flowviant 0.125.13 → 0.125.16

package/README.md

@@ -254,7 +254,8 @@ OpenAI, GitHub, AWS, Slack, OAuth token fields, PEM private keys) with
 hostname, a lowercase hex string) is left as it is, and a secret in none of
 those is relayed as printed. What your CLI writes through Flowviant's own tools
 (such as a tab's progress messages and purpose line, or the cards a New task
-chat stages) goes from the CLI to Flowviant, not through the daemon, as written.
+chat stages) is sent to Flowviant as written, either directly or through the
+daemon's root-only capture credential relay.
 The full list, and the exact test for what looks generated, are in
 [SECURITY.md](./SECURITY.md#what-is-redacted).
 

package/bin/cli.mjs

@@ -80,6 +80,11 @@
 // answered here before anything else loads: no config, no update check, no
 // output but the hook's. An unknown hook exits 2, which Claude Code reads as a
 // refusal — the read guard's own rule for a hook that cannot judge.
+if (process.argv[2] === '__capture-mcp') {
+  await (await import('./lib/captureAuthority.mjs')).captureMcpMain();
+  process.exit(process.exitCode ?? 0);
+}
+
 if (process.argv[2] === '__orchestrator-mcp') {
   await (await import('./lib/orchestratorClient.mjs')).orchestratorMcpMain();
   process.exit(process.exitCode ?? 0);

package/bin/lib/artifactReporter.mjs

@@ -37,7 +37,7 @@
  * with `includeNames`, so it never attributes a sibling card's files.
  */
 
-import { artifactStoredName } from './artifacts.mjs';
+import { artifactStoredName, artifactTypeFor, scanArtifacts } from './artifacts.mjs';
 import { fleetHeaders } from './fleetPost.mjs';
 import {
   imageRevisionProtection, iterationSignature, iterationChanges, deletedArtifacts, localArtifact, discardLocalArtifact, iterationInstructions,
@@ -226,7 +226,7 @@ export function createArtifactReporter({
 
   /** Upload what this turn changed in `placeDir`. Resolves to the number of
    *  bodies SENT this call (delivered or held), for the tests and the log. */
-  const report = async ({ placeDir, before, sessionId, agentId, turnId, idle = false, requireStored = false, includeNames = null }) => {
+  const report = async ({ placeDir, before, sessionId, agentId, turnId, idle = false, requireStored = false, includeNames = null, requiredOutputs = null }) => {
     if (!placeDir || (!sessionId && !agentId)) return 0;
     const changes = iterationChanges(placeDir, before);
     const protectedNames = imageRevisionProtection(before?.stored, before?.imageRevision);
@@ -250,14 +250,29 @@ export function createArtifactReporter({
       pending.delete(key);
       genOf.set(key, ++generation);
     }
-    const changed = idle ? [] : listChanged(placeDir, before).filter((e) =>
+    const required = new Map((requiredOutputs ?? []).map(ref => [ref.name, ref.sha256]));
+    // Prepared handoffs are an explicit set, independent of the newest-first
+    // discovery window. Re-walk safely, then verify the built bytes against
+    // the prepared version before sending anything to storage.
+    const discovered = idle ? [] : listChanged(placeDir, before);
+    const entries = required.size
+      ? [...scanArtifacts(placeDir, { all: true, includeNames: new Set(required.keys()) }),
+        ...discovered.filter(e => !artifactTypeFor(e.name))] // unsupported files still report by name
+      : discovered;
+    const changed = idle ? [] : entries.filter((e) =>
       !removing.has(artifactStoredName(e.name)) && (!includeNames || includeNames.has(e.name)));
     const delivered = new Map();
     const failures = before?.inventoryFailed
       ? ['Stored artifact inventory could not be measured; cleanup is incomplete. Retry.'] : [];
+    for (const name of required.keys()) if (!changed.some(e => e.name === name))
+      failures.push(`Required intermediate output ${name} is missing, unsafe or excluded from reporting; its handoff is unfinished.`);
     let n = 0;
     for (const entry of changed) {
       const body = buildUpload(entry, { sessionId, agentId, turnId }, scrub, secretIn);
+      if (required.has(entry.name) && (!body?.bytes || body.withheld || body.fields.sha256 !== required.get(entry.name))) {
+        failures.push(`Required intermediate output ${entry.name} is unreadable, withheld or changed since preparation. Restore its exact producer bytes and retry.`);
+        continue;
+      }
       if (!body) {
         if (requireStored) failures.push(`artifact ${entry.name} could not be read; it was not delivered`);
         continue;
@@ -327,6 +342,28 @@ export function createArtifactReporter({
         [...(before.seen ?? []), ...present, ...delivered.keys()]
           .filter((name) => owned.has(name) && !removed.has(name) && (!protectedNames.has(name) || present.has(name))));
     }
+    if (requireStored && required.size && !failures.length) {
+      // A series of successful POSTs is not proof the set still exists: the
+      // owner's storage window may have pruned an earlier file. Measure the
+      // exact uploaded versions together before allowing settlement. The
+      // existing inventory exposes ids, not hashes. The POST was hash-checked
+      // above, and the server assigns a new immutable id to changed content.
+      try {
+        const query = new URLSearchParams(sessionId ? { sessionId } : { agentId });
+        const response = await doFetch(`${fleetEndpoint('artifacts', fleetUrl)}?${query}`, {
+          method: 'GET', headers: fleetHeaders({ token, json: false }), signal: AbortSignal.timeout(15_000),
+        });
+        const result = response.ok ? await response.json() : null;
+        if (!Array.isArray(result?.data)) throw new Error('unmeasured inventory');
+        for (const name of required.keys()) {
+          const storedName = artifactStoredName(name), id = delivered.get(storedName);
+          if (!id || !result.data.some(ref => ref.name === storedName && ref.id === id))
+            failures.push(`Required intermediate output ${name} was not retained at its uploaded producer version by artifact storage. Retry this producer; its handoff is unfinished.`);
+        }
+      } catch {
+        failures.push('Required intermediate output storage could not be measured. Retry this producer; its handoff is unfinished.');
+      }
+    }
     if (failures.length) throw new Error(failures.join('; '));
     return n;
   };

package/bin/lib/artifacts.mjs

@@ -225,21 +225,26 @@ export function walkArtifactDir(placeDir, visit) {
  * The directory's regular files, newest first, at most `ARTIFACT_MAX_FILES`.
  * `[]` for a directory that does not exist, is not a directory, or is a
  * symlink — nothing to report is the only honest reading of any of those.
+ * `all` retains the full safe metadata walk for before/after identity and
+ * explicit handoffs. `includeNames` filters before the general scan window.
  */
-export function scanArtifacts(placeDir) {
+export function scanArtifacts(placeDir, { all = false, includeNames = null } = {}) {
   const out = [];
   walkArtifactDir(placeDir, ({ name, path, kind, st }) => {
-    if (kind === 'file') out.push({ name, path, size: st.size, mtimeMs: st.mtimeMs });
+    if (kind === 'file' && (!includeNames || includeNames.has(name))) out.push({ name, path, size: st.size, mtimeMs: st.mtimeMs });
   });
   out.sort((a, b) => b.mtimeMs - a.mtimeMs || a.name.localeCompare(b.name));
-  return out.slice(0, ARTIFACT_MAX_FILES);
+  return all ? out : out.slice(0, ARTIFACT_MAX_FILES);
 }
 
 const sigOf = (e) => `${e.size}:${e.mtimeMs}`;
 
 /** name → size:mtime, taken before the CLI spawns. */
 export function snapshotArtifacts(placeDir) {
-  return new Map(scanArtifacts(placeDir).map((e) => [e.name, sigOf(e)]));
+  // A bounded snapshot mistakes an unchanged older file for a new output if
+  // it later enters the discovery window. Keep metadata for the entire safe
+  // walk; the general upload window remains bounded separately.
+  return new Map(scanArtifacts(placeDir, { all: true }).map((e) => [e.name, sigOf(e)]));
 }
 
 /** What the turn wrote: every entry whose (name, size, mtime) is not what the

package/bin/lib/captureAuthority.mjs

@@ -0,0 +1,82 @@
+/** A capture credential never enters a delegated CLI or its children. The
+ * daemon relays only calls authorized by the native ROOT's trusted hook.
+ * Tickets bind the tool and complete arguments, and replay returns the same
+ * promise/result rather than performing a second staging write. */
+import { createHash, randomUUID } from 'node:crypto';
+import { fleetHeaders } from './fleetPost.mjs';
+import { callOrchestrator } from './orchestratorClient.mjs';
+import { mcpRequest, serveMcpStdio } from './mcpStdio.mjs';
+import { captureToolName } from './nativeAgentTools.mjs';
+import { DAEMON_INSTANCE } from './config.mjs';
+
+export const CAPTURE_CALL_TICKET = '_flowviantRootCall';
+const CAP = 256;
+const cleanArgs = args => Object.fromEntries(Object.entries(args ?? {}).filter(([key]) => key !== CAPTURE_CALL_TICKET));
+const canonical = value => Array.isArray(value) ? value.map(canonical) : value && typeof value === 'object'
+  ? Object.fromEntries(Object.keys(value).sort().map(key => [key, canonical(value[key])])) : value;
+const fingerprint = (name, args) => createHash('sha256').update(JSON.stringify([name, canonical(cleanArgs(args))])).digest('hex');
+
+export function createCaptureAuthority({ url, token, turnId, attempt, sessionId, signal, request = fetch, clock = Date.now }) {
+  const tickets = new Map(), calls = new Map();
+  const lifetime = new AbortController();
+  let closed = false, discovery = null;
+  const active = () => !closed && !signal?.aborted;
+  const remote = async (method, params, callId) => {
+    if (!active()) throw new Error('This capture turn stopped.');
+    const response = await request(url, { method: 'POST',
+      headers: { ...fleetHeaders({ token }), 'X-Flowviant-Capture-Turn': turnId,
+        'X-Flowviant-Capture-Attempt': String(attempt), 'X-Flowviant-Capture-Instance': DAEMON_INSTANCE,
+        ...(callId ? { 'X-Flowviant-Capture-Call': callId } : {}) },
+      body: JSON.stringify(mcpRequest(method, params, randomUUID())),
+      signal: AbortSignal.any([lifetime.signal, ...(signal ? [signal] : []), AbortSignal.timeout(30_000)]),
+    });
+    const body = await response.json();
+    if (!response.ok || body.error || !body.result) throw new Error(body.error?.message ?? 'The capture tool did not answer.');
+    if (!active()) throw new Error('This capture turn stopped.');
+    return body.result;
+  };
+  return {
+    async describe() {
+      discovery ??= (async () => {
+        const init = await remote('initialize', { protocolVersion: '2024-11-05', capabilities: {}, clientInfo: { name: 'flowviant-capture', version: '1' } });
+        const list = await remote('list', {});
+        if (!Array.isArray(list.tools) || list.tools.length > 64) throw new Error('The capture tool list is unavailable.');
+        return { ...init, tools: list.tools.map(tool => ({ ...tool, inputSchema: { ...tool.inputSchema,
+          properties: { ...tool.inputSchema?.properties, [CAPTURE_CALL_TICKET]: { type: 'string', description: 'Internal authorization supplied by the native root hook.' } },
+        } })) };
+      })();
+      return discovery;
+    },
+    authorize(event) {
+      if (!active()) return { deny: 'This capture turn stopped.' };
+      const name = captureToolName(event.tool_name), id = event.tool_use_id;
+      if (!name || typeof id !== 'string' || !id || id.length > 160) return { deny: 'The capture call has no native identity.' };
+      const args = cleanArgs(event.tool_input);
+      if (args.sessionId !== sessionId) return { deny: 'Capture tools belong to this conversation only.' };
+      const hash = fingerprint(name, args), prior = calls.get(id);
+      if (prior && prior.hash !== hash) return { deny: 'This native capture call already authorized different arguments.' };
+      if (!prior && calls.size >= CAP) return { deny: 'This capture turn has reached its tool-call bound. Finish this reply and continue in the next message.' };
+      const ticket = prior?.ticket ?? randomUUID();
+      const grant = prior ?? { ticket, hash, name, args, callId: id, at: clock(), response: null };
+      calls.set(id, grant); tickets.set(ticket, grant);
+      return { updatedInput: { ...args, [CAPTURE_CALL_TICKET]: ticket } };
+    },
+    async call({ name, args = {} }) {
+      if (!active()) throw new Error('This capture turn stopped.');
+      const grant = tickets.get(args[CAPTURE_CALL_TICKET]);
+      if (!grant || grant.hash !== fingerprint(name, args) || clock() - grant.at > 15 * 60_000)
+        throw new Error('Only the capture coordinator may call these tools. No native root authorization was supplied.');
+      grant.response ??= remote('call', { name, arguments: grant.args }, grant.callId);
+      return grant.response;
+    },
+    close() { closed = true; lifetime.abort(); tickets.clear(); calls.clear(); },
+  };
+}
+
+/** The credential-free stdio client. It knows only this attempt's loopback
+ * capability. The shared protocol loop preserves raw MCP errors and replies. */
+export async function captureMcpMain() {
+  const description = await callOrchestrator('capture_describe', {}, 65_000);
+  return serveMcpStdio({ serverInfo: description.serverInfo, tools: description.tools, instructions: description.instructions,
+    rawResult: true, call: (name, args) => callOrchestrator('capture_call', { name, args }, 35_000) });
+}

package/bin/lib/claudePosture.mjs

@@ -499,6 +499,15 @@ export function withNativeChildren(perm) {
   return out;
 }
 
+/** A consult keeps exactly its readers and guard. The only additional MCP
+ * permission is the daemon's local coordination capability, never flowviant's
+ * board/staging tools or a project/personal server. Capture keeps its already
+ * allowed flowviant tools behind the daemon's root-only credential relay. */
+export function withReadOnlyCoordination(perm) {
+  return withNativeChildren(perm).flatMap(arg => arg === '--allowedTools'
+    ? [arg, 'SendMessage', 'TaskStop', 'ToolSearch', 'mcp__card_orchestrator'] : [arg]);
+}
+
 /**
  * CLAUDE'S PERMISSION LIST FOR A TURN PROFILE, by the profile's name — one
  * entry per profile Claude declares, plus plan-mode (runtimeClaude.mjs

package/bin/lib/hooks/orchestrator.mjs

@@ -31,7 +31,7 @@ export async function main() {
     // The names are the controller's own list (nativeAgentTools.mjs).
     // A research card's children only read (FLOWVIANT_ORCHESTRATOR_CHILDREN,
     // orchestrator.mjs): a child's write is refused here too.
-    if (gatedSpawnEvent(event, process.env.FLOWVIANT_ORCHESTRATOR_CHILDREN)) { process.exitCode = 2; return; }
+    if (gatedSpawnEvent(event, process.env.FLOWVIANT_ORCHESTRATOR_CHILDREN, process.env.FLOWVIANT_ORCHESTRATOR_READ_ONLY === '1')) { process.exitCode = 2; return; }
     try { await answer({}); } catch { /* the CLI already stopped reading */ }
   }
 }

package/bin/lib/intermediateArtifacts.mjs

@@ -4,8 +4,8 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { closeSync, constants, fstatSync, lstatSync, openSync, readFileSync, readSync, renameSync, writeFileSync } from 'node:fs';
 import { basename, dirname, join } from 'node:path';
-import { artifactTypeFor, artifactMaxBytesFor, changedArtifacts, scanArtifacts } from './artifacts.mjs';
-import { ARTIFACT_BINARY_MODEL_MAX_BYTES } from './artifactPolicy.mjs';
+import { ARTIFACT_MAX_DEPTH, artifactTypeFor, artifactMaxBytesFor, changedArtifacts, scanArtifacts } from './artifacts.mjs';
+import { ARTIFACT_BINARY_MODEL_MAX_BYTES, ARTIFACT_MAX_PER_OWNER } from './artifactPolicy.mjs';
 import { ensureRealSubdir, realDirState } from './ownedDirs.mjs';
 import { scrub, secretIn } from './uplinkScrub.mjs';
 import { exportModelPage } from './modelExport.mjs';
@@ -31,7 +31,8 @@ function readRegular(path, max = ARTIFACT_BINARY_MODEL_MAX_BYTES) {
   const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
   try {
     const stat = fstatSync(fd);
-    if (!stat.isFile() || stat.size > max) throw new Error('Intermediate artifact is not a bounded regular file.');
+    if (!stat.isFile()) throw new Error('Intermediate artifact is not a regular file.');
+    if (stat.size > max) throw new Error(`Intermediate artifact is ${stat.size} bytes; the per-file limit is ${max} bytes.`);
     const bytes = Buffer.alloc(stat.size);
     let offset = 0;
     while (offset < bytes.length) {
@@ -142,7 +143,7 @@ export function createIntermediateArtifacts({ wt, agentId, path, exportPage = ex
     signal?.throwIfAborted();
     const state = load(), taskId = taskOf(job);
     const identity = { agentId, taskId, turnId, taskKind };
-    const standing = scanArtifacts(wt);
+    const standing = scanArtifacts(wt, { all: true });
     const changed = changedArtifacts(before, standing);
     // Failed export/storage retries are tied to a card and exact source hash.
     // A changed page is a new version; it never reuses a previous GLB receipt.
@@ -151,11 +152,11 @@ export function createIntermediateArtifacts({ wt, agentId, path, exportPage = ex
       if (changed.some(e => e.name === ref.name)) continue;
       const entry = standing.find(e => e.name === ref.name);
       let bytes;
-      try { bytes = readIntermediateFile(wt, `.flowviant/artifacts/${ref.name}`); }
+      try { bytes = readIntermediateFile(wt, `.flowviant/artifacts/${ref.name}`, artifactMaxBytesFor(ref.name)); }
       catch (error) { throw new Error(`Required intermediate output ${ref.name} is unavailable: ${error.message}. Restore its exact producer bytes or revise the producer explicitly, then retry.`); }
       if (hash(bytes) !== ref.sha256)
         throw new Error(`Required intermediate output ${ref.name} is missing or changed since the failed handoff. Restore it or revise the producer explicitly, then retry.`);
-      if (!entry) throw new Error(`Required intermediate output ${ref.name} is outside the artifact scan limit. Reduce the output files and retry this producer.`);
+      if (!entry) throw new Error(`Required intermediate output ${ref.name} is outside the safe artifact walk (non-hidden paths with at most ${ARTIFACT_MAX_DEPTH} directories). Move it to a supported artifact path and retry this producer.`);
       changed.push(entry);
     }
     if (taskKind === 'model' && !changed.some(e => /\.html?$/i.test(e.name)) && (job.kind !== 'task' || job.redo === true) && taskId) {
@@ -188,12 +189,14 @@ export function createIntermediateArtifacts({ wt, agentId, path, exportPage = ex
       exports.push(receipt);
       if (!outputs.some(e => e.name === name)) outputs.push({ name });
     }
-    const reportable = new Set(scanArtifacts(wt).map(e => e.name));
-    const omitted = outputs.filter(e => !reportable.has(e.name));
-    if (omitted.length) throw new Error(`The artifact scan limit excludes required output ${omitted[0].name}. Reduce the output files and retry this producer; its handoff is unfinished.`);
     state.pending.sources = outputs.map(e => ({ name: e.name,
       sha256: hash(readIntermediateFile(wt, `.flowviant/artifacts/${e.name}`, artifactMaxBytesFor(e.name))) }));
     save(state);
+    // The server retains 40 artifacts per owner. Discovery crowding is not a
+    // storage limit, but uploading a larger required set would prune one of
+    // this very handoff's files and then falsely claim complete delivery.
+    if (outputs.length > ARTIFACT_MAX_PER_OWNER)
+      throw new Error(`This producer requires ${outputs.length} output files including model exports; artifact storage retains at most ${ARTIFACT_MAX_PER_OWNER} files per agent. Narrow this producer's output set before retrying; its handoff is unfinished.`);
     const textures = [...state.files.flatMap(f => [...(/\.png$/i.test(f.name) ? [f] : []), ...(f.model?.textureInputs ?? [])]),
       ...outputs.filter(e => /\.png$/i.test(e.name)).map(e => snapshot(wt, e, identity, retain))]
       .map(({ name, path, sha256, taskId, turnId, agentId, taskKind }) => ({ name, path, sha256, taskId, turnId, agentId, taskKind }));
@@ -211,7 +214,7 @@ export function createIntermediateArtifacts({ wt, agentId, path, exportPage = ex
     // Retry all prepared files even if their mtime did not change this turn.
     const uploadBefore = Object.assign(new Map(before), before);
     for (const ref of files) uploadBefore.delete(ref.name);
-    return { modelExports: exports, uploadBefore, commit: () => {
+    return { modelExports: exports, requiredOutputs: files.map(({ name, sha256 }) => ({ name, sha256 })), uploadBefore, commit: () => {
       const byName = new Map(state.files.map(f => [f.name, f]));
       for (const ref of files) byName.set(ref.name, ref);
       if (byName.size > 160) throw new Error('The intermediate artifact receipt exceeds 160 files. Narrow the outputs before retrying.');

package/bin/lib/mcpStdio.mjs

@@ -15,18 +15,26 @@
  */
 import { createInterface } from 'node:readline';
 
+/** The same vocabulary for daemon-side MCP relays, without another protocol
+ * envelope or tools/list spelling in each client. */
+export const mcpRequest = (action, params, id) => ({ jsonrpc: '2.0', id,
+  method: { initialize: 'initialize', list: 'tools/list', call: 'tools/call' }[action], params });
+
 /** `call(name, args)` answers a listed tool; what it resolves is the text result, as JSON. */
-export async function serveMcpStdio({ serverInfo, tools, call, input = process.stdin, write = s => process.stdout.write(s) }) {
+export async function serveMcpStdio({ serverInfo, tools, call, instructions, rawResult = false, input = process.stdin, write = s => process.stdout.write(s) }) {
   for await (const line of createInterface({ input })) {
     let req;
     try {
       req = JSON.parse(line); if (req.id === undefined) continue;
       let result;
-      if (req.method === 'initialize') result = { protocolVersion: req.params?.protocolVersion ?? '2024-11-05', capabilities: { tools: {} }, serverInfo };
+      if (req.method === 'initialize') result = { protocolVersion: req.params?.protocolVersion ?? '2024-11-05', capabilities: { tools: {} }, serverInfo, ...(instructions ? { instructions } : {}) };
       else if (req.method === 'ping') result = {};
       else if (req.method === 'tools/list') result = { tools };
       else if (req.method === 'tools/call' && tools.some(t => t.name === req.params?.name)) {
-        try { result = { content: [{ type: 'text', text: JSON.stringify(await call(req.params.name, req.params.arguments ?? {})) }] }; }
+        try {
+          const answer = await call(req.params.name, req.params.arguments ?? {});
+          result = rawResult ? answer : { content: [{ type: 'text', text: JSON.stringify(answer) }] };
+        }
         catch (error) { result = { isError: true, content: [{ type: 'text', text: error.message }] }; }
       } else { write(`${JSON.stringify({ jsonrpc: '2.0', id: req.id, error: { code: -32601, message: 'Unknown method' } })}\n`); continue; }
       write(`${JSON.stringify({ jsonrpc: '2.0', id: req.id, result })}\n`);

package/bin/lib/mergeBatch.mjs

@@ -8,8 +8,21 @@ import { mergeOutward, isRaceRejection } from './shipMerge.mjs';
 import { repositoryMergeOrder } from './repositoryMerge.mjs';
 import { ghReady, ensureOpenPr, mergeAndVerifyTip, linkRepositoryPrs } from './prWorkflow.mjs';
 
+/**
+ * ONE RUN'S CEILINGS (2026-10-22). A round whose base moved under a delivered
+ * integration folds the new base in with Git and validates again; only a
+ * conflict, or a failed validation, asks the coordinator again. The daemon's
+ * validation is the only full run, so its failure goes back to the coordinator
+ * inside the run, as the coordinator's own runs used to. Before this, every
+ * moved base was a whole new CLI turn that re-read everything and re-ran the
+ * full suite: a measured 3-agent batch spent 7 minutes integrating and
+ * nearly an hour validating and restarting.
+ */
+const MAX_ROUNDS = 5;
+const MAX_COORDINATIONS = 3;
+
 export async function integrateMergeBatch({ spec, progress = {}, previousError, entries, rootFor, baseDir, coordinate, validate, report,
-  setup = async () => {}, gitNet = network, land = mergeOutward, pr = { ghReady, ensureOpenPr, mergeAndVerifyTip, linkRepositoryPrs } }) {
+  setup = async () => {}, checkCommand = () => null, gitNet = network, land = mergeOutward, pr = { ghReady, ensureOpenPr, mergeAndVerifyTip, linkRepositoryPrs } }) {
   if (!/^[a-f0-9-]{36}$/.test(spec.id)) throw new Error('Invalid merge batch identity.');
   const states = structuredClone(progress);
   const ids = [...new Set(spec.members.flatMap((m) => m.cards.flatMap((c) => c.repos)))];
@@ -56,7 +69,15 @@ export async function integrateMergeBatch({ spec, progress = {}, previousError,
   }
   const worktrees = rows.map((r) => ({ wt: r.wt, branch: r.branch, repoRoot: r.repoRoot }));
   if (spec.prMode && pr.ghReady()) throw new Error('This project merges through pull requests. GitHub CLI is not installed or signed in on this machine.');
-  for (let attempt = 0; attempt < 3; attempt++) {
+  // Git's own merge of a moved base into the delivered integration. Clean is
+  // the only answer that keeps the coordinator's work; anything else aborts.
+  const foldBase = (r) => {
+    if (isAncestor(r.baseTip, git(['rev-parse', 'HEAD'], r.wt), r.wt)) return true;
+    try { gitMergeIn(r.repoRoot)(['merge', '--no-edit', r.baseTip], r.wt); return true; }
+    catch { gitOrNull(['merge', '--abort'], r.wt); return false; }
+  };
+  let commands = null, failure = previousError ?? null, coordinations = 0;
+  for (let round = 0; round < MAX_ROUNDS; round++) {
     const pending = [];
     for (const r of rows) {
       fetch(r);
@@ -74,38 +95,46 @@ export async function integrateMergeBatch({ spec, progress = {}, previousError,
     }
     await report(states);
     if (!pending.length) return { states, worktrees };
-    const context = { selection: spec, previousFailure: previousError ?? null, progress: states, repositories: rows.map((r) => ({ id: r.id, name: r.name,
-      integrationWorktree: r.wt, integrationBranch: r.branch, targetRef: r.baseRef, targetHead: r.baseTip,
-      alreadyLanded: Boolean(states[r.id].landed), sources: r.sources.map((s) => {
-        const mergeBase = git(['merge-base', r.baseTip, s.head], r.repoRoot);
-        const name = createHash('sha256').update(s.agentId).digest('hex').slice(0, 16);
-        const diffPath = resolve(r.wt, git(['rev-parse', '--git-path', `batch-source-${name}.diff`], r.wt));
-        const fd = openSync(diffPath, 'w', 0o600);
-        try { gitRaw(['diff', '--binary', mergeBase, s.head], r.repoRoot, { stdio: ['ignore', fd, 'pipe'] }); }
-        finally { closeSync(fd); }
-        const diffBytes = statSync(diffPath).size;
-        return { agentId: s.agentId, head: s.head, branch: s.branch, mergeBase, diffPath, diffBytes,
-          ...(diffBytes <= 64 * 1024 ? { diff: readFileSync(diffPath, 'utf8') } : {}),
-          commits: git(['log', '--format=%H %s', `${mergeBase}..${s.head}`], r.repoRoot),
-          files: git(['diff', '--stat', mergeBase, s.head], r.repoRoot), diffCommand: `git diff ${mergeBase} ${s.head}` };
-      }) })) };
-    const result = await coordinate(context);
-    if (result?.status !== 'delivered') throw new Error(result?.question ? `${result.question}\n${result.context || ''}` : 'The coordinating CLI did not deliver a combined result.');
+    if (!commands || !pending.every(foldBase)) {
+      if (coordinations++ === MAX_COORDINATIONS) throw new Error(failure ?? 'The batch needed more coordination than one run allows. Try the merge again.');
+      const context = { selection: spec, previousFailure: failure, progress: states, repositories: rows.map((r) => ({ id: r.id, name: r.name,
+        integrationWorktree: r.wt, integrationBranch: r.branch, targetRef: r.baseRef, targetHead: r.baseTip, configuredCheck: checkCommand(r),
+        alreadyLanded: Boolean(states[r.id].landed), sources: r.sources.map((s) => {
+          const mergeBase = git(['merge-base', r.baseTip, s.head], r.repoRoot);
+          const name = createHash('sha256').update(s.agentId).digest('hex').slice(0, 16);
+          const diffPath = resolve(r.wt, git(['rev-parse', '--git-path', `batch-source-${name}.diff`], r.wt));
+          const fd = openSync(diffPath, 'w', 0o600);
+          try { gitRaw(['diff', '--binary', mergeBase, s.head], r.repoRoot, { stdio: ['ignore', fd, 'pipe'] }); }
+          finally { closeSync(fd); }
+          const diffBytes = statSync(diffPath).size;
+          return { agentId: s.agentId, head: s.head, branch: s.branch, mergeBase, diffPath, diffBytes,
+            ...(diffBytes <= 64 * 1024 ? { diff: readFileSync(diffPath, 'utf8') } : {}),
+            commits: git(['log', '--format=%H %s', `${mergeBase}..${s.head}`], r.repoRoot),
+            files: git(['diff', '--stat', mergeBase, s.head], r.repoRoot), diffCommand: `git diff ${mergeBase} ${s.head}` };
+        }) })) };
+      const result = await coordinate(context);
+      if (result?.status !== 'delivered') throw new Error(result?.question ? `${result.question}\n${result.context || ''}` : 'The coordinating CLI did not deliver a combined result.');
+      commands = new Map(pending.map((r) => [r.id, result.validations?.find((v) => v.repositoryId === r.id)?.command]));
+    }
     // Validate all pending trees before any new repository lands.
+    let failed = false;
     for (const r of pending) {
       const head = git(['rev-parse', 'HEAD'], r.wt);
       if (git(['symbolic-ref', '--quiet', '--short', 'HEAD'], r.wt) !== r.branch ||
           git(['status', '--porcelain', '--untracked-files=no'], r.wt).trim() ||
           gitOrNull(['rev-parse', '--verify', 'MERGE_HEAD'], r.wt) ||
           !isAncestor(r.baseTip, head, r.wt) || r.sources.some((s) => !isAncestor(s.head, head, r.wt))) throw new Error(`${r.name}: the combined tree must contain the target base and every selected source, with all resolutions committed.`);
-      const command = result.validations?.find((v) => v.repositoryId === r.id)?.command;
+      const command = commands.get(r.id);
       if (typeof command !== 'string' || !command.trim() || command.length > 2000) throw new Error(`${r.name}: the coordinator supplied no runnable combined validation.`);
       await report(states);
-      await validate({ ...r, command });
+      try { await validate({ ...r, command }); }
+      catch (e) { failure = String(e?.message ?? e); commands = null; failed = true; break; }
       if (git(['rev-parse', 'HEAD'], r.wt) !== head || git(['status', '--porcelain', '--untracked-files=no'], r.wt).trim()) throw new Error(`${r.name}: the combined tree changed during validation.`);
       states[r.id] = { ...states[r.id], base: r.baseTip, head, validation: { command, head } };
       await report(states);
     }
+    if (failed) continue;
+    failure = null;
     // A sibling's validation may touch this repository too. Recheck the whole set.
     for (const r of pending) {
       if (git(['rev-parse', 'HEAD'], r.wt) !== states[r.id].head || git(['status', '--porcelain', '--untracked-files=no'], r.wt).trim()) throw new Error(`${r.name}: the combined tree changed after validation.`);
@@ -123,7 +152,7 @@ export async function integrateMergeBatch({ spec, progress = {}, previousError,
       await report(states);
       for (const r of pending) await pr.linkRepositoryPrs?.(states[r.id].prUrl, { cwd: r.wt, cards: spec.members.flatMap((m) => m.cards), order, repositories: spec.repositories, states });
     }
-    // A base race invalidates validation; send the whole set through the coordinator again.
+    // A base race invalidates validation; the next round folds the new base in and validates again.
     let raced = false;
     for (const id of order) {
       const r = pending.find((r) => r.id === id);
@@ -150,5 +179,5 @@ export async function integrateMergeBatch({ spec, progress = {}, previousError,
     }
     if (!raced) return { states, worktrees };
   }
-  throw new Error('The target base kept moving. Try the batch merge again; its selection and landed work have been saved.');
+  throw new Error(failure ?? 'The target base kept moving. Try the batch merge again; its selection and landed work have been saved.');
 }

package/bin/lib/nativeAgentTools.mjs

@@ -74,14 +74,17 @@ export const isShellTool = name => nativeName(name) === 'Bash';
 export const isClaudeFollowupTool = name => NATIVE_AGENT_TOOLS.claude.followup.includes(nativeName(name));
 // The controller reads only Claude's stop: TaskStop names its child as task_id.
 export const isClaudeStopTool = name => NATIVE_AGENT_TOOLS.claude.stop.includes(nativeName(name));
+/** Both runtime hook spellings for the capture server. */
+export const captureToolName = name => String(name ?? '').match(/^(?:mcp__flowviant__|mcp[./]flowviant[./]|flowviant[./])([a-z_]+)$/)?.[1] ?? null;
 
 /** What the hook refuses while the controller is unreachable: every spawn and
  * follow-up the controller gates, and on a run whose children only read
  * (`children` 'read', a research card) a child's write or shell, which only
  * the controller can fence read-only. */
 export const GATED_TOOLS = Object.freeze([...SPAWN, ...FOLLOWUP]);
-export const gatedSpawnEvent = (event, children = 'edit') => event?.hook_event_name === 'PreToolUse' &&
+export const gatedSpawnEvent = (event, children = 'edit', readOnlyRun = false) => event?.hook_event_name === 'PreToolUse' &&
   (GATED_TOOLS.includes(nativeName(event.tool_name)) ||
+    (readOnlyRun && (isChildWriteTool(event.tool_name) || Boolean(captureToolName(event.tool_name)) || /^(?:mcp__|mcp[./])/.test(String(event.tool_name)))) ||
     (children === 'read' && Boolean(event.agent_id) && (isChildWriteTool(event.tool_name) || isShellTool(event.tool_name))));
 
 /** Claude's PostToolUse and PostToolUseFailure matcher (orchestratorHooks.mjs):