approval-md 0.3.0 → 0.4.1

package/dist/src/cli/execute.js

@@ -52,7 +52,7 @@ import { spawnSync } from "node:child_process";
 import { readdirSync, rmSync } from "node:fs";
 import { constants as osConstants } from "node:os";
 import { dirname, isAbsolute, resolve as resolvePathSegments } from "node:path";
-import { HUMAN_ACTOR_ENV, checkAttestation, resolveHumanActor } from "../core/attest.js";
+import { HUMAN_ACTOR_ENV, attesterAt, checkAttestation, resolveHumanActor, } from "../core/attest.js";
 import { RESOLVE_DANGLING_COMMAND, proveDanglingAdvances, } from "../core/advance-cycle.js";
 import { openObligations } from "../core/audit.js";
 import { evaluateBudgets } from "../core/budgets.js";
@@ -62,20 +62,24 @@ import { coverageReport } from "../core/coverage.js";
 import { credentialPathsFor, detectSandbox, resolveExecutable, sandboxPosture, sandboxRequired, wrapForSandbox, } from "../core/sandbox.js";
 import { DEFAULT_TRUNK_REF, defaultRange, observeGit, } from "../core/coverage-sources/git.js";
 import { danglingExecutions, findDeclaration, finishExecution, indexDeclarations, indeterminateExecutions, isReconcileResolution, loopEscalation, reconcileExecution, resolveExecution, startExecution, } from "../core/execute.js";
+import { settleTerminationGuards, yieldToTerminationSignals } from "../core/log-lock.js";
 import { harnessLoopEscalation, harnessOutcomeCoverage, loopClearance } from "../core/loop.js";
 import { isPayloadHash, runPayloadHash } from "../core/payload.js";
 import { payloadStoreCensus } from "../core/payload-census.js";
 import { payloadStoreDirFor } from "../core/payload-store.js";
-import { withdraw } from "../core/gate.js";
+import { boundScript, describeBoundScript } from "../core/run-payload.js";
+import { attestedPolicySha256, requestStanding, taskRegistration, withdraw, } from "../core/gate.js";
 import { openGateWindow } from "../core/gate-window.js";
 import { keyStoreDirFor } from "../core/seal.js";
 import { readVerifiedRecords, requestState } from "../core/state.js";
 import { deliveredToken } from "../core/token.js";
 import { passphraseEnvFor } from "../core/vault.js";
+import { resolveDaemonAllowlist, resolveDaemonId } from "../core/daemon-host.js";
+import { DAEMON_ID_ENV } from "../core/daemon-identity.js";
 import { loadPolicy, parseDuration, POLICY_FILENAMES } from "../core/policy-load.js";
 import { verify } from "../core/verify.js";
 import { boolFlag, parseFlags, stringFlag } from "./args.js";
-import { EXIT_INTEGRITY, EXIT_IO, EXIT_NO_TOKEN, EXIT_OK, EXIT_TIMEOUT, EXIT_TORN_TAIL, EXIT_USAGE, } from "./exit-codes.js";
+import { EXIT_INTEGRITY, EXIT_IO, EXIT_NO_TOKEN, EXIT_OK, EXIT_TIMEOUT, EXIT_VOID, EXIT_TORN_TAIL, EXIT_USAGE, } from "./exit-codes.js";
 import { repoRoot } from "./git-scope.js";
 import { resolveReadRoots } from "./hook.js";
 import { publishedState } from "./log-advance.js";
@@ -170,6 +174,10 @@ function emitRefusal(streams, json, refusal) {
             error["seq"] = refusal.seq;
         if (refusal.record !== undefined)
             error["event_seq"] = refusal.record.seq;
+        // APRV-448: the write-boundary code under `append-failed`, as `approval
+        // gate` and the gate verbs report it.
+        if (refusal.append !== undefined)
+            error["append"] = refusal.append.code;
         streams.err(`${JSON.stringify({ ok: false, error })}\n`);
     }
     else {
@@ -308,7 +316,40 @@ function childExitCode(status, signal) {
     return status ?? EXIT_COMMAND_NOT_RUN;
 }
 const INHERIT_CHILD_IO = { stdio: "inherit" };
+/**
+ * `approval run`, for a caller that can await (the CLI): between appending
+ * `execution.started` and spawning the child it turns the event loop, so a
+ * SIGTERM, SIGINT or SIGHUP that landed during that append kills this process,
+ * with the signal's own status, before the command exists (APRV-479 round 2,
+ * RS1). Node shows a held signal to JavaScript only on that turn.
+ */
+export async function commandRunYielding(argv, streams, cwd, childIo = INHERIT_CHILD_IO) {
+    const steps = runSteps(argv, streams, cwd, childIo);
+    for (let next = steps.next();; next = steps.next()) {
+        if (next.done === true)
+            return next.value;
+        await yieldToTerminationSignals();
+        settleTerminationGuards();
+    }
+}
+/**
+ * `approval run`, synchronously, for in-process callers (the MCP server, which
+ * owns its own signal listeners, so no lock guard is ever installed there).
+ */
 export function commandRun(argv, streams, cwd, childIo = INHERIT_CHILD_IO) {
+    const steps = runSteps(argv, streams, cwd, childIo);
+    for (let next = steps.next();; next = steps.next()) {
+        if (next.done === true)
+            return next.value;
+        settleTerminationGuards();
+    }
+}
+/**
+ * The body of `approval run`. It yields once, after `execution.started` is
+ * appended and before the child is spawned, so its driver can let a termination
+ * signal that arrived during the append end the process first.
+ */
+function* runSteps(argv, streams, cwd, childIo) {
     // `--` separates our flags from the child's argv, and the child's argv may
     // legitimately contain anything at all — including flags this CLI knows. So
     // the split happens on the RAW argv, before any parsing, and everything to the
@@ -371,12 +412,23 @@ export function commandRun(argv, streams, cwd, childIo = INHERIT_CHILD_IO) {
     if (hashFlag !== null && !isPayloadHash(hashFlag)) {
         return usageError(streams, json, `--payload-hash expects 64 lowercase hex characters (SHA-256 over the RFC 8785 canonical serialization of the payload), got ${JSON.stringify(hashFlag)}`, RUN_HELP);
     }
+    // APRV-401 put the SCRIPT inside that computation: an interpreter followed by
+    // a path operand, or a path at argv[0], carries that file's digest, so a
+    // script rewritten between the declaration and this moment hashes differently
+    // and is refused here rather than executed under a grant nobody gave it. The
+    // refusal names what was bound, because "the hash differs" leaves an agent to
+    // guess whether the argv moved or the file under it did, and those have
+    // different repairs.
     const payloadHash = runPayloadHash(childArgv, cwd);
     if (hashFlag !== null && hashFlag !== payloadHash) {
+        const script = boundScript(childArgv, cwd);
+        const binding = script === null
+            ? `The argv names no readable script, so the binding is the argv and the cwd alone (amended SPEC.md §6.2, APRV-401).`
+            : `The binding covers the script's bytes as well (amended SPEC.md §6.2, APRV-401): ${describeBoundScript(script)}, so a script edited since the declaration changes this value.`;
         return emitRefusal(streams, json, {
             ok: false,
             code: "payload-mismatch",
-            message: `--payload-hash ${hashFlag} is not the hash of the command this would spawn: ${JSON.stringify(childArgv[0])} and ${childArgv.length - 1} argument(s) in ${cwd} hash to ${payloadHash}. \`approval run\` recomputes the binding from the argv and cwd it is about to spawn and never accepts a caller's substitute for it (amended SPEC.md §10.4, APRV-140); the flag states what you believe you are running, and this is a refusal to run something else. Nothing was appended.`,
+            message: `--payload-hash ${hashFlag} is not the hash of the command this would spawn: ${JSON.stringify(childArgv[0])} and ${childArgv.length - 1} argument(s) in ${cwd} hash to ${payloadHash}. ${binding} \`approval run\` recomputes the binding from the argv, the cwd and those bytes and never accepts a caller's substitute for it (amended SPEC.md §10.4, APRV-140); the flag states what you believe you are running, and this is a refusal to run something else. Nothing was appended.`,
         });
     }
     // APRV-205. The child's environment is built BEFORE `execution.started`,
@@ -442,6 +494,12 @@ export function commandRun(argv, streams, cwd, childIo = INHERIT_CHILD_IO) {
     const wrapped = posture.kind === "apply"
         ? wrapExecutable(posture.mechanism, command, childArgv.slice(1), childEnv.env, logPath, readJailFor(flags, cwd))
         : null;
+    // `execution.started` was just appended. The driver turns the event loop here
+    // (the CLI) so a stop request that landed during the append ends the process
+    // before the child exists, then settles the guard, so a signal during the
+    // child's run reaches this process as it did before the guard existed
+    // (APRV-479, S2 and round 2 RS1).
+    yield "before-spawn";
     const child = spawnSync(wrapped?.command ?? command, wrapped?.args ?? childArgv.slice(1), {
         cwd,
         stdio: childIo.stdio,
@@ -486,8 +544,15 @@ export function commandRun(argv, streams, cwd, childIo = INHERIT_CHILD_IO) {
 // ===========================================================================
 // approval wait
 // ===========================================================================
-/** Synchronous sleep with no dependency and no busy-spin. */
+/** `wait --timeout 0` (and `0s`, `0ms`, …): read once, never sleep (APRV-445). */
+const ZERO_DURATION = /^0(?:ms|s|m|h|d|w)?$/u;
+/**
+ * Synchronous sleep with no dependency and no busy-spin. The log lock's signal
+ * guard is settled first, so a wait that follows an append is never run with
+ * termination signals held (APRV-479, S2).
+ */
 function sleepSync(ms) {
+    settleTerminationGuards();
     if (ms <= 0)
         return;
     Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
@@ -499,10 +564,28 @@ function sleepSync(ms) {
 function stateRole(state) {
     if (state === "granted")
         return "ok";
-    if (state === "expired" || state === "requested" || state === "withdrawn")
+    if (state === "expired" ||
+        state === "requested" ||
+        state === "withdrawn" ||
+        state === NOTHING_TO_WAIT_FOR) {
         return "warn";
+    }
     return "fail";
 }
+/**
+ * `approval wait`'s status for a REGISTERED task that holds nothing a wait could
+ * resolve (APRV-428): no `approval.requested` at all (no action was declared,
+ * none reached the manual path, or none has been requested yet), or every
+ * granted action has already started executing, so its grant is spent.
+ *
+ * Exit 0, because the wait contract has always returned at once and at 0 for a
+ * task with no requests, and the supervised path tells an agent its
+ * `proceed: true` needs no wait at all. What changes is the WORD: before
+ * APRV-428 this was `granted`, and a caller that branched on `status` saw a
+ * grant nobody made. Nothing is minted either way, since `approval run` still
+ * needs a token on the manual path.
+ */
+const NOTHING_TO_WAIT_FOR = "nothing-to-wait-for";
 /**
  * `approval wait`'s human answer: the verdict, then one aligned row per action.
  *
@@ -510,7 +593,11 @@ function stateRole(state) {
  * (`plainLeft`) and the state beside it carries the colour instead.
  */
 export function renderWaitHuman(task, status, actions, st = style()) {
-    const glyph = status === "granted" ? "ok" : status === "expired" || status === "withdrawn" ? "skip" : "fail";
+    const glyph = status === "granted"
+        ? "ok"
+        : status === "expired" || status === "withdrawn" || status === NOTHING_TO_WAIT_FOR
+            ? "skip"
+            : "fail";
     const head = `${st.glyph(glyph)} ${st.key(task)}  ${st.paint(stateRole(status), status)}`;
     if (actions.length === 0)
         return `${head}\n`;
@@ -521,6 +608,25 @@ export function renderWaitHuman(task, status, actions, st = style()) {
     }));
     return `${head}\n${st.table(rows, { indent: 2 })}\n`;
 }
+/**
+ * `approval wait`'s refusal of a task the log has never registered (APRV-428).
+ *
+ * The frozen `{ok:false,error:{code,message}}` shape on stderr, like every other
+ * refusal this verb prints, and exit 1: the same code `approval request` exits
+ * for the same `not-registered`, and the meaning wait's exit 1 already carries
+ * (not authorized, and waiting again will not change that). A separate writer
+ * because the verb's other refusals are the execute union's log-read codes,
+ * and `not-registered` is a member of the gate union only.
+ */
+function emitWaitRefusal(streams, json, refusal) {
+    if (json) {
+        streams.err(`${JSON.stringify({ ok: false, error: { code: refusal.code, message: refusal.message } })}\n`);
+    }
+    else {
+        streams.err(`${renderRefusal(style({ json }), refusal.code, refusal.message)}\n`);
+    }
+    return EXIT_INTEGRITY;
+}
 /** Every action key of `task` that ever carried an `approval.requested`. */
 function requestedKeysOf(records, task) {
     const keys = [];
@@ -560,9 +666,18 @@ export function commandWait(argv, streams, cwd) {
     if (timeoutText === null) {
         return usageError(streams, json, "missing --timeout <duration>", WAIT_HELP);
     }
-    const timeoutMs = parseDuration(timeoutText);
+    // APRV-445. `--timeout 0` is a STATUS READ: one verified read of the log, the
+    // current state of every request of the task, and no sleep at all. The
+    // duration grammar has no zero (a zero TTL or window in a policy would be a
+    // control that never runs), so the spelling is admitted here and only here.
+    // It is what a poller on `approval serve` uses: that server runs every verb
+    // and every hook call through one queue, and a `wait` that sleeps holds the
+    // whole tenant's hook traffic for as long as it sleeps. The result set and
+    // the exit codes are unchanged; an undecided request answers `timeout`
+    // (exit 6) at once, as a wait that ran out would.
+    const timeoutMs = ZERO_DURATION.test(timeoutText) ? 0 : parseDuration(timeoutText);
     if (timeoutMs === null) {
-        return usageError(streams, json, `--timeout expects a duration like 30s, 10m, 6h, got ${JSON.stringify(timeoutText)}`, WAIT_HELP);
+        return usageError(streams, json, `--timeout expects a duration like 30s, 10m, 6h, or 0 to read the current state without waiting, got ${JSON.stringify(timeoutText)}`, WAIT_HELP);
     }
     const intervalText = stringFlag(flags, "--interval");
     const intervalMs = intervalText === null ? DEFAULT_WAIT_INTERVAL_MS : parseDuration(intervalText);
@@ -576,6 +691,12 @@ export function commandWait(argv, streams, cwd) {
     // after a nine-minute wait, and failing then, would leave exactly the stale
     // request the flag exists to prevent.
     const withdrawOnTimeout = boolFlag(flags, "--withdraw-on-timeout");
+    // APRV-445 (L1). A zero wait is a status read, and a status read that
+    // withdraws whatever is still pending would retract every question a poller
+    // looked at, on the first look.
+    if (withdrawOnTimeout && timeoutMs === 0) {
+        return usageError(streams, json, "--withdraw-on-timeout cannot be combined with --timeout 0: a zero wait reads the current state, and withdrawing on it would retract every pending request the moment it is polled", WAIT_HELP);
+    }
     const asFlag = stringFlag(flags, "--as");
     const withdrawActor = asFlag ?? resolveHumanActor();
     if (withdrawOnTimeout && (withdrawActor === null || !PRINCIPAL_ACTOR.test(withdrawActor))) {
@@ -592,33 +713,72 @@ export function commandWait(argv, streams, cwd) {
                 message: read.message,
             });
         }
+        // APRV-428. A task the log has never registered is refused, not answered.
+        // Before this check the loop below found no requests and reported the task
+        // `granted` with no actions: a typo read as a grant, and a shim polling
+        // until granted would have proceeded on a request it never opened. Checked
+        // on every pass rather than once, because it costs one walk of records
+        // already in hand and a registration cannot disappear from an append-only
+        // log, so the answer only ever moves from refusal to not.
+        const registered = taskRegistration(read.records, task);
+        if (!registered.ok)
+            return emitWaitRefusal(streams, json, registered);
         const ts = now();
         const actions = [];
         let pending = false;
+        // APRV-445 refutation (B1): the state a waiter acts on is what the record
+        // still AUTHORIZES. A grant whose window lapsed reads `expired`, and a
+        // pending request, or a harness grant (every proposal), pinned to a
+        // superseded policy reads `void` (a token grant `run` still spends stays
+        // `granted`), so
+        // a poller asks again instead of being told `granted` about an answer the
+        // spend will refuse.
+        const attestedSha = attestedPolicySha256(read.records, { policy: policyLocation(flags, cwd) });
+        // A granted action whose grant nothing has spent yet: the one thing a
+        // `granted` status can honestly promise (APRV-428). Judged on the
+        // standing, so a lapsed or voided grant never counts as one.
+        let unspentGrant = false;
         for (const key of requestedKeysOf(read.records, task)) {
             const derivation = requestState(read.records, key, ts, ttlMs);
+            const standing = requestStanding(read.records, key, ts, ttlMs, attestedSha);
+            // An executed key reads as its recorded decision when a grant authorized
+            // it (the long-standing `granted`), and as `executed` when it ran on the
+            // policy's own authority after its request ended (APRV-445 recheck L-a):
+            // a policy-path `start` after a withdrawal is not a `withdrawn` action.
+            const state = standing === "executed"
+                ? derivation.state === "granted"
+                    ? "granted"
+                    : "executed"
+                : standing;
             // APRV-105. The token, when this machine can open it: the grant sealed it
             // to the ephemeral public key this action's request published, and the
             // private half is in the key store beside the log. Attached only to a
             // GRANTED action, and only in `--json` below — a `null` on every other
             // state would be a field consumers have to ignore, and a token on a
             // rejected action would be a value with nothing behind it.
-            const token = json && derivation.state === "granted"
+            const token = json && state === "granted"
                 ? deliveredToken(read.records, key, keyStoreDirFor(logPath))
                 : null;
             actions.push({
                 action_key: key,
-                state: derivation.state,
+                state,
                 seq: derivation.decisionSeq ?? derivation.requestSeq,
                 ...(token === null ? {} : { token }),
             });
-            if (derivation.state === "requested")
+            if (state === "requested")
                 pending = true;
+            if (state === "granted" &&
+                derivation.state === "granted" &&
+                derivation.execution.started === null) {
+                unspentGrant = true;
+            }
         }
         if (!pending) {
             // Precedence, documented in --help: a human's "no" outranks a lapse, and
-            // both outrank "everything was granted". A task with no requests at all
-            // has nothing to wait for and is granted vacuously.
+            // both outrank "everything was granted". A registered task with no
+            // requests at all, or whose every grant has already been spent by an
+            // execution, has nothing to wait for and says so (APRV-428); it was
+            // "granted vacuously" before, which is a grant nobody made.
             //
             // APRV-106 puts `withdrawn` between the two, and REUSES exit 1 rather
             // than adding a code. The table in `cli/exit-codes.ts` is frozen public
@@ -630,15 +790,31 @@ export function commandWait(argv, streams, cwd) {
             // the JSON and printed beside the action in the human render.
             const rejected = actions.some((action) => action.state === "rejected" || action.state === "revoked");
             const withdrawn = actions.some((action) => action.state === "withdrawn");
+            const voided = actions.some((action) => action.state === "void");
             const expired = actions.some((action) => action.state === "expired");
+            // APRV-445: `void` sits below a human's no and a requester's withdrawal
+            // (both final) and above a lapse, because its repair is the most
+            // specific: the same question, asked again under the policy in force.
             const status = rejected
                 ? "rejected"
                 : withdrawn
                     ? "withdrawn"
+                    : voided
+                        ? "void"
+                        : expired
+                            ? "expired"
+                            : unspentGrant
+                                ? "granted"
+                                : actions.length > 0 && actions.every((action) => action.state === "executed")
+                                    ? "executed"
+                                    : NOTHING_TO_WAIT_FOR;
+            const code = rejected || withdrawn
+                ? EXIT_INTEGRITY
+                : voided
+                    ? EXIT_VOID
                     : expired
-                        ? "expired"
-                        : "granted";
-            const code = rejected || withdrawn ? EXIT_INTEGRITY : expired ? EXIT_TORN_TAIL : EXIT_OK;
+                        ? EXIT_TORN_TAIL
+                        : EXIT_OK;
             if (json)
                 emitJson(streams, { ok: true, task, status, actions });
             else
@@ -707,11 +883,18 @@ function pendingRequests(records, ts, ttlMs) {
         const derivation = requestState(records, key, ts, ttlMs);
         if (derivation.state !== "requested")
             continue;
+        // APRV-423 (second review pass): the window is the derivation's, never a
+        // second copy of the arithmetic here. `requestState` already took the
+        // minimum of the policy's TTL and the declared harness cap less its margin;
+        // reading `ttlMs` again would show a capped request the policy's hour while
+        // the gate refuses it after four minutes, and would show a capped request
+        // under a policy with no TTL as "no TTL" when it has one.
+        const windowMs = derivation.effectiveTtlMs;
         const requestedAt = Date.parse(derivation.requestTs ?? "");
         const asked = Date.parse(ts);
-        const remaining = ttlMs === null || Number.isNaN(requestedAt) || Number.isNaN(asked)
+        const remaining = windowMs === null || Number.isNaN(requestedAt) || Number.isNaN(asked)
             ? null
-            : requestedAt + ttlMs - asked;
+            : requestedAt + windowMs - asked;
         entries.push({
             action_key: key,
             task: derivation.task,
@@ -720,6 +903,7 @@ function pendingRequests(records, ts, ttlMs) {
             requested_ts: derivation.requestTs,
             seq: derivation.requestSeq,
             ttl_remaining_ms: remaining,
+            ttl_ms: windowMs,
         });
     }
     return entries.sort((a, b) => (a.seq ?? 0) - (b.seq ?? 0));
@@ -773,7 +957,13 @@ export function renderQueueHuman(pending, ttlMs, st = style()) {
         entry.class ?? "-",
         `$${String(entry.est_cost_usd ?? 0)}`,
         entry.requested_ts ?? "-",
-        { text: ttlText(entry.ttl_remaining_ms), role: ttlRole(entry.ttl_remaining_ms, ttlMs) },
+        // The fraction is of the entry's OWN window (APRV-423): a capped request's
+        // four minutes, or the policy's TTL for one nothing narrowed. The `ttlMs`
+        // parameter stays as the fallback for an entry that carries no window.
+        {
+            text: ttlText(entry.ttl_remaining_ms),
+            role: ttlRole(entry.ttl_remaining_ms, entry.ttl_ms ?? ttlMs),
+        },
     ]);
     return `${table(st, rows, {
         header: ["action", "task", "class", "cost", "requested", "ttl"],
@@ -950,6 +1140,101 @@ function gitCoverageSummary(records, flags, cwd) {
         covered: report.covered,
     };
 }
+/**
+ * The two refusal records `status` counts, and the key each is reported under
+ * (APRV-376).
+ *
+ * The event NAMES are matched here rather than imported from
+ * `core/decision-refusal.ts` and `core/gesture-refusal.ts`, and that is
+ * deliberate: both modules are writers on the append path, and the whole safety
+ * argument for those records is that nothing reads them from anywhere that
+ * decides. A report that filters on a string pulls in no writer, and the two
+ * suites that pin the module graph stay true without an exemption for this file.
+ */
+const REFUSAL_FAMILIES = {
+    decision: "audit.decision_refused",
+    gesture: "audit.gesture_refused",
+};
+/**
+ * How many of the newest refusals each family lists.
+ *
+ * Small and fixed on purpose. The COUNT answers "is this happening", and the
+ * point of the listing beside it is to hand an operator a seq to paste into
+ * `approval log tail` and an account to recognize. A row that grew with the log
+ * would push the rest of the report off a terminal for a fact that is
+ * informational, and the whole history is `approval log export` away.
+ */
+const RECENT_REFUSALS = 5;
+/** One record, read the way `status` reports it: verbatim, and nothing derived. */
+function refusalEntry(record) {
+    const payload = record.payload ?? {};
+    // The event schema requires `code` on both types, so the fallback is for a
+    // reader of a log written by something else: a report that threw on a record
+    // it could not read would take the whole health report down with it.
+    const code = typeof payload["code"] === "string" ? payload["code"] : "(no code)";
+    const sender = payload["sender"];
+    if (sender === null || typeof sender !== "object")
+        return { seq: record.seq, code };
+    const observed = sender;
+    const channel = observed["channel"];
+    const id = observed["id"];
+    if (typeof channel !== "string" || typeof id !== "string")
+        return { seq: record.seq, code };
+    return {
+        seq: record.seq,
+        code,
+        sender: {
+            channel,
+            id,
+            // APRV-370's marker, carried only when the record carries it: a keyed
+            // digest and a raw account id are different things to go looking for.
+            ...(observed["hashed"] === true ? { hashed: true } : {}),
+        },
+    };
+}
+/**
+ * The refused decisions and refused gestures in this log (APRV-376).
+ *
+ * Both families were visible only through `approval log tail` and `approval log
+ * export` until this row existed. The fact an operator needs is small and the
+ * log is the wrong place to read it from: told that taps from an account they
+ * did not map are being refused, they want to know how many and from which
+ * account, and the chain is a poor answer to a question that size.
+ *
+ * INFORMATIONAL, on the terms `harness outcomes` and `git coverage` set: it
+ * moves neither `healthy` nor the exit code. A refusal is the gate having
+ * worked, and a report that went red because the gate refused a stranger would
+ * teach an operator to stop reading it. It reads only verified records (SPEC.md
+ * §11.1 invariant 1) because its caller passes only those, and it reads them
+ * only to report: nothing here authorizes, settles, charges or samples
+ * anything.
+ *
+ * A family with no records is ABSENT rather than zero, and the object is empty
+ * when both are, so a log with no refusals emits the object it always emitted.
+ * A zero here would be a row an operator scrolls past on every healthy
+ * repository, which is how the rows that matter stop being read.
+ */
+function refusalSummaries(records) {
+    const summaries = {};
+    for (const family of Object.keys(REFUSAL_FAMILIES)) {
+        const seen = records.filter((record) => record.event === REFUSAL_FAMILIES[family]);
+        if (seen.length === 0)
+            continue;
+        summaries[family] = {
+            count: seen.length,
+            // Newest first: the reason to read this row at all is what just happened.
+            recent: seen.slice(-RECENT_REFUSALS).reverse().map(refusalEntry),
+        };
+    }
+    return summaries;
+}
+/** How the human rendering spells one entry's account. */
+function refusalSenderText(entry) {
+    if (entry.sender === undefined)
+        return "";
+    const keyed = entry.sender.hashed === true ? " (keyed)" : "";
+    return `  ${entry.sender.channel}:${entry.sender.id}${keyed}`;
+}
 export function commandStatus(argv, streams, cwd) {
     const outcome = front(argv, { ...COMMON_FLAGS, ...POLICY_FLAGS, "--verbose": "boolean" }, STATUS_HELP, streams, cwd);
     if (outcome.kind === "handled")
@@ -977,6 +1262,13 @@ export function commandStatus(argv, streams, cwd) {
     // anything from one.
     const records = read.ok ? read.records : [];
     const attestation = checkAttestation(records, policyPathFor(flags, cwd));
+    // APRV-449: who made the attestation the state names, read from the verified
+    // record at that seq, never from the file. On `hash-mismatch` it is the
+    // attester of the bytes the log last vouched for, which is the policy a
+    // re-attestation would replace.
+    const attestedBy = attestation.status === "attested" || attestation.status === "hash-mismatch"
+        ? attesterAt(records, attestation.seq)
+        : null;
     // APRV-120. `dangling` is now the `open` custody state only: a harness
     // execution is terminal by design and never gains an outcome, so listing it
     // as debris trained operators to ignore this list (the reference repository's
@@ -1070,6 +1362,28 @@ export function commandStatus(argv, streams, cwd) {
         status: verification.status,
         records: verification.status === "corrupt" ? null : verification.records,
     };
+    // APRV-383. The daemon identity this instance resolves, and the allowlist in
+    // force for it. `status` is not the daemon, so what it reports is the id a
+    // daemon started HERE would write: that is the fact an operator wiring up a
+    // hosted deployment needs, and the one a tenant needs to look up a `daemon`
+    // field they have just read in a record.
+    //
+    // The allowlist comes from `resolveDaemonAllowlist`, so it is reported only
+    // when the policy loads AND is attested — the same bytes the write boundary
+    // would refuse on. An unattested policy reports `null`, no restriction, which
+    // is exactly what the write boundary would do with it.
+    const daemonId = resolveDaemonId(logPath);
+    const daemonAllowlist = resolveDaemonAllowlist(records, loadPolicy(policyLocation(flags, cwd)));
+    const daemonReport = {
+        id: daemonId.ok ? daemonId.id : null,
+        source: daemonId.ok ? daemonId.source : null,
+        allowed: daemonAllowlist.ok ? daemonAllowlist.allowed : null,
+    };
+    // APRV-376, and informational for the reason stated where it is computed: the
+    // two refusal families, counted, with the newest few of each. Neither the
+    // health line below nor the exit code reads it.
+    const refusals = refusalSummaries(records);
+    const refusalFamilies = Object.keys(refusals);
     // APRV-40. Timestamp anomalies (SPEC.md §8) are informational and deliberately
     // outside `healthy`: they are a judgment, not an integrity verdict. `verify`
     // already declined to refuse on them, and `status` does not get to overrule it
@@ -1106,6 +1420,9 @@ export function commandStatus(argv, streams, cwd) {
                 seq: attestation.status === "attested" || attestation.status === "hash-mismatch"
                     ? attestation.seq
                     : null,
+                // APRV-449, additive and always present: the identity the attesting
+                // record declared, `null` when there is no attestation to name.
+                attested_by: attestedBy,
             },
             verification: verificationSummary,
             dangling,
@@ -1127,7 +1444,16 @@ export function commandStatus(argv, streams, cwd) {
             },
             reconciliation: obligations,
             payload_store: payloadStore,
+            // APRV-383. Always present, for the reason `coverage` is: three keys every
+            // consumer sees on every log, whether or not a daemon has ever run here and
+            // whether or not the policy restricts one. `allowed: null` is no restriction
+            // and is not the same fact as an empty list, which admits nobody.
+            daemon: daemonReport,
             ...(anomalies.length === 0 ? {} : { anomalies }),
+            // APRV-376. Present only when the log carries a refusal of either family,
+            // and each family present only when that family has one, so a repository
+            // where nothing has been refused emits the object it always emitted.
+            ...(refusalFamilies.length === 0 ? {} : { refusals }),
             // Present only while a window stands, exactly as `anomalies` and
             // `indeterminate` are: a repository with no window emits the object it
             // has always emitted, byte for byte.
@@ -1159,7 +1485,7 @@ export function commandStatus(argv, streams, cwd) {
                 // a bug report, so APRV-102 took the `muted` dressing off it. The state
                 // beside it still carries the colour.
                 right: `${st.paint(attestation.status === "attested" ? "ok" : "warn", attestation.status)}${attestation.status === "attested" || attestation.status === "hash-mismatch"
-                    ? ` (seq ${attestation.seq})`
+                    ? ` (seq ${attestation.seq}${attestedBy === null ? "" : `, by ${attestedBy}`})`
                     : ""}`,
             },
             {
@@ -1254,6 +1580,26 @@ export function commandStatus(argv, streams, cwd) {
                     ? `${String(coverage.covered)} of ${String(coverage.observed)} effects carry evidence`
                     : (coverage.reason ?? "unavailable")),
             },
+            // APRV-376. Its own INFORMATIONAL row, and printed only when the log
+            // carries a refusal of either family: a repository where nothing has been
+            // refused reads exactly as it always did, and a row saying "none" on every
+            // healthy repository is a row an operator learns to skip. The counts say
+            // whether this is happening; the lines under them hand over a seq to paste
+            // into `approval log tail` and an account to recognize.
+            ...(refusalFamilies.length === 0
+                ? []
+                : [
+                    {
+                        left: "refusals",
+                        right: st.muted(`${refusalFamilies
+                            .map((family) => `${String(refusals[family]?.count ?? 0)} ${family}`)
+                            .join(", ")} (reported; health unaffected)`),
+                        under: refusalFamilies.flatMap((family) => (refusals[family]?.recent ?? []).map((entry) => 
+                        // The family is padded to the longer of the two names, so the
+                        // seqs line up under each other when both are listed.
+                        `${family.padEnd("decision".length)}  seq ${String(entry.seq)}  ${entry.code}${refusalSenderText(entry)}`)),
+                    },
+                ]),
             {
                 // APRV-214. Its own row and not a footnote: while this says OPEN, the
                 // policy is deciding nothing for the harness, and the person reading
@@ -1282,6 +1628,26 @@ export function commandStatus(argv, streams, cwd) {
                         under: obligations.map((item) => `seq ${item.seq}  ${item.action_key}  ${item.class}  ${item.obligation} — close with \`approval audit reconcile ${item.seq}\``),
                     }),
             },
+            {
+                // APRV-383. The id a daemon started against THIS log writes onto every
+                // record it appends, and whether the attested policy admits it. Printed
+                // by a verb that is not the daemon on purpose: an operator setting up a
+                // hosted deployment needs the id before anything is running, and a tenant
+                // reading a record's `daemon` field needs somewhere to look it up.
+                // Informational: it moves neither `healthy` nor the exit code, because
+                // nothing here is a fact about the log's integrity.
+                left: "daemon identity",
+                right: daemonReport.id === null
+                    ? st.fail(`UNUSABLE (${DAEMON_ID_ENV} is set to something that is not an id)`)
+                    : `${daemonReport.id} ${st.muted(`(${daemonReport.source})`)}`,
+                under: daemonReport.allowed === null
+                    ? [st.muted("the policy lists no allowed daemon ids, so any daemon may write")]
+                    : [
+                        daemonReport.id !== null && daemonReport.allowed.includes(daemonReport.id)
+                            ? st.muted(`allowed by the policy's daemons list (${daemonReport.allowed.join(", ")})`)
+                            : st.warn(`NOT in the policy's daemons list (${daemonReport.allowed.length === 0 ? "empty" : daemonReport.allowed.join(", ")}) — a daemon started here would be refused every append`),
+                    ],
+            },
             { left: "log", right: relPath(logPath, cwd) },
         ];
         streams.out(`${st.table(rows)}\n`);