blun-king-cli 9.1.587 → 9.1.588

package/agent-spine-plugin/src/lib/learning-context.js

@@ -37,7 +37,8 @@ export function visible(candidate, entities, audience, includePrivate, groupId)
 
 export async function learningContext({
   root = process.cwd(), includePrivate = false, groupId = null, kinds = null,
-  subjectIds = null, scope = null, maxItems = null, catalog: providedCatalog = null, now = new Date()
+  subjectIds = null, scope = null, maxItems = null, catalog: providedCatalog = null, now = new Date(),
+  taskFocus = null
 } = {}) {
   const catalog = providedCatalog || await buildCatalog(root);
   const { learning } = await loadLearning(catalog.root, catalog);
@@ -75,10 +76,14 @@ export async function learningContext({
     .filter((candidate) => !subjectFilter || subjectFilter.has(candidate.subjectId))
     .filter((candidate) => candidate.privacy !== "group" || (groupId && candidate.groupId === groupId))
     .filter((candidate) => visible(candidate, entities, audience, includePrivate, groupId));
-  const items = applicable
+  const candidates = applicable
     .filter((candidate) => !invalidCanaries.has(candidate.id))
-    .filter((candidate) => visible(candidate, entities, audience, includePrivate, groupId))
-    .sort((a, b) => b.confidence - a.confidence || b.updatedAt.localeCompare(a.updatedAt) || a.id.localeCompare(b.id))
+    .filter((candidate) => visible(candidate, entities, audience, includePrivate, groupId));
+  const focusedTaskId = typeof taskFocus === "string" && taskFocus === runtimeScope.taskId ? taskFocus : null;
+  const items = candidates
+    .sort((a, b) => Number(Boolean(focusedTaskId && b.scope?.taskId === focusedTaskId))
+      - Number(Boolean(focusedTaskId && a.scope?.taskId === focusedTaskId))
+      || b.confidence - a.confidence || b.updatedAt.localeCompare(a.updatedAt) || a.id.localeCompare(b.id))
     .slice(0, limit)
     .map((candidate) => ({
       id: candidate.id,
@@ -97,6 +102,8 @@ export async function learningContext({
           && new Date(candidate.promotion.canary.revalidation.expiresAt).getTime() >= new Date(timestamp).getTime()
           ? "revalidating" : candidate.promotion.canary.status)
         : "not-required",
+      ...(focusedTaskId && candidate.scope?.taskId === focusedTaskId
+        ? { relevance: { taskId: focusedTaskId, match: "exact-task" } } : {}),
       authority: "context-only"
     }));
   return {

package/agent-spine-plugin/src/lib/learning-measurements.js

@@ -23,7 +23,7 @@ import {
 
 export async function recordLearningMeasurement({
   root = process.cwd(), id = `measurement:${randomUUID()}`, learningId, evaluationId, phase, scope, metric,
-  measurement, coverage, measuredAt, confirmLocalMeasurement = false, now = new Date()
+  measurement, coverage, measuredAt, confirmLocalMeasurement = false, now = new Date(), catalog: providedCatalog = null
 }) {
   if (!confirmLocalMeasurement) throw new Error("measurement registration requires explicit local confirmation");
   if (!ID_RE.test(id || "") || !ID_RE.test(learningId || "") || !ID_RE.test(evaluationId || "")) {
@@ -205,7 +205,7 @@ export async function recordLearningMeasurement({
     state.measurementLineage.push(lineage);
     state.measurementLineage.sort((a, b) => a.measurementReceiptId.localeCompare(b.measurementReceiptId));
     return { receipt, lineage, learningPath, unchanged: false };
-  });
+  }, providedCatalog);
 }
 
 export async function revokeLearningMeasurement({

package/agent-spine-plugin/src/lib/mcp-runtime.js

@@ -25,6 +25,7 @@ import {
 import { sharedContext } from "./sharing.js";
 import { recordWorldAssertion, worldContext } from "./world-model.js";
 import { indexSessionTimeline, searchSessionTimeline } from "./session-timeline.js";
+import { captureSessionTimelineEvidence } from "./timeline-world-capture.js";
 import { gatewayEnvironmentContext } from "./hook-context.js";
 import {
   timelineInvocationInput, timelineInvocationRequest
@@ -48,6 +49,66 @@ function timelineTransport(input, root, environment) {
 
 function absent(value) { return value === undefined || value === null || value === ""; }
 
+function gatewayWorldRoute(environment) {
+  const gateway = gatewayEnvironmentContext(environment);
+  return gateway?.portalRef && gateway?.threadRef ? gateway : null;
+}
+
+function exactGatewayValue(args, key, value) {
+  if (!absent(args[key]) && args[key] !== value) {
+    throw new Error(`${key} does not match the authenticated gateway binding`);
+  }
+  return value ?? null;
+}
+
+function boundGatewayBriefing(args, gateway) {
+  if (!gateway) return args;
+  const result = { ...args, portalRef: gateway.portalRef, threadRef: gateway.threadRef };
+  for (const [key, gatewayKey] of [["host", "host"], ["entityId", "entityId"],
+    ["projectId", "projectId"], ["groupId", "groupId"], ["currentTaskId", "taskId"]]) {
+    result[key] = exactGatewayValue(args, key, gateway[gatewayKey]);
+  }
+  if (result.groupId && result.includePrivate) {
+    throw new Error("private briefing context cannot be requested from an authenticated group route");
+  }
+  return result;
+}
+
+function boundWorldWrite(args, environment) {
+  if (Object.hasOwn(args, "portalRef") || Object.hasOwn(args, "threadRef")) {
+    throw new Error("portal and thread references are supplied only by the authenticated gateway");
+  }
+  const gateway = gatewayWorldRoute(environment);
+  if (!gateway || !args.knowledgeKind || args.subjectId !== gateway.taskId) return args;
+  const projectId = exactGatewayValue(args, "projectId", gateway.projectId);
+  const groupId = exactGatewayValue(args, "groupId", gateway.groupId);
+  if (groupId && args.privacy !== "group") {
+    throw new Error("task knowledge from an authenticated group route requires group privacy");
+  }
+  if (!groupId && args.privacy === "group") {
+    throw new Error("group task knowledge requires an authenticated group route");
+  }
+  return { ...args, projectId, groupId, portalRef: gateway.portalRef, threadRef: gateway.threadRef };
+}
+
+function boundWorldRead(args, environment) {
+  if (Object.hasOwn(args, "portalRef") || Object.hasOwn(args, "threadRef")) {
+    throw new Error("portal and thread references are supplied only by the authenticated gateway");
+  }
+  const gateway = gatewayWorldRoute(environment);
+  if (!gateway) return args;
+  if (args.continuationTaskId && gateway.taskId && args.continuationTaskId !== gateway.taskId) {
+    throw new Error("continuationTaskId does not match the authenticated gateway task");
+  }
+  const projectId = exactGatewayValue(args, "projectId", gateway.projectId);
+  const groupId = exactGatewayValue(args, "groupId", gateway.groupId);
+  if (groupId && args.includePrivate) {
+    throw new Error("private world context cannot be requested from an authenticated group route");
+  }
+  return { ...args, projectId, groupId, portalRef: gateway.portalRef, threadRef: gateway.threadRef,
+    continuationTaskId: args.continuationTaskId ?? gateway.taskId };
+}
+
 // The MCP process can outlive a host turn.  A group claim that appears after a
 // private permit was issued must therefore suppress consumption here as well
 // as in PreToolUse; tool arguments cannot clear an authenticated environment.
@@ -99,7 +160,8 @@ async function callTool(name, args = {}, environment = process.env) {
     }));
   }
   if (name === "session_briefing") {
-    const scoped = await boundBriefingArguments({ ...args, root });
+    const gateway = gatewayWorldRoute(environment);
+    const scoped = boundGatewayBriefing(await boundBriefingArguments({ ...args, root }), gateway);
     const sources = await resolveMcpSources({ ...scoped, required: Boolean(args.requirementId) });
     const briefing = await sessionBriefing({ ...scoped, host: sources.host,
       catalog: sources.catalog, userStateRoot: sources.userStateRoot, sourceDiagnostics: sources.diagnostics });
@@ -150,8 +212,12 @@ async function callTool(name, args = {}, environment = process.env) {
   if (name === "update_task") return textResult(await updateTask({ ...args, root }));
   if (name === "task_context") return textResult(await taskContext({ ...args, root }));
   if (name === "shared_context") return textResult(await sharedContext({ ...args, root }));
-  if (name === "record_world_assertion") return textResult(await recordWorldAssertion({ ...args, root }));
-  if (name === "world_context") return textResult(await worldContext({ ...args, root }));
+  if (name === "record_world_assertion") {
+    return textResult(await recordWorldAssertion({ ...boundWorldWrite(args, environment), root }));
+  }
+  if (name === "world_context") {
+    return textResult(await worldContext({ ...boundWorldRead(args, environment), root }));
+  }
   if (name === "project_portfolio") return textResult(await projectPortfolioContext({ ...args, root }));
   if (name === "record_project_observation") return textResult(await recordProjectObservation({ ...args, root }));
   if (name === "evaluate_autonomy_action") return textResult(await evaluateAutonomyAction({ ...args, root }));
@@ -181,10 +247,30 @@ async function callTool(name, args = {}, environment = process.env) {
     if (!invocationRequest) return textResult(unavailableTimelineInvocation("timeline-invocation-unavailable"));
     return textResult(await searchSessionTimeline({ root, host: timeline.host, sessionId: input.request.sessionId, scope: timeline.scope,
       at: args.at, query: args.query, windowSeconds: args.windowSeconds, includePriorSessions: args.includePriorSessions,
+      includePriorProviders: args.includePriorProviders, environment,
       enrollmentDigest: input.request.enrollmentDigest,
       hostHome: timelineHostHome(timeline.host, environment), transportDigest: timeline.transportDigest,
       invocationRequest }));
   }
+  if (name === "session_timeline_capture") {
+    const input = timelineInvocationInput(args);
+    if (runtimeTimelineGroup(environment, input)) return textResult(unavailableTimelineInvocation("timeline-group-suppressed"));
+    if (!input.valid) return textResult(unavailableTimelineInvocation(input.reason || "timeline-scope-invalid"));
+    const timeline = timelineTransport(input, root, environment);
+    if (!runtimeGatewayMatchesTimeline(environment, timeline.scope, timeline.host)) {
+      return textResult(unavailableTimelineInvocation("timeline-gateway-binding-mismatch"));
+    }
+    const invocationRequest = timelineInvocationRequest("capture", args, root);
+    if (!invocationRequest) return textResult(unavailableTimelineInvocation("timeline-invocation-unavailable"));
+    return textResult(await captureSessionTimelineEvidence({ root, host: timeline.host,
+      sessionId: input.request.sessionId, scope: timeline.scope, eventId: args.eventId,
+      at: args.at, query: args.query, windowSeconds: args.windowSeconds,
+      includePriorSessions: args.includePriorSessions, includePriorProviders: args.includePriorProviders,
+      interpretation: args.interpretation ?? null,
+      environment, enrollmentDigest: input.request.enrollmentDigest,
+      hostHome: timelineHostHome(timeline.host, environment), transportDigest: timeline.transportDigest,
+      invocationRequest }));
+  }
   if (name === "audit") return textResult(await runAudit(root));
   if (name === "complete_delivery") {
     const completed = await completeDelivery(args);

package/agent-spine-plugin/src/lib/mcp-source-context.js

@@ -3,7 +3,7 @@ import { resolveHostSourceCatalog } from "./source-roots.js";
 import { inspectPremortemState } from "./delivery-premortem.js";
 
 const INTERNAL = new Set(["catalog", "userStateRoot", "sourceDiagnostics", "sourceRegistry",
-  "env", "input", "memoryHooks", "resolvedSources"]);
+  "env", "input", "memoryHooks", "resolvedSources", "portalRef", "threadRef"]);
 
 export function rejectInternalSourceArguments(args) {
   for (const key of INTERNAL) {
@@ -31,8 +31,18 @@ export async function boundBriefingArguments(args) {
 }
 
 export async function resolveMcpSources({ root, cwd = root,
-  host = process.env.AGENTSPINE_HOST || "generic", entityId = null,
+  host, entityId = null,
   groupId = null, projectId = null, currentTaskId = null, required = false }) {
+  const blunHost = Boolean(process.env.BLUN_HOME && process.env.BLUN_PLUGIN_ROOT);
+  const runtimeHost = blunHost && process.env.AGENTSPINE_HOST === "blun"
+    ? "codex" : process.env.AGENTSPINE_HOST;
+  const selectedHost = host === undefined ? runtimeHost : host;
+  // King binds both values when loading this plugin; model arguments cannot
+  // switch that running host to another application's private profile.
+  if (blunHost && selectedHost !== undefined && selectedHost !== "codex") {
+    throw new Error("MCP source host does not match the running BLUN host");
+  }
+  host = blunHost ? "codex" : (host === undefined ? process.env.AGENTSPINE_HOST || "generic" : host);
   const canonicalRoot = await canonicalPath(root);
   const canonicalCwd = await canonicalPath(cwd);
   if (!isInside(canonicalRoot, canonicalCwd)) throw new Error("MCP cwd must remain inside its root");

package/agent-spine-plugin/src/lib/mcp-timeline-tools.js

@@ -6,18 +6,60 @@ const stableId = {
 };
 
 const optionalId = { anyOf: [stableId, { type: "null" }] };
+const assertionId = {
+  type: "string",
+  pattern: "^assertion:[A-Za-z0-9][A-Za-z0-9._/-]{0,190}$"
+};
+
+export const TIMELINE_INTERPRETATION_SCHEMA = "agentspine.timeline-user-feedback-interpretation-request/v1";
+export const TIMELINE_CLARIFICATION_SCHEMA = "agentspine.timeline-user-feedback-clarification-request/v2";
+const INTERPRETATION_KINDS = new Set([
+  "next-step-correction", "completion-claim", "not-current-instruction", "ambiguous"
+]);
+
+export function timelineInterpretationRequest(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)
+    || Object.getPrototypeOf(value) !== Object.prototype) return null;
+  const clarificationKeys = ["schema", "feedbackAssertionIds", "targetAssertionId", "clarificationQuestion"];
+  if (Object.keys(value).sort().join("\0") === clarificationKeys.sort().join("\0")
+    && value.schema === TIMELINE_CLARIFICATION_SCHEMA
+    && Array.isArray(value.feedbackAssertionIds) && value.feedbackAssertionIds.length >= 2
+    && value.feedbackAssertionIds.length <= 3
+    && value.feedbackAssertionIds.every((id) => /^assertion:[A-Za-z0-9][A-Za-z0-9._/-]{0,190}$/.test(id))
+    && new Set(value.feedbackAssertionIds).size === value.feedbackAssertionIds.length
+    && [...value.feedbackAssertionIds].sort().every((id, index) => id === value.feedbackAssertionIds[index])
+    && /^assertion:[A-Za-z0-9][A-Za-z0-9._/-]{0,190}$/.test(value.targetAssertionId || "")
+    && typeof value.clarificationQuestion === "string" && Boolean(value.clarificationQuestion.trim())
+    && value.clarificationQuestion.length <= 300 && !/[\r\n]/u.test(value.clarificationQuestion)) {
+    return structuredClone(value);
+  }
+  const keys = ["schema", "feedbackAssertionId", "targetAssertionId", "kind",
+    "proposedNextStepSummary", "clarificationQuestion"];
+  if (Object.keys(value).sort().join("\0") !== keys.sort().join("\0")
+    || value.schema !== TIMELINE_INTERPRETATION_SCHEMA
+    || !/^assertion:[A-Za-z0-9][A-Za-z0-9._/-]{0,190}$/.test(value.feedbackAssertionId || "")
+    || !/^assertion:[A-Za-z0-9][A-Za-z0-9._/-]{0,190}$/.test(value.targetAssertionId || "")
+    || !INTERPRETATION_KINDS.has(value.kind)) return null;
+  const next = value.proposedNextStepSummary;
+  const question = value.clarificationQuestion;
+  const validNext = typeof next === "string" && Boolean(next.trim())
+    && next.length <= 500 && !/[\r\n]/u.test(next);
+  const validQuestion = typeof question === "string" && Boolean(question.trim())
+    && question.length <= 300 && !/[\r\n]/u.test(question);
+  if ((value.kind === "next-step-correction" ? !validNext || question !== null
+    : next !== null || (value.kind === "ambiguous" ? !validQuestion : question !== null))) return null;
+  return structuredClone(value);
+}
 
 // Hosts qualify MCP tools differently. These prefixes must stay exact: a
 // foreign MCP server can expose an identically named tool but must never
 // receive a timeline invocation permit.
 export const AGENTSPINE_TIMELINE_TOOL_PREFIX = "mcp__plugin_agent-spine_agent-spine__";
 export const BLUN_TIMELINE_TOOL_PREFIX = "mcp__agent-spine__";
-export const KING_PLUGIN_TIMELINE_TOOL_PREFIX = "mcp__plugin-agent-spine_agent-spine__";
 
 const TIMELINE_TOOL_PREFIXES = [
   AGENTSPINE_TIMELINE_TOOL_PREFIX,
-  BLUN_TIMELINE_TOOL_PREFIX,
-  KING_PLUGIN_TIMELINE_TOOL_PREFIX
+  BLUN_TIMELINE_TOOL_PREFIX
 ];
 
 const SCOPE_FIELDS = [
@@ -29,6 +71,8 @@ const SCOPE_FIELDS = [
   ["currentTaskId", ["taskId", "task_id", "currentTaskId", "current_task_id"]],
   ["goalId", ["goalId", "goal_id"]],
   ["goalStepId", ["goalStepId", "goal_step_id"]],
+  ["portalRef", ["portalRef", "portal_ref"]],
+  ["threadRef", ["threadRef", "thread_ref"]],
   ["timelineVisibility", ["timelineVisibility", "timeline_visibility"]]
 ];
 
@@ -110,6 +154,7 @@ export function timelineToolKind(name) {
   const qualified = String(name || "");
   if (TIMELINE_TOOL_PREFIXES.some((prefix) => qualified === `${prefix}session_timeline_index`)) return "index";
   if (TIMELINE_TOOL_PREFIXES.some((prefix) => qualified === `${prefix}session_timeline_search`)) return "search";
+  if (TIMELINE_TOOL_PREFIXES.some((prefix) => qualified === `${prefix}session_timeline_capture`)) return "capture";
   return null;
 }
 
@@ -120,17 +165,22 @@ export function timelineInvocationRequest(tool, args, root) {
   const request = { root, tool, sessionId: input.request.sessionId, entityId: scope.entityId, userId: scope.userId,
     tenantId: scope.tenantId, projectId: scope.projectId, groupId: scope.groupId, taskId: scope.currentTaskId,
     goalId: scope.goalId, goalStepId: scope.goalStepId, timelineVisibility: scope.timelineVisibility,
+    portalRef: scope.portalRef, threadRef: scope.threadRef,
     enrollmentDigest: input.request.enrollmentDigest };
   if (tool === "index") return { ...request, maxBytes: args.maxBytes ?? 4 * 1024 * 1024 };
-  return { ...request, at: args.at ?? null, query: args.query ?? null,
+  return { ...request, ...(tool === "capture" ? { eventId: args.eventId ?? null,
+    interpretation: args.interpretation ?? null } : {}),
+    at: args.at ?? null, query: args.query ?? null,
     windowSeconds: args.windowSeconds === undefined ? 0 : args.windowSeconds,
-    includePriorSessions: args.includePriorSessions === true };
+    includePriorSessions: args.includePriorSessions === true,
+    includePriorProviders: args.includePriorProviders === true };
 }
 
 const scopeProperties = {
   host: { enum: TIMELINE_HOSTS },
   entityId: stableId, userId: stableId, tenantId: stableId, projectId: stableId,
-  taskId: stableId, goalId: optionalId, goalStepId: optionalId
+  taskId: stableId, goalId: optionalId, goalStepId: optionalId,
+  portalRef: optionalId, threadRef: optionalId
 };
 
 export const sessionTimelineTools = [
@@ -148,7 +198,7 @@ export const sessionTimelineTools = [
   },
   {
     name: "session_timeline_search",
-    description: "Search the current or a same-task prior explicitly enrolled immutable Claude, Codex or King source for redacted objective evidence by exact UTC time or at least two concrete terms. Prior-session search opens only one indexed source and never grants authority.",
+    description: "Search one enrolled immutable same-task source for objective evidence or strict user corrections. Query 'user message' explicitly selects bounded native user-message candidates without interpreting them; add exact UTC time to narrow. No source text is indexed. Cross-provider recall requires opt-in; one source is opened and no authority is granted.",
     inputSchema: {
       type: "object", additionalProperties: false,
       required: [],
@@ -158,7 +208,40 @@ export const sessionTimelineTools = [
         timelineVisibility: { const: "private-verified" }, groupId: { anyOf: [stableId, { type: "null" }] },
         at: { type: "string", format: "date-time" }, query: { type: "string", minLength: 3, maxLength: 512 },
         windowSeconds: { type: "integer", minimum: 0, maximum: 900 },
-        includePriorSessions: { type: "boolean" } }
+        includePriorSessions: { type: "boolean" }, includePriorProviders: { type: "boolean" } }
+    }
+  },
+  {
+    name: "session_timeline_capture",
+    description: "Reopen one source-bound event. Objective fields become descriptive task state; strict prefixed corrections may replace the same-thread next step. Natural user messages remain uninterpreted beside their exact checkpoint. A second source-bound call may preserve one model interpretation as an unconfirmed proposal; it never changes continuation, proves completion or grants authority.",
+    inputSchema: {
+      type: "object", additionalProperties: false,
+      required: ["eventId"],
+      anyOf: [{ required: ["at"] }, { required: ["query"] }],
+      properties: { root: { type: "string", minLength: 1 }, sessionId: stableId, ...scopeProperties,
+        enrollmentDigest: { type: "string", pattern: "^[a-f0-9]{64}$" },
+        timelineVisibility: { const: "private-verified" }, groupId: { anyOf: [stableId, { type: "null" }] },
+        eventId: { type: "string", pattern: "^timeline-event:[a-f0-9]{32}$" },
+        interpretation: { oneOf: [{
+          type: "object", additionalProperties: false,
+          required: ["schema", "feedbackAssertionId", "targetAssertionId", "kind",
+            "proposedNextStepSummary", "clarificationQuestion"],
+          properties: { schema: { const: TIMELINE_INTERPRETATION_SCHEMA },
+            feedbackAssertionId: assertionId, targetAssertionId: assertionId,
+            kind: { enum: [...INTERPRETATION_KINDS] },
+            proposedNextStepSummary: { anyOf: [{ type: "string", minLength: 1, maxLength: 500 }, { type: "null" }] },
+            clarificationQuestion: { anyOf: [{ type: "string", minLength: 1, maxLength: 300 }, { type: "null" }] } }
+        }, {
+          type: "object", additionalProperties: false,
+          required: ["schema", "feedbackAssertionIds", "targetAssertionId", "clarificationQuestion"],
+          properties: { schema: { const: TIMELINE_CLARIFICATION_SCHEMA },
+            feedbackAssertionIds: { type: "array", minItems: 2, maxItems: 3, uniqueItems: true,
+              items: assertionId }, targetAssertionId: assertionId,
+            clarificationQuestion: { type: "string", minLength: 1, maxLength: 300 } }
+        }] },
+        at: { type: "string", format: "date-time" }, query: { type: "string", minLength: 3, maxLength: 512 },
+        windowSeconds: { type: "integer", minimum: 0, maximum: 900 },
+        includePriorSessions: { type: "boolean" }, includePriorProviders: { type: "boolean" } }
     }
   }
 ];

package/agent-spine-plugin/src/lib/mcp-world-tools.js

@@ -8,7 +8,7 @@ const nullableStableId = { anyOf: [stableId, { type: "null" }] };
 export const worldModelTools = [
   {
     name: "record_world_assertion",
-    description: "Persist one provenance-bound world, user, relationship, or team assertion outside source files. Optional typed knowledge distinguishes facts, user preferences, decisions, task state, and error lessons. Measurements and explicit user feedback become context-only facts; model output remains a proposal. Authority predicates and secret-shaped structured knowledge are rejected.",
+    description: "Persist one provenance-bound world, user, relationship, or team assertion outside source files. Optional typed knowledge distinguishes facts, user preferences, decisions, task state, and error lessons. In an authenticated portal task, task-subject knowledge is bound to the gateway's opaque portal/thread route; tool arguments cannot claim that route. Measurements and explicit user feedback become context-only facts; model output remains a proposal. Authority predicates and secret-shaped structured knowledge are rejected.",
     inputSchema: {
       type: "object", additionalProperties: false,
       required: ["id", "subjectId", "predicate", "value", "evidenceKind", "evidenceId", "evidenceDigest", "observedAt"],
@@ -36,7 +36,7 @@ export const worldModelTools = [
   },
   {
     name: "world_context",
-    description: "Read privacy-filtered world context. Conflicts, expiry, and suggestions remain separate; continuationTaskId adds bounded, sourced task-relevant knowledge.",
+    description: "Read privacy-filtered world context. Conflicts, expiry, and suggestions remain separate; continuationTaskId adds bounded, sourced task-relevant knowledge. An authenticated portal process automatically restricts task continuation to its opaque gateway route; route references are not accepted as tool input.",
     inputSchema: {
       type: "object", additionalProperties: false,
       properties: {

package/agent-spine-plugin/src/lib/owned-file-lock.js

@@ -3,11 +3,26 @@ import { open, readFile, stat, unlink, utimes } from "node:fs/promises";
 import { isFileLockContention, isTransientLockMetadataError } from "./filesystem-retry.js";
 
 const LOCK_SCHEMA = "agentspine.owned-file-lock/v1";
+const LOCAL_TAILS = new Map();
 
 function delay(milliseconds) {
   return new Promise((resolve) => setTimeout(resolve, milliseconds));
 }
 
+async function serialize(path, task) {
+  const previous = LOCAL_TAILS.get(path) || Promise.resolve();
+  let release;
+  const current = new Promise(resolve => { release = resolve; });
+  const tail = previous.catch(() => {}).then(() => current);
+  LOCAL_TAILS.set(path, tail);
+  await previous.catch(() => {});
+  try { return await task(); }
+  finally {
+    release();
+    if (LOCAL_TAILS.get(path) === tail) LOCAL_TAILS.delete(path);
+  }
+}
+
 function lockPayload(token, acquiredAt, leaseMs) {
   return {
     schema: LOCK_SCHEMA,
@@ -66,7 +81,7 @@ async function removeStaleLock(path, staleAfterMs, assertPath = null) {
   }
 }
 
-export async function withOwnedFileLock(path, task, {
+async function acquire(path, task, {
   staleAfterMs = 15000,
   heartbeatIntervalMs = 1000,
   retryDelayMs = 25,
@@ -161,3 +176,7 @@ export async function withOwnedFileLock(path, task, {
     }
   }
 }
+
+export function withOwnedFileLock(path, task, options) {
+  return serialize(path, () => acquire(path, task, options));
+}

package/agent-spine-plugin/src/lib/persona-runtime.js

@@ -3,7 +3,7 @@ import { constants as fsConstants } from "node:fs";
 import { lstat, open, opendir, readFile, realpath, stat, unlink, writeFile } from "node:fs/promises";
 import { isAbsolute, join } from "node:path";
 import { buildCatalog } from "./catalog.js";
-import { isFileLockContention, replaceFileWithRetry } from "./filesystem-retry.js";
+import { isFileLockContention, isTransientLockMetadataError, replaceFileWithRetry } from "./filesystem-retry.js";
 import { linkEntities, loadGraph, unlinkEntities, upsertEntity } from "./graph.js";
 import { isInside, projectStateDir } from "./paths.js";
 
@@ -175,7 +175,7 @@ async function withLock(paths, task) {
       try {
         const metadata = await stat(lockPath);
         if (Date.now() - metadata.mtimeMs > 90000) await unlink(lockPath);
-      } catch (lockError) { if (lockError.code !== "ENOENT") throw lockError; }
+      } catch (lockError) { if (!isTransientLockMetadataError(lockError)) throw lockError; }
       await new Promise((resolve) => setTimeout(resolve, 25));
     }
   }

package/agent-spine-plugin/src/lib/preflight-delivery-id.js

@@ -0,0 +1,27 @@
+import { createHash, randomBytes } from "node:crypto";
+
+const ID = /^[A-Za-z0-9][A-Za-z0-9:_.@/+~-]{0,255}$/;
+const issued = new WeakMap();
+
+function exact(value, field) {
+  if (value === null || value === undefined || value === "") return null;
+  if (typeof value !== "string" || !ID.test(value) || value.includes("*")) {
+    throw new Error(`${field} must be one exact ID`);
+  }
+  return value;
+}
+
+// Without a host ID, only the parsed invocation object can verify its receipt.
+export function preflightDeliveryId(input, { issue = false } = {}) {
+  if (!input || typeof input !== "object") return null;
+  const turn = exact(input.turn_id, "turnId");
+  const event = exact(input.event_id ?? input.hook_event_id, "hookEventId");
+  if (turn && event) return `host-turn:${createHash("sha256").update(`${turn}\0${event}`).digest("hex").slice(0, 32)}`;
+  if (turn || event) return turn || event;
+  let id = issued.get(input);
+  if (!id && issue) {
+    id = `hook-invocation:${randomBytes(16).toString("hex")}`;
+    issued.set(input, id);
+  }
+  return id || null;
+}

package/agent-spine-plugin/src/lib/preflight.js

@@ -5,6 +5,7 @@ import { lstat, mkdir, open, readFile, realpath, stat, unlink, writeFile } from
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { isFileLockContention, replaceFileWithRetry } from "./filesystem-retry.js";
 import { ancestorsBetween, isInside, stateRoot } from "./paths.js";
+import { preflightDeliveryId } from "./preflight-delivery-id.js";
 import { resolveHostSourceCatalog } from "./source-roots.js";
 
 export const PREFLIGHT_SCHEMA = "agentspine.preflight/v2";
@@ -493,8 +494,8 @@ export async function runPreflight({ input, scope, resolvedSources, prompt, now
   if (typeof prompt !== "string" || !prompt.length || Buffer.byteLength(prompt) > 64 * 1024) throw new Error("preflight requires one bounded prompt");
   const exactScope = scopeFromInput({ input, scope, resolvedSources, env });
   const promptDigest = sha256(prompt);
-  const deliveryId = exactId(input.event_id ?? input.hook_event_id, "hookEventId",
-    `prompt:${sha256(`${exactScope.sessionId}\0${promptDigest}`).slice(0, 32)}`);
+  const deliveryId = preflightDeliveryId(input, { issue: true });
+  if (!deliveryId) throw new Error("preflight hook invocation identity is unavailable");
   const paths = storagePaths(env);
   const policy = validatePolicy(await readJson(paths.policy, MAX_POLICY_BYTES, emptyPolicy));
   const profile = policy.profiles.find((item) => item.enabled && item.agentId === exactScope.agentId && item.host === exactScope.host
@@ -590,8 +591,7 @@ export async function verifyPreflightReceipt({ receipt, input, scope, resolvedSo
     || receipt.tenantId !== exactScope.tenantId || receipt.host !== exactScope.host || receipt.profileId !== exactScope.profileId
     || receipt.sessionId !== exactScope.sessionId || receipt.projectId !== exactScope.projectId || receipt.cwdDigest !== sha256(exactScope.cwd)
     || receipt.taskId !== exactScope.taskId || receipt.groupId !== exactScope.groupId) return false;
-  const deliveryId = exactId(input.event_id ?? input.hook_event_id, "hookEventId",
-    `prompt:${sha256(`${exactScope.sessionId}\0${sha256(prompt)}`).slice(0, 32)}`);
+  const deliveryId = preflightDeliveryId(input);
   if (receipt.deliveryId !== deliveryId) return false;
   const { id: _id, bodyDigest, signature, ...body } = receipt;
   if (digestObject(body) !== bodyDigest) return false;

package/agent-spine-plugin/src/lib/session-timeline-codex.js

@@ -56,3 +56,18 @@ export function codexTimelineToolResult(line) {
   }
   return typeof output === "string" ? { role: "tool", content: output, nativeMessageId: item.call_id } : null;
 }
+
+export function codexTimelineUserMessage(line) {
+  if (!RECORDS.has(line?.type) || line.schema_version !== undefined) {
+    throw new Error("codex-history-format-mismatch");
+  }
+  if (line.type !== "response_item") return null;
+  const item = line.payload;
+  if (!item || item.type !== "message" || item.role !== "user" || !Array.isArray(item.content)
+    || item.content.length > 12 || item.content.some((part) => part?.type !== "input_text"
+      || typeof part.text !== "string")) return null;
+  const nativeMessageId = item.id === undefined ? undefined : ID.test(item.id) ? item.id : null;
+  if (nativeMessageId === null) return null;
+  return { role: "user", content: item.content.map((part) => part.text).join("\n"),
+    ...(nativeMessageId ? { nativeMessageId } : {}) };
+}

package/agent-spine-plugin/src/lib/session-timeline-contract.js

@@ -7,7 +7,7 @@ export function safeTimelineId(value) {
 }
 
 export function sessionTimelineBinding({ host, sessionId, scope }) {
-  return {
+  const binding = {
     host: validTimelineHost(host) ? host : null,
     sessionId: safeTimelineId(sessionId),
     entityId: safeTimelineId(scope?.entityId),
@@ -19,6 +19,11 @@ export function sessionTimelineBinding({ host, sessionId, scope }) {
     goalId: safeTimelineId(scope?.goalId),
     goalStepId: safeTimelineId(scope?.goalStepId)
   };
+  if (scope?.portalRef || scope?.threadRef) {
+    binding.portalRef = safeTimelineId(scope?.portalRef);
+    binding.threadRef = safeTimelineId(scope?.threadRef);
+  }
+  return binding;
 }
 
 export function hasTimelineGroupScope(scope) {
@@ -31,12 +36,13 @@ export function hasVerifiedTimelinePrivateScope(scope) {
 
 export function completeTimelineBinding(value) {
   return validTimelineHost(value.host) && !value.groupId
+    && Boolean(value.portalRef) === Boolean(value.threadRef)
     && ["sessionId", "entityId", "userId", "tenantId", "projectId", "taskId"].every((key) => value[key]);
 }
 
 export function sameTimelineBinding(left, right) {
-  return ["host", "sessionId", "entityId", "userId", "tenantId", "projectId", "groupId", "taskId", "goalId", "goalStepId"]
-    .every((key) => left[key] === right[key]);
+  return ["host", "sessionId", "entityId", "userId", "tenantId", "projectId", "groupId", "taskId", "goalId", "goalStepId",
+    "portalRef", "threadRef"].every((key) => (left[key] ?? null) === (right[key] ?? null));
 }
 
 export function validTimelineBinding(value) {
@@ -44,5 +50,7 @@ export function validTimelineBinding(value) {
     && [value.sessionId, value.entityId, value.userId, value.tenantId, value.projectId, value.taskId]
       .every((item) => typeof item === "string" && TIMELINE_ID_RE.test(item))
     && [value.groupId, value.goalId, value.goalStepId]
-      .every((item) => item === null || (typeof item === "string" && TIMELINE_ID_RE.test(item)));
+      .every((item) => item === null || (typeof item === "string" && TIMELINE_ID_RE.test(item)))
+    && ((value.portalRef === undefined && value.threadRef === undefined)
+      || [value.portalRef, value.threadRef].every((item) => typeof item === "string" && TIMELINE_ID_RE.test(item)));
 }