chainlesschain 0.163.8 → 0.164.0

package/src/commands/session-location.js

@@ -0,0 +1,276 @@
+import fs from "node:fs";
+import path from "node:path";
+import { TextDecoder } from "node:util";
+import {
+  buildExecutionLocationCatalog,
+  buildExecutionLocationHandoffPreview,
+} from "../lib/execution-location-contract.js";
+import { captureAmbientExecutionLocation } from "../lib/execution-location-runtime.js";
+import { getVerifiedSessionExecutionLocationAuthority } from "../harness/jsonl-session-store.js";
+import {
+  sameFileStatIdentity,
+  samePathHandleFileIdentity,
+  withTrustedFileParentSync,
+} from "../lib/secure-file-identity.js";
+
+const MAX_HANDOFF_FACTS_BYTES = 1024 * 1024;
+export const SESSION_EXECUTION_LOCATION_AUTHORITY_SCHEMA =
+  "cc-session-execution-location-authority/v1";
+
+function readHandoffFacts(filePath, deps = {}) {
+  const runtimeFs = deps.fs || fs;
+  const withTrustedParent =
+    deps.withTrustedFileParentSync || withTrustedFileParentSync;
+  return withTrustedParent(
+    runtimeFs,
+    path.resolve(filePath),
+    ({ canonicalPath, parentDevice }) => {
+      const before = runtimeFs.lstatSync(canonicalPath, { bigint: true });
+      if (
+        before.isSymbolicLink() ||
+        !before.isFile() ||
+        Number(before.nlink) !== 1
+      ) {
+        throw new Error("handoff facts must be a regular, single-link file");
+      }
+      const size = Number(before.size);
+      if (size <= 0 || size > MAX_HANDOFF_FACTS_BYTES) {
+        throw new Error(
+          `handoff facts must be 1..${MAX_HANDOFF_FACTS_BYTES} bytes`,
+        );
+      }
+      let descriptor = null;
+      try {
+        descriptor = runtimeFs.openSync(
+          canonicalPath,
+          runtimeFs.constants.O_RDONLY |
+            Number(runtimeFs.constants.O_NOFOLLOW || 0),
+        );
+        const opened = runtimeFs.fstatSync(descriptor, { bigint: true });
+        const samePathHandle =
+          deps.samePathHandleFileIdentity || samePathHandleFileIdentity;
+        if (
+          !opened.isFile() ||
+          Number(opened.nlink) !== 1 ||
+          !samePathHandle(before, opened, parentDevice, deps.runtime)
+        ) {
+          throw new Error("handoff facts identity changed while opening");
+        }
+        const bounded = Buffer.allocUnsafe(MAX_HANDOFF_FACTS_BYTES + 1);
+        let bytesRead = 0;
+        while (bytesRead < bounded.length) {
+          const count = runtimeFs.readSync(
+            descriptor,
+            bounded,
+            bytesRead,
+            bounded.length - bytesRead,
+            null,
+          );
+          if (count === 0) break;
+          bytesRead += count;
+        }
+        if (bytesRead > MAX_HANDOFF_FACTS_BYTES) {
+          throw new Error(
+            `handoff facts exceed ${MAX_HANDOFF_FACTS_BYTES} bytes`,
+          );
+        }
+        const after = runtimeFs.fstatSync(descriptor, { bigint: true });
+        if (
+          Number(after.size) !== bytesRead ||
+          !(deps.sameFileStatIdentity || sameFileStatIdentity)(opened, after)
+        ) {
+          throw new Error("handoff facts changed while being read");
+        }
+        return JSON.parse(
+          new TextDecoder("utf-8", { fatal: true }).decode(
+            bounded.subarray(0, bytesRead),
+          ),
+        );
+      } finally {
+        if (descriptor !== null) runtimeFs.closeSync(descriptor);
+      }
+    },
+    { runtime: deps.runtime },
+  );
+}
+
+export function projectCurrentExecutionLocation(options = {}, deps = {}) {
+  const binding = (
+    deps.captureAmbientExecutionLocation || captureAmbientExecutionLocation
+  )(options, deps);
+  return {
+    schema: SESSION_EXECUTION_LOCATION_AUTHORITY_SCHEMA,
+    authority: "current-process-observation",
+    binding,
+  };
+}
+
+export function projectSessionExecutionLocation(sessionId, deps = {}) {
+  const authority = (
+    deps.getVerifiedSessionExecutionLocationAuthority ||
+    getVerifiedSessionExecutionLocationAuthority
+  )(sessionId);
+  return {
+    schema: SESSION_EXECUTION_LOCATION_AUTHORITY_SCHEMA,
+    authority: "verified-session-start",
+    sessionId: authority.sessionId,
+    headHash: authority.headHash,
+    eventCount: authority.eventCount,
+    binding: authority.binding,
+  };
+}
+
+export function projectExecutionLocationComparison(options = {}, deps = {}) {
+  return buildExecutionLocationCatalog(
+    (deps.captureAmbientExecutionLocation || captureAmbientExecutionLocation)(
+      options,
+      deps,
+    ),
+  );
+}
+
+export function projectExecutionLocationHandoff(
+  sessionId,
+  target,
+  factsPath,
+  deps = {},
+) {
+  const source = projectSessionExecutionLocation(sessionId, deps);
+  const facts = (deps.readHandoffFacts || readHandoffFacts)(factsPath, deps);
+  return {
+    ...buildExecutionLocationHandoffPreview({
+      sourceBinding: source.binding,
+      sourceAuthority: {
+        sessionId: source.sessionId,
+        headHash: source.headHash,
+        eventCount: source.eventCount,
+      },
+      target,
+      facts,
+    }),
+    session: {
+      sessionId: source.sessionId,
+      headHash: source.headHash,
+      eventCount: source.eventCount,
+    },
+  };
+}
+
+function renderBinding(binding) {
+  const git = binding.source.git;
+  return [
+    `Location: ${binding.location}`,
+    `Observed: ${binding.observed ? "yes" : "no"}`,
+    `Working directory: ${binding.source.cwd || "unknown"}`,
+    `Git root: ${git.root || "not detected"}`,
+    `Git head: ${git.head || "unknown"}`,
+    `Git commit: ${git.commit || "unknown"}`,
+    `Tools: ${binding.runtime.tools.join(", ") || "none observed"}`,
+    `Model: ${binding.model.provider || "unknown"}/${binding.model.name || "unknown"}`,
+    `Credential source: ${binding.model.credentialSource}`,
+    `Network policy: ${binding.policy.network}`,
+    `Sandbox strength: ${binding.policy.sandbox}`,
+    `Data boundary: ${binding.policy.dataBoundary.kind} (${binding.policy.dataBoundary.root || "unknown"})`,
+    "Remote Control: controls this host; it is not a remote execution location",
+  ].join("\n");
+}
+
+function writeProjection(projection, options = {}) {
+  if (options.json) {
+    process.stdout.write(`${JSON.stringify(projection, null, 2)}\n`);
+    return;
+  }
+  if (projection.binding) {
+    process.stdout.write(`${renderBinding(projection.binding)}\n`);
+    return;
+  }
+  if (Array.isArray(projection.locations)) {
+    process.stdout.write(
+      `${projection.locations
+        .map(
+          (entry) =>
+            `${entry.location.padEnd(10)} ${entry.availability.padEnd(24)} launch=${entry.capabilities.launch} resume=${entry.capabilities.resume} sandbox=${entry.policy.sandbox} network=${entry.policy.network}`,
+        )
+        .join(
+          "\n",
+        )}\nRemote Control is a control plane, not an execution location.\n`,
+    );
+    return;
+  }
+  process.stdout.write(
+    `${projection.allowed ? "ALLOWED" : "BLOCKED"}\n${
+      projection.blockers.length > 0
+        ? `Blockers:\n${projection.blockers.map((item) => `- ${item}`).join("\n")}\n`
+        : ""
+    }`,
+  );
+}
+
+function runAction(action, options = {}) {
+  try {
+    const projection = action();
+    writeProjection(projection, options);
+    return projection.allowed === false ? 2 : 0;
+  } catch (error) {
+    process.stderr.write(`Execution location failed: ${error.message}\n`);
+    return 1;
+  }
+}
+
+export function registerSessionLocationSubcommands(session) {
+  const location = session
+    .command("location")
+    .description(
+      "Inspect verified execution location, capabilities, and handoff safety",
+    );
+
+  location
+    .command("current")
+    .description("Observe where this CLI process is executing")
+    .option("--json", "Machine-readable JSON output")
+    .action((options) => {
+      process.exitCode = runAction(
+        () => projectCurrentExecutionLocation({}, {}),
+        options,
+      );
+    });
+
+  location
+    .command("show <id>")
+    .description("Show the execution location anchored by session_start")
+    .option("--json", "Machine-readable JSON output")
+    .action((id, options) => {
+      process.exitCode = runAction(
+        () => projectSessionExecutionLocation(id),
+        options,
+      );
+    });
+
+  location
+    .command("compare")
+    .description(
+      "Compare current and declared Local/WSL/SSH/Container/Cloud capabilities",
+    )
+    .option("--json", "Machine-readable JSON output")
+    .action((options) => {
+      process.exitCode = runAction(
+        () => projectExecutionLocationComparison({}, {}),
+        options,
+      );
+    });
+
+  location
+    .command("handoff <id> <target>")
+    .description("Preview a fail-closed, secret-free session handoff")
+    .requiredOption(
+      "--facts <path>",
+      "Versioned Git/summary/artifact/permission/target evidence JSON",
+    )
+    .option("--json", "Machine-readable JSON output")
+    .action((id, target, options) => {
+      process.exitCode = runAction(
+        () => projectExecutionLocationHandoff(id, target, options.facts),
+        options,
+      );
+    });
+}

package/src/commands/session.js

@@ -66,6 +66,7 @@ import { executionBroker } from "../lib/process-execution-broker/index.js";
 import { registerSessionMcpRecoveryCommands } from "./session-mcp-recovery.js";
 import { registerSessionShowSubcommand } from "./session-show.js";
 import { registerSessionObservabilitySubcommand } from "./session-observability.js";
+import { registerSessionLocationSubcommands } from "./session-location.js";
 
 export const _deps = {
   execFileSync: (...args) => executionBroker.execFileSync(...args),
@@ -222,6 +223,7 @@ export function registerSessionCommand(program) {
     .description("Conversation session management");
 
   registerSessionMcpRecoveryCommands(session);
+  registerSessionLocationSubcommands(session);
 
   // session list
   session

package/src/data/changelog.json

@@ -1,6 +1,19 @@
 {
   "source": "CHANGELOG.md",
   "releases": [
+    {
+      "productVersion": null,
+      "cliVersion": "0.164.0",
+      "cliVersions": ["0.163.8", "0.164.0"],
+      "date": "2026-08-15",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Added — cc CLI 0.164.0: governed marketplace, execution authority, and native isolation hardening",
+          "body": "> `chainlesschain` **0.163.8 → 0.164.0** (candidate; not yet published,\n> 2026-08-15).\n> CLI-only candidate; `@chainlesschain/personal-data-hub` remains **0.4.57**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Native clipboard images**: `/paste-image` can attach bounded PNG, JPEG,\n  GIF, and WebP clipboard payloads to the next vision turn. Windows, macOS,\n  Wayland, and X11 host adapters use literal arguments, private temporary\n  files, signature checks, byte/count limits, and the Process Broker boundary.\n- **Scoped execution and context authority**: runtime permissions now expose\n  exact side-effect explanations and scoped decisions, while session execution\n  locations, IDE context-center evidence, prompt interactions, and durable\n  workflow definitions carry versioned identities instead of ambient context.\n- **Governed plugin marketplace**: catalog, multi-registry candidate selection,\n  install authority, update-impact review, artifact byte readback, and remote\n  artifact verification bind publisher, digest, signature, source, policy, and\n  approval evidence before plugin installation or update.\n- **Background keeper containment**: an independent keeper records Worker and\n  descendant PIDs, retires interrupted turns under bounded Windows identity and\n  cleanup budgets, and emits strict formal/smoke evidence contracts. The local\n  real-spawn regression is green; the three-platform formal keeper aggregate is\n  still required before P1-2 can be marked complete.\n- **MCP capsule boundary evidence**: materialized capsules bind the exact Node\n  builtin capability set and OS execution-context requirements. Formal evidence\n  now hashes and reparses each live result and schedules three independent\n  fresh-isolate probes per platform across a two-hour span; smoke evidence is\n  explicitly non-qualifying.\n- **Session and remote-approval hardening**: canonical session persistence gains\n  additional crash and anti-rollback checks. Client-hosted remote approval uses\n  durable same-machine membership epochs and fails closed on stale, revoked, or\n  unavailable authority. Signed coordinator/host lease modules are included as\n  a foundation only; they are not yet wired as a complete cross-host dispatch\n  fence and do not claim distributed consensus or revoke closure.\n- **Linux dynamic-native isolation candidate**: strict Linux native execution\n  recursively attests the ELF startup graph, snapshots caller-owned runtime and\n  plugin bytes, exposes only a read-only descriptor-bound namespace, and blocks\n  loader-input acquisition and nested mount namespaces with a dynamic-only\n  seccomp profile. The typed claim is limited to pathname-visible loader input;\n  broad `sharedLibraryClosure` remains false, JIT/custom loaders are excluded,\n  and packed Linux runtimes fail closed until separately supported.\n- **macOS signed launcher candidate**: a fixed signed/root helper contract can\n  copy and hash runtime and entry descriptors into root-protected snapshots,\n  gate entry until the runtime pathname is removed, supervise the target, and\n  fail closed when ownership, receipt, protocol, or signing evidence differs.\n  It remains disabled until the protected x64/arm64 workflow proves Developer\n  ID signing, notarization, root package installation, and the full live race\n  matrix; it does not claim shared-library closure.\n- **Compatibility and reliability boundary**: reaching the documented\n  `0.164.0` removal floor does not replace representative telemetry. All 25\n  compatibility aliases remain retained because approved cohort export,\n  three-platform reporting coverage, accepted points, and per-command usage are\n  still absent. The scheduler campaign remains incomplete, and the uncommitted\n  remote `run_shell` lease-consumption vertical is excluded after its expanded\n  parallel matrix did not finish fully green.\n- **Release authority hardening**: manual npm workflow runs are dry-run only;\n  production packaging and publishing require an immutable `v-npm-*` tag-push\n  event. Operator-controlled version text is no longer interpolated into shell\n  scripts, release Actions are commit-pinned, and independent readback validates\n  a canonical numeric SemVer before resolving the tag and attested artifact.\n- **Release status**: final tag, source SHA, workflow run IDs, package digests,\n  provenance, and registry readback are intentionally omitted until the exact\n  `0.164.0` release merge commit passes complete `CLI CI` and\n  `CLI Strict Sandbox` matrices on Linux, Windows, and macOS, followed by the\n  dedicated npm release and independent public readback workflows."
+        }
+      ]
+    },
     {
       "productVersion": null,
       "cliVersion": "0.163.8",
@@ -10,7 +23,7 @@
       "sections": [
         {
           "heading": "Added — cc CLI 0.163.8: governed recovery, merge review, and MCP resource templates",
-          "body": "> `chainlesschain` **0.163.7 → 0.163.8** (candidate; not yet published,\n> 2026-08-14).\n> CLI-only candidate; `@chainlesschain/personal-data-hub` remains **0.4.57**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Crash-safe scheduler source persistence**: Agenda and Cowork authoritative\n  stores now reject unreadable, malformed, and non-object records instead of\n  treating them as empty state. Generation replacement uses private exclusive\n  temporary files, complete short-write loops, file fsync, atomic rename, and\n  POSIX directory fsync, while distinguishing pre-rename `not-committed`\n  failures from post-rename durability-unknown outcomes.\n- **Deterministic scheduler disk-fault closure**: fault injection covers ENOSPC,\n  partial writes, file and directory fsync failures, rename failures, corrupted\n  source stores, native SQLite `SQLITE_FULL` transaction rollback, Automation\n  source rollback atomicity, database truncation, and clean reopen behavior.\n  Routine and Loop retain their existing durable-store and append/CAS\n  protections.\n- **Governed Automation runtime recovery**: scheduler-backed Automation work can\n  expose exact-fence, control-revision, capability-bound pause and resume safe\n  points. Revisioned incidents support bounded retry or cancellation; retry\n  revalidates the exact dead-letter occurrence, run identity, fence, and error\n  evidence, while manual incidents are not silently replayed.\n- **Governed multi-agent merge review**: `cc team merge-review` subcommands\n  `preview|show|apply|rollback` provide stable file and hunk selection,\n  digest-bound decisions, durable conflict evidence, guarded cross-branch batch\n  publication, and retained-history rollback. Git hooks, repository-local\n  configuration, inherited environment, stale revisions, oversized selections,\n  and changed branch identities fail closed.\n- **Read-only MCP resource templates**: templates-only MCP servers can now\n  register the existing resource surface. The new\n  `list_mcp_resource_templates {server?}` tool reads the bounded discovery\n  cache, supports explicit server filtering, and lets the model instantiate a\n  concrete URI before using the existing `read_mcp_resource` boundary. It does\n  not add an implicit network request, subscription, or automatic URI\n  expansion.\n- **Explicit optional-protocol decisions**: resource templates enter the\n  production read-only surface; resource subscriptions, peer-controlled\n  logging, and completion remain deferred pending bounded consumers and\n  cancellation/recovery UX. MCP sampling remains undeclared and server\n  `createMessage` requests continue to return JSON-RPC `-32601`.\n- **Transaction-time scheduler fencing**: claim, renewal, and settlement paths\n  now read their lease clock inside the write transaction, preventing queue\n  wait time from turning a pre-transaction timestamp into a stale lease or\n  settlement decision.\n- **Formal scheduler soak evidence gate**: Linux, Windows, and macOS workflows\n  now exercise two-worker contention, lease/fence recovery, heartbeat renewal,\n  stale settlement rejection, outcome-unknown no-replay, DST/backlog behavior,\n  SQLite integrity, descendant cleanup, and bounded resource trends. The\n  campaign verifier requires at least four identity-bound formal segments whose\n  authoritative starts span at least 72 natural hours, with no gap above\n  30 hours.\n- **Release boundary**: the scheduler soak implementation and smoke matrices are\n  present, but the required 72-hour formal campaign has not completed; P2-4\n  therefore remains partially complete. Signed native distribution,\n  representative alias-removal telemetry, and the entire unmerged P2-2 native\n  clipboard-image host work remain outside this candidate.\n- **Release status**: final tag, source SHA, workflow run IDs, package digests,\n  provenance, and registry readback are intentionally omitted until the exact\n  `0.163.8` release merge commit passes complete `CLI CI` and\n  `CLI Strict Sandbox` matrices on Linux, Windows, and macOS, followed by the\n  dedicated npm release and independent public readback workflows."
+          "body": "> `chainlesschain` **0.163.7 → 0.163.8** (published from exact SHA\n> `a0631cb4f97f45ff7fcef9c19d346ed2b8387da6`, 2026-08-14).\n> CLI-only release; `@chainlesschain/personal-data-hub` remains **0.4.57**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Crash-safe scheduler source persistence**: Agenda and Cowork authoritative\n  stores now reject unreadable, malformed, and non-object records instead of\n  treating them as empty state. Generation replacement uses private exclusive\n  temporary files, complete short-write loops, file fsync, atomic rename, and\n  POSIX directory fsync, while distinguishing pre-rename `not-committed`\n  failures from post-rename durability-unknown outcomes.\n- **Deterministic scheduler disk-fault closure**: fault injection covers ENOSPC,\n  partial writes, file and directory fsync failures, rename failures, corrupted\n  source stores, native SQLite `SQLITE_FULL` transaction rollback, Automation\n  source rollback atomicity, database truncation, and clean reopen behavior.\n  Routine and Loop retain their existing durable-store and append/CAS\n  protections.\n- **Governed Automation runtime recovery**: scheduler-backed Automation work can\n  expose exact-fence, control-revision, capability-bound pause and resume safe\n  points. Revisioned incidents support bounded retry or cancellation; retry\n  revalidates the exact dead-letter occurrence, run identity, fence, and error\n  evidence, while manual incidents are not silently replayed.\n- **Governed multi-agent merge review**: `cc team merge-review` subcommands\n  `preview|show|apply|rollback` provide stable file and hunk selection,\n  digest-bound decisions, durable conflict evidence, guarded cross-branch batch\n  publication, and retained-history rollback. Git hooks, repository-local\n  configuration, inherited environment, stale revisions, oversized selections,\n  and changed branch identities fail closed.\n- **Read-only MCP resource templates**: templates-only MCP servers can now\n  register the existing resource surface. The new\n  `list_mcp_resource_templates {server?}` tool reads the bounded discovery\n  cache, supports explicit server filtering, and lets the model instantiate a\n  concrete URI before using the existing `read_mcp_resource` boundary. It does\n  not add an implicit network request, subscription, or automatic URI\n  expansion.\n- **Explicit optional-protocol decisions**: resource templates enter the\n  production read-only surface; resource subscriptions, peer-controlled\n  logging, and completion remain deferred pending bounded consumers and\n  cancellation/recovery UX. MCP sampling remains undeclared and server\n  `createMessage` requests continue to return JSON-RPC `-32601`.\n- **Transaction-time scheduler fencing**: claim, renewal, and settlement paths\n  now read their lease clock inside the write transaction, preventing queue\n  wait time from turning a pre-transaction timestamp into a stale lease or\n  settlement decision.\n- **Formal scheduler soak evidence gate**: Linux, Windows, and macOS workflows\n  now exercise two-worker contention, lease/fence recovery, heartbeat renewal,\n  stale settlement rejection, outcome-unknown no-replay, DST/backlog behavior,\n  SQLite integrity, descendant cleanup, and bounded resource trends. The\n  campaign verifier requires at least four identity-bound formal segments whose\n  authoritative starts span at least 72 natural hours, with no gap above\n  30 hours.\n- **Release boundary**: the scheduler soak implementation and smoke matrices are\n  present, but the required 72-hour formal campaign has not completed; P2-4\n  therefore remains partially complete. Signed native distribution,\n  representative alias-removal telemetry, and the later P2-2 native\n  clipboard-image host work remain outside this immutable release.\n- **Published release evidence**: immutable tag `v-npm-0-163-8` resolves to\n  exact source commit `a0631cb4f97f45ff7fcef9c19d346ed2b8387da6`. Its\n  three-OS `CLI CI` (`31804468633`) and `CLI Strict Sandbox` (`31804468464`)\n  matrices passed; the dedicated npm release (`31806101423`) and independent\n  public readback (`31807574517`) succeeded. npm reports `latest=0.163.8`;\n  tarball SHA-1 is `655557b5c5b897b23a29975708abbf8d5cd31e88` and SHA-256\n  is `862a0f450da013740a1c21d084233b002982b4b816f156e4949b6110eda80e12`."
         }
       ]
     },
@@ -23,7 +36,7 @@
       "sections": [
         {
           "heading": "Added — cc CLI 0.163.7: governed scheduler migration and causal observability",
-          "body": "> `chainlesschain` **0.163.6 → 0.163.7** (published from exact SHA\n> `3e997168621c53708a1682868c6cc4edc9baf15b`, 2026-08-14).\n> CLI-only release; `@chainlesschain/personal-data-hub` remains **0.4.57**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Five-domain migration journal**: Agenda, Cowork Cron, Routine, Automation,\n  and Loop migrations use the scheduler store schema-v5 journal with\n  domain-typed source locators, immutable source/target digest bindings,\n  idempotent recovery, and fail-closed rejection of conflicting or ambiguous\n  legacy entries.\n- **Governed rollback controls**: the new scheduler migration `list`, `show`,\n  and `rollback` commands expose redacted migration status and blockers.\n  Rollback requires the latest evidence digest, an interactive TTY, and the\n  exact typed challenge before reopening any legacy source.\n- **Target-first recovery and CAS fencing**: rollback stops or restores the\n  scheduler target before restoring the legacy source, validates target\n  revision, definition and execution evidence, and makes terminal source\n  restoration retry-safe across process crashes. This is not a claim of one\n  atomic transaction across independent stores or filesystems.\n- **Fail-closed source identity**: Windows drive and UNC paths are canonicalized\n  while relative, incomplete and device-namespace paths are rejected.\n  Automation migration requires an existing native SQLite database and refuses\n  the non-durable sql.js fallback; Loop restoration remains bound to its durable\n  retirement fence, marker and original source digest.\n- **Windows persistence hardening**: team adjudication atomic replacement\n  retries only transient Windows `EACCES`, `EBUSY`, and `EPERM` sharing\n  failures with bounded backoff and authority-path revalidation. Exhausted,\n  non-transient, and non-Windows replacement failures continue to fail closed.\n- **Cross-platform CI hardening**: migration fixtures verify retirement fences\n  and canonical source identities consistently across operating systems, while\n  distributed-queue and authority test workers use bounded lifetimes and attach\n  result observers before short-lived children can exit. Terminal Skill\n  authority fixtures now use an explicit parent acknowledgement before clean\n  exit, removing Windows IPC exit-before-message ordering ambiguity without\n  weakening concurrent revocation assertions.\n- **Verified causal delivery reports**: scoped sessions can be bound by exact\n  transcript head and event count to digest-protected delivery states. The new\n  session observability commands export a redacted session-to-delivery graph\n  spanning diffs, gates, artifacts, pull requests, and merges, with exact\n  workspace, team, and policy filters.\n- **Fail-closed call-ledger budgets**: `call-ledger@1` brackets model, retry,\n  compaction, subagent, isolated-skill, and tool calls with known or unknown\n  settlements. Strict budget mode rejects exceeded and unevaluable results\n  instead of treating missing token, cost, retry, or tool-latency evidence as\n  zero.\n- **Background recovery authority hardening**: verified transcript CAS,\n  delegated recovery leases, IPC sender/nonce binding, bootstrap guards, exact\n  process-group termination checks, and terminal cleanup prevent uncertain or\n  still-live descendants from authorizing recovery or worktree deletion.\n- **Causal evidence boundary**: report bindings prove exact verified revisions,\n  not that a model call semantically caused a source hunk. Scope labels are not\n  identity or membership proofs, digests are not signatures, anti-rollback is\n  machine-local, and incomplete or legacy ledgers remain partial or unknown.\n- **Release boundary**: deterministic scheduler disk-fault closure landed after\n  this immutable release and is not attributed to its tarball. The\n  three-platform long-soak campaign, signed native distribution, and\n  representative alias-removal telemetry remained outside this release.\n- **Published release evidence**: immutable tag `v-npm-0-163-7` resolves to\n  exact source commit `3e997168621c53708a1682868c6cc4edc9baf15b`. Its Linux,\n  Windows, and macOS `CLI CI` (`31745391661`, attempt 2) and\n  `CLI Strict Sandbox` (`31745391321`) matrices passed; the dedicated npm\n  release (`31748153519`) completed its exact-SHA gate, immutable package,\n  Trusted Publishing, and signed provenance, and the independent public\n  readback (`31749404980`) succeeded. npm reports `latest=0.163.7`; the public\n  tarball SHA-1 is `5bfb7471643cfe4d4cd0b0a382b31c63fc1efdff` and SHA-256 is\n  `d7ca295e6cdb4e442ee7ad6bb9cc0b9d923f40de4eae395974d91b4dfab83a9d`."
+          "body": "> `chainlesschain` **0.163.6 → 0.163.7** (published from exact SHA\n> `3e997168621c53708a1682868c6cc4edc9baf15b`, 2026-08-14).\n> CLI-only release; `@chainlesschain/personal-data-hub` remains **0.4.57**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **Five-domain migration journal**: Agenda, Cowork Cron, Routine, Automation,\n  and Loop migrations use the scheduler store schema-v5 journal with\n  domain-typed source locators, immutable source/target digest bindings,\n  idempotent recovery, and fail-closed rejection of conflicting or ambiguous\n  legacy entries.\n- **Governed rollback controls**: the new scheduler migration `list`, `show`,\n  and `rollback` commands expose redacted migration status and blockers.\n  Rollback requires the latest evidence digest, an interactive TTY, and the\n  exact typed challenge before reopening any legacy source.\n- **Target-first recovery and CAS fencing**: rollback stops or restores the\n  scheduler target before restoring the legacy source, validates target\n  revision, definition and execution evidence, and makes terminal source\n  restoration retry-safe across process crashes. This is not a claim of one\n  atomic transaction across independent stores or filesystems.\n- **Fail-closed source identity**: Windows drive and UNC paths are canonicalized\n  while relative, incomplete and device-namespace paths are rejected.\n  Automation migration requires an existing native SQLite database and refuses\n  the non-durable sql.js fallback; Loop restoration remains bound to its durable\n  retirement fence, marker and original source digest.\n- **Windows persistence hardening**: team adjudication atomic replacement\n  retries only transient Windows `EACCES`, `EBUSY`, and `EPERM` sharing\n  failures with bounded backoff and authority-path revalidation. Exhausted,\n  non-transient, and non-Windows replacement failures continue to fail closed.\n- **Cross-platform CI hardening**: migration fixtures verify retirement fences\n  and canonical source identities consistently across operating systems, while\n  distributed-queue and authority test workers use bounded lifetimes and attach\n  result observers before short-lived children can exit. Terminal Skill\n  authority fixtures now use an explicit parent acknowledgement before clean\n  exit, removing Windows IPC exit-before-message ordering ambiguity without\n  weakening concurrent revocation assertions.\n- **Verified causal delivery reports**: scoped sessions can be bound by exact\n  transcript head and event count to digest-protected delivery states. The new\n  session observability commands export a redacted session-to-delivery graph\n  spanning diffs, gates, artifacts, pull requests, and merges, with exact\n  workspace, team, and policy filters.\n- **Fail-closed call-ledger budgets**: `call-ledger@1` brackets model, retry,\n  compaction, subagent, isolated-skill, and tool calls with known or unknown\n  settlements. Strict budget mode rejects exceeded and unevaluable results\n  instead of treating missing token, cost, retry, or tool-latency evidence as\n  zero.\n- **Background recovery authority hardening**: verified transcript CAS,\n  delegated recovery leases, IPC sender/nonce binding, bootstrap guards, exact\n  process-group termination checks, and terminal cleanup prevent uncertain or\n  still-live descendants from authorizing recovery or worktree deletion.\n- **Causal evidence boundary**: report bindings prove exact verified revisions,\n  not that a model call semantically caused a source hunk. Scope labels are not\n  identity or membership proofs, digests are not signatures, anti-rollback is\n  machine-local, and incomplete or legacy ledgers remain partial or unknown.\n- **Published release evidence**: immutable tag `v-npm-0-163-7` resolves to\n  exact source commit `3e997168621c53708a1682868c6cc4edc9baf15b`. Its\n  three-OS `CLI CI` (`31745391661`, attempt 2) and `CLI Strict Sandbox`\n  (`31745391321`) matrices passed; the dedicated npm release (`31748153519`)\n  completed exact-SHA gating, immutable artifact, CycloneDX SBOM, Trusted\n  Publishing, signed provenance, registry byte verification, and npmmirror\n  synchronization. Independent readback (`31749404980`) verified the public\n  tarball byte-for-byte against the immutable artifact. npm reports\n  `latest=0.163.7`; tarball SHA-1 is\n  `5bfb7471643cfe4d4cd0b0a382b31c63fc1efdff` and SHA-256 is\n  `d7ca295e6cdb4e442ee7ad6bb9cc0b9d923f40de4eae395974d91b4dfab83a9d`.\n- **Release boundary**: deterministic scheduler disk-fault closure landed\n  after this immutable release and must not be attributed to its tarball. The\n  three-OS long-soak exit campaign, signed native distribution, and\n  representative alias-removal telemetry remain open."
         }
       ]
     },

package/src/gateways/ws/action-protocol.js

@@ -310,9 +310,21 @@ export async function handleWorkflowGet(server, id, ws, message) {
   const { id: wfId } = message || {};
   if (!wfId) return _sendError(server, ws, id, "MISSING_ID", "id required");
   try {
-    const { getWorkflow } = await import("../../lib/cowork-workflow.js");
-    const workflow = getWorkflow(_cwd(server), wfId);
-    server._send(ws, { id, type: "workflow:get", workflow: workflow || null });
+    const { getWorkflowRecord } = await import("../../lib/cowork-workflow.js");
+    const record = getWorkflowRecord(_cwd(server), wfId);
+    server._send(ws, {
+      id,
+      type: "workflow:get",
+      workflow: record?.definition || null,
+      definitionAuthority: record
+        ? {
+            status: record.status,
+            recordSchema: record.recordSchema,
+            definitionSchema: record.definitionSchema,
+            definitionDigest: record.definitionDigest,
+          }
+        : null,
+    });
   } catch (err) {
     _sendError(server, ws, id, "WORKFLOW_GET_FAILED", err.message);
   }
@@ -330,7 +342,7 @@ export async function handleWorkflowSave(server, id, ws, message) {
     );
   }
   try {
-    const { validateWorkflow, saveWorkflow } =
+    const { getWorkflowRecord, validateWorkflow, saveWorkflow } =
       await import("../../lib/cowork-workflow.js");
     const result = validateWorkflow(workflow);
     if (!result.valid) {
@@ -343,11 +355,14 @@ export async function handleWorkflowSave(server, id, ws, message) {
       );
     }
     saveWorkflow(_cwd(server), workflow);
+    const record = getWorkflowRecord(_cwd(server), workflow.id);
     server._send(ws, {
       id,
       type: "workflow:save",
       saved: true,
       workflowId: workflow.id,
+      definitionDigest: record.definitionDigest,
+      definitionSchema: record.definitionSchema,
     });
   } catch (err) {
     _sendError(server, ws, id, "WORKFLOW_SAVE_FAILED", err.message);
@@ -367,14 +382,16 @@ export async function handleWorkflowRemove(server, id, ws, message) {
 }
 
 export async function handleWorkflowRun(server, id, ws, message) {
-  const { id: wfId } = message || {};
+  const { id: wfId, definitionDigest } = message || {};
   if (!wfId) return _sendError(server, ws, id, "MISSING_ID", "id required");
 
   try {
-    const { getWorkflow, executeWorkflow } =
+    const { getWorkflowRecord, getWorkflowVersion, executeWorkflow } =
       await import("../../lib/cowork-workflow.js");
-    const workflow = getWorkflow(_cwd(server), wfId);
-    if (!workflow) {
+    const definitionRecord = definitionDigest
+      ? getWorkflowVersion(_cwd(server), wfId, definitionDigest)
+      : getWorkflowRecord(_cwd(server), wfId);
+    if (!definitionRecord) {
       return _sendError(
         server,
         ws,
@@ -385,7 +402,13 @@ export async function handleWorkflowRun(server, id, ws, message) {
     }
 
     const runId = `wf-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
-    server._send(ws, { id, type: "workflow:started", runId, workflowId: wfId });
+    server._send(ws, {
+      id,
+      type: "workflow:started",
+      runId,
+      workflowId: wfId,
+      definitionDigest: definitionRecord.definitionDigest,
+    });
 
     const onStepStart = ({ stepId, message: stepMessage }) => {
       server._send(ws, {
@@ -408,7 +431,8 @@ export async function handleWorkflowRun(server, id, ws, message) {
     };
 
     const record = await executeWorkflow({
-      workflow,
+      workflow: definitionRecord.definition,
+      definitionDigest: definitionRecord.definitionDigest,
       cwd: _cwd(server),
       onStepStart,
       onStepComplete,
@@ -420,6 +444,7 @@ export async function handleWorkflowRun(server, id, ws, message) {
       runId,
       status: record?.status || "completed",
       steps: record?.steps || [],
+      definitionDigest: record?.definitionDigest,
     });
   } catch (err) {
     _sendError(server, ws, id, "WORKFLOW_RUN_FAILED", err.message);

package/src/gateways/ws/remote-session-protocol.js

@@ -129,6 +129,10 @@ export function handleRemoteSessionCreate(server, clientId, ws, message) {
       agentSessionId: message.sessionId,
       name: message.name,
       scopes: message.scopes,
+      // A local/headless approval bridge asks the server to persist a
+      // principal/session epoch before it exposes pairing credentials. Older
+      // or ordinary server-hosted sessions remain on their in-memory path.
+      durableMembership: message.requireDurableMembershipAuthority === true,
     });
     audit(server, {
       sessionId: result.session.sessionId,
@@ -446,7 +450,7 @@ export async function handleRemoteSessionPublish(
       return;
     }
     const requiredScope = CLIENT_EVENT_SCOPES[message.event.type];
-    const { session } = server.remoteSessions.authorize(
+    const { session, membership } = server.remoteSessions.authorize(
       message.remoteSessionId,
       clientId,
       requiredScope || "observe",
@@ -508,6 +512,13 @@ export async function handleRemoteSessionPublish(
           scopes: ["approve"],
           principalId: clientId,
           sessionId: message.remoteSessionId,
+          ...(membership
+            ? {
+                remoteSessionId: membership.sessionId,
+                sessionEpoch: membership.sessionEpoch,
+                membershipEpoch: membership.membershipEpoch,
+              }
+            : {}),
         };
         const approved = message.event.answer ?? message.event.approved;
         if (approved === true || approved === "true" || approved === "yes") {
@@ -538,6 +549,11 @@ export async function handleRemoteSessionPublish(
             "Remote session host is not reachable for this control event",
           );
         }
+        if (message.event.type === "approval.resolve" && !membership) {
+          throw new Error(
+            "Durable Remote membership authority is required before forwarding an approval",
+          );
+        }
       }
       // Idempotent forward: a control event with a stable commandId runs its
       // side effect (audit + dispatch into the host agent) AT MOST ONCE, so a
@@ -594,6 +610,13 @@ export async function handleRemoteSessionPublish(
             remoteSessionId: message.remoteSessionId,
             agentSessionId: session.agentSessionId,
             from: clientId,
+            ...(membership
+              ? {
+                  membershipAuthority: membership.authorityVersion,
+                  sessionEpoch: membership.sessionEpoch,
+                  membershipEpoch: membership.membershipEpoch,
+                }
+              : {}),
             event: message.event,
           });
           reply(server, ws, message.id, "remote-session-published", {

package/src/gateways/ws/ws-agent-handler.js

@@ -20,6 +20,7 @@ import {
   persistSideEffectLedger,
 } from "../../lib/side-effect-ledger-store.js";
 import { operationIdempotencyKey } from "../../lib/idempotency.js";
+import { collectToolResourceIdentifiers } from "../../lib/permission-side-effect-center.js";
 import {
   detectTaskType,
   selectModelForTask,
@@ -1289,6 +1290,12 @@ export class WSAgentHandler {
                       key: se.key,
                       meta: {
                         tool: event.tool,
+                        toolUseId: event.tool_use_id || null,
+                        turnId: event.turn_id || null,
+                        resources: collectToolResourceIdentifiers(
+                          event.tool,
+                          event.args,
+                        ),
                         idempotencyKey: operationIdempotencyKey({
                           tool: event.tool,
                           args: event.args,
@@ -1329,6 +1336,11 @@ export class WSAgentHandler {
               currentTodoWrite = null;
               if (currentSideEffectOpId) {
                 const err = event.error || event.result?.error || null;
+                if (event.permission_decision) {
+                  sideEffectLedger.annotate(currentSideEffectOpId, {
+                    permissionDecision: event.permission_decision,
+                  });
+                }
                 if (event.result?._diffReviewAudit) {
                   diffReviewFollowUps.observe(
                     sideEffectLedger,

package/src/gateways/ws/ws-server.js

@@ -37,6 +37,7 @@ import {
   isApprovalRequestEvent,
 } from "../../harness/remote-session-push.js";
 import { createRemoteSessionPushSender } from "../../harness/remote-session-push-senders.js";
+import { DurableRemoteMembershipAuthority } from "../../lib/remote-membership-authority.js";
 import { RemoteSessionRelay } from "../remote-session-relay.js";
 import { handleRemoteSessionPublish } from "./remote-session-protocol.js";
 import { handleTaskDetail, handleTaskHistory } from "./task-protocol.js";
@@ -273,7 +274,19 @@ export class ChainlessChainWSServer extends EventEmitter {
     /** Local authorization state for multi-device Remote Sessions. */
     this.remoteSessions =
       options.remoteSessionRegistry ||
-      new RemoteSessionRegistry({ policy: this.remoteSessionPolicy });
+      new RemoteSessionRegistry({
+        policy: this.remoteSessionPolicy,
+        membershipAuthority:
+          options.remoteMembershipAuthority === null
+            ? null
+            : () =>
+                options.remoteMembershipAuthority ||
+                new DurableRemoteMembershipAuthority(
+                  options.remoteMembershipStateFile
+                    ? { filePath: options.remoteMembershipStateFile }
+                    : {},
+                ),
+      });
     /**
      * Optional durable sink (JSONL) for the audit trail. Enabled only when a
      * sink is injected or CHAINLESSCHAIN_REMOTE_SESSION_AUDIT_FILE is set; the
@@ -502,16 +515,36 @@ export class ChainlessChainWSServer extends EventEmitter {
       // remaining clients finalizes itself).
       cleanupBgAttachments(client);
       this.clients.delete(clientId);
-      for (const affected of this.remoteSessions.removeClient(clientId)) {
-        if (affected.closed)
-          this.remoteSessionCrypto.delete(affected.sessionId);
-        if (affected.closed)
-          this.remoteSessionPairingSecrets.delete(affected.sessionId);
+      try {
+        for (const affected of this.remoteSessions.removeClient(clientId)) {
+          if (affected.closed)
+            this.remoteSessionCrypto.delete(affected.sessionId);
+          if (affected.closed)
+            this.remoteSessionPairingSecrets.delete(affected.sessionId);
+          this.remoteSessionAudit?.record({
+            sessionId: affected.sessionId,
+            actor: clientId,
+            action: affected.closed ? "session.closed" : "device.disconnected",
+            detail: { reason: "disconnect" },
+          });
+        }
+      } catch (error) {
+        // A durable membership transition that cannot be committed must never
+        // be represented as a successful revoke/close. The socket is already
+        // gone (so this principal cannot send another frame), and every future
+        // durable authorization still re-checks the authority store.
         this.remoteSessionAudit?.record({
-          sessionId: affected.sessionId,
+          sessionId: null,
           actor: clientId,
-          action: affected.closed ? "session.closed" : "device.disconnected",
-          detail: { reason: "disconnect" },
+          action: "membership.state-error",
+          detail: {
+            reason: "disconnect-transition-failed",
+            errorCode: error?.code || null,
+          },
+        });
+        this.emit("client-error", {
+          clientId,
+          error: error?.message || String(error),
         });
       }
       this.emit("disconnection", { clientId });
@@ -539,11 +572,12 @@ export class ChainlessChainWSServer extends EventEmitter {
     return this._dispatcher.dispatch(clientId, ws, message);
   }
 
-  /** Read the same .claude settings rules used by the Agent Core. */
+  /** Read the same static + scoped authority used by the Agent Core. */
   async _handlePermissionRulesGet(id, ws) {
     try {
-      const { loadSettings } = await import("../../lib/settings-loader.cjs");
-      const loaded = loadSettings({ cwd: this.projectRoot });
+      const { loadPermissionAuthority } =
+        await import("../../lib/permission-authority.js");
+      const loaded = loadPermissionAuthority({ cwd: this.projectRoot });
       this._send(ws, {
         id,
         type: "permission-rules",
@@ -551,6 +585,8 @@ export class ChainlessChainWSServer extends EventEmitter {
         sources: loaded.sources,
         files: loaded.files,
         managed: loaded.managed || null,
+        managedFile: loaded.managedFile || null,
+        scoped: loaded.scoped || null,
       });
     } catch (error) {
       this._send(ws, {