atris 3.42.0 → 3.44.0

package/commands/worktree.js

@@ -12,8 +12,8 @@ const COMMAND_MAX_BUFFER_BYTES = 64 * 1024 * 1024;
 const GIT_OID_PATTERN = /^[0-9a-f]{40,64}$/;
 const ONE_LAP_PROOF_REF_PATTERN = /^refs\/atris\/one-lap\/([0-9a-f]{40,64})$/;
 
-function runGit(args, { cwd = process.cwd(), check = true } = {}) {
-  const result = spawnSync('git', args, { cwd, encoding: 'utf8' });
+function runGit(args, { cwd = process.cwd(), check = true, timeout } = {}) {
+  const result = spawnSync('git', args, { cwd, encoding: 'utf8', timeout });
   if (check && result.status !== 0) {
     const msg = (result.stderr || result.stdout || `git ${args.join(' ')} failed`).trim();
     throw new Error(msg);
@@ -157,6 +157,95 @@ function listWorktrees(root = repoRoot()) {
   return parseWorktrees(runGit(['worktree', 'list', '--porcelain'], { cwd: root }).stdout);
 }
 
+// Duplicate flight guard. On 2026-08-07 two agents were dispatched onto the
+// same map rewrite 44 seconds apart: fleet dispatch claims a task first, but a
+// direct `worktree start` had no pre-check beyond the target path existing.
+const AGENT_FLIGHT_NAME_PATTERN = /^codex\/(.+)-(\d{8}-\d{6})$/;
+const FLIGHT_WINDOW_MS = 24 * 60 * 60 * 1000;
+const FLIGHT_STOPWORDS = new Set([
+  'fix', 'add', 'update', 'make', 'change', 'new', 'task', 'work', 'repo',
+  'cli', 'atris', 'backend', 'the', 'a', 'an', 'and', 'for', 'to', 'of', 'in', 'on',
+]);
+
+function flightStampMs(stampText) {
+  const m = /^(\d{4})(\d{2})(\d{2})-(\d{2})(\d{2})(\d{2})$/.exec(String(stampText || ''));
+  if (!m) return null;
+  const [, year, month, day, hour, minute, second] = m.map(Number);
+  if (month < 1 || month > 12 || day < 1 || day > 31 || hour > 23 || minute > 59 || second > 59) return null;
+  return Date.UTC(year, month - 1, day, hour, minute, second);
+}
+
+function taskTokens(value) {
+  return String(value || '')
+    .toLowerCase()
+    .split(/[^a-z0-9]+/)
+    .filter(Boolean)
+    .filter((token) => !FLIGHT_STOPWORDS.has(token));
+}
+
+// codex/<owner>-<task-slug>-<YYYYMMDD-HHMMSS>: drop the owner segment and the
+// stamp, and what is left is the task the flight is working on.
+function parseAgentFlightName(name) {
+  const text = String(name || '').trim().replace(/^refs\/heads\//, '');
+  const match = AGENT_FLIGHT_NAME_PATTERN.exec(text);
+  if (!match) return null;
+  const stampMs = flightStampMs(match[2]);
+  if (stampMs === null) return null;
+  const segments = match[1].split('-').filter(Boolean);
+  if (segments.length < 2) return null;
+  return {
+    name: text,
+    owner: segments[0],
+    taskSlug: segments.slice(1).join('-'),
+    stamp: match[2],
+    stampMs,
+    tokens: taskTokens(segments.slice(1).join('-')),
+  };
+}
+
+function remoteAgentBranchNames(root) {
+  // One ls-remote, best effort: offline dispatchers still get the local view.
+  const result = runGit(['ls-remote', '--heads', 'origin'], { cwd: root, check: false, timeout: 10000 });
+  if (result.status !== 0) return [];
+  return String(result.stdout || '')
+    .split(/\r?\n/)
+    .map((line) => (line.split(/\s+/)[1] || '').replace(/^refs\/heads\//, '').trim())
+    .filter(Boolean);
+}
+
+function inFlightAgentFlights({ root = repoRoot(), now = new Date(), windowMs = FLIGHT_WINDOW_MS } = {}) {
+  const nowMs = now.getTime();
+  const flights = new Map();
+  const add = (name, kind) => {
+    const flight = parseAgentFlightName(name);
+    if (!flight) return;
+    // Branch age comes from the stamp in the name, never a git log per branch.
+    if (kind !== 'worktree' && nowMs - flight.stampMs > windowMs) return;
+    const existing = flights.get(flight.name);
+    if (existing && existing.kind === 'worktree') return;
+    flights.set(flight.name, { ...flight, kind });
+  };
+  for (const wt of listWorktrees(root)) add(wt.branch, 'worktree');
+  const local = runGit(['branch', '--format=%(refname:short)'], { cwd: root, check: false });
+  if (local.status === 0) {
+    for (const name of String(local.stdout || '').split(/\r?\n/)) add(name, 'branch');
+  }
+  for (const name of remoteAgentBranchNames(root)) add(name, 'branch');
+  return [...flights.values()].sort((a, b) => b.stampMs - a.stampMs);
+}
+
+function collidingFlights(flights, tokens) {
+  const wanted = new Set(tokens);
+  if (!wanted.size) return [];
+  return flights.filter((flight) => flight.tokens.some((token) => wanted.has(token)));
+}
+
+function describeFlightAge(flight, nowMs = Date.now()) {
+  const minutes = Math.max(0, Math.round((nowMs - flight.stampMs) / 60000));
+  if (minutes < 60) return `${minutes}m old`;
+  return `${Math.floor(minutes / 60)}h${minutes % 60}m old`;
+}
+
 function refExists(root, ref) {
   return runGit(['rev-parse', '--verify', `${ref}^{commit}`], { cwd: root, check: false }).status === 0;
 }
@@ -408,13 +497,33 @@ function startWorktree(args) {
   const owner = member || agent;
   const task = readFlag(args, '--task');
   if (!owner || !task) {
-    console.error('Usage: atris worktree start --member <member>|--agent <name> --task "<short task>" [--claim]');
+    console.error('Usage: atris worktree start --member <member>|--agent <name> --task "<short task>" [--claim] [--force]');
     return 2;
   }
   const memberFile = member ? path.join(root, 'atris', 'team', member, 'MEMBER.md') : '';
   if (memberFile && !fs.existsSync(memberFile)) {
     console.error(`warning: no member persona at ${path.relative(root, memberFile)}`);
   }
+
+  const force = hasFlag(args, '--force');
+  const now = new Date();
+  const flights = inFlightAgentFlights({ root, now });
+  const active = flights.filter((flight) => flight.kind === 'worktree');
+  const repoName = path.basename(findPrimaryRoot(root));
+  console.log(`flights: ${active.length} active agent ${active.length === 1 ? 'worktree' : 'worktrees'} for ${repoName}`);
+  const collisions = collidingFlights(flights, taskTokens(slugify(task, 'task', 36)));
+  if (collisions.length) {
+    const label = force ? 'warning' : 'refusing';
+    for (const flight of collisions) {
+      console.error(`${label}: overlapping flight ${flight.name} (${describeFlightAge(flight, now.getTime())})`);
+    }
+    console.error(`${label}: another flight may already be doing this work`);
+    if (!force) {
+      console.error('refusing: pass --force to start anyway');
+      return 2;
+    }
+  }
+
   let created;
   try {
     created = createAgentWorktree({
@@ -912,7 +1021,8 @@ function help() {
   console.log('Usage: atris worktree <guide|start|ship|status|guard|prune|cleanup>');
   console.log('');
   console.log('  atris worktree guide');
-  console.log('  atris worktree start --member <member>|--agent <name> --task "<task>" [--claim]');
+  console.log('  atris worktree start --member <member>|--agent <name> --task "<task>" [--claim] [--force]');
+  console.log('    --force         start even when another recent flight shares a task word');
   console.log('  atris worktree ship --message "<commit>" --verify "<cmd>" [--merge] [--target <ref>] [--local]');
   console.log('    --target <ref>  override the default landing target (default: branch atris-base, else origin default branch)');
   console.log('    --local         merge into the local primary checkout instead of pushing and opening a PR');
@@ -946,15 +1056,20 @@ function worktreeCommand(args = []) {
 
 module.exports = {
   branchName,
+  collidingFlights,
   createAgentWorktree,
   deniedLaneForShip,
   createOrFindPr,
   cleanupWorktrees,
   defaultStartBase,
+  describeFlightAge,
+  flightStampMs,
   listWorktrees,
+  parseAgentFlightName,
   parseWorktrees,
   normalizeTargetRef,
   slugify,
+  taskTokens,
   statusCounts,
   swarloClaim,
   worktreeCommand,

package/lib/auto-accept-certified.js

@@ -7,6 +7,7 @@ const { taskProofState, taskProofExecutionState } = require('./task-proof');
 const { extractReceiptEvidence } = require('./receipt-evidence');
 const reviewIntegrity = require('./review-integrity');
 const { computeTrustTier } = require('./trust-tiers');
+const { policyLessonsForFiles, readPolicyLessons } = require('./policy-lessons');
 
 const AGENT_CERTIFICATION_REVIEW_PASSES = 2;
 // Kept for compat with older callers/tests; the pass-count landing lane it
@@ -620,6 +621,298 @@ function hygieneBlockResult(task, ref) {
   };
 }
 
+const CANDIDATE_PATH_KEYS = [
+  'files',
+  'paths',
+  'touched_files',
+  'touchedFiles',
+  'changed_files',
+  'changedFiles',
+  'modified_files',
+  'modifiedFiles',
+  'artifacts',
+  'artifact_paths',
+  'artifactPaths',
+];
+
+function candidatePathValues(value) {
+  if (!value) return [];
+  if (Array.isArray(value)) return value.flatMap(candidatePathValues);
+  if (typeof value === 'object') {
+    for (const key of ['path', 'file', 'filename']) {
+      if (typeof value[key] === 'string') return [value[key]];
+    }
+    return [];
+  }
+  if (typeof value !== 'string') return [];
+  return value.split(/[\n,]+/).map((entry) => entry.trim()).filter(Boolean);
+}
+
+function declaredCandidatePathValues(task) {
+  const metadata = task && task.metadata && typeof task.metadata === 'object' ? task.metadata : {};
+  const review = task && task.review && typeof task.review === 'object' ? task.review : {};
+  const sources = [
+    metadata,
+    metadata.diff_stats,
+    metadata.diffStats,
+    metadata.git_diff_stats,
+    metadata.gitDiffStats,
+    metadata.change_stats,
+    metadata.changeStats,
+    metadata.result_trace,
+    review.result,
+    review.result_trace,
+  ].filter((source) => source && typeof source === 'object');
+  const values = [];
+  for (const source of sources) {
+    for (const key of CANDIDATE_PATH_KEYS) values.push(...candidatePathValues(source[key]));
+  }
+  for (const event of Array.isArray(task && task.events) ? task.events : []) {
+    const payload = event && event.payload && typeof event.payload === 'object' ? event.payload : {};
+    const trace = payload.result_trace && typeof payload.result_trace === 'object' ? payload.result_trace : null;
+    if (!trace) continue;
+    for (const key of CANDIDATE_PATH_KEYS) values.push(...candidatePathValues(trace[key]));
+  }
+  return [...new Set(values)];
+}
+
+function candidateWorkspaceRoot(task) {
+  const workspace = path.resolve(task.workspace_root || process.cwd());
+  const metadata = task.metadata || {};
+  const declared = metadata.worktree_path
+    || metadata.worktreePath
+    || metadata.worktree?.path
+    || task.worktree_path
+    || task.worktree?.path;
+  if (!declared) return workspace;
+  const target = path.resolve(String(declared));
+  const allowedRoot = parentArenaDir(workspace);
+  try {
+    if (isInsidePath(target, allowedRoot) && fs.statSync(target).isDirectory()) return target;
+  } catch {}
+  return workspace;
+}
+
+function normalizeCandidatePath(value, root) {
+  const text = String(value || '').trim().replace(/^['"`]|['"`]$/g, '');
+  if (!text || text === '.' || text.includes('://') || /[*?\[\]{}]/.test(text)) return null;
+  const absolute = path.resolve(root, text);
+  if (!isInsidePath(absolute, root)) return null;
+  const relative = path.relative(root, absolute).replace(/\\/g, '/');
+  if (!relative || relative === '.') return null;
+  if (!relative.includes('/') && !path.extname(relative) && !fs.existsSync(absolute)) return null;
+  return relative;
+}
+
+function safeCandidateRef(value) {
+  const text = String(value || '').trim();
+  return safeGitRevToken(text) ? text : null;
+}
+
+function candidateGit(root, args) {
+  try {
+    return spawnSync('git', args, { cwd: root, encoding: 'utf8', timeout: 10000 });
+  } catch {
+    return { status: 1, stdout: '', stderr: '' };
+  }
+}
+
+function mergeChangedLineMaps(target, source) {
+  for (const [file, lines] of source) {
+    const merged = target.get(file) || new Set();
+    for (const line of lines) merged.add(line);
+    target.set(file, merged);
+  }
+}
+
+function declaredCandidateChangedLines(root, declaredPaths) {
+  const repoCheck = candidateGit(root, ['rev-parse', '--is-inside-work-tree']);
+  if (repoCheck.status !== 0 || String(repoCheck.stdout).trim() !== 'true') return null;
+  const { gitChangedLines } = require('../commands/slop');
+  const changedPaths = new Set();
+  const changedLines = new Map();
+  const addDiff = (args, lines) => {
+    const names = candidateGit(root, args);
+    if (names.status !== 0) return;
+    String(names.stdout || '').split('\0').filter(Boolean)
+      .map((entry) => normalizeCandidatePath(entry, root))
+      .filter(Boolean)
+      .forEach((entry) => changedPaths.add(entry));
+    mergeChangedLineMaps(changedLines, lines);
+  };
+  addDiff(['diff', '--name-only', '-z'], gitChangedLines(false, root));
+  addDiff(['diff', '--cached', '--name-only', '-z'], gitChangedLines(true, root));
+  for (const base of ['origin/master', 'origin/main', 'master', 'main']) {
+    const baseResult = candidateGit(root, ['rev-parse', base]);
+    const headResult = candidateGit(root, ['rev-parse', 'HEAD']);
+    if (baseResult.status !== 0 || headResult.status !== 0) continue;
+    if (String(baseResult.stdout).trim() === String(headResult.stdout).trim()) break;
+    const range = `${base}...HEAD`;
+    addDiff(['diff', '--name-only', '-z', range], gitChangedLines(false, root, range));
+    break;
+  }
+  const pathIsChanged = (declaredPath) => [...changedPaths]
+    .some((changedPath) => changedPath === declaredPath || changedPath.startsWith(`${declaredPath}/`));
+  return declaredPaths.every(pathIsChanged) ? changedLines : null;
+}
+
+function candidateBranchScope(task, root) {
+  const metadata = task.metadata || {};
+  const branch = safeCandidateRef(
+    metadata.branch
+      || metadata.worktree_branch
+      || metadata.git_branch
+      || metadata.pr_branch
+      || metadata.head_branch
+      || metadata.worktree?.branch,
+  );
+  if (!branch) return null;
+  const base = safeCandidateRef(
+    metadata.base
+      || metadata.base_ref
+      || metadata.target_ref
+      || metadata.target_branch
+      || metadata.worktree?.base,
+  );
+  if (!base) return { certain: false, source: 'branch', paths: [], detail: 'candidate branch has no exact base ref' };
+  const headResult = candidateGit(root, ['rev-parse', 'HEAD']);
+  const branchResult = candidateGit(root, ['rev-parse', branch]);
+  if (headResult.status !== 0 || branchResult.status !== 0) {
+    return { certain: false, source: 'branch', paths: [], detail: 'candidate branch ref is unavailable' };
+  }
+  if (String(headResult.stdout).trim() !== String(branchResult.stdout).trim()) {
+    return { certain: false, source: 'branch', paths: [], detail: 'candidate branch content is not checked out here' };
+  }
+  const names = candidateGit(root, ['diff', '--name-only', '-z', `${base}...${branch}`]);
+  if (names.status !== 0) {
+    return { certain: false, source: 'branch', paths: [], detail: 'candidate branch diff is unavailable' };
+  }
+  const paths = String(names.stdout || '').split('\0').filter(Boolean);
+  const normalized = paths.map((entry) => normalizeCandidatePath(entry, root));
+  if (normalized.some((entry) => !entry)) {
+    return { certain: false, source: 'branch', paths: [], detail: 'candidate branch diff contains an unsafe path' };
+  }
+  const { gitChangedLines } = require('../commands/slop');
+  return {
+    certain: true,
+    source: 'branch',
+    paths: [...new Set(normalized)],
+    changed_lines: gitChangedLines(false, root, `${base}...${branch}`),
+  };
+}
+
+function candidateTouchedScope(task) {
+  const root = candidateWorkspaceRoot(task);
+  const declared = declaredCandidatePathValues(task);
+  if (declared.length) {
+    const normalized = declared.map((entry) => normalizeCandidatePath(entry, root));
+    if (normalized.some((entry) => !entry)) {
+      return { certain: false, source: 'declared', root, paths: [], detail: 'declared candidate paths are ambiguous or outside the workspace' };
+    }
+    const paths = [...new Set(normalized)];
+    return {
+      certain: true,
+      source: 'declared',
+      root,
+      paths,
+      changed_lines: declaredCandidateChangedLines(root, paths),
+    };
+  }
+  const branch = candidateBranchScope(task, root);
+  if (branch) return { root, ...branch };
+  return { certain: false, source: 'unknown', root, paths: [], detail: 'no exact diff or declared artifact paths were recorded' };
+}
+
+function candidatePolicyGate(task, options = {}) {
+  const scope = candidateTouchedScope(task);
+  const gate = {
+    scope: scope.source,
+    paths: scope.paths,
+    advisory_only: !scope.certain,
+    advisories: [],
+    bypassed: false,
+  };
+  if (!scope.certain) {
+    gate.advisories.push({ reason: 'candidate_scope_unknown', detail: scope.detail });
+    return { ok: true, gate };
+  }
+
+  const { scanPaths } = require('../commands/slop');
+  const scanned = scanPaths(scope.paths, {
+    root: scope.root,
+    changedLines: scope.changed_lines,
+  });
+  if (scanned.findings.length) {
+    const findings = scanned.findings.map((finding) => ({
+      file: path.relative(scope.root, finding.file).replace(/\\/g, '/'),
+      line: finding.line,
+      rule: finding.rule,
+      severity: finding.sev,
+    }));
+    const rules = [...new Set(findings.map((finding) => finding.rule))];
+    const offenders = findings.map((finding) => `${finding.file}:${finding.line} ${finding.rule}`);
+    return {
+      ok: false,
+      eligible: false,
+      reason: 'slop_gate',
+      rules,
+      findings,
+      offenders,
+      gate,
+      message: 'the touched prose or user-facing text breaks a deterministic taste rule, so this work cannot land yet.',
+      next_action: `fix ${offenders.join(', ')}, then re-certify`,
+    };
+  }
+
+  const matchedLessons = policyLessonsForFiles(
+    scope.paths,
+    readPolicyLessons(scope.root),
+    scope.root,
+  );
+  const failing = [];
+  for (const lesson of matchedLessons) {
+    if (!lesson.detector) {
+      gate.advisories.push({ reason: 'lesson_has_no_detector', lesson_id: lesson.id, matched_path: lesson.matched_path });
+      continue;
+    }
+    if (options.executeDetectors === false) {
+      gate.advisories.push({ reason: 'lesson_detector_pending', lesson_id: lesson.id, matched_path: lesson.matched_path });
+      continue;
+    }
+    const result = runVerifyCommandCached(lesson.detector, scope.root, options.verifyCache || null);
+    if (result.reason === 'verify_failed' && Number.isInteger(result.status) && result.status !== 0) {
+      failing.push({
+        lesson_id: lesson.id,
+        detector: lesson.detector,
+        exit_code: result.status,
+        matched_path: lesson.matched_path,
+      });
+    } else if (!result.ok) {
+      gate.advisories.push({
+        reason: 'lesson_detector_unrunnable',
+        lesson_id: lesson.id,
+        detector_reason: result.reason,
+        matched_path: lesson.matched_path,
+      });
+    }
+  }
+  if (failing.length) {
+    const lessonIds = failing.map((entry) => entry.lesson_id);
+    return {
+      ok: false,
+      eligible: false,
+      reason: 'lesson_gate',
+      lesson_id: lessonIds[0],
+      lesson_ids: lessonIds,
+      lessons: failing,
+      gate,
+      message: `the touched work breaks detector-backed lesson ${lessonIds.join(', ')}, so it cannot land yet.`,
+      next_action: `repair lesson ${lessonIds.join(', ')} and rerun its detector, then re-certify`,
+    };
+  }
+  return { ok: true, gate };
+}
+
 function strictVerifyMissingResult(ref) {
   return {
     eligible: false,
@@ -822,7 +1115,10 @@ function evaluateAutoAccept(task, options = {}) {
     if (verify && !executeVerify && !isAutoCertifyVerifyCommandAllowed(verify)) {
       return { eligible: false, ref, reason: 'verify_command_not_allowed', verify };
     }
+    let candidateGate = null;
     if (executeVerify) {
+      candidateGate = candidatePolicyGate(task, { verifyCache, executeDetectors: true });
+      if (!candidateGate.ok) return { ...candidateGate, ref };
       const hygieneBlock = hygieneBlockResult(task, ref);
       if (hygieneBlock) return hygieneBlock;
     }
@@ -834,6 +1130,7 @@ function evaluateAutoAccept(task, options = {}) {
       proof,
       policy: 'all_but_protected',
       verification_pending: tierRequiresStrictVerify && Boolean(verify) && !executeVerify,
+      ...(candidateGate ? { candidate_gate: candidateGate.gate } : {}),
     };
   }
 
@@ -900,7 +1197,10 @@ function evaluateAutoAccept(task, options = {}) {
     }
   }
 
+  let candidateGate = null;
   if (executeVerify) {
+    candidateGate = candidatePolicyGate(task, { verifyCache, executeDetectors: true });
+    if (!candidateGate.ok) return { ...candidateGate, ref };
     const hygieneBlock = hygieneBlockResult(task, ref);
     if (hygieneBlock) return hygieneBlock;
   }
@@ -914,12 +1214,14 @@ function evaluateAutoAccept(task, options = {}) {
     proof,
     policy: requiresStrictVerify ? 'strict_verify' : 'independent_reviewer',
     verification_pending: requiresStrictVerify && !executeVerify,
+    ...(candidateGate ? { candidate_gate: candidateGate.gate } : {}),
   };
 }
 
 module.exports = {
   AGENT_CERTIFICATION_REVIEW_PASSES,
   DENIED_TAGS,
+  candidatePolicyGate,
   declaredProtectedLane,
   sniffedProtectedLane,
   evaluateAutoAccept,

package/lib/cloud-mission.js

@@ -104,7 +104,10 @@ function requestError(result) {
   const hint = /business/i.test(String(backendDetail || errorDetail || ''))
     ? '\ntry: --agent <id of a business-attached agent>'
     : '';
-  return new CloudMissionError(`cloud mission request failed${status}${detail}${hint}`, 1);
+  const error = new CloudMissionError(`cloud mission request failed${status}${detail}${hint}`, 1);
+  error.status = result && result.status ? result.status : 0;
+  error.detail = errorDetail ? String(errorDetail) : '';
+  return error;
 }
 
 // Every cloud mission carries the receipt voice contract: the wish text is the
@@ -118,7 +121,14 @@ function withReceiptVoice(text) {
   return `${body}\n\n${RECEIPT_VOICE_CONTRACT}`;
 }
 
-async function enqueueCloudMission({ text, lane = 'fast', agentId }, deps = {}) {
+async function enqueueCloudMission({
+  text,
+  lane = 'fast',
+  agentId,
+  businessId,
+  idempotencyKey,
+  budgetUsd,
+}, deps = {}) {
   if (!VALID_CLOUD_LANES.has(lane)) {
     throw new CloudMissionError(`invalid --lane "${lane}". expected fast, pro, or max`, 2);
   }
@@ -126,6 +136,9 @@ async function enqueueCloudMission({ text, lane = 'fast', agentId }, deps = {})
   const request = deps.apiRequestJson || apiRequestJson;
   const body = { text: withReceiptVoice(text), lane };
   if (agentId) body.agent_id = agentId;
+  if (businessId) body.business_id = businessId;
+  if (idempotencyKey !== undefined) body.idempotency_key = idempotencyKey;
+  if (budgetUsd !== undefined) body.budget_usd = budgetUsd;
   const response = await request('/atris2/missions', {
     method: 'POST',
     token,
@@ -152,6 +165,45 @@ async function fetchCloudMissionStatus(taskId, deps = {}) {
   return response.data;
 }
 
+async function fetchCurrentCloudMission(deps = {}) {
+  const token = credentialsToken(deps.loadCredentials || loadCredentials);
+  const request = deps.apiRequestJson || apiRequestJson;
+  // This route is owned by the mission-core backend. Keep the client call here
+  // while that backend change lands; the human command layer translates a 404.
+  const response = await request('/atris2/missions/current', {
+    method: 'GET',
+    token,
+  });
+  if (!response || !response.ok) throw requestError(response);
+  if (!response.data || !(response.data.mission_id || response.data.task_id || response.data.id || response.data.mission || response.data.card)) {
+    throw new CloudMissionError('current cloud mission response did not include a mission', 1);
+  }
+  return response.data;
+}
+
+async function updateCloudMission(taskId, action, body = {}, deps = {}) {
+  const token = credentialsToken(deps.loadCredentials || loadCredentials);
+  const request = deps.apiRequestJson || apiRequestJson;
+  const response = await request(`/mission-control/missions/${encodeURIComponent(taskId)}/${action}`, {
+    method: 'POST',
+    token,
+    body,
+  });
+  if (!response || !response.ok) throw requestError(response);
+  return response.data || {};
+}
+
+async function fetchCloudMissionChecks(taskId, deps = {}) {
+  const token = credentialsToken(deps.loadCredentials || loadCredentials);
+  const request = deps.apiRequestJson || apiRequestJson;
+  const response = await request(`/mission-control/missions/${encodeURIComponent(taskId)}`, {
+    method: 'GET',
+    token,
+  });
+  if (!response || !response.ok) throw requestError(response);
+  return response.data || {};
+}
+
 function appendCloudMissionReceipt(root, receipt) {
   const stateDir = path.join(root, '.atris', 'state');
   fs.mkdirSync(stateDir, { recursive: true });
@@ -248,6 +300,11 @@ module.exports = {
   withReceiptVoice,
   parseCloudRunArgs,
   enqueueCloudMission,
+  fetchCloudMissionStatus,
+  fetchCurrentCloudMission,
+  updateCloudMission,
+  fetchCloudMissionChecks,
+  appendCloudMissionReceipt,
   runCloudMissionCommand,
   statusCloudMissionCommand,
 };

package/lib/conductor-artifacts.js

@@ -6,7 +6,7 @@
 // this list; keeping it in one place is what stops an engine from being blocked
 // by its own prompt file.
 const CONDUCTOR_UNTRACKED_PATTERN =
-  /^\.atris\/(?:agent-worktree\.json|fleet-prompt-[^/]+\.md|runtime-tmp(?:\/.*)?|state\/briefs\.jsonl)$/;
+  /^\.atris\/(?:agent-worktree\.json|fleet-prompt-[^/]+\.md|codex-watchdog-[^/]+\.json|runtime-tmp(?:\/.*)?|state\/briefs\.jsonl)$/;
 
 function isConductorArtifact(file) {
   return CONDUCTOR_UNTRACKED_PATTERN.test(String(file || ''));