arkaos 4.14.3 → 4.14.4

package/VERSION

@@ -1 +1 @@
-4.14.3
+4.14.4

package/config/agent-roster.json

@@ -3,33 +3,49 @@
     "generator": "core/agents/roster_manifest.py",
     "purpose": "every specialist-gate owner resolves to a dispatchable agent source; installer/skill-deploy.js deploys these"
   },
+  "aliases": {
+    "andre": "backend-dev",
+    "bruno": "security-eng",
+    "carlos": "devops-eng",
+    "diana": "frontend-dev",
+    "gabriel": "architect",
+    "vasco": "dba"
+  },
+  "ambiguous_first_names": [],
   "gate_owners": {
     "architect": {
       "compiled": false,
+      "human_name": "Gabriel",
       "source": "departments/dev/agents/architect.md"
     },
     "backend-dev": {
       "compiled": true,
+      "human_name": "Andre",
       "source": "config/claude-agents/backend-dev.md"
     },
     "dba": {
       "compiled": true,
+      "human_name": "Vasco",
       "source": "config/claude-agents/dba.md"
     },
     "devops-eng": {
       "compiled": true,
+      "human_name": "Carlos",
       "source": "config/claude-agents/devops-eng.md"
     },
     "frontend-dev": {
       "compiled": false,
+      "human_name": "Diana",
       "source": "departments/dev/agents/frontend-dev.md"
     },
     "security-eng": {
       "compiled": true,
+      "human_name": "Bruno",
       "source": "config/claude-agents/security-eng.md"
     },
     "senior-dev": {
       "compiled": false,
+      "human_name": "",
       "source": "departments/dev/agents/senior-dev.md"
     }
   }

package/core/agents/authority_brief.py

@@ -0,0 +1,205 @@
+"""Authority brief — the write rules a session must know BEFORE it writes.
+
+The 2026-07-12 incident: a session was blocked writing a Laravel
+controller and, never having been told the rule existed, invented a
+"documented bug" to justify a bypass. Grep confirms the gap: ownership
+and ``specialist-bypass`` appear NOWHERE in CLAUDE.md, arka/SKILL.md,
+flow/SKILL.md or constitution.yaml. The deny message was the first and
+only place a session ever learned any of it.
+
+This module renders the ``[ARKA:AUTHORITY]`` block the SessionStart hook
+injects. Everything is GENERATED from ``config/agent-ownership.yaml`` +
+``config/agent-roster.json`` + the agents actually deployed on THIS
+machine — never hand-typed.
+
+Two rules this file learned the hard way (QG, redo 1):
+
+1. **Relevance is decided by the FULL literal spine, never its first
+   segment.** The first cut matched ``**/app/Http/Controllers/**`` in
+   this repo because a directory called ``dashboard/app`` exists — so it
+   taught a session five Laravel rules that govern nothing here.
+2. **Never truncate in silence.** The same cut capped the list at 8 and
+   dropped ``core/workflow/**/*.py`` and ``core/agents/**/*.py`` — the
+   rules that own the very files that PR was editing — under a heading
+   that claims "Owned paths in THIS project". A brief that hides the
+   rules that apply is the incident, re-delivered as its own fix.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+from pathlib import Path
+
+import yaml
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+OWNERSHIP_YAML = REPO_ROOT / "config" / "agent-ownership.yaml"
+ROSTER_JSON = REPO_ROOT / "config" / "agent-roster.json"
+
+# Enough to state every rule that really applies to a project this size
+# (arka-os itself renders 14). Anything beyond is COUNTED, never dropped.
+_MAX_RULES = 16
+_MAX_FIELD = 120
+# `{` is a glob char too: the enforcer expands `{core,dashboard}` braces,
+# so treating that segment as a literal spine would make the brief DROP a
+# rule the gate enforces — the "brief hides an applicable rule" incident.
+_GLOB_CHARS = ("*", "?", "[", "{")
+# The brief lands in a system prompt. A pattern is operator-editable YAML
+# (agent-ownership.yaml is `lead_allowed`), so a newline in it could forge
+# an authority line — OWASP LLM01. Control bytes never reach the prompt.
+_CONTROL_RE = re.compile(r"[\x00-\x1f\x7f]")
+
+
+def _load(path: Path) -> dict:
+    try:
+        text = path.read_text(encoding="utf-8")
+    except OSError:
+        return {}
+    try:
+        data = (
+            json.loads(text) if path.suffix == ".json" else yaml.safe_load(text)
+        )
+    except (json.JSONDecodeError, yaml.YAMLError):
+        return {}
+    return data if isinstance(data, dict) else {}
+
+
+def _clean(value: str) -> str:
+    """Strip control bytes and bound the length — prompt-injection guard."""
+    return _CONTROL_RE.sub("", str(value))[:_MAX_FIELD]
+
+
+def deployed_agents(agents_dirs: list[Path] | None = None) -> set[str]:
+    """Slugs the Task tool can actually dispatch on this machine."""
+    dirs = agents_dirs or [
+        Path.home() / ".claude" / "agents",
+        Path.cwd() / ".claude" / "agents",
+    ]
+    found: set[str] = set()
+    for base in dirs:
+        try:
+            for md in base.glob("*.md"):
+                found.add(md.stem.removeprefix("arka-"))
+        except OSError:
+            continue
+    return found
+
+
+def _spine(pattern: str) -> list[str]:
+    """The literal path segments of a glob: `**/app/Http/Controllers/**`
+    -> ['app', 'Http', 'Controllers']; `**/*.vue` -> []."""
+    return [
+        part for part in pattern.split("/")
+        if part and not any(ch in part for ch in _GLOB_CHARS)
+    ]
+
+
+def rule_applies(pattern: str, root: Path) -> bool:
+    """Does this rule govern anything in `root`?
+
+    The FULL spine must exist — checking only its first segment is what
+    made `**/app/Http/Controllers/**` look relevant here (a `dashboard/app`
+    directory exists) while the rules that actually govern the repo were
+    pushed out of the list. Extension-only rules always apply: they cost
+    one line and are honest ("write a .vue and frontend-dev owns it").
+    """
+    spine = _spine(pattern)
+    if not spine:
+        return True
+    joined = Path(*spine)
+    try:
+        if (root / joined).exists():
+            return True
+        # One level down covers monorepo layouts (dashboard/app/…).
+        return any(
+            (child / joined).exists()
+            for child in root.iterdir()
+            if child.is_dir() and not child.name.startswith(".")
+        )
+    except OSError:
+        return False
+
+
+def applicable_rules(rules: list[dict], root: Path) -> list[dict]:
+    return [
+        rule for rule in rules
+        if isinstance(rule, dict)
+        and rule.get("pattern")
+        and rule.get("owners")
+        and "*" not in rule["owners"]
+        and rule_applies(str(rule["pattern"]), root)
+    ]
+
+
+def _dispatch_status(named: set[str], owners_meta: dict,
+                     dispatchable: set[str]) -> list[str]:
+    status: list[str] = []
+    for slug in sorted(named):
+        # agent-roster.json is operator-editable and this line lands in a
+        # system prompt — human_name walks through _clean like every other
+        # field (QG redo 2: it was the one field that did not).
+        tokens = _clean(owners_meta.get(slug, {}).get("human_name", "")).split()
+        label = f"{slug} ({tokens[0]})" if tokens else slug
+        status.append(
+            f"{label} ok" if slug in dispatchable else f"{label} MISSING"
+        )
+    return status
+
+
+def render(cwd: str | Path | None = None,
+           agents_dirs: list[Path] | None = None) -> str:
+    """The [ARKA:AUTHORITY] block, or "" when there is nothing to say."""
+    ownership = _load(OWNERSHIP_YAML)
+    roster = _load(ROSTER_JSON)
+    rules = ownership.get("ownership") or []
+    owners_meta = roster.get("gate_owners") or {}
+    if not isinstance(rules, list) or not owners_meta:
+        return ""
+
+    root = Path(cwd) if cwd else Path.cwd()
+    relevant = applicable_rules(rules, root)
+    if not relevant:
+        return ""
+    shown, overflow = relevant[:_MAX_RULES], len(relevant) - _MAX_RULES
+
+    lines = [
+        "[ARKA:AUTHORITY] Write permissions (enforced by a PreToolUse gate)",
+        "1. Your last [arka:routing] / [arka:dispatch] marker is an "
+        "AUTHORIZATION TOKEN a gate reads before every Write/Edit. It is "
+        "not narration.",
+        "2. Owned paths in THIS project (first match wins):",
+    ]
+    named: set[str] = set()
+    for rule in shown:
+        owners = [_clean(o) for o in rule["owners"]]
+        named.update(owners)
+        lines.append(
+            f"     {_clean(rule['pattern']):<26s} -> {', '.join(owners)}"
+        )
+    if overflow > 0:
+        lines.append(
+            f"     (+{overflow} more — see config/agent-ownership.yaml)"
+        )
+
+    status = _dispatch_status(named, owners_meta, deployed_agents(agents_dirs))
+    lines.append(
+        f"3. Dispatchable here (Task subagent_type): {', '.join(status)}"
+    )
+    if any(entry.endswith("MISSING") for entry in status):
+        lines.append("   MISSING -> run `npx arkaos update` (never bypass).")
+    lines.append(
+        "4. The dispatched specialist writes with NO block. Retrying a "
+        "blocked Write never works — dispatch instead."
+    )
+    return "\n".join(lines)
+
+
+def main() -> int:
+    brief = render()
+    print(brief or "(no ownership rules apply to this directory)")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/core/agents/roster_manifest.py

@@ -68,6 +68,55 @@ def _resolve_source(slug: str) -> Path | None:
     return None
 
 
+def _agent_yaml(slug: str) -> Path | None:
+    matches = sorted(DEPARTMENTS_DIR.glob(f"*/agents/**/{slug}.yaml"))
+    return matches[0] if matches else None
+
+
+def _human_name(slug: str) -> str:
+    source = _agent_yaml(slug)
+    if source is None:
+        return ""
+    try:
+        data = yaml.safe_load(source.read_text(encoding="utf-8"))
+    except yaml.YAMLError:
+        return ""
+    return str(data.get("name") or "") if isinstance(data, dict) else ""
+
+
+def _first_name(human: str) -> str:
+    """'Andre — Backend Core Lead' -> 'andre'."""
+    return human.split()[0].split("—")[0].strip().lower() if human else ""
+
+
+def build_aliases(entries: dict[str, dict]) -> dict[str, str]:
+    """First-name -> owner slug, resolved WITHIN the gate-owner set.
+
+    Sessions route by human name (``[arka:dispatch] paulo -> diana``) but
+    ownership rules name slugs (``frontend-dev``). Unresolved, that
+    mismatch blocked the RIGHT specialist from her own files: 22 of 189
+    measured blocks. (The 22 `senior-dev` blocks are a separate, still
+    open class: there the slug IS the persona, so no alias helps.)
+
+    Scoping to gate owners is what makes this safe. Globally, ``diana``
+    is ambiguous (frontend-dev AND hr-specialist) and so is ``andre``
+    (backend-dev AND growth-engineer) — a naive first-name alias would
+    trade one bug for a worse one. Among the owners the gate can
+    actually demand, both are unique. Anything still ambiguous here is
+    REFUSED, never guessed.
+    """
+    by_first: dict[str, set[str]] = {}
+    for slug in entries:
+        first = _first_name(_human_name(slug))
+        if first:
+            by_first.setdefault(first, set()).add(slug)
+    return {
+        first: next(iter(slugs))
+        for first, slugs in sorted(by_first.items())
+        if len(slugs) == 1
+    }
+
+
 def build_roster() -> dict:
     owners = gate_owners()
     entries: dict[str, dict] = {}
@@ -80,6 +129,7 @@ def build_roster() -> dict:
         entries[slug] = {
             "source": str(source.relative_to(REPO_ROOT)),
             "compiled": source.parent == COMPILED_DIR,
+            "human_name": _human_name(slug),
         }
     if ghosts:
         raise ValueError(
@@ -88,6 +138,14 @@ def build_roster() -> dict:
             f"config/agent-ownership.yaml; a gate must never demand an "
             f"owner nobody can invoke"
         )
+    aliases = build_aliases(entries)
+    ambiguous = sorted(
+        first
+        for first in {
+            _first_name(e["human_name"]) for e in entries.values()
+        }
+        if first and first not in aliases
+    )
     return {
         "_meta": {
             "generator": "core/agents/roster_manifest.py",
@@ -97,6 +155,8 @@ def build_roster() -> dict:
             ),
         },
         "gate_owners": entries,
+        "aliases": aliases,
+        "ambiguous_first_names": ambiguous,
     }
 
 

package/core/hooks/session_start.py

@@ -242,6 +242,30 @@ def _ensure_dashboard(repo: str, config: dict) -> None:
     )
 
 
+def _authority_brief(cwd: str) -> str:
+    """[ARKA:AUTHORITY] — who may write what, BEFORE the first Write.
+
+    The 2026-07-12 incident happened because this information existed
+    nowhere in the prompt surface: a session met the ownership rule for
+    the first time in a deny message, and rationalized a bypass instead
+    of dispatching. Generated per project, never hand-typed.
+    """
+    try:
+        from core.agents.authority_brief import render
+        brief = render(cwd)
+    except Exception as exc:
+        # But it must not fail SILENTLY either: a swallowed error here
+        # restores the exact pre-incident state (a session writing with no
+        # idea the rules exist). One honest line beats a silent void.
+        return (
+            f"\n\n[ARKA:AUTHORITY] unavailable ({type(exc).__name__}) — "
+            f"write rules could not be rendered; check "
+            f"config/agent-ownership.yaml. Dispatch the owning specialist "
+            f"rather than assuming you may write."
+        )
+    return f"\n\n{brief}" if brief else ""
+
+
 def build_message(cwd: str) -> str:
     repo = repo_path()
     config = _config()
@@ -254,6 +278,7 @@ def build_message(cwd: str) -> str:
     msg += _drift(version)
     msg += _EVIDENCE_CONTRACT
     msg += _META_TAG_CONTRACT
+    msg += _authority_brief(cwd)
     msg += _model_fabric()
     _trigger_reorganizer(repo, config)
     _ensure_dashboard(repo, config)

package/core/workflow/specialist_enforcer.py

@@ -24,11 +24,12 @@ Read by: config/hooks/pre-tool-use.sh between the KB-gate and the
 flow-gate. Same Decision JSON contract as core.workflow.flow_enforcer.
 """
 
+import contextlib
 import json
 import re
 from contextlib import contextmanager
 from dataclasses import asdict, dataclass, field
-from datetime import datetime, timezone
+from datetime import UTC, datetime
 from functools import lru_cache
 from pathlib import Path
 
@@ -55,10 +56,8 @@ def _locked_append(path: Path):
         yield fh
     finally:
         if _HAS_FLOCK:
-            try:
+            with contextlib.suppress(OSError):
                 fcntl.flock(fh.fileno(), fcntl.LOCK_UN)
-            except OSError:
-                pass
         fh.close()
 
 
@@ -73,6 +72,11 @@ OWNERSHIP_YAML_PATH = (
     / "config"
     / "agent-ownership.yaml"
 )
+ROSTER_PATH = (
+    Path(__file__).resolve().parent.parent.parent
+    / "config"
+    / "agent-roster.json"
+)
 
 GATED_TOOLS: frozenset[str] = frozenset(
     {"Write", "Edit", "MultiEdit", "NotebookEdit"}
@@ -85,8 +89,13 @@ ROUTING_RE = re.compile(
 DISPATCH_RE = re.compile(
     r"\[arka:dispatch\]\s*[\w-]+\s*->\s*([\w-]+)", re.IGNORECASE
 )
+# Single-line, length-bounded body: the lazy `([^\]]+?)\s*` form
+# backtracked catastrophically on an unclosed marker (4000 trailing
+# spaces = 22s) — inside a BLOCKING PreToolUse hook, on model-emitted
+# text. 400 chars is far above any substantive reason; beyond it the
+# marker simply does not parse and the gate stays closed.
 BYPASS_RE = re.compile(
-    r"\[arka:specialist-bypass\s+([^\]]+?)\s*\]", re.IGNORECASE
+    r"\[arka:specialist-bypass\s+([^\]\n]{1,400})\]", re.IGNORECASE
 )
 
 ASSISTANT_WINDOW = 20
@@ -107,22 +116,42 @@ class Decision:
     bypass_used: bool = False
     bypass_reason: str | None = None
     target_file: str | None = None
+    # Alias resolution (PR-1): the marker said "diana", the rules say
+    # "frontend-dev" — record both so telemetry can prove the fix.
+    persona_raw: str | None = None
+    alias_resolved: bool = False
 
     def to_stderr_message(self) -> str:
+        """The message a blocked session reads.
+
+        Rewritten after the 2026-07-12 incident, where a session read the
+        old text and went looking for a bug to justify a bypass. Three
+        changes carry the weight: it refuses the false diagnosis up front,
+        it hands over the correct path already filled in (two copyable
+        lines), and it demotes the bypass to what it is — an audited
+        exception the operator sees. The old text also called EVERY
+        persona "(lead)", so a blocked specialist was told she was a lead:
+        that actively fed the "the gate is buggy" story.
+        """
         if self.allow:
             return ""
-        persona = self.current_persona or "lead"
-        owners = ", ".join(self.required_owners) or "specialist"
+        persona = self.current_persona or "unrouted"
+        owner = (self.required_owners or ["the owning specialist"])[0]
+        owners = ", ".join(self.required_owners) or "the owning specialist"
         target = self.target_file or "this file"
         return (
-            f"[ARKA:SPECIALIST] {persona} (lead) is not authorised to write "
-            f"{target}. Required owners: {owners}. Choose one: (1) dispatch "
-            f"the specialist via the Agent tool AND emit "
-            f"`[arka:dispatch] {persona} -> <specialist>` immediately before "
-            f"the dispatch call (NON-NEGOTIABLE constitution rule "
-            f"`dispatch-must-be-announced`), OR (2) add "
-            f"`[arka:specialist-bypass <reason>]` to the same assistant "
-            f"message to override (logged for accountability)."
+            f"[ARKA:SPECIALIST] BLOCKED. {target} is owned by: {owners} "
+            f"— dispatch any ONE of them. You are {persona}.\n"
+            f"This is NOT a bug. The gate is working as designed. Retrying "
+            f"this Write will fail again, every time.\n"
+            f"DO THIS — two lines, and the specialist writes with no block:\n"
+            f"    [arka:dispatch] {persona} -> {owner}\n"
+            f"    Task(subagent_type=\"{owner}\", prompt=\"<what you were "
+            f"about to write>\")\n"
+            f"Audited exception (visible to the operator in "
+            f"`/arka enforcement`) — ONLY if no specialist can do this:\n"
+            f"    [arka:specialist-bypass owner={owner} reason=<24+ chars "
+            f"explaining why a specialist cannot>]"
         )
 
 
@@ -139,6 +168,8 @@ class _Ctx:
     messages: list[str] = field(default_factory=list)
     persona: str | None = None
     marker: str | None = None
+    persona_raw: str | None = None
+    alias_resolved: bool = False
     config: dict = field(default_factory=dict)
     preloaded_messages: list[str] | None = None
 
@@ -233,34 +264,110 @@ def _glob_match(pattern: str, path: str) -> bool:
 # ─── Persona, bypass, ownership resolution ─────────────────────────────
 
 
-def _resolve_persona(messages: list[str]) -> tuple[str | None, str | None]:
-    """Find the current persona, scanning newest-to-oldest assistant turns.
+def _load_aliases() -> dict[str, str]:
+    """First-name -> owner slug, from the generated roster.
+
+    Sessions dispatch by human name (``-> diana``); ownership rules name
+    slugs (``frontend-dev``). Without this, the RIGHT specialist was
+    blocked from her own files — 22 of 189 measured blocks. The roster
+    only emits aliases that are unambiguous among gate owners, and never
+    guesses (core/agents/roster_manifest.py::build_aliases).
+    """
+    try:
+        data = json.loads(ROSTER_PATH.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        return {}
+    aliases = data.get("aliases")
+    return aliases if isinstance(aliases, dict) else {}
+
+
+def _normalize_persona(raw: str) -> tuple[str, bool]:
+    """Return (slug, alias_resolved). Unknown names pass through."""
+    slug = _load_aliases().get(raw)
+    return (slug, True) if slug else (raw, False)
+
+
+def _resolve_persona(
+    messages: list[str],
+) -> tuple[str | None, str | None, str | None, bool]:
+    """Find the current persona: (slug, marker, raw, alias_resolved).
 
     Dispatch tag wins over routing because dispatching is more specific.
+    The name is normalized through the roster aliases, so a marker that
+    names the human (``-> diana``) matches an ownership rule that names
+    the slug (``frontend-dev``).
     """
     for text in reversed(messages):
         dispatch = DISPATCH_RE.search(text)
         if dispatch:
-            return dispatch.group(1).lower(), "dispatch"
+            raw = dispatch.group(1).lower()
+            slug, resolved = _normalize_persona(raw)
+            return slug, "dispatch", raw, resolved
         routing = ROUTING_RE.search(text)
         if routing:
-            return routing.group(1).lower(), "routing"
-    return None, None
+            raw = routing.group(1).lower()
+            slug, resolved = _normalize_persona(raw)
+            return slug, "routing", raw, resolved
+    return None, None, None, False
+
+
+# A bypass must cost more than doing the right thing. Before the
+# 2026-07-12 incident the only barrier was a non-empty string, and the
+# deny message advertised the bypass beside the dispatch as an equal
+# option — the single place in the whole prompt surface that taught it.
+_MIN_BYPASS_REASON = 24
+_EMPTY_REASONS = (
+    "typo", "quick fix", "quickfix", "trivial", "urgent", "just this once",
+    "small change", "minor", "one char", "fast", "quick typo fix",
+    "just a quick typo fix", "just a quick typo fix honestly",
+    "nothing important", "it is faster this way",
+)
+# Structured form the deny message teaches: `owner=<slug> reason=<text>`.
+_BYPASS_STRUCTURED_RE = re.compile(
+    r"^owner=(?P<owner>[\w-]+)\s+reason=(?P<reason>.*)$",
+    re.IGNORECASE | re.DOTALL,
+)
 
 
-def _find_bypass(messages: list[str]) -> str | None:
-    """Return bypass reason from LAST assistant message, or None.
+def _reason_is_substantive(reason: str) -> bool:
+    """A reason must say something. QG redo 1 caught the hole: the floor
+    was applied to the WHOLE marker body, so
+    ``owner=senior-dev reason=`` (24 chars of boilerplate, empty reason)
+    opened the gate — with the deny message teaching that very template.
+    The floor now applies to the reason ALONE."""
+    reason = reason.strip()
+    if len(reason) < _MIN_BYPASS_REASON:
+        return False
+    normalized = reason.lower().strip(" .!,;")
+    return normalized not in _EMPTY_REASONS
+
+
+def _find_bypass(messages: list[str], owners: list[str] | None = None) -> str | None:
+    """Return the bypass reason from the LAST assistant message, or None.
 
     Scope is strict: only the immediately preceding assistant message can
-    grant a bypass. Empty / whitespace reasons are rejected.
+    grant a bypass. The structured form is required in spirit — a bare
+    legacy reason is still accepted for one release, but it must clear the
+    same substance floor. When ``owners`` is given, a structured
+    ``owner=`` that names someone other than an actual owner is rejected:
+    a bypass may not invent its own justification target.
     """
     if not messages:
         return None
     match = BYPASS_RE.search(messages[-1])
     if not match:
         return None
-    reason = match.group(1).strip()
-    return reason if reason else None
+    body = match.group(1).strip()
+    structured = _BYPASS_STRUCTURED_RE.match(body)
+    if structured:
+        if owners:
+            claimed = structured.group("owner").lower()
+            if claimed not in {o.lower() for o in owners}:
+                return None
+        reason = structured.group("reason")
+    else:
+        reason = body
+    return reason.strip() if _reason_is_substantive(reason) else None
 
 
 def _match_ownership(
@@ -312,7 +419,9 @@ def _populate_context(ctx: _Ctx) -> None:
         ctx.messages = _load_last_assistant_messages(
             ctx.transcript_path, ASSISTANT_WINDOW
         )
-    ctx.persona, ctx.marker = _resolve_persona(ctx.messages)
+    ctx.persona, ctx.marker, ctx.persona_raw, ctx.alias_resolved = (
+        _resolve_persona(ctx.messages)
+    )
 
 
 def _check_no_persona(ctx: _Ctx) -> Decision | None:
@@ -360,7 +469,8 @@ def _decide_owner_match(ctx: _Ctx, owners: list[str]) -> Decision:
     return Decision(
         allow=True, reason=f"owner-match:{ctx.persona}",
         current_persona=ctx.persona, marker_found=ctx.marker,
-        target_file=ctx.file_path, required_owners=owners,
+        target_file=ctx.file_path,
+        persona_raw=ctx.persona_raw, alias_resolved=ctx.alias_resolved, required_owners=owners,
     )
 
 
@@ -368,7 +478,8 @@ def _decide_bypass(ctx: _Ctx, owners: list[str], reason: str) -> Decision:
     return Decision(
         allow=True, reason="bypass-with-reason",
         current_persona=ctx.persona, marker_found=ctx.marker,
-        target_file=ctx.file_path, required_owners=owners,
+        target_file=ctx.file_path,
+        persona_raw=ctx.persona_raw, alias_resolved=ctx.alias_resolved, required_owners=owners,
         bypass_used=True, bypass_reason=reason,
     )
 
@@ -379,7 +490,8 @@ def _decide_block(ctx: _Ctx, owners: list[str]) -> Decision:
         allow=False,
         reason=f"lead-blocked:{ctx.persona}-not-in-[{','.join(owners_lower)}]",
         current_persona=ctx.persona, marker_found=ctx.marker,
-        target_file=ctx.file_path, required_owners=owners,
+        target_file=ctx.file_path,
+        persona_raw=ctx.persona_raw, alias_resolved=ctx.alias_resolved, required_owners=owners,
     )
 
 
@@ -389,7 +501,7 @@ def _resolve_with_owners(ctx: _Ctx, owners: list[str], rule_reason: str | None)
         return _decide_open_access(ctx, owners, rule_reason)
     if ctx.persona in {o.lower() for o in owners}:
         return _decide_owner_match(ctx, owners)
-    bypass = _find_bypass(ctx.messages)
+    bypass = _find_bypass(ctx.messages, owners)
     if bypass:
         return _decide_bypass(ctx, owners, bypass)
     return _decide_block(ctx, owners)
@@ -464,7 +576,7 @@ def record_telemetry(
     if safe is None:
         return
     entry = {
-        "ts": datetime.now(timezone.utc).isoformat(),
+        "ts": datetime.now(UTC).isoformat(),
         "session_id": safe,
         "tool": tool,
         "cwd": cwd,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arkaos",
-  "version": "4.14.3",
+  "version": "4.14.4",
   "description": "The Operating System for AI Agent Teams",
   "type": "module",
   "bin": {

package/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "arkaos-core"
-version = "4.14.3"
+version = "4.14.4"
 description = "Core engine for ArkaOS — The Operating System for AI Agent Teams"
 readme = "README.md"
 license = {text = "MIT"}