arcane-cli 1.20.1 → 1.21.0

package/dist/index.js

@@ -5,7 +5,7 @@ const require = __createRequire(import.meta.url);
 // src/index.ts
 import { Command, Option } from "commander";
 import { fileURLToPath } from "url";
-import { dirname as dirname15, join as join31 } from "path";
+import { dirname as dirname15, join as join32 } from "path";
 
 // src/package-info.ts
 import { createRequire } from "module";
@@ -1695,14 +1695,14 @@ async function syncUserTierFanout(options) {
   const ownsClient = (client2) => owned === void 0 || client2 !== void 0 && owned.includes(client2);
   const previous = options.previous ?? {};
   const dryRun = Boolean(options.dryRun);
-  const record = {};
+  const record2 = {};
   const outcomes = [];
   const desiredPaths = new Set(desired.map((f) => f.relativePath));
   for (const id of rendered.missing) {
     for (const client2 of SPELL_FANOUT_CLIENTS) {
       const relativePath = USER_FANOUT_PATHS[client2](id);
       desiredPaths.add(relativePath);
-      if (previous[relativePath] !== void 0) record[relativePath] = previous[relativePath];
+      if (previous[relativePath] !== void 0) record2[relativePath] = previous[relativePath];
       outcomes.push({ relativePath, status: "unrenderable" });
     }
   }
@@ -1717,7 +1717,7 @@ async function syncUserTierFanout(options) {
         await mkdir2(dirname2(target), { recursive: true });
         await writeFile3(target, file.content, "utf-8");
       }
-      record[file.relativePath] = newHash;
+      record2[file.relativePath] = newHash;
       outcomes.push({ relativePath: file.relativePath, status: "written" });
       continue;
     }
@@ -1726,24 +1726,24 @@ async function syncUserTierFanout(options) {
       continue;
     }
     if (!await fileMatchesHash(target, recorded)) {
-      record[file.relativePath] = recorded;
+      record2[file.relativePath] = recorded;
       outcomes.push({ relativePath: file.relativePath, status: "customized" });
       continue;
     }
     const currentHash = await hashFile(target);
     if (currentHash === newHash) {
-      record[file.relativePath] = newHash;
+      record2[file.relativePath] = newHash;
       outcomes.push({ relativePath: file.relativePath, status: "unchanged" });
       continue;
     }
     if (!dryRun) await writeFile3(target, file.content, "utf-8");
-    record[file.relativePath] = newHash;
+    record2[file.relativePath] = newHash;
     outcomes.push({ relativePath: file.relativePath, status: "written" });
   }
   for (const [relativePath, recorded] of Object.entries(previous)) {
     if (desiredPaths.has(relativePath)) continue;
     if (!ownsClient(clientOfFanoutPath(relativePath))) {
-      record[relativePath] = recorded;
+      record2[relativePath] = recorded;
       continue;
     }
     validateTargetPath(options.homeDir, relativePath);
@@ -1754,7 +1754,7 @@ async function syncUserTierFanout(options) {
       continue;
     }
     if (state === "other" || !await fileMatchesHash(target, recorded)) {
-      record[relativePath] = recorded;
+      record2[relativePath] = recorded;
       outcomes.push({ relativePath, status: "kept-edited" });
       continue;
     }
@@ -1765,7 +1765,7 @@ async function syncUserTierFanout(options) {
     }
     outcomes.push({ relativePath, status: "pruned" });
   }
-  return { record, outcomes };
+  return { record: record2, outcomes };
 }
 function summarizeFanout(outcomes) {
   const counts = {
@@ -1834,14 +1834,14 @@ ${paths("kept-edited")}`
   }
   return lines;
 }
-async function inspectUserTierFanout(homeDir, record) {
+async function inspectUserTierFanout(homeDir, record2) {
   const health = {
     total: 0,
     byClient: { codex: 0, claude: 0, "copilot-agents": 0 },
     missing: [],
     customized: []
   };
-  for (const [relativePath, recorded] of Object.entries(record ?? {})) {
+  for (const [relativePath, recorded] of Object.entries(record2 ?? {})) {
     health.total++;
     const client2 = clientOfFanoutPath(relativePath);
     if (client2 !== void 0) health.byClient[client2]++;
@@ -4086,8 +4086,8 @@ function hookInForce(outcome) {
 }
 async function applyBlockedPushControls(cwd, options = {}) {
   const messages = [];
-  const say = (level, text2) => {
-    const message = { level, text: text2 };
+  const say = (level, text3) => {
+    const message = { level, text: text3 };
     messages.push(message);
     options.emit?.(message);
   };
@@ -5052,8 +5052,8 @@ function arraysEqual(a, b) {
   return a.every((line2, idx) => line2 === b[idx]);
 }
 var MAX_LINES_FOR_LCS = 4e3;
-function splitLines(text2) {
-  return text2.split("\n");
+function splitLines(text3) {
+  return text3.split("\n");
 }
 function merge3(base, ours, theirs) {
   const baseLines = splitLines(base);
@@ -6457,18 +6457,18 @@ function titleAfterId(rest) {
   return rest.replace(/^\s*[—–:-]+\s*/u, "").trim();
 }
 function parseDecisions(content) {
-  const text2 = content.replace(/\r\n?/g, "\n");
+  const text3 = content.replace(/\r\n?/g, "\n");
   const positions = [];
   let match2;
   HEADING.lastIndex = 0;
-  while ((match2 = HEADING.exec(text2)) !== null) {
+  while ((match2 = HEADING.exec(text3)) !== null) {
     positions.push({ id: `${match2[1]}-${match2[2]}`, heading: `${match2[1]}-${match2[2]}${match2[3]}`, index: match2.index });
   }
   const entries = [];
   const warnings = [];
   positions.forEach(({ id, heading, index }, i) => {
-    const end = i + 1 < positions.length ? positions[i + 1].index : text2.length;
-    const section = text2.slice(index, end);
+    const end = i + 1 < positions.length ? positions[i + 1].index : text3.length;
+    const section = text3.slice(index, end);
     const dateMatch = /^\*\*Date:\*\*\s*(\d{4}-\d{2}-\d{2})/m.exec(section);
     const statusMatch = /^\*\*Status:\*\*\s*(\S+)/m.exec(section);
     if (!dateMatch && !statusMatch) {
@@ -6515,12 +6515,12 @@ async function collectDecisions(root) {
 var ITEM = /^\s*- \[( |x|X)\] (.*)$/;
 var HEADING2 = /^#{1,6}\s+(.+?)\s*#*\s*$/;
 var TEXT_LIMIT = 200;
-function normalizeItemText(text2) {
-  return text2.replace(/\s+/g, " ").trim();
+function normalizeItemText(text3) {
+  return text3.replace(/\s+/g, " ").trim();
 }
-function itemLocator(section, text2) {
+function itemLocator(section, text3) {
   const slug = section === null ? "" : headingAnchor(section);
-  const hash = createHash3("sha256").update(normalizeItemText(text2), "utf8").digest("hex").slice(0, 12);
+  const hash = createHash3("sha256").update(normalizeItemText(text3), "utf8").digest("hex").slice(0, 12);
   return `${slug === "" ? "root" : slug}/${hash}`;
 }
 function parseBook(content) {
@@ -6537,13 +6537,13 @@ function parseBook(content) {
     const item = ITEM.exec(line2);
     if (!item) continue;
     const checked = item[1] !== " ";
-    const text2 = item[2].trim();
+    const text3 = item[2].trim();
     if (checked) done++;
     else open++;
     items.push({
-      text: text2.length > TEXT_LIMIT ? text2.slice(0, TEXT_LIMIT) : text2,
+      text: text3.length > TEXT_LIMIT ? text3.slice(0, TEXT_LIMIT) : text3,
       section,
-      locator: itemLocator(section, text2),
+      locator: itemLocator(section, text3),
       checked
     });
   }
@@ -6608,10 +6608,10 @@ function featureTracking(frontmatter) {
   };
 }
 function parsePrd(content, displayPath) {
-  const text2 = content.replace(/\r\n?/g, "\n");
-  const heading = H1.exec(text2);
+  const text3 = content.replace(/\r\n?/g, "\n");
+  const heading = H1.exec(text3);
   const empty = { title: heading ? heading[1] : null, status: null, implementation_status: null, tracking: null };
-  const match2 = FRONTMATTER.exec(text2);
+  const match2 = FRONTMATTER.exec(text3);
   if (!match2) return { fields: empty, warning: `features: ${displayPath} has no frontmatter` };
   let parsed;
   try {
@@ -6961,13 +6961,13 @@ import { join as join17 } from "path";
 var JOURNAL_DIR = "journal";
 var ENTRY_NAME = /^(\d{4}-\d{2}-\d{2})-(.+)\.md$/;
 function journalTitle(content) {
-  const text2 = content.replace(/\r\n?/g, "\n");
-  const frontmatter = /^---\n([\s\S]*?)\n---/.exec(text2);
+  const text3 = content.replace(/\r\n?/g, "\n");
+  const frontmatter = /^---\n([\s\S]*?)\n---/.exec(text3);
   if (frontmatter) {
     const title = /^title:\s*(.+)$/m.exec(frontmatter[1]);
     if (title) return title[1].trim().replace(/^(["'])(.*)\1$/, "$2");
   }
-  const heading = /^# (.+?)\s*$/m.exec(text2);
+  const heading = /^# (.+?)\s*$/m.exec(text3);
   return heading ? heading[1].trim() : null;
 }
 async function collectJournal(root) {
@@ -7405,9 +7405,9 @@ async function collectState(cwd, packageVersion, options) {
 
 // src/commands/state.ts
 var USAGE_POINTER = "spell state prints one JSON document to stdout: run `spell state --json` (spell status is the human view).";
-function writeStdout(text2) {
+function writeStdout(text3) {
   return new Promise((resolve10, reject) => {
-    process.stdout.write(text2, (error2) => error2 ? reject(error2) : resolve10());
+    process.stdout.write(text3, (error2) => error2 ? reject(error2) : resolve10());
   });
 }
 async function runState(targetDir, packageVersion, options = {}, deps = {}) {
@@ -7417,13 +7417,13 @@ async function runState(targetDir, packageVersion, options = {}, deps = {}) {
     return;
   }
   const collect = deps.collect ?? collectState;
-  let text2;
+  let text3;
   try {
     const doc = await collect(targetDir, packageVersion, {
       online: options.online === true,
       includeLocalPaths: options.includeLocalPaths === true
     });
-    text2 = serializeState(doc);
+    text3 = serializeState(doc);
   } catch (error2) {
     if (error2 instanceof ManifestNotFoundError) {
       console.error('Not initialized. Run "spell init" first.');
@@ -7436,7 +7436,7 @@ async function runState(targetDir, packageVersion, options = {}, deps = {}) {
     return;
   }
   try {
-    await (deps.write ?? writeStdout)(text2);
+    await (deps.write ?? writeStdout)(text3);
   } catch (error2) {
     console.error(`spell state: stdout is not writable (${error2 instanceof Error ? error2.message : String(error2)})`);
     process.exitCode = 1;
@@ -7638,8 +7638,8 @@ async function uninstallUserTier(options, storeRoot, manifest) {
 }
 
 // src/commands/doctor.ts
-import { access as access4, readdir as readdir11, readFile as readFile19, mkdir as mkdir7, copyFile as fsCopyFile } from "fs/promises";
-import { join as join24, dirname as dirname12, resolve as resolve7 } from "path";
+import { access as access4, readdir as readdir11, readFile as readFile20, mkdir as mkdir7, copyFile as fsCopyFile } from "fs/promises";
+import { join as join25, dirname as dirname12, resolve as resolve7 } from "path";
 
 // src/config/incidents.ts
 var INCIDENT_QUEUE = [
@@ -7665,37 +7665,37 @@ function evaluateIncidentGate(records) {
   const blockers = [];
   const acceptedRisks = [];
   const seen = /* @__PURE__ */ new Set();
-  for (const record of records) {
-    if (seen.has(record.id)) {
-      blockers.push(`${record.id}: duplicate incident record`);
+  for (const record2 of records) {
+    if (seen.has(record2.id)) {
+      blockers.push(`${record2.id}: duplicate incident record`);
       continue;
     }
-    seen.add(record.id);
-    if (record.confidence === "research") continue;
-    if (!PROTECTED_IMPACTS.has(record.impact)) continue;
-    if (!record.severity) {
-      blockers.push(`${record.id}: confirmed ${record.impact} incident is missing severity`);
+    seen.add(record2.id);
+    if (record2.confidence === "research") continue;
+    if (!PROTECTED_IMPACTS.has(record2.impact)) continue;
+    if (!record2.severity) {
+      blockers.push(`${record2.id}: confirmed ${record2.impact} incident is missing severity`);
       continue;
     }
-    if (!BLOCKING_SEVERITIES.has(record.severity)) continue;
-    if (record.state === "resolved") {
-      if (!record.resolution?.trim()) {
-        blockers.push(`${record.id}: resolved incident is missing resolution evidence`);
+    if (!BLOCKING_SEVERITIES.has(record2.severity)) continue;
+    if (record2.state === "resolved") {
+      if (!record2.resolution?.trim()) {
+        blockers.push(`${record2.id}: resolved incident is missing resolution evidence`);
       }
       continue;
     }
-    if (record.state === "deferred") {
-      if (!record.deferral || !DEFERRAL_PATTERN.test(record.deferral)) {
+    if (record2.state === "deferred") {
+      if (!record2.deferral || !DEFERRAL_PATTERN.test(record2.deferral)) {
         blockers.push(
-          `${record.id}: deferral must be exactly "Deferred <date> \u2014 known open, accepting the risk."`
+          `${record2.id}: deferral must be exactly "Deferred <date> \u2014 known open, accepting the risk."`
         );
       } else {
-        acceptedRisks.push(`${record.id}: ${record.deferral}`);
+        acceptedRisks.push(`${record2.id}: ${record2.deferral}`);
       }
       continue;
     }
     blockers.push(
-      `${record.id}: unresolved ${record.severity} ${record.impact} incident blocks release`
+      `${record2.id}: unresolved ${record2.severity} ${record2.impact} incident blocks release`
     );
   }
   return {
@@ -7977,10 +7977,10 @@ function stripFrontmatter(content) {
   const block = FRONTMATTER_PATTERN2.exec(content);
   return block ? content.slice(block[0].length) : content;
 }
-function stripFencedCode(text2) {
+function stripFencedCode(text3) {
   const kept = [];
   let fence = null;
-  for (const line2 of text2.split(/\r?\n/)) {
+  for (const line2 of text3.split(/\r?\n/)) {
     if (fence) {
       const close = /^ {0,3}(`{3,}|~{3,})[ \t]*$/.exec(line2);
       if (close && close[1][0] === fence.char && close[1].length >= fence.length) fence = null;
@@ -7997,8 +7997,8 @@ function stripFencedCode(text2) {
   }
   return kept.join("\n");
 }
-function stripInlineCode(text2) {
-  return text2.split(/\n[ \t]*\n/).map((paragraph) => {
+function stripInlineCode(text3) {
+  return text3.split(/\n[ \t]*\n/).map((paragraph) => {
     let out = "";
     let i = 0;
     while (i < paragraph.length) {
@@ -8356,9 +8356,9 @@ function createSessionStorage(options = {}) {
   const interpret = (result, source) => {
     if (result.state === "signed-out") return null;
     if (result.state === "corrupt") return { state: "corrupt", source, reason: result.reason };
-    const record = parseSessionRecord(result.secret);
-    if (record === null) return { state: "corrupt", source, reason: "the stored session is not valid" };
-    return { state: "ok", source, record };
+    const record2 = parseSessionRecord(result.secret);
+    if (record2 === null) return { state: "corrupt", source, reason: "the stored session is not valid" };
+    return { state: "ok", source, record: record2 };
   };
   return {
     load() {
@@ -8376,8 +8376,8 @@ function createSessionStorage(options = {}) {
       }
       return keychainError ? { state: "signed-out", keychainError } : { state: "signed-out" };
     },
-    save(record, { insecure }) {
-      const serialized = JSON.stringify(record);
+    save(record2, { insecure }) {
+      const serialized = JSON.stringify(record2);
       if (insecure) {
         file.save(serialized);
         try {
@@ -8606,10 +8606,10 @@ function send(port, token, method, path5, body, options = {}) {
       res.on("error", () => done({ kind: "unreachable" }));
       res.on("end", () => {
         const status = res.statusCode ?? 0;
-        const text2 = Buffer.concat(chunks).toString("utf8");
+        const text3 = Buffer.concat(chunks).toString("utf8");
         let parsed = null;
         try {
-          parsed = text2.length > 0 ? JSON.parse(text2) : null;
+          parsed = text3.length > 0 ? JSON.parse(text3) : null;
         } catch {
           parsed = null;
         }
@@ -8727,6 +8727,77 @@ function openEventFeed(callbacks, options = {}) {
 
 // src/commands/doctor.ts
 import { statSync } from "fs";
+
+// src/modules/run-grants.ts
+import { readFile as readFile19 } from "fs/promises";
+import { join as join24 } from "path";
+var RUN_ACTIONS = [
+  "commit",
+  "push",
+  "create-pr",
+  "assign-pr",
+  "approve-pr",
+  "complete-pr",
+  "delete-remote-branch",
+  "run-dev-pipeline"
+];
+var record = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var text = (v) => typeof v === "string" && v.trim().length > 0;
+var strings = (v) => Array.isArray(v) && v.every(text);
+var actions = (v) => strings(v) && v.every((a) => RUN_ACTIONS.some((known) => known === a));
+function timestamp(v) {
+  if (typeof v !== "string" || !/^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d\.\d{3}Z$/.test(v)) return false;
+  const n = Date.parse(v);
+  return Number.isFinite(n) && new Date(n).toISOString() === v;
+}
+function isRunGrant(v) {
+  if (!record(v) || !record(v.scope)) return false;
+  return [v.id, v.grantedBy, v.operatorWords, v.revocation].every(text) && timestamp(v.grantedAt) && timestamp(v.expiresAt) && Date.parse(v.expiresAt) > Date.parse(v.grantedAt) && (v.status === "active" || v.status === "revoked") && [v.scope.repository, v.scope.task, v.scope.branchPrefix].every(text) && actions(v.permittedActions) && v.permittedActions.length > 0 && strings(v.excludedActions) && strings(v.requiredChecks) && (!v.permittedActions.includes("complete-pr") || v.requiredChecks.length > 0);
+}
+function parseRunGrants(value) {
+  if (!record(value)) throw new Error("expected a delegations object");
+  if (value.runGrants === void 0) return [];
+  if (!Array.isArray(value.runGrants) || !value.runGrants.every(isRunGrant)) {
+    throw new Error("runGrants must be an array of well-formed, expiring run grants");
+  }
+  const grants = value.runGrants;
+  if (new Set(grants.map((g) => g.id)).size !== grants.length) {
+    throw new Error("duplicate run grant ID");
+  }
+  return grants;
+}
+async function readRunGrants(targetDir) {
+  let raw;
+  try {
+    raw = await readFile19(join24(targetDir, ".arcane", "delegations.json"), "utf8");
+  } catch (error2) {
+    if (error2.code === "ENOENT") return [];
+    throw error2;
+  }
+  return parseRunGrants(JSON.parse(raw));
+}
+function evaluateRunGrant(grants, request2) {
+  const deny = (reason) => ({ matches: false, reason });
+  const candidates = grants.filter((g) => g.id === request2.id);
+  if (candidates.length !== 1) return deny("missing or duplicate grant");
+  const grant = candidates[0];
+  if (!isRunGrant(grant)) return deny("invalid grant");
+  if (!Number.isFinite(request2.now.getTime())) return deny("invalid clock");
+  if (grant.status !== "active") return deny("revoked grant");
+  if (request2.now.getTime() < Date.parse(grant.grantedAt)) return deny("grant not yet active");
+  if (request2.now.getTime() >= Date.parse(grant.expiresAt)) return deny("expired grant");
+  if (grant.scope.repository !== request2.repository || grant.scope.task !== request2.task) {
+    return deny("repository or task outside scope");
+  }
+  const prefix = grant.scope.branchPrefix;
+  const boundary = prefix.endsWith("/") || prefix.endsWith("-");
+  if (!(request2.branch === prefix || request2.branch.startsWith(boundary ? prefix : `${prefix}-`) || !boundary && request2.branch.startsWith(`${prefix}/`))) return deny("branch outside scope");
+  if (grant.excludedActions.some((a) => a === request2.action)) return deny("excluded action");
+  if (!grant.permittedActions.some((a) => a === request2.action)) return deny("action not permitted");
+  return { matches: true, reason: "record matches; verify operator consent and execution/platform gates", grant };
+}
+
+// src/commands/doctor.ts
 function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -8745,13 +8816,13 @@ async function checkNodeVersion() {
 }
 async function checkArcaneManifest(targetDir) {
   const name = "Arcane manifest (.arcane.json)";
-  const manifestPath2 = join24(targetDir, ".arcane.json");
+  const manifestPath2 = join25(targetDir, ".arcane.json");
   try {
     await access4(manifestPath2);
   } catch {
-    const selfHostedManifestPath = join24(targetDir, "src", "assets", ".arcane.json");
+    const selfHostedManifestPath = join25(targetDir, "src", "assets", ".arcane.json");
     try {
-      const raw = await readFile19(selfHostedManifestPath, "utf8");
+      const raw = await readFile20(selfHostedManifestPath, "utf8");
       const manifest = JSON.parse(raw);
       if (isRecord7(manifest) && manifest["selfHosted"] === true && manifest["tracking_mode"] === "internal") {
         return {
@@ -8770,7 +8841,7 @@ async function checkArcaneManifest(targetDir) {
     };
   }
   try {
-    const raw = await readFile19(manifestPath2, "utf8");
+    const raw = await readFile20(manifestPath2, "utf8");
     const manifest = JSON.parse(raw);
     if (!isRecord7(manifest) || typeof manifest["version"] !== "string" || !manifest["version"] || !Array.isArray(manifest["components"])) {
       return {
@@ -8855,7 +8926,7 @@ async function checkSessionContinuity(targetDir) {
   const results = [];
   for (const file of SESSION_CONTINUITY_FILES) {
     const name = `Session file: ${file}`;
-    const filePath = join24(targetDir, file);
+    const filePath = join25(targetDir, file);
     try {
       await access4(filePath);
       results.push({ name, passed: true, message: "present" });
@@ -8873,7 +8944,7 @@ async function checkSessionContinuity(targetDir) {
 async function fixSessionContinuity(targetDir, assetsDir) {
   const created = [];
   for (const file of SESSION_CONTINUITY_FILES) {
-    const destPath = join24(targetDir, file);
+    const destPath = join25(targetDir, file);
     try {
       await access4(destPath);
     } catch {
@@ -8891,7 +8962,7 @@ async function fixSessionContinuity(targetDir, assetsDir) {
         );
         continue;
       }
-      const srcPath = join24(assetsDir, file);
+      const srcPath = join25(assetsDir, file);
       await mkdir7(dirname12(destPath), { recursive: true });
       await fsCopyFile(srcPath, destPath);
       created.push(file);
@@ -9070,7 +9141,7 @@ async function checkGovernancePlaceholders(targetDir) {
   const name = "Governance placeholders (ARC-051)";
   let scan;
   try {
-    scan = await scanGovernancePlaceholders(join24(targetDir, ".arcane", "governance"));
+    scan = await scanGovernancePlaceholders(join25(targetDir, ".arcane", "governance"));
   } catch (err) {
     return {
       name,
@@ -9157,10 +9228,10 @@ async function checkNewlyAvailableComponents(targetDir) {
 }
 async function checkMcpConfig(targetDir) {
   const name = "MCP config (per-server timeout, I12)";
-  const filePath = join24(targetDir, ".mcp.json");
+  const filePath = join25(targetDir, ".mcp.json");
   let raw;
   try {
-    raw = await readFile19(filePath, "utf8");
+    raw = await readFile20(filePath, "utf8");
   } catch {
     return { name, passed: true, blocking: false, message: "no .mcp.json \u2014 nothing to check" };
   }
@@ -9240,10 +9311,10 @@ function isDelegationsFile(value) {
 }
 async function checkDelegations(targetDir) {
   const name = "Standing delegations (T13)";
-  const filePath = join24(targetDir, ".arcane", "delegations.json");
+  const filePath = join25(targetDir, ".arcane", "delegations.json");
   let raw;
   try {
-    raw = await readFile19(filePath, "utf8");
+    raw = await readFile20(filePath, "utf8");
   } catch {
     return { name, passed: true, blocking: false, message: "no delegations recorded" };
   }
@@ -9279,6 +9350,23 @@ async function checkDelegations(targetDir) {
     message: `${active.length} active: ${summary}`
   };
 }
+async function checkRunGrants(targetDir, now = /* @__PURE__ */ new Date()) {
+  const name = "Run grants (ARC-061)";
+  try {
+    const grants = await readRunGrants(targetDir);
+    const active = grants.filter((g) => g.status === "active" && Date.parse(g.grantedAt) <= now.getTime() && now.getTime() < Date.parse(g.expiresAt));
+    const inactive = grants.length - active.length;
+    return {
+      name,
+      passed: true,
+      blocking: false,
+      showDetails: grants.length > 0,
+      message: grants.length === 0 ? "no run grants recorded" : `${active.length} active run grant(s): ${active.map((g) => `${g.id} (expires ${g.expiresAt}; task: ${g.scope.task}; branch: ${g.scope.branchPrefix})`).join("; ")}; ${inactive} expired, future or revoked`
+    };
+  } catch {
+    return { name, passed: false, blocking: false, message: "run grant file unreadable or invalid; no run authority can be inferred" };
+  }
+}
 async function checkPlatformBranchPolicy(targetDir) {
   const name = "Platform branch/merge policy (T11)";
   const targets = await pushTargets(targetDir);
@@ -9343,7 +9431,7 @@ async function checkManagedFileModes(targetDir) {
     if (!isClientShimPath(file) || asLinks.includes(file)) continue;
     let body;
     try {
-      body = await readFile19(join24(targetDir, file), "utf-8");
+      body = await readFile20(join25(targetDir, file), "utf-8");
     } catch {
       continue;
     }
@@ -9396,7 +9484,7 @@ async function checkSpellScope(targetDir, homeDir = resolveHomeDir()) {
   let probed = false;
   const probe2 = "spell-status.md";
   try {
-    const entries = await readdir11(join24(storeRoot, USER_TIER_SPELLS_DIR));
+    const entries = await readdir11(join25(storeRoot, USER_TIER_SPELLS_DIR));
     const spells = entries.filter((e) => e.startsWith("spell-") && e.endsWith(".md"));
     spellCount = spells.length;
     probed = spells.includes(probe2);
@@ -9456,6 +9544,7 @@ async function runDoctor(targetDir, options = {}, assetsDir) {
     checkPushPolicy(targetDir),
     checkPlatformBranchPolicy(targetDir),
     checkDelegations(targetDir),
+    checkRunGrants(targetDir),
     checkMcpConfig(targetDir),
     checkUserTier(resolveHomeDir(), options.packageVersion),
     checkSpellScope(targetDir),
@@ -9473,7 +9562,7 @@ async function runDoctor(targetDir, options = {}, assetsDir) {
     const icon = skipped ? "\u2013" : result.passed ? "\u2713" : result.blocking === false ? "\u26A0" : "\u2717";
     const label2 = skipped ? "skip" : result.passed ? "pass" : result.blocking === false ? "warn" : "FAIL";
     console.log(`  ${icon} [${label2}] ${result.name}`);
-    if (!result.passed || skipped) {
+    if (!result.passed || skipped || result.showDetails === true) {
       console.log(`         ${result.message}`);
     }
     if (!result.passed && result.blocking !== false) {
@@ -9518,17 +9607,31 @@ async function runDoctor(targetDir, options = {}, assetsDir) {
   }
 }
 
+// src/commands/grant.ts
+async function checkRunGrant(targetDir, request2) {
+  try {
+    return evaluateRunGrant(await readRunGrants(targetDir), request2);
+  } catch {
+    return { matches: false, reason: "grant file unreadable or invalid" };
+  }
+}
+async function runGrantCheck(options) {
+  const result = await checkRunGrant(process.cwd(), { ...options, now: /* @__PURE__ */ new Date() });
+  console.log(JSON.stringify({ matches: result.matches, reason: result.reason }));
+  if (!result.matches) process.exitCode = 1;
+}
+
 // src/commands/ward.ts
-import { readFile as readFile21 } from "fs/promises";
+import { readFile as readFile22 } from "fs/promises";
 
 // src/modules/ward.ts
-import { readdir as readdir12, readFile as readFile20 } from "fs/promises";
-import { join as join25, relative as relative3 } from "path";
+import { readdir as readdir12, readFile as readFile21 } from "fs/promises";
+import { join as join26, relative as relative3 } from "path";
 async function scanFileAllRules(absolutePath, displayPath, rules) {
   const findings = [];
   let content;
   try {
-    content = await readFile20(absolutePath, "utf8");
+    content = await readFile21(absolutePath, "utf8");
   } catch {
     return findings;
   }
@@ -9586,7 +9689,7 @@ async function scanFilenames(root, rules, repoRoot = root) {
     return findings;
   }
   for (const entry of entries) {
-    const absolutePath = join25(root, entry.name);
+    const absolutePath = join26(root, entry.name);
     if (entry.isDirectory()) {
       if (SKIP_DIRECTORIES.has(entry.name)) continue;
       findings.push(...await scanFilenames(absolutePath, rules, repoRoot));
@@ -9623,7 +9726,7 @@ async function runWard(repoRoot, options = {}) {
     const findings2 = await scanFileAllRules(absolutePath, displayPath, allRules);
     if (findings2.length > 0) {
       try {
-        fileLines.set(displayPath, (await readFile20(absolutePath, "utf8")).split("\n"));
+        fileLines.set(displayPath, (await readFile21(absolutePath, "utf8")).split("\n"));
       } catch {
       }
     }
@@ -9651,7 +9754,7 @@ function parseTermsFileContent(raw) {
 }
 async function readTermsFile(filePath) {
   try {
-    return parseTermsFileContent(await readFile21(filePath, "utf8"));
+    return parseTermsFileContent(await readFile22(filePath, "utf8"));
   } catch (error2) {
     console.warn(
       `\u26A0 arcane: could not read --terms-file "${filePath}": ${error2.message}`
@@ -9906,16 +10009,16 @@ import * as client from "openid-client";
 
 // src/modules/result-pages.ts
 import { createHash as createHash5 } from "crypto";
-import { readFile as readFile22 } from "fs/promises";
-import { join as join26 } from "path";
+import { readFile as readFile23 } from "fs/promises";
+import { join as join27 } from "path";
 var RESULT_KINDS = ["success", "denied", "failure"];
 function resultPagePath(kind) {
-  return join26("sign-in", `sign-in-callback-${kind}.html`);
+  return join27("sign-in", `sign-in-callback-${kind}.html`);
 }
 function styleHashes(html) {
   return [...html.matchAll(/<style\b[^>]*>([\s\S]*?)<\/style\s*>/gi)].map((match2) => {
-    const text2 = match2[1].replace(/\r\n?/g, "\n");
-    return `'sha256-${createHash5("sha256").update(text2, "utf8").digest("base64")}'`;
+    const text3 = match2[1].replace(/\r\n?/g, "\n");
+    return `'sha256-${createHash5("sha256").update(text3, "utf8").digest("base64")}'`;
   });
 }
 function resultPageHeaders(html) {
@@ -9958,7 +10061,7 @@ var PLAIN_RESULT_PAGES = {
 async function loadResultPages(assetsDir) {
   try {
     const [success, denied, failure] = await Promise.all(
-      RESULT_KINDS.map(async (kind) => resultPage(await readFile22(join26(assetsDir, resultPagePath(kind)), "utf8")))
+      RESULT_KINDS.map(async (kind) => resultPage(await readFile23(join27(assetsDir, resultPagePath(kind)), "utf8")))
     );
     return { success, denied, failure };
   } catch {
@@ -10196,9 +10299,9 @@ function toSessionRecord(result, environment) {
     expiresAt: result.expiresAt.toISOString()
   };
 }
-function describeAccount(record) {
-  const who = record.email ? `${record.email} (${record.sub})` : record.sub;
-  return record.environment === "development" ? `${who} [development]` : who;
+function describeAccount(record2) {
+  const who = record2.email ? `${record2.email} (${record2.sub})` : record2.sub;
+  return record2.environment === "development" ? `${who} [development]` : who;
 }
 async function runLogin(options, deps) {
   let environment;
@@ -10229,11 +10332,11 @@ async function runLogin(options, deps) {
     process.exit(1);
     return;
   }
-  let record;
+  let record2;
   const saveValidatedSession = (result) => {
     const next = toSessionRecord(result, environment);
     deps.storage.save(next, { insecure: Boolean(options.insecureStorage) });
-    record = next;
+    record2 = next;
   };
   try {
     if (options.deviceCode) {
@@ -10258,7 +10361,7 @@ async function runLogin(options, deps) {
           printWarning("No browser could be opened. Run `spell login --device-code` to sign in on another device.");
         }
       });
-      if (!record) throw new Error("The browser sign-in ended without storing a session.");
+      if (!record2) throw new Error("The browser sign-in ended without storing a session.");
     }
   } catch (error2) {
     if (error2 instanceof KeychainUnavailableError) {
@@ -10273,8 +10376,8 @@ async function runLogin(options, deps) {
     process.exit(1);
     return;
   }
-  if (!record) throw new Error("The sign-in completed without a stored session.");
-  printSuccess(`Signed in as ${describeAccount(record)}.`);
+  if (!record2) throw new Error("The sign-in completed without a stored session.");
+  printSuccess(`Signed in as ${describeAccount(record2)}.`);
   if (options.insecureStorage) printWarning(INSECURE_STORAGE_WARNING);
 }
 
@@ -10342,21 +10445,21 @@ async function runWhoami(options, deps = defaultWhoamiDeps()) {
     process.exit(1);
     return;
   }
-  const { record, source } = loaded;
-  printSuccess(`Signed in as ${describeAccount(record)}.`);
-  const expires = new Date(record.expiresAt);
+  const { record: record2, source } = loaded;
+  printSuccess(`Signed in as ${describeAccount(record2)}.`);
+  const expires = new Date(record2.expiresAt);
   const expired = expires.getTime() <= deps.now().getTime();
-  printInfo(`Signed in on ${new Date(record.obtainedAt).toLocaleString()}.`);
+  printInfo(`Signed in on ${new Date(record2.obtainedAt).toLocaleString()}.`);
   printInfo(
     expired ? `The last token expired on ${expires.toLocaleString()}; the session refreshes on next use.` : `The current token is valid until ${expires.toLocaleString()}.`
   );
   printInfo(`Stored in ${source === "keychain" ? "the OS keychain" : "the insecure session file"}.`);
   if (source === "file") printWarning(INSECURE_STORAGE_WARNING);
   if (!options.verify) return;
-  const environment = IDENTITY_ENVIRONMENTS[record.environment];
+  const environment = IDENTITY_ENVIRONMENTS[record2.environment];
   try {
     const config = await deps.loadConfiguration(environment);
-    const fresh = await deps.refreshSession(config, record.refreshToken, SIGN_IN_SCOPES);
+    const fresh = await deps.refreshSession(config, record2.refreshToken, SIGN_IN_SCOPES);
     deps.storage.save(toSessionRecord(fresh, environment), { insecure: source === "file" });
     printSuccess(`Verified with the identity service at ${environment.signInHost}; the session is active.`);
   } catch (error2) {
@@ -10369,15 +10472,15 @@ async function runWhoami(options, deps = defaultWhoamiDeps()) {
 
 // src/commands/report.ts
 import { access as access5 } from "fs/promises";
-import { join as join29 } from "path";
+import { join as join30 } from "path";
 
 // src/modules/show-report/generate.ts
-import { mkdir as mkdir8, readdir as readdir13, readFile as readFile24, writeFile as writeFile11 } from "fs/promises";
-import { basename as basename4, dirname as dirname13, isAbsolute, join as join28, relative as relative4, resolve as resolve9 } from "path";
+import { mkdir as mkdir8, readdir as readdir13, readFile as readFile25, writeFile as writeFile11 } from "fs/promises";
+import { basename as basename4, dirname as dirname13, isAbsolute, join as join29, relative as relative4, resolve as resolve9 } from "path";
 
 // src/modules/show-report/model.ts
-import { readFile as readFile23 } from "fs/promises";
-import { join as join27 } from "path";
+import { readFile as readFile24 } from "fs/promises";
+import { join as join28 } from "path";
 
 // src/modules/show-report/plan-parser.ts
 function parseFrontmatter(content) {
@@ -10512,8 +10615,8 @@ function computeCoverageOutcome(content) {
   const dispositioned = total - parkedCount;
   return `${total} of ${total} items dispositioned \u2014 ${dispositioned} routed to an epic, ${parkedCount} parked`;
 }
-function stripMarkdown(text2) {
-  return text2.replace(/\[([^\]]+)\]\([^)]+\)/g, "$1").replace(/\*\*/g, "").replace(/`/g, "").trim();
+function stripMarkdown(text3) {
+  return text3.replace(/\[([^\]]+)\]\([^)]+\)/g, "$1").replace(/\*\*/g, "").replace(/`/g, "").trim();
 }
 
 // src/modules/show-report/queue-parser.ts
@@ -10559,8 +10662,8 @@ function parseVerificationLedgerSection(content, programNameWords) {
   }
   return rows;
 }
-function stripMarkdown2(text2) {
-  return text2.replace(/\[([^\]]+)\]\([^)]+\)/g, "$1").replace(/\*\*/g, "").replace(/`/g, "").trim();
+function stripMarkdown2(text3) {
+  return text3.replace(/\[([^\]]+)\]\([^)]+\)/g, "$1").replace(/\*\*/g, "").replace(/`/g, "").trim();
 }
 
 // src/modules/show-report/sources.ts
@@ -10628,7 +10731,7 @@ async function getCast(cwd, fromRef, toRef, generatedOutputs = []) {
 // src/modules/show-report/model.ts
 async function readOptional(path5) {
   try {
-    return await readFile23(path5, "utf8");
+    return await readFile24(path5, "utf8");
   } catch {
     return null;
   }
@@ -10696,9 +10799,9 @@ function buildNeedsYou(queueEntries) {
     return entry;
   });
 }
-function truncateAtWord(text2, limit) {
-  if (text2.length <= limit) return text2;
-  const window = text2.slice(0, limit - 1);
+function truncateAtWord(text3, limit) {
+  if (text3.length <= limit) return text3;
+  const window = text3.slice(0, limit - 1);
   const lastSpace = window.lastIndexOf(" ");
   const head = lastSpace > 0 ? window.slice(0, lastSpace) : window;
   return `${head.replace(/[\s,;:.—-]+$/, "")}\u2026`;
@@ -10724,13 +10827,13 @@ function buildCorrections(ledgerRows, programName) {
   };
 }
 async function buildShowReportModel(options) {
-  const planAbsPath = join27(options.rootDir, options.planRelPath);
-  const queueAbsPath = join27(options.rootDir, options.queueRelPath);
+  const planAbsPath = join28(options.rootDir, options.planRelPath);
+  const queueAbsPath = join28(options.rootDir, options.queueRelPath);
   const ledgerRelPath = "docs/verification-ledger.md";
-  const ledgerAbsPath = join27(options.rootDir, ledgerRelPath);
-  const decisionsAbsPath = join27(options.rootDir, "DECISIONS.md");
+  const ledgerAbsPath = join28(options.rootDir, ledgerRelPath);
+  const decisionsAbsPath = join28(options.rootDir, "DECISIONS.md");
   const [planContent, queueContent, ledgerContent, decisionsContent] = await Promise.all([
-    readFile23(planAbsPath, "utf8"),
+    readFile24(planAbsPath, "utf8"),
     readOptional(queueAbsPath),
     readOptional(ledgerAbsPath),
     readOptional(decisionsAbsPath)
@@ -10824,11 +10927,11 @@ var CATEGORY_ORDER = [
   "docs",
   "platform"
 ];
-function escapeHtml(text2) {
-  return text2.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+function escapeHtml(text3) {
+  return text3.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
-function inlineMarkupToHtml(text2) {
-  const escaped = escapeHtml(text2);
+function inlineMarkupToHtml(text3) {
+  const escaped = escapeHtml(text3);
   const withLinks = escaped.replace(
     /\[([^\]]+)\]\((https?:\/\/[^)\s]+)\)/g,
     '<a href="$2">$1</a>'
@@ -10926,7 +11029,7 @@ function toPosix(path5) {
 async function programFromPlan(rootDir, slug, planRelPath) {
   let planContent;
   try {
-    planContent = await readFile24(join28(rootDir, planRelPath), "utf8");
+    planContent = await readFile25(join29(rootDir, planRelPath), "utf8");
   } catch {
     return { skipped: { slug, reason: `no PLAN.md at ${planRelPath}` } };
   }
@@ -10938,13 +11041,13 @@ async function programFromPlan(rootDir, slug, planRelPath) {
     program: {
       slug,
       planRelPath,
-      queueRelPath: toPosix(join28(dirname13(planRelPath), "OPERATOR-QUEUE.md")),
+      queueRelPath: toPosix(join29(dirname13(planRelPath), "OPERATOR-QUEUE.md")),
       ledgerProgramName: programNameFromTitle(frontmatter.title ?? slug)
     }
   };
 }
 async function discoverPrograms(rootDir) {
-  const plansDir = join28(rootDir, "docs", "plans");
+  const plansDir = join29(rootDir, "docs", "plans");
   let entries;
   try {
     entries = (await readdir13(plansDir, { withFileTypes: true })).filter((e) => e.isDirectory());
@@ -10971,14 +11074,14 @@ function normalizeLineEndings2(content) {
 }
 async function readOptionalFile(path5) {
   try {
-    return await readFile24(path5, "utf8");
+    return await readFile25(path5, "utf8");
   } catch (error2) {
     if (error2.code === "ENOENT") return null;
     throw error2;
   }
 }
 async function generateReport(rootDir, program2, templateHtml, theme = "auto") {
-  const planContent = await readFile24(join28(rootDir, program2.planRelPath), "utf8");
+  const planContent = await readFile25(join29(rootDir, program2.planRelPath), "utf8");
   const frontmatter = parseFrontmatter(planContent);
   const model = await buildShowReportModel({
     rootDir,
@@ -10998,7 +11101,7 @@ async function generateReport(rootDir, program2, templateHtml, theme = "auto") {
   };
 }
 async function runReportGeneration(options) {
-  const templateHtml = await readFile24(options.templatePath, "utf8");
+  const templateHtml = await readFile25(options.templatePath, "utf8");
   const theme = options.theme ?? "auto";
   const drifted = [];
   const repaired = [];
@@ -11016,12 +11119,12 @@ async function runReportGeneration(options) {
       [`${outRel}/show-report.html`, generated.html]
     ];
     for (const [relPath, expected] of outputs) {
-      const actual = await readOptionalFile(join28(options.rootDir, relPath));
+      const actual = await readOptionalFile(join29(options.rootDir, relPath));
       if (actual === null || normalizeLineEndings2(actual) !== normalizeLineEndings2(expected)) {
         drifted.push(`${relPath} does not match a regeneration from its sources.`);
         if (options.mode === "write") {
           await mkdir8(outAbs, { recursive: true });
-          await writeFile11(join28(options.rootDir, relPath), expected, "utf8");
+          await writeFile11(join29(options.rootDir, relPath), expected, "utf8");
           repaired.push(relPath);
         }
       }
@@ -11032,7 +11135,7 @@ async function runReportGeneration(options) {
 
 // src/commands/report.ts
 async function runReport(targetDir, options = {}, assetsDir) {
-  const templatePath = join29(assetsDir, "report", "show-report.template.html");
+  const templatePath = join30(assetsDir, "report", "show-report.template.html");
   try {
     await access5(templatePath);
   } catch {
@@ -11156,12 +11259,12 @@ function mintRef(type, generate = uuidv7) {
 function mintSessionRef() {
   return mintRef("session");
 }
-function parseRef(text2, expected) {
-  if (typeof text2 !== "string") return { ok: false, reason: "a reference must be a string" };
-  if (text2.length === 0) return { ok: false, reason: "a reference must not be empty" };
-  if (text2 !== text2.trim()) return { ok: false, reason: "a reference must not carry surrounding whitespace" };
-  if (text2 !== text2.toLowerCase()) return { ok: false, reason: "a reference must be lowercase" };
-  const parts = text2.split(":");
+function parseRef(text3, expected) {
+  if (typeof text3 !== "string") return { ok: false, reason: "a reference must be a string" };
+  if (text3.length === 0) return { ok: false, reason: "a reference must not be empty" };
+  if (text3 !== text3.trim()) return { ok: false, reason: "a reference must not carry surrounding whitespace" };
+  if (text3 !== text3.toLowerCase()) return { ok: false, reason: "a reference must be lowercase" };
+  const parts = text3.split(":");
   if (parts.length !== 3 || parts[0] !== "arcane") {
     return { ok: false, reason: 'a reference must have the form "arcane:<type>:<uuid>"' };
   }
@@ -11398,7 +11501,7 @@ var RpcError = class extends Error {
 function isObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function text(value, isError = false) {
+function text2(value, isError = false) {
   return { content: [{ type: "text", text: value }], isError };
 }
 function stringArg(args, key) {
@@ -11420,10 +11523,10 @@ function serveMcp(options) {
   const fail = (id, error2) => write({ jsonrpc: "2.0", id, error: error2 });
   const report = async (args) => {
     const status = stringArg(args, "status");
-    if (status === void 0) return text("status is required: one of working, waiting, blocked, idle.", true);
+    if (status === void 0) return text2("status is required: one of working, waiting, blocked, idle.", true);
     const needs = args["required_actions"];
     if (needs !== void 0 && (!Array.isArray(needs) || needs.some((n) => typeof n !== "string"))) {
-      return text("required_actions must be a list of strings.", true);
+      return text2("required_actions must be a list of strings.", true);
     }
     const flags = { status };
     for (const key of ["task", "spell", "message", "agent", "harness"]) {
@@ -11431,21 +11534,21 @@ function serveMcp(options) {
       if (v !== void 0) flags[key] = v;
     }
     if (Array.isArray(needs)) flags.requiredActions = needs;
-    if (resolveEndpoint(deps) === null) return text(NOT_CONFIGURED_TEXT);
+    if (resolveEndpoint(deps) === null) return text2(NOT_CONFIGURED_TEXT);
     const where = stringArg(args, "cwd") ?? cwd;
     const outcome = await sendReport(where, flags, deps);
-    if (outcome.kind === "refused") return text(outcome.line, true);
-    if (outcome.kind === "silent") return text(`Nothing was reported: ${where} is not inside an Arcane repository, or the service did not answer.`);
-    const record = outcome.record;
-    return { ...text(`Reported ${record.status} for ${record.session}.`), structuredContent: record };
+    if (outcome.kind === "refused") return text2(outcome.line, true);
+    if (outcome.kind === "silent") return text2(`Nothing was reported: ${where} is not inside an Arcane repository, or the service did not answer.`);
+    const record2 = outcome.record;
+    return { ...text2(`Reported ${record2.status} for ${record2.session}.`), structuredContent: record2 };
   };
   const end = async (args) => {
-    if (resolveEndpoint(deps) === null) return text(NOT_CONFIGURED_TEXT);
+    if (resolveEndpoint(deps) === null) return text2(NOT_CONFIGURED_TEXT);
     const where = stringArg(args, "cwd") ?? cwd;
     const outcome = await sendEnd(where, deps);
-    if (outcome.kind === "refused") return text(outcome.line, true);
-    if (outcome.kind === "silent") return text(`No session was open for ${where}.`);
-    return { ...text(`Ended ${outcome.record.session}.`), structuredContent: outcome.record };
+    if (outcome.kind === "refused") return text2(outcome.line, true);
+    if (outcome.kind === "silent") return text2(`No session was open for ${where}.`);
+    return { ...text2(`Ended ${outcome.record.session}.`), structuredContent: outcome.record };
   };
   const findResource = (uri) => {
     const resource = PRESENCE_RESOURCES.find((r) => r.uri === uri);
@@ -11591,7 +11694,7 @@ function serveMcp(options) {
           if (name === "presence_report") return await report(args);
           if (name === "presence_end") return await end(args);
         } catch (error2) {
-          if (error2 instanceof RpcError && error2.code === -32602) return text(error2.message, true);
+          if (error2 instanceof RpcError && error2.code === -32602) return text2(error2.message, true);
           throw error2;
         }
         throw new RpcError(-32602, `Unknown tool: ${String(name)}`);
@@ -11742,14 +11845,14 @@ function closed(value, field, required, optional = []) {
   if (!isObject2(value)) throw new Refusal("invalid_field", field, `${field ?? "the body"} must be an object`);
   const allowed = /* @__PURE__ */ new Set([...required, ...optional]);
   for (const key of Object.keys(value)) {
-    if (!allowed.has(key)) throw new Refusal("unknown_field", join30(field, key), `${join30(field, key)} is not a field of this contract`);
+    if (!allowed.has(key)) throw new Refusal("unknown_field", join31(field, key), `${join31(field, key)} is not a field of this contract`);
   }
   for (const key of required) {
-    if (!(key in value)) throw new Refusal("missing_field", join30(field, key), `${join30(field, key)} is required`);
+    if (!(key in value)) throw new Refusal("missing_field", join31(field, key), `${join31(field, key)} is required`);
   }
   return value;
 }
-function join30(parent, key) {
+function join31(parent, key) {
   return parent === void 0 ? key : `${parent}.${key}`;
 }
 function nonEmpty(value, field) {
@@ -11885,10 +11988,10 @@ var JSON_HEADERS = {
   "X-Content-Type-Options": "nosniff"
 };
 function send2(res, status, body, extra = {}) {
-  const text2 = `${JSON.stringify(body)}
+  const text3 = `${JSON.stringify(body)}
 `;
-  res.writeHead(status, { ...JSON_HEADERS, "Content-Length": Buffer.byteLength(text2), ...extra });
-  res.end(text2);
+  res.writeHead(status, { ...JSON_HEADERS, "Content-Length": Buffer.byteLength(text3), ...extra });
+  res.end(text3);
 }
 function error(res, status, code, message, field, extra = {}) {
   const body = { error: field === void 0 ? { code, message } : { code, field, message } };
@@ -11935,9 +12038,9 @@ function readBody(req, res) {
     });
   });
 }
-function parseJson(text2) {
+function parseJson(text3) {
   try {
-    return { ok: true, value: JSON.parse(text2) };
+    return { ok: true, value: JSON.parse(text3) };
   } catch {
     return { ok: false };
   }
@@ -12051,13 +12154,13 @@ data: ${JSON.stringify(hello)}
     if (path5 === "/v0/events") return events(req, res);
     if (path5 === "/v0/sessions/{session}") {
       const parsed = parseRef(found.param, "session");
-      const record = parsed.ok ? table.get(found.param ?? "") : null;
-      if (record === null) return error(res, 404, "not_found", "no such session");
-      return send2(res, 200, record);
+      const record2 = parsed.ok ? table.get(found.param ?? "") : null;
+      if (record2 === null) return error(res, 404, "not_found", "no such session");
+      return send2(res, 200, record2);
     }
-    const text2 = await readBody(req, res);
-    if (text2 === null) return;
-    const json = parseJson(text2);
+    const text3 = await readBody(req, res);
+    if (text3 === null) return;
+    const json = parseJson(text3);
     if (!json.ok) return error(res, 400, "invalid_json", "the body is not valid JSON");
     if (path5 === "/v0/sessions/report") {
       const result2 = validateReport(json.value);
@@ -12066,8 +12169,8 @@ data: ${JSON.stringify(hello)}
       if (isNew && table.count() >= MAX_SESSIONS) {
         return error(res, 503, "too_many_sessions", `at most ${MAX_SESSIONS} sessions are held at once`, void 0, { "Retry-After": "60" });
       }
-      const { record, created } = table.report(result2.value);
-      return send2(res, created ? 201 : 200, record);
+      const { record: record2, created } = table.report(result2.value);
+      return send2(res, created ? 201 : 200, record2);
     }
     const result = validateEnd(json.value);
     if (!result.ok) return error(res, 400, result.code, result.message, result.field);
@@ -12097,8 +12200,8 @@ data: ${JSON.stringify(hello)}
 }
 
 // src/modules/presence/sessions.ts
-function copy(record) {
-  return structuredClone(record);
+function copy(record2) {
+  return structuredClone(record2);
 }
 function sameRequiredActions(a, b) {
   if (a.length !== b.length) return false;
@@ -12115,9 +12218,9 @@ function createSessionTable(options) {
   const expireAfterMs = options.expireAfterMs ?? EXPIRE_AFTER_MS;
   const entries = /* @__PURE__ */ new Map();
   const listeners = /* @__PURE__ */ new Set();
-  const emit = (name, record) => {
-    const event = { event: name, data: copy(record) };
-    for (const listener of listeners) listener({ event: name, data: copy(record) });
+  const emit = (name, record2) => {
+    const event = { event: name, data: copy(record2) };
+    for (const listener of listeners) listener({ event: name, data: copy(record2) });
     return event;
   };
   return {
@@ -12128,7 +12231,7 @@ function createSessionTable(options) {
       const requiredActions2 = (body.required_actions ?? []).map((n) => ({ action: n.action, reason: n.reason }));
       const existing = entries.get(key);
       if (existing === void 0) {
-        const record2 = {
+        const record3 = {
           session: options.mint(),
           agent: structuredClone(body.agent),
           harness: body.harness,
@@ -12144,41 +12247,41 @@ function createSessionTable(options) {
           ended_at: null,
           stale: false
         };
-        entries.set(key, { record: record2, reportedMs: ms });
-        emit("session.started", record2);
-        return { record: copy(record2), created: true, event: "session.started" };
+        entries.set(key, { record: record3, reportedMs: ms });
+        emit("session.started", record3);
+        return { record: copy(record3), created: true, event: "session.started" };
       }
-      const record = existing.record;
-      const wasStale = record.stale;
-      const needsChanged = !sameRequiredActions(record.required_actions, requiredActions2);
-      record.agent = structuredClone(body.agent);
-      record.harness = body.harness;
-      record.repository = structuredClone(body.repository);
-      record.checkout = structuredClone(body.checkout);
-      if (body.spell !== void 0) record.spell = body.spell;
-      if (body.task !== void 0) record.task = body.task;
-      if (body.message !== void 0) record.message = body.message;
-      record.status = body.status;
-      record.required_actions = requiredActions2;
-      record.reported_at = at;
-      record.stale = false;
+      const record2 = existing.record;
+      const wasStale = record2.stale;
+      const needsChanged = !sameRequiredActions(record2.required_actions, requiredActions2);
+      record2.agent = structuredClone(body.agent);
+      record2.harness = body.harness;
+      record2.repository = structuredClone(body.repository);
+      record2.checkout = structuredClone(body.checkout);
+      if (body.spell !== void 0) record2.spell = body.spell;
+      if (body.task !== void 0) record2.task = body.task;
+      if (body.message !== void 0) record2.message = body.message;
+      record2.status = body.status;
+      record2.required_actions = requiredActions2;
+      record2.reported_at = at;
+      record2.stale = false;
       existing.reportedMs = ms;
       const event = wasStale ? "session.resumed" : needsChanged ? "session.action_required" : "session.updated";
-      emit(event, record);
-      return { record: copy(record), created: false, event };
+      emit(event, record2);
+      return { record: copy(record2), created: false, event };
     },
     end(checkoutPath) {
       const existing = entries.get(checkoutPath);
       if (existing === void 0) return null;
       entries.delete(checkoutPath);
-      const record = existing.record;
-      record.status = "done";
-      record.ended_at = new Date(now()).toISOString();
-      emit("session.ended", record);
-      return copy(record);
+      const record2 = existing.record;
+      record2.status = "done";
+      record2.ended_at = new Date(now()).toISOString();
+      emit("session.ended", record2);
+      return copy(record2);
     },
     get(session) {
-      for (const { record } of entries.values()) if (record.session === session) return copy(record);
+      for (const { record: record2 } of entries.values()) if (record2.session === session) return copy(record2);
       return null;
     },
     snapshot() {
@@ -12474,7 +12577,7 @@ async function runPresenceMcp() {
 
 // src/index.ts
 import { realpathSync as realpathSync2 } from "fs";
-var ASSETS_DIR = process.env["ARCANE_ASSETS_DIR"] ?? join31(dirname15(fileURLToPath(import.meta.url)), "assets");
+var ASSETS_DIR = process.env["ARCANE_ASSETS_DIR"] ?? join32(dirname15(fileURLToPath(import.meta.url)), "assets");
 var program = new Command();
 var USER_FLAG_DESCRIPTION = "Operate on the per-user tier at ~/.arcane \u2014 spells shared by every repository on this machine, fanned out to ~/.agents/skills (Codex, Copilot) and ~/.claude/commands (Claude Code)";
 var USER_TIER_AGENTS_DESCRIPTION = "Operate on the per-user tier at ~/.arcane \u2014 one agent roster shared by every repository on this machine, rendered to ~/.copilot/agents (VS Code agent modes)";
@@ -12693,6 +12796,7 @@ agentsCommand.command("list").description("Show the current agent roster with as
   const scope = opts.user ? "user" : "repo";
   await runAgentsList(agentsTargetDir(scope, process.cwd()), scope);
 });
+program.command("grant").description("Read-only run-grant record checks; operator consent and execution/platform gates remain").command("check").requiredOption("--id <id>", "Run grant ID").requiredOption("--repository <repository>", "Exact repository identity recorded in scope").requiredOption("--task <task>", "Exact approved task ID").requiredOption("--branch <branch>", "Current source branch").requiredOption("--action <action>", "Action to check (for example commit or complete-pr)").action(runGrantCheck);
 var presenceCommand = program.command("presence").description("The local presence channel: which session works on what, right now (ARC-060). Loopback only; nothing runs until `serve`");
 presenceCommand.command("serve").description("Run the presence service in the foreground on 127.0.0.1 until Ctrl+C or `spell presence stop`").option("--port <port>", "Port on 127.0.0.1 (default 27226, or ARCANE_PRESENCE_PORT); 0 picks a free one").option("--rotate", "Replace the token in ~/.arcane/presence/token; every subscriber must re-read it").action(async (opts) => {
   await runPresenceServe(opts);