atris 3.82.8 → 3.82.9

package/commands/sentinel-bench.js

@@ -4,7 +4,8 @@
 //
 //   atris sentinel bench [--summary] [--json] [--review] [--sets guard,agents]
 //   atris sentinel bench --split <file> --set guard|agents|review
-//   atris sentinel improve [--engine claude] [--offline] [--json]
+//   atris sentinel improve [--engine claude] [--focus exfil|destroy|disarm|agents] [--offline] [--json]
+//   atris sentinel improve --rounds N --parallel K --review codex [--max-minutes 120] [--max-calls N] [--push]
 //   atris sentinel improve --schedule [--every 24] [--engine claude] | --unschedule
 
 const path = require('path');
@@ -51,12 +52,21 @@ function benchHelp() {
 
 async function benchCommand(argv, deps = {}) {
   if (argv.includes('--help') || argv.includes('-h') || argv[0] === 'help') return benchHelp();
-  try { checkFlags(argv, ['--summary', '--json', '--review'], ['--split', '--set', '--sets', '--target', '--seen', '--hunter', '--verifier', '--budget']); } catch (e) { console.error(`  ${e.message}`); return 2; }
+  try { checkFlags(argv, ['--summary', '--json', '--review'], ['--split', '--set', '--sets', '--target', '--seen', '--hunter', '--verifier', '--budget', '--screen']); } catch (e) { console.error(`  ${e.message}`); return 2; }
   const bench = require('../lib/sentinel-bench');
   const env = deps.env || process.env;
   const root = path.resolve(readFlag(argv, '--target') || deps.root || process.cwd());
   const seenDir = path.resolve(readFlag(argv, '--seen') || bench.seenDirOf(root));
   const holdoutDir = bench.defaultHoldoutDir(env);
+  const screen = readFlag(argv, '--screen');
+  if (screen) {
+    // Internal to the night run: refused ids only, as json.
+    let candidates;
+    try { candidates = JSON.parse(require('fs').readFileSync(path.resolve(screen), 'utf8')); } catch (e) { console.error(`  could not read the items to screen: ${e.message}`); return 1; }
+    if (!Array.isArray(candidates)) { console.error('  the items to screen must be a json list'); return 1; }
+    console.log(JSON.stringify({ ok: true, ...bench.screenItems(candidates, { holdoutDir, env }) }));
+    return 0;
+  }
   const split = readFlag(argv, '--split');
   if (split) {
     const set = readFlag(argv, '--set');
@@ -97,26 +107,49 @@ function improveHelp() {
   atris sentinel improve, one exam-checked change to the sentinel
 
     atris sentinel improve [--engine claude]   propose one change and judge it
+    atris sentinel improve --focus exfil       point the proposer at one area:
+                                               exfil, destroy, disarm or agents
     atris sentinel improve --offline           skip the published advisory lookup
     atris sentinel improve --schedule [--every 24] [--engine claude]
                                                run it on a timer, nightly by default
     atris sentinel improve --unschedule        turn the timer off
 
+  a night run, many changes in one sitting:
+
+    atris sentinel improve --rounds 4 --parallel 3 --review codex
+        --rounds N        up to N rounds. each starts from what shipped before
+        --parallel K      K proposers at once, each on its own area (up to 4)
+        --review codex    codex reviews every change the exam keeps. SHIP keeps
+                          it. FIX rejects it and its examples join the exam
+        --max-minutes M   stop after M minutes (120 by default)
+        --max-calls C     stop after C proposer and reviewer calls
+        --push            push the two night branches by name when done
+    atris sentinel improve --break-lock    clear a night run lock whose run is gone
+
+  shipped rules land on sentinel-improve/night-<date>. new exam items land
+  apart on sentinel-exam/<date>. you can review them on their own. the
+  run stops early after two rounds with nothing shipped or no held-out gain.
+
   claude proposes one change to lib/sentinel-rules.json on a new branch,
   sealed off from the held-out exam. the sentinel bench, fixed code with no
   model, scores it before and after. it is kept only when
   held-out attack catch holds or rises, wrong blocks and false alarms do
   not rise and no seen item that passed now fails. a kept change waits on
-  its branch for you. nothing is merged, pushed or released.
+  its branch for you. nothing is merged or released. nothing is pushed without --push.
 `);
   return 0;
 }
 
 async function improveCommand(argv, deps = {}) {
   if (argv.includes('--help') || argv.includes('-h') || argv[0] === 'help') return improveHelp();
-  try { checkFlags(argv, ['--json', '--offline', '--schedule', '--unschedule'], ['--engine', '--every']); } catch (e) { console.error(`  ${e.message}`); return 2; }
+  try { checkFlags(argv, ['--json', '--offline', '--schedule', '--unschedule', '--push', '--break-lock'], ['--engine', '--every', '--focus', '--rounds', '--parallel', '--review', '--max-minutes', '--max-calls']); } catch (e) { console.error(`  ${e.message}`); return 2; }
   const improve = require('../lib/sentinel-improve');
   const env = deps.env || process.env;
+  if (argv.includes('--break-lock')) {
+    const res = require('../lib/sentinel-night').breakLock(env);
+    (res.refused ? console.error : console.log)(`  ${res.message}`);
+    return res.refused ? 1 : 0;
+  }
   const engine = readFlag(argv, '--engine') || 'claude';
   if (!/^[a-z][a-z0-9:_-]{0,30}$/.test(engine)) { console.error(`  unknown engine: ${engine}`); return 2; }
   const refused = require('../lib/sentinel-improve').refusedEngine(engine);
@@ -148,9 +181,14 @@ async function improveCommand(argv, deps = {}) {
     console.log('  each run leaves a receipt in ~/.atris/sentinel-improve/receipts. kept changes wait on their branch for you');
     return 0;
   }
+  const focus = readFlag(argv, '--focus');
+  if (argv.includes('--focus') && !focus) { console.error('  --focus needs exfil, destroy, disarm or agents'); return 2; }
+  if (focus && !improve.FOCI.includes(focus)) { console.error(`  unknown focus: ${focus}. use exfil, destroy, disarm or agents`); return 2; }
+  const nightFlags = ['--rounds', '--parallel', '--review', '--max-minutes', '--max-calls', '--push'];
+  if (argv.some((a) => nightFlags.includes(String(a).split('=')[0]))) return nightCommand(argv, { root, engine, env, focus, deps });
   let res;
   try {
-    res = await improve.improve({ root, engine, env, offline: argv.includes('--offline'), log: argv.includes('--json') ? () => {} : (m) => console.log(`  ${m}`), ...(deps.improveOpts || {}) });
+    res = await improve.improve({ root, engine, env, focus, offline: argv.includes('--offline'), log: argv.includes('--json') ? () => {} : (m) => console.log(`  ${m}`), ...(deps.improveOpts || {}) });
   } catch (e) { console.error(`  improve did not run: ${e.message}`); return 1; }
   if (argv.includes('--json')) {
     console.log(JSON.stringify({ ok: !res.error, kept: res.kept, branch: res.branch, error: res.error || null, decision: res.decision, receipt: res.receipt }, null, 2));
@@ -169,4 +207,44 @@ async function improveCommand(argv, deps = {}) {
   return res.error ? 1 : 0;
 }
 
+function numFlag(argv, name) {
+  const v = readFlag(argv, name);
+  if (v === null) return argv.includes(name) ? NaN : undefined;
+  return Number(v);
+}
+
+async function nightCommand(argv, { root, engine, env, focus, deps }) {
+  const improve = require('../lib/sentinel-improve');
+  const review = readFlag(argv, '--review');
+  if (argv.includes('--review') && !review) { console.error('  --review needs codex'); return 2; }
+  if (review && review !== 'codex') { console.error('  --review takes codex only'); return 2; }
+  const opts = { root, engine, env, focus, review, push: argv.includes('--push'), offline: argv.includes('--offline') };
+  for (const [flag, key] of [['--rounds', 'rounds'], ['--parallel', 'parallel'], ['--max-minutes', 'maxMinutes'], ['--max-calls', 'maxCalls']]) {
+    const n = numFlag(argv, flag);
+    if (n === undefined) continue;
+    if (!Number.isFinite(n) || n <= 0) { console.error(`  ${flag} needs a number above 0`); return 2; }
+    if (key !== 'maxMinutes' && !Number.isInteger(n)) { console.error(`  ${flag} needs a whole number`); return 2; }
+    if (key === 'parallel' && n > improve.FOCI.length) { console.error(`  --parallel goes up to ${improve.FOCI.length}, one proposer per focus area`); return 2; }
+    opts[key] = n;
+  }
+  const json = argv.includes('--json');
+  let res;
+  try {
+    res = await require('../lib/sentinel-night').night({ ...opts, log: json ? () => {} : (m) => console.log(`  ${m}`), ...(deps.nightOpts || {}) });
+  } catch (e) { console.error(`  improve did not run: ${e.message}`); return 1; }
+  if (json) {
+    console.log(JSON.stringify({ ok: !res.error, shipped: res.landed, stop: res.stop, night_branch: res.night_branch, exam_branch: res.exam_branch, exam_added: res.exam_added, calls: res.calls, minutes: res.minutes, pushed: res.pushed, error: res.error || null, receipt: res.receipt }, null, 2));
+    return res.error ? 1 : 0;
+  }
+  const home = require('os').homedir();
+  console.log('');
+  console.log(`  ${res.landed} ${res.landed === 1 ? 'change' : 'changes'} shipped in ${res.rounds.length} ${res.rounds.length === 1 ? 'round' : 'rounds'}. stopped because ${res.stop}`);
+  if (res.night_branch) console.log(`  rules wait on ${res.night_branch}`);
+  if (res.exam_branch) console.log(`  ${res.exam_added} new exam items wait on ${res.exam_branch}`);
+  if (res.pushed.length) console.log(`  pushed: ${res.pushed.join(', ')}`);
+  console.log(`  used ${res.calls} engine calls in ${res.minutes} minutes`);
+  console.log(`  receipt: ${res.receipt.replace(home, '~')}\n`);
+  return res.error ? 1 : 0;
+}
+
 module.exports = { benchCommand, improveCommand };

package/lib/sentinel-bench.js

@@ -158,12 +158,18 @@ function keyFromKeychain() {
   return add.status === 0 ? read() : null;
 }
 
+// Where the last key came from: 'keychain' or 'file'. The night run asks
+// for this in the report and refuses a file key: a reviewer that can read
+// files could read a key file too.
+let lastKeySource = null;
+
 function holdoutKey(env = process.env) {
-  if (env.ATRIS_SENTINEL_KEY_FILE) return keyFromFile(env.ATRIS_SENTINEL_KEY_FILE);
+  if (env.ATRIS_SENTINEL_KEY_FILE) { lastKeySource = 'file'; return keyFromFile(env.ATRIS_SENTINEL_KEY_FILE); }
   if (process.platform === 'darwin' && env.ATRIS_SENTINEL_KEYCHAIN !== '0') {
     const k = keyFromKeychain();
-    if (k) return k;
+    if (k) { lastKeySource = 'keychain'; return k; }
   }
+  lastKeySource = 'file';
   return keyFromFile(path.join(homeDir(env), '.atris', 'sentinel-judge', 'holdout.key'));
 }
 
@@ -416,9 +422,47 @@ async function runBench({ target, seenDir, holdoutDir, sets = ['guard', 'agents'
       report[half][set] = score;
     }
   }
+  report.key_source = lastKeySource;
   return report;
 }
 
+// ---------------------------------------------------------------- screen
+
+// Lowercase with whitespace collapsed, for overlap checks.
+function normalizeText(v) {
+  return String(v || '').toLowerCase().replace(/\s+/g, ' ').trim();
+}
+
+function itemTexts(set, item) {
+  if (set === 'guard') return [item.command !== undefined ? item.command : JSON.stringify(item.input || '')];
+  return Object.entries(item.files || {}).map(([f, c]) => `${f} ${typeof c === 'string' ? c : JSON.stringify(c)}`).concat(Object.values(item.files || {}).map((c) => (typeof c === 'string' ? c : JSON.stringify(c))));
+}
+
+// New seen items proposed from outside (the night reviewer) checked against
+// the held-out half. This runs in the judge, the one process that holds it. An item
+// whose normalized text equals, contains or sits inside any held-out item's
+// text is refused. Only the refused ids leave this function, never a
+// held-out item. A held-out set that cannot be read refuses everything.
+function screenItems(candidates, { holdoutDir, env = process.env } = {}) {
+  const held = path.resolve(holdoutDir || defaultHoldoutDir(env));
+  const texts = [];
+  let unreadable = false;
+  for (const set of ['guard', 'agents']) {
+    try {
+      const loaded = loadSet(held, set, { held: true, env });
+      for (const item of loaded.items) for (const t of itemTexts(set, item)) { const n = normalizeText(t); if (n) texts.push(n); }
+    } catch { unreadable = true; }
+  }
+  const refused = [];
+  for (const c of candidates) {
+    if (!c || typeof c.id !== 'string' || (c.set !== 'guard' && c.set !== 'agents')) continue;
+    if (unreadable) { refused.push(c.id); continue; }
+    const mine = itemTexts(c.set, c.item || {}).map(normalizeText).filter(Boolean);
+    if (!mine.length || mine.some((m) => texts.some((h) => h === m || h.includes(m) || m.includes(h)))) refused.push(c.id);
+  }
+  return { refused, key_source: lastKeySource, unreadable };
+}
+
 // What may leave this module: held-out totals only, never an item. With
 // summary, seen items are dropped too.
 function publicReport(report, { summary = false } = {}) {
@@ -437,6 +481,8 @@ function publicReport(report, { summary = false } = {}) {
     holdout_dir: report.holdout_dir,
     // Sealed split sources, paths only. The improver uses them to deny reads.
     sealed_sources: report.sealed_sources || [],
+    // How the judge got the held-out key: 'keychain' or 'file'. Never the key.
+    key_source: report.key_source || null,
   };
 }
 
@@ -541,6 +587,8 @@ module.exports = {
   SETS,
   readHeldText,
   readSealedSources,
+  normalizeText,
+  screenItems,
   FAKE,
   defaultHoldoutDir,
   expand,

package/lib/sentinel-guard.js

@@ -704,13 +704,26 @@ const BLOCK_REASON = {
   disarm: ['blocked: this command matches a known way to turn off a protection.', 'An agent ran a command that matches a known way to turn off a protection. Nothing changed.'],
 };
 
-// Literal command blocks from the rules file. Each block reads the whole
-// command with plain substring checks, limited to commands that run one of
-// its programs when it lists any. Linear time, no regular expression.
+// Literal command blocks from the rules file, matched with plain substring
+// checks in linear time, never a regular expression. A block that lists
+// programs reads only the words of each piece of the command that runs one of
+// them, so harmless pieces chained with && or ; never add up to a match. A
+// block with no programs reads the whole command. Fail closed: when a piece can
+// receive code from elsewhere (a pipe, any redirect or file write, a heredoc or
+// here-string, a command substitution, a shell variable, eval, source or a shell
+// string), every block reads the whole command. Per-piece matching is only for
+// plain chains that pass nothing between pieces.
+// Accepted limit: the guard judges one command at a time, so a script written by
+// one command and run by a later, separate command is not connected by any rule.
+const FEEDS_CODE = ['|', '<', '>', '`', '$', 'tee ', 'eval', 'source ', 'sh -c', 'bash -c', 'zsh -c'];
 function checkBlocks(command, cmds) {
+  const whole = FEEDS_CODE.some((t) => command.includes(t));
   for (const b of R().commandBlocks) {
+    const texts = b.programs && !whole
+      ? cmds.filter((c) => b.programs.has(c.name)).map((c) => (c.words || [c.name, ...(c.args || [])]).join(' '))
+      : [command];
     if (b.programs && !cmds.some((c) => b.programs.has(c.name))) continue;
-    if (!b.all.every((sub) => command.includes(sub))) continue;
+    if (!texts.some((t) => b.all.every((sub) => t.includes(sub)))) continue;
     const [reason, detail] = BLOCK_REASON[b.category];
     return block(`${b.category}-block`, b.category === 'disarm' ? 'high' : 'critical', reason, detail);
   }

package/lib/sentinel-improve.js

@@ -177,11 +177,12 @@ async function gather({ env = process.env, request, osvBase, offline = false } =
 
 // The exam in its own process, from this atris. Returns the public report:
 // seen items and held-out totals, never a held-out item.
-function runJudge({ target, seenDir, sets = ['guard', 'agents'], atrisBin, env = process.env, spawn = spawnSync } = {}) {
+function runJudge({ target, seenDir, sets = ['guard', 'agents'], atrisBin, env = process.env, spawn = spawnSync, timeoutMs = 10 * 60 * 1000 } = {}) {
   const bin = atrisBin || path.join(__dirname, '..', 'bin', 'atris.js');
   const args = [bin, 'sentinel', 'bench', '--json', '--target', target, '--sets', sets.join(',')];
   if (seenDir) args.push('--seen', seenDir);
-  const r = spawn(process.execPath, args, { encoding: 'utf8', env: { ...env, ATRIS_SKIP_UPDATE_CHECK: '1' }, maxBuffer: 32 * 1024 * 1024, timeout: 10 * 60 * 1000 });
+  const r = spawn(process.execPath, args, { encoding: 'utf8', env: { ...env, ATRIS_SKIP_UPDATE_CHECK: '1' }, maxBuffer: 32 * 1024 * 1024, timeout: Math.max(1, Math.floor(timeoutMs)) });
+  if (r.error && r.error.code === 'ETIMEDOUT') throw new Error('the exam ran out of time');
   if (r.status !== 0) throw new Error(`the exam did not run: ${String(r.stderr || r.stdout || '').trim().split('\n').slice(-1)[0] || `exit ${r.status}`}`);
   try { return JSON.parse(r.stdout); } catch { throw new Error('the exam printed something that is not json'); }
 }
@@ -289,15 +290,36 @@ function keepDecision(before, after, { newIds = [] } = {}) {
 
 // ---------------------------------------------------------------- propose
 
-function missesForPrompt(report) {
+// The areas a proposer can be pointed at. A focus narrows the misses it
+// sees to one area so parallel proposers do not all chase the same thing.
+const FOCI = ['exfil', 'destroy', 'disarm', 'agents'];
+const FOCUS_WORDS = {
+  exfil: 'commands that send a secret or private file off the machine',
+  destroy: 'commands that delete or wreck files, history or data',
+  disarm: 'commands that turn the guard or other safety checks off',
+  agents: 'agent setup files (CLAUDE.md, AGENTS.md, skills, hooks, mcp configs) with planted problems',
+};
+
+function inFocus(set, r, focus) {
+  if (!focus) return true;
+  if (focus === 'agents') return set === 'agents';
+  return set === 'guard' && r.kind === focus;
+}
+
+function missesForPrompt(report, focus = null) {
   const lines = [];
   const seenDir = report.seen || {};
-  for (const r of (seenDir.guard && seenDir.guard.results) || []) if (!r.ok) lines.push(`guard ${r.id}: expected ${r.expect}, got ${r.got}${r.rule ? ` (${r.rule})` : ''}`);
-  for (const r of (seenDir.agents && seenDir.agents.results) || []) if (!r.ok) lines.push(`agents ${r.id}: missed ${r.missed.join(', ') || 'none'}, false alarms ${r.false_alarms.join(', ') || 'none'}`);
+  for (const r of (seenDir.guard && seenDir.guard.results) || []) if (!r.ok && inFocus('guard', r, focus)) lines.push(`guard ${r.id}: expected ${r.expect}, got ${r.got}${r.rule ? ` (${r.rule})` : ''}`);
+  for (const r of (seenDir.agents && seenDir.agents.results) || []) if (!r.ok && inFocus('agents', r, focus)) lines.push(`agents ${r.id}: missed ${r.missed.join(', ') || 'none'}, false alarms ${r.false_alarms.join(', ') || 'none'}`);
   return lines;
 }
 
-function buildPrompt({ report, signals, seenDirRel }) {
+// Misses per focus area, for handing each parallel proposer its own area.
+function missCounts(report) {
+  return Object.fromEntries(FOCI.map((f) => [f, missesForPrompt(report, f).length]));
+}
+
+function buildPrompt({ report, signals, seenDirRel, focus = null, tonight = [] }) {
   const totals = (half) => Object.entries(report[half] || {}).map(([set, s]) => `${set}: ${JSON.stringify(Object.fromEntries(Object.entries(s).filter(([k]) => k !== 'results' && k !== 'by_kind')))}`).join('\n');
   return [
     'You are improving the atris sentinel, a fixed-rule safety check for coding agents. Propose exactly one small change.',
@@ -320,8 +342,11 @@ function buildPrompt({ report, signals, seenDirRel }) {
     'Known limits a literal rule cannot fix, so do not try: one-liners run through an interpreter (python -c, node -e and similar) that read a secret and send it. Literal words cannot tell reading a secret and sending it apart from printing a variable next to a web address, and reviewers rejected three such rules tonight for blocking everyday commands. Pick a different miss.',
     'Before proposing a command_block, picture five everyday developer commands that contain the same literal substrings. If any of them would be blocked, the rule is too broad.',
     '',
-    'Seen items the current code gets wrong:',
-    ...(missesForPrompt(report).map((l) => `  ${l}`)),
+    ...(focus ? [`Focus: ${focus}, ${FOCUS_WORDS[focus]}. Other proposers cover the other areas tonight. Propose a change for this area only.`, ''] : []),
+    ...(tonight.length ? ['Learned earlier tonight from a strict reviewer. Treat these as part of the exam:', ...tonight.map((l) => `  ${l}`), ''] : []),
+    focus ? `Seen items the current code gets wrong in this area:` : 'Seen items the current code gets wrong:',
+    ...(missesForPrompt(report, focus).map((l) => `  ${l}`)),
+    ...(focus && !missesForPrompt(report, focus).length ? ['  none. look for a general weakness in this area that the hidden half may hold'] : []),
     '',
     'Current totals, seen half:',
     totals('seen'),
@@ -505,9 +530,63 @@ function cleanItems(p, prefix) {
   return out;
 }
 
+// The strict secret check for exam items an engine wrote, proposer or
+// reviewer. Unlike the repo scan it honors no suppression marker and no
+// placeholder exemption: a marker or any match of a secret rule counts.
+// Exam items may write a key only as a {{fake:...}} placeholder.
+const SUPPRESS = /atris-allow-secret|atris-security-ignore|nosec/i;
+function strictSecret(text) {
+  const { SECRET_RULES } = require('./security-scan');
+  const s = String(text || '');
+  if (SUPPRESS.test(s)) return true;
+  return SECRET_RULES.some((rule) => rule.re.test(s));
+}
+const SECRET_ITEM_ERROR = 'the proposal holds an exam item that looks like a real key. keys in exam items must be {{fake:...}} placeholders';
+const SECRET_PROPOSAL_ERROR = 'the proposal holds text that looks like a secret';
+
+// The one gate for engine text. Every raw string in a value, keys included,
+// is checked with the strict secret check before anything is serialized or
+// written. One failing string fails the whole value. True means clean.
+function gateValue(v, depth = 0) {
+  if (depth > 40) return false;
+  if (typeof v === 'string') return !strictSecret(v);
+  if (Array.isArray(v)) return v.every((x) => gateValue(x, depth + 1));
+  if (v && typeof v === 'object') return Object.entries(v).every(([k, x]) => !strictSecret(k) && gateValue(x, depth + 1));
+  return true;
+}
+
+// Errors and reasons that get written are fixed sentences chosen here,
+// never built from engine output: no file names, field names, titles or
+// example text. Anything not known maps to one plain sentence.
+const FIXED_ERRORS = [
+  [/^the time limit ran out/, 'the time limit ran out'],
+  [/did not return a proposal|not one json|is not json|must be one object|needs the new rules or one to six edits|an edit/, 'the proposer gave no usable proposal'],
+  [/only lib\/sentinel-rules\.json may change/, 'the proposal named a file other than lib/sentinel-rules.json. only lib/sentinel-rules.json may change'],
+  [/break the schema/, 'the proposed rules break the schema'],
+  [/changed files it may not touch/, 'the proposer changed files it may not touch'],
+  [/looks like a real key/, SECRET_ITEM_ERROR],
+  [/looks like a secret/, SECRET_PROPOSAL_ERROR],
+  [/^the proposer failed/, 'the proposer did not finish'],
+  [/^the exam did not run|^the exam printed|ran out of time/, 'the exam did not run'],
+  [/cannot be kept from reading/, 'that engine may not propose'],
+  [/the copy changed while the exam ran/, 'the copy changed while the exam ran'],
+  [/touches files other than the rules/, 'the change touches files other than the rules and the seen items'],
+];
+function fixedError(e) {
+  const m = String((e && e.message) || e || '');
+  for (const [re, text] of FIXED_ERRORS) if (re.test(m)) return text;
+  return 'the proposal could not be judged';
+}
+
+// A keep-rule reason without the item ids it may list.
+function fixedReason(r) {
+  return String(r || '').replace(/:.*$/, '');
+}
+
 function appendItems(seenDir, items) {
   for (const set of ['guard', 'agents']) {
-    const list = items.filter((x) => x.set === set).map((x) => x.item);
+    // The gate again at the write: an item that fails is never written.
+    const list = items.filter((x) => x.set === set && gateValue(x.item)).map((x) => x.item);
     if (!list.length) continue;
     const file = path.join(seenDir, `${set}.jsonl`);
     fs.appendFileSync(file, list.map((i) => JSON.stringify(i)).join('\n') + '\n');
@@ -531,7 +610,9 @@ function renderReceipt({ at, engine, proposal, items, before, after, decision, b
   lines.push('proposer sealed: reads denied under ~/.atris and the held-out folder, no shell, no mcp servers or connectors, temp HOME, no api keys. only the rules file may change');
   if (error) lines.push(`stopped: ${error}`);
   if (proposal) {
-    lines.push('', '## the change', '', `${String(proposal.title || 'untitled').slice(0, 300)}`, '', `${String(proposal.why || '').slice(0, 600)}`, '', `file: ${proposal.file}`);
+    // The proposer's title and reasons are never written. The change itself
+    // is the rules diff on the branch.
+    lines.push('', '## the change', '', 'one change to lib/sentinel-rules.json. read the rules diff on the branch', '');
     lines.push(`new seen exam items: ${items ? items.length : 0}`);
   }
   if (before && after) {
@@ -556,7 +637,7 @@ function renderReceipt({ at, engine, proposal, items, before, after, decision, b
     if (decision.path) lines.push(`- kept because: ${decision.path}`);
     for (const g of decision.gains) lines.push(`- gain: ${g}`);
     for (const n of decision.notes || []) lines.push(`- note: ${n}`);
-    for (const r of decision.reasons) lines.push(`- stop: ${r}`);
+    for (const r of decision.reasons) lines.push(`- stop: ${fixedReason(r)}`);
   }
   lines.push('');
   return lines.join('\n');
@@ -564,8 +645,9 @@ function renderReceipt({ at, engine, proposal, items, before, after, decision, b
 
 // ---------------------------------------------------------------- git
 
-function git(cwd, args, { check = true, env } = {}) {
-  const r = spawnSync('git', args, { cwd, encoding: 'utf8', maxBuffer: 32 * 1024 * 1024, ...(env ? { env } : {}) });
+function git(cwd, args, { check = true, env, timeoutMs } = {}) {
+  const r = spawnSync('git', args, { cwd, encoding: 'utf8', maxBuffer: 32 * 1024 * 1024, ...(env ? { env } : {}), ...(timeoutMs ? { timeout: Math.max(1, Math.floor(timeoutMs)) } : {}) });
+  if (r.error && r.error.code === 'ETIMEDOUT') throw new Error(`git ${args[0]} ran out of time`);
   if (check && r.status !== 0) throw new Error(`git ${args[0]} failed: ${String(r.stderr || r.stdout || '').trim().split('\n').slice(-1)[0]}`);
   return r;
 }
@@ -679,7 +761,7 @@ function sweepStale(root, env) {
   for (const block of list.split('\n\n')) {
     const tree = (block.match(/^worktree (.+)$/m) || [])[1];
     const branch = ((block.match(/^branch refs\/heads\/(.+)$/m) || [])[1]) || '';
-    if (!tree || !/^sentinel-improve\//.test(branch) || !/atris-sentinel-improve-/.test(path.basename(tree))) continue;
+    if (!tree || !/^sentinel-(?:improve|exam)\//.test(branch) || !/atris-sentinel-improve-/.test(path.basename(tree))) continue;
     const rec = records.get(path.resolve(tree)) || [...records.values()].find((r) => fs.existsSync(r.tree) && fs.existsSync(tree) && fs.realpathSync(r.tree) === fs.realpathSync(tree));
     const keep = (reason) => kept.push({ tree, branch, reason });
     if (!rec) { keep('no record says which run owns it'); continue; }
@@ -702,6 +784,7 @@ async function improve(opts = {}) {
   if (!fs.existsSync(path.join(root, RULES_PATH))) throw new Error(`${root} is not an atris checkout with the sentinel rules in it`);
   const refused = refusedEngine(engine);
   if (refused) throw new Error(refused);
+  if (opts.focus && !FOCI.includes(opts.focus)) throw new Error(`unknown focus: ${opts.focus}. use ${FOCI.join(', ')}`);
   const judge = opts.judge || ((args) => runJudge({ ...args, env, atrisBin: opts.atrisBin }));
   const propose = opts.propose || ((args) => askEngine({ ...args, env }));
   const at = now.toISOString();
@@ -738,13 +821,16 @@ async function improve(opts = {}) {
     log('running the exam on the current code');
     const current = judge({ target: tree, seenDir });
     log(`asking ${engine} for one change`);
-    const answer = await propose({ engine, prompt: buildPrompt({ report: current, signals, seenDirRel: seenRel }), cwd: tree, sealed: [path.join(homeDir(env), '.atris'), current.holdout_dir, ...(current.sealed_sources || [])] });
+    const answer = await propose({ engine, prompt: buildPrompt({ report: current, signals, seenDirRel: seenRel, focus: opts.focus || null }), cwd: tree, sealed: [path.join(homeDir(env), '.atris'), current.holdout_dir, ...(current.sealed_sources || [])] });
     proposal = answer && typeof answer === 'object' && (Array.isArray(answer.edits) || answer.rules) ? answer : extractJsonObject(answer && answer.stdout);
     const bad = checkProposal(proposal, tree);
     if (bad) throw new Error(bad);
     const strayEarly = strayChanges(tree);
     if (strayEarly.length) throw new Error(`the proposer changed files it may not touch: ${strayEarly.slice(0, 3).join(', ')}`);
+    if (Array.isArray(proposal.new_items) && !gateValue(proposal.new_items)) throw new Error(SECRET_ITEM_ERROR);
+    if (!gateValue(proposal)) throw new Error(SECRET_PROPOSAL_ERROR);
     items = cleanItems(proposal, `imp-${id.slice(0, 8)}`);
+    if (items.some((x) => !gateValue(x.item))) throw new Error(SECRET_ITEM_ERROR);
     fs.mkdirSync(candSeen, { recursive: true });
     for (const set of ['guard', 'agents']) {
       const f = path.join(seenDir, `${set}.jsonl`);
@@ -774,14 +860,14 @@ async function improve(opts = {}) {
       const outside = strayChanges(tree, new Set([...ALLOWED_CHANGES, rel]));
       if (outside.length) throw new Error(`the change touches files other than the rules and the seen items: ${outside.slice(0, 3).join(', ')}`);
       git(tree, ['add', RULES_PATH, seenRel]);
-      const msg = `Sentinel improve: ${String(proposal.title || 'one guard change').replace(/\s+/g, ' ').slice(0, 72)}\n\nKept by the sentinel bench. Receipt: ${rel}\n\nCo-authored-by: Atris <299057014+atris-builder[bot]@users.noreply.github.com>`;
+      const msg = `Sentinel improve: one guard rules change\n\nKept by the sentinel bench. Receipt: ${rel}\n\nCo-authored-by: Atris <299057014+atris-builder[bot]@users.noreply.github.com>`;
       git(tree, ['commit', '-q', '-m', msg], { env });
       keepBranch = true;
       out.branch = branch;
       out.kept = true;
     }
   } catch (e) {
-    error = String(e.message || e).split('\n')[0].slice(0, 300);
+    error = fixedError(e);
   } finally {
     fs.rmSync(candidate, { recursive: true, force: true });
     // Kept, rejected or failed: the same safe check decides if the copy goes.
@@ -811,6 +897,31 @@ function schedulePlan({ root, engine = 'claude', everyHours = 24, env = process.
 }
 
 module.exports = {
+  SECRET_ITEM_ERROR,
+  SECRET_PROPOSAL_ERROR,
+  fixedError,
+  fixedReason,
+  gateValue,
+  strictSecret,
+  FOCI,
+  RULES_PATH,
+  SEEN_REL,
+  appendItems,
+  applyRules,
+  askEngine,
+  cleanItems,
+  dropCopy,
+  git,
+  homeDir,
+  missCounts,
+  okMap,
+  pgidOf,
+  repoTop,
+  runAlive,
+  runsDir,
+  stamp,
+  strayChanges,
+  totalsLine,
   buildPrompt,
   checkProposal,
   engineEnv,