution start says an exact file action was authorized, not that a
+            // mode-only or whitespace-only change happened. Legacy human grants retain
+            // their narrow no-substantive-hunk behavior; policy starts do not gain it.
+            if (hunks.identical && source === "policy")
+                continue;
+            const at = source === "grant"
+                ? `the grant at seq ${record.seq}`
+                : `the policy-authorized execution at seq ${record.seq}`;
             if (match.command) {
                 if (!commandTargetsPath(match.target ?? "", match.cwd, path)) {
                     rejected.push(`${at} writes ${JSON.stringify(match.target ?? "")} from ${JSON.stringify(match.cwd ?? "(no cwd recorded)")}, which is not this checkout's ${path}: a granted write to a copy of the file elsewhere (a dry run into a scratch directory, another worktree) authorizes nothing here`);
                     continue;
                 }
-                const run = attributeRun(grant, runs, anchorMs, attributionMs);
+                const run = attributeRun(record, runs, anchorMs, attributionMs);
                 if (!run.ok) {
                     rejected.push(run.why);
                     continue;
@@ -896,7 +1345,7 @@ export function evaluateProtectedPaths(input) {
                 // A command payload describes no bytes, so attribution is all or
                 // nothing: the run that wrote this file wrote whatever is in it.
                 whole = true;
-                contributors.push({ grant, kind: match.kind, why: `${match.detail}, and ${run.detail}`, whole: true });
+                contributors.push({ record, kind: match.kind, why: `${match.detail}, and ${run.detail}`, whole: true, source });
                 continue;
             }
             if (match.after === null && match.before === null) {
@@ -947,8 +1396,34 @@ export function evaluateProtectedPaths(input) {
                 if (parts.length > 0)
                     contributed = `${match.detail}, and ${parts.join(" and ")}`;
             }
-            if (contributed !== null)
-                contributors.push({ grant, kind: match.kind, why: contributed, whole: wholeHere });
+            if (contributed !== null) {
+                contributors.push({ record, kind: match.kind, why: contributed, whole: wholeHere, source });
+            }
+        }
+        // Exact Edit payloads may bind fragments within a line, including several
+        // independent fragments of the same long line. Whole-line set membership
+        // cannot express that safely. Replay is the bounded fallback: genuine
+        // starts, execution order, unique anchors, and final byte equality.
+        const needsReplay = !whole &&
+            !hunks.identical &&
+            (hunks.reordered ||
+                hunks.added.some((line) => !addedCover.has(line)) ||
+                hunks.removed.some((line) => !removedCover.has(line)));
+        const replay = needsReplay
+            ? exactEditReplay(candidates, records, blobs.base, blobs.head, anchorMs, lookbackMs, path, input.policyProtectedPaths)
+            : { steps: null, bound: null };
+        if (replay.bound !== null) {
+            rejected.unshift(`exact BASE-to-HEAD replay refused after reaching its ${replay.bound.replace("-", " ")}`);
+        }
+        if (replay.steps !== null) {
+            whole = true;
+            contributors.splice(0, contributors.length, ...replay.steps.map((step) => ({
+                record: step.candidate.record,
+                kind: step.candidate.match.kind,
+                why: `${step.candidate.match.detail}, applied at execution.started seq ${step.start.seq} in an exact BASE-to-HEAD replay`,
+                whole: true,
+                source: step.candidate.source,
+            })));
         }
         // What the bytes alone cover, before any whole-file attribution. If this is
         // non-empty the change RESTS on the attribution, and the finding has to
@@ -976,12 +1451,14 @@ export function evaluateProtectedPaths(input) {
         const lead = restsOnAttribution
             ? (contributors.find((one) => one.whole) ?? contributors[0])
             : contributors[0];
-        const quiet = hunks.identical ? candidates[0] : undefined;
+        const quiet = hunks.identical
+            ? candidates.find((candidate) => candidate.source === "grant")
+            : undefined;
         const passing = lead !== undefined
-            ? { record: lead.grant, kind: lead.kind, why: lead.why }
+            ? { record: lead.record, kind: lead.kind, why: lead.why }
             : quiet !== undefined
                 ? {
-                    record: quiet.grant,
+                    record: quiet.record,
                     kind: quiet.match.kind,
                     why: `${quiet.match.detail}, and this change alters no substantive line (whitespace, mode or metadata only), so there is no hunk to cover`,
                 }
@@ -997,14 +1474,16 @@ export function evaluateProtectedPaths(input) {
                 seq: record.seq,
                 ts: record.ts,
                 actor: record.actor,
-                coveredBy: contributors.map((one) => one.grant.seq),
-                detail: `${path} was granted by ${record.actor} at seq ${record.seq} (${record.ts}), ${boundText}: ${why}. ${hunks.identical
-                    ? "there are no substantive hunks to cover"
-                    : whole
-                        ? "the whole change is attributed to that grant"
-                        : `${hunks.added.length} added and ${hunks.removed.length} removed line(s) all trace to granted material`}${contributors.length > 1
-                    ? ` (assembled from ${contributors.length} grants: seq ${contributors.map((one) => one.grant.seq).join(", ")}; the strongest and nearest leads)`
-                    : ""}`,
+                coveredBy: contributors.map((one) => one.record.seq),
+                detail: replay.steps !== null
+                    ? `${path}'s full change was reconstructed byte-for-byte from ${contributors.length} replayed authorization record${contributors.length === 1 ? "" : "s"} in execution order, ${boundText}. Evidence records in that order: seq ${contributors.map((one) => one.record.seq).join(", ")}. The first record, ${record.actor} at seq ${record.seq} (${record.ts}), leads the finding: ${why}.`
+                    : `${path} was ${kind === "policy-authorized-file" ? "authorized by policy for execution" : "granted"} by ${record.actor} at seq ${record.seq} (${record.ts}), ${boundText}: ${why}. ${hunks.identical
+                        ? "there are no substantive hunks to cover"
+                        : whole
+                            ? "the whole change is attributed to that authorization record"
+                            : `${hunks.added.length} added and ${hunks.removed.length} removed line(s) all trace to authorized material`}${contributors.length > 1
+                        ? ` (assembled from ${contributors.length} ${contributors.every((one) => one.source === "grant") ? "grants" : "evidence records"}: seq ${contributors.map((one) => one.record.seq).join(", ")}; the strongest and nearest leads)`
+                        : ""}`,
             });
             continue;
         }
@@ -1019,8 +1498,8 @@ export function evaluateProtectedPaths(input) {
                 ok: false,
                 code: "uncovered-hunk",
                 uncovered: sample,
-                detail: `${path} is a protected path and ${uncovered.length} line(s) of this change trace to no granted material. ${candidates.length} grant${candidates.length === 1 ? "" : "s"} name this path ${boundText}, and naming is not coverage: a grant authorizes the bytes it bound, and a later edit to the same file is a different decision. ${contributors.length > 0
-                    ? `${contributors.length} grant${contributors.length === 1 ? "" : "s"} covered part of it (seq ${contributors.map((one) => one.grant.seq).join(", ")}); `
+                detail: `${path} is a protected path and ${uncovered.length} line(s) of this change trace to no authorized material. ${candidates.length} ${evidenceNoun} name this path ${boundText}, and naming is not coverage: evidence authorizes only the bytes it binds, and a later edit to the same file is a different decision. ${contributors.length > 0
+                    ? `${contributors.length} evidence record${contributors.length === 1 ? "" : "s"} covered part of it (seq ${contributors.map((one) => one.record.seq).join(", ")}); `
                     : ""}${rejected.length > 0
                     ? `${rejected.slice(0, 6).join("; ")}${rejected.length > 6 ? `; … and ${rejected.length - 6} other naming grants set aside for the same kinds of reason` : ""}. `
                     : ""}uncovered: ${sample.map((line) => JSON.stringify(line)).join(", ")}${uncovered.length > sample.length ? `, … ${uncovered.length - sample.length} more` : ""}. ${windowText(input.window)}. ${ORDERING_RULE}.`,