great-cto 3.60.0 → 3.62.0

package/board/scripts/lib/adaptive-benchmark-protocol.mjs

@@ -0,0 +1,75 @@
+/** Matched experiment contract and descriptive supplied-data checks, not a runner. */
+import { createHash } from 'node:crypto';
+
+const hash = value => createHash('sha256').update(JSON.stringify(value)).digest('hex');
+const arms = ['legacy', 'adaptive'];
+const metrics = ['activeMs', 'workerCalls', 'verifierCalls', 'humanPauses', 'actionableFindings', 'escapedDefects', 'actualCostUsd'];
+export const scenarios = [
+  { id: 'docs-low-risk', cluster: 'content', tier: 'T0', task: 'Repair broken internal documentation links without code/config changes', checks: ['all target links resolve', 'no source/config drift'] },
+  { id: 'tenant-auth', cluster: 'identity', tier: 'T2', task: 'Fix cross-tenant object access and preserve valid tenant access', checks: ['cross-tenant deny', 'owner allow', 'unauthenticated deny', 'audit without secrets'] },
+  { id: 'billing-webhook', cluster: 'commerce', tier: 'T2', task: 'Make signed billing webhooks idempotent under duplicate and out-of-order delivery', checks: ['signature refusal', 'duplicate no-op', 'out-of-order reconciliation', 'no double charge'] },
+  { id: 'bounded-import', cluster: 'data', tier: 'T2', task: 'Implement dry-run import with validation, bounded history and rollback', checks: ['invalid data refused', 'dry run no mutation', 'bounded replacement', 'repeat import idempotent'] },
+  { id: 'prompt-injection', cluster: 'ai', tier: 'T2', task: 'Preserve citations and prevent retrieved text from changing tool authority', checks: ['injection rejected', 'supported citations', 'uncertainty retained', 'cross-user isolation'] },
+  { id: 'api-compatibility', cluster: 'platform', tier: 'T1', task: 'Add an optional API field while preserving older clients and explicit errors', checks: ['old client preserved', 'schema validation', 'no silent default on missing source'] },
+  { id: 'migration-safety', cluster: 'storage', tier: 'T2', task: 'Plan a backward-compatible schema change with concurrent readers and rollback', checks: ['rollback path', 'reader compatibility', 'bounded locks', 'least privilege'] },
+  { id: 'board-accessibility', cluster: 'ui', tier: 'T1', task: 'Repair keyboard navigation and narrow-screen layout without losing decision controls', checks: ['keyboard destinations', 'no horizontal overflow', 'decision target preserved', 'no console error'] },
+];
+
+/** Both exact policies/artifacts and corpus must be pinned before observations. */
+export function preregisterBenchmark({ artifacts, policies, repetitions = 3, hostModelPolicy }) {
+  if (!Number.isInteger(repetitions) || repetitions < 3 || repetitions > 10) throw Error('repetitions must be 3..10');
+  if (typeof hostModelPolicy !== 'string' || !hostModelPolicy.trim()) throw Error('explicit matched host/model policy required');
+  for (const arm of arms) {
+    if (!/^[a-f0-9]{40}$/.test(artifacts?.[arm]?.commit || '') || !/^[a-f0-9]{64}$/.test(artifacts?.[arm]?.artifactSha256 || '')) throw Error('exact artifact pins required for both arms');
+    if (!policies?.[arm] || typeof policies[arm] !== 'object' || Array.isArray(policies[arm])) throw Error('both full execution policies required');
+  }
+  if (JSON.stringify(artifacts.legacy) === JSON.stringify(artifacts.adaptive) && JSON.stringify(policies.legacy) === JSON.stringify(policies.adaptive)) throw Error('identical arms are not an adaptive comparison');
+  const blocks = scenarios.flatMap((scenario, index) => Array.from({ length: repetitions }, (_, repetition) => ({
+    task: scenario.id, cluster: scenario.cluster, repetition, order: (index + repetition) % 2 ? ['adaptive', 'legacy'] : ['legacy', 'adaptive'],
+    specificationDigest: hash(scenario), acceptanceDigest: hash(scenario.checks),
+  })));
+  const contract = { version: 1, kind: 'matched full-workflow preregistration', artifacts, policies, hostModelPolicy,
+    scenarios, repetitions, blocks, metrics, unitOfAnalysis: 'task cluster, not individual assertion or agent call',
+    gates: 'actual operator approvals required; never infer approval from exit zero or test fixture',
+    safety: 'same mandatory domain/security/compliance floors in both arms; no production targets',
+    stopping: 'record launch failures, incomplete runs and gates; no silent replacement of unsuccessful trials',
+    hiddenChecks: 'outside workers; fixed before first call; never fed back into repair prompts',
+    status: 'preregistered-not-run-ready', remaining: 'representative fixtures, independent scorer and attested controller observation collector' };
+  return { ...contract, digest: hash(contract) };
+}
+
+/** Validate observations without pretending supplied numbers are runtime attestation. */
+export function describeMatchedObservations(protocol, observations) {
+  const { digest, ...contract } = protocol || {};
+  if (!digest || hash(contract) !== digest) throw Error('preregistration changed');
+  if (!Array.isArray(observations)) throw Error('observations must be an array');
+  const groups = new Map();
+  for (const row of observations) {
+    const block = protocol.blocks.find(b => b.task === row.task && b.repetition === row.repetition);
+    if (!block || !arms.includes(row.arm) || row.protocolDigest !== digest
+      || row.specificationDigest !== block.specificationDigest || row.acceptanceDigest !== block.acceptanceDigest
+      || row.artifactSha256 !== protocol.artifacts[row.arm].artifactSha256) throw Error('unmatched observation identity');
+    const key = `${row.task}:${row.repetition}`;
+    const group = groups.get(key) || {};
+    if (group[row.arm]) throw Error('duplicate arm observation');
+    if (!['completed', 'blocked', 'failed', 'unassessed'].includes(row.status)) throw Error('invalid observation status');
+    if (row.status === 'completed' ? typeof row.accepted !== 'boolean' : row.accepted !== null) throw Error('unassessed acceptance must be null');
+    for (const metric of metrics) {
+      if (row[metric] !== null && (!Number.isFinite(row[metric]) || row[metric] < 0)) throw Error('unavailable metric must be null, never fabricated zero');
+      if (row[metric] !== null && metric !== 'activeMs' && metric !== 'actualCostUsd' && !Number.isInteger(row[metric])) throw Error('count metric must be integral');
+    }
+    group[row.arm] = row; groups.set(key, group);
+  }
+  const paired = [...groups.values()].filter(g => arms.every(a => g[a]?.status === 'completed'));
+  const differences = Object.fromEntries(metrics.map(metric => {
+    const measured = paired.filter(g => arms.every(a => g[a][metric] !== null));
+    return [metric, { pairedMeasured: measured.length, meanAdaptiveMinusLegacy: measured.length
+      ? measured.reduce((sum, g) => sum + g.adaptive[metric] - g.legacy[metric], 0) / measured.length : null }];
+  }));
+  return { evidenceLevel: 'supplied-observations-not-runtime-attested', plannedBlocks: protocol.blocks.length,
+    observedRows: observations.length, completedPairs: paired.length,
+    incompleteBlocks: protocol.blocks.length - paired.length,
+    pairedAcceptance: Object.fromEntries(arms.map(a => [a, paired.length ? paired.filter(g => g[a].accepted).length / paired.length : null])),
+    differences, qualityUpliftPercent: null, defaultEnablementAllowed: false,
+    inference: 'descriptive only; no significance or product-quality conclusion without independent evidence and task-cluster uncertainty' };
+}

package/board/scripts/lib/agent-execution-budget.mjs

@@ -0,0 +1,143 @@
+/** Same-machine cross-host admission control, outside worker project scope. */
+import { mkdirSync, readFileSync, writeFileSync, renameSync, unlinkSync, rmdirSync, realpathSync, existsSync, lstatSync, openSync, fsyncSync, closeSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join, relative, isAbsolute, sep } from 'node:path';
+import { randomUUID, createHash } from 'node:crypto';
+
+const sha = value => createHash('sha256').update(value).digest('hex');
+const record = value => value !== null && typeof value === 'object' && !Array.isArray(value);
+const outside = (root, path) => { const rel = relative(root, path); return rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel); };
+const sleep = ms => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+
+export function readExecutionBudget(root, { env = process.env } = {}) {
+  if (!env.GREAT_CTO_AGENT_BUDGET_FILE) return null;
+  root = realpathSync(root);
+  const file = realpathSync(env.GREAT_CTO_AGENT_BUDGET_FILE);
+  if (!outside(root, file)) throw Error('agent budget policy must be outside the worker workspace');
+  if ((lstatSync(file).mode & 0o077) !== 0) throw Error('agent budget policy must be private (0600)');
+  const policy = JSON.parse(readFileSync(file, 'utf8'));
+  for (const [key, min, max] of [['maxConcurrent', 1, 16], ['maxCallsPerRun', 2, 512]]) {
+    if (!Number.isInteger(policy[key]) || policy[key] < min || policy[key] > max) throw Error(`invalid agent budget ${key}`);
+  }
+  if (policy.maxDepth !== 1) throw Error('v1 requires maxDepth=1; nested delegation is not admitted');
+  if (!/^[a-zA-Z0-9_-]{1,100}$/.test(policy.runId || '')) throw Error('explicit shared budget runId required');
+  const limits = { maxConcurrent: policy.maxConcurrent, maxDepth: 1, maxCallsPerRun: policy.maxCallsPerRun };
+  const configured = env.GREAT_CTO_AGENT_BUDGET_STORE || join(homedir(), '.great_cto', 'agent-execution');
+  if (!isAbsolute(configured) || !outside(root, configured)) throw Error('agent budget store must be absolute and outside workspace');
+  mkdirSync(configured, { recursive: true, mode: 0o700 });
+  const store = realpathSync(configured);
+  if (!outside(root, store) || (lstatSync(store).mode & 0o077) !== 0) throw Error('agent budget store must be private and outside workspace');
+  return { store, limits, policyDigest: sha(JSON.stringify(limits)), runKey: sha(policy.runId) };
+}
+
+function atomicJson(path, value) {
+  const temp = `${path}.${randomUUID()}.tmp`;
+  const fd = openSync(temp, 'wx', 0o600);
+  try { writeFileSync(fd, JSON.stringify(value)); fsyncSync(fd); } finally { closeSync(fd); }
+  renameSync(temp, path);
+}
+
+/** A crashed lock stays closed. No TTL/PID assumption can prove a worker ended. */
+function transaction(budget, operation) {
+  const lock = join(budget.store, 'lock'); const deadline = Date.now() + 1500;
+  while (true) {
+    try { mkdirSync(lock, { mode: 0o700 }); break; }
+    catch (e) { if (e.code !== 'EEXIST' || Date.now() >= deadline) throw Error('agent budget lock unavailable; inspect/reconcile, never bypass'); sleep(10); }
+  }
+  const lockToken = randomUUID();
+  try {
+    atomicJson(join(lock, 'owner.json'), { token: lockToken, pid: process.pid });
+    const path = join(budget.store, 'ledger.json');
+    const ledger = existsSync(path) ? JSON.parse(readFileSync(path, 'utf8')) : { version: 1, policyDigest: budget.policyDigest, limits: budget.limits, nextFence: 0, leases: {}, calls: {}, retired: {}, events: [] };
+    // JSON arrays discard string-keyed properties on serialization. Treating
+    // them as maps can silently lose leases, call counts or replay fencing.
+    if (!record(ledger) || ledger.version !== 1 || ledger.policyDigest !== budget.policyDigest || JSON.stringify(ledger.limits) !== JSON.stringify(budget.limits) || !record(ledger.leases) || !record(ledger.calls) || !record(ledger.retired) || !Array.isArray(ledger.events) || !Number.isSafeInteger(ledger.nextFence) || ledger.nextFence < 0 || Object.values(ledger.calls).some(n => !Number.isSafeInteger(n) || n < 0)) throw Error('agent budget ledger/policy mismatch; admission refused');
+    const result = operation(ledger);
+    atomicJson(path, ledger);
+    return result;
+  } finally {
+    // Only the holder may unlock. Never delete somebody else's state recursively.
+    const owner = JSON.parse(readFileSync(join(lock, 'owner.json'), 'utf8'));
+    if (owner.token !== lockToken) throw Error('agent budget lock ownership changed');
+    unlinkSync(join(lock, 'owner.json')); rmdirSync(lock);
+  }
+}
+
+const event = (ledger, entry) => {
+  ledger.events.push({ at: new Date().toISOString(), ...entry });
+  if (ledger.events.length > 2000) ledger.events.splice(0, ledger.events.length - 2000);
+};
+
+/** Allocate a whole wave atomically, so one host cannot consume half a quorum. */
+export function reserveAgents(budget, requests) {
+  if (!budget) return requests.map(() => null);
+  return transaction(budget, ledger => {
+    const deny = reason => { event(ledger, { kind: 'denied', runKey: budget.runKey, reason }); return { error: reason }; };
+    if (!Array.isArray(requests) || !requests.length) return deny('empty agent reservation');
+    for (const r of requests) if (!/^[a-zA-Z0-9:_-]{1,200}$/.test(r.callId || '') || !['codex', 'claude-code'].includes(r.host) || r.depth !== 1) return deny('invalid agent identity or delegation depth');
+    const seen = new Set();
+    for (const r of requests) { if (seen.has(r.callId)) return deny('duplicate call identity'); seen.add(r.callId); }
+    const present = requests.map(r => Object.values(ledger.leases).find(l => l.runKey === budget.runKey && l.callId === r.callId));
+    if (present.some(Boolean)) {
+      if (present.every((lease, i) => lease && lease.host === requests[i].host && lease.role === (requests[i].role || 'worker') && lease.depth === requests[i].depth)) return present;
+      return deny('partial/conflicting reservation replay');
+    }
+    if (requests.some(r => ledger.retired[sha(`${budget.runKey}\0${r.callId}`)])) return deny('completed/reconciled call identity cannot be reused');
+    if (Object.keys(ledger.leases).length + requests.length > ledger.limits.maxConcurrent) return deny('global agent concurrency exhausted');
+    if ((ledger.calls[budget.runKey] || 0) + requests.length > ledger.limits.maxCallsPerRun) return deny('shared run agent-call budget exhausted');
+    if (requests.length > Number.MAX_SAFE_INTEGER - ledger.nextFence) return deny('agent lease fence exhausted; admission refused');
+    const leases = requests.map(r => {
+      const lease = { token: randomUUID(), fence: ++ledger.nextFence, runKey: budget.runKey, callId: r.callId, host: r.host, role: r.role || 'worker', depth: r.depth, acquiredAt: new Date().toISOString(), ownerPid: Object.hasOwn(r, 'ownerPid') ? r.ownerPid : process.pid };
+      ledger.leases[lease.token] = lease;
+      event(ledger, { kind: 'admitted', ...lease }); return lease;
+    });
+    ledger.calls[budget.runKey] = (ledger.calls[budget.runKey] || 0) + leases.length;
+    return leases;
+  });
+}
+
+export function requireAgents(budget, requests) {
+  const result = reserveAgents(budget, requests);
+  if (result.error) throw Error(result.error);
+  return result;
+}
+
+export function releaseAgent(budget, lease) {
+  if (!budget || !lease) return;
+  return transaction(budget, ledger => {
+    const current = ledger.leases[lease.token];
+    if (!current || current.fence !== lease.fence || current.runKey !== budget.runKey) throw Error('stale or foreign agent lease');
+    ledger.retired[sha(`${current.runKey}\0${current.callId}`)] = current.fence;
+    delete ledger.leases[lease.token]; event(ledger, { kind: 'released', token: lease.token, fence: lease.fence, runKey: lease.runKey });
+  });
+}
+
+/** Explicit reconciliation is not automatic expiry; caller must confirm work stopped. */
+export function reconcileAgent(budget, { token, fence, confirmedStopped = false }) {
+  if (!confirmedStopped) throw Error('operator confirmation that execution stopped is required');
+  return releaseAgent(budget, { token, fence });
+}
+
+export function reconcileBudgetLock(budget, { token, confirmedStopped = false }) {
+  if (!confirmedStopped) throw Error('operator confirmation required for crashed lock recovery');
+  const lock = join(budget.store, 'lock');
+  const owner = JSON.parse(readFileSync(join(lock, 'owner.json'), 'utf8'));
+  if (owner.token !== token || !Number.isInteger(owner.pid)) throw Error('lock recovery identity mismatch');
+  try { process.kill(owner.pid, 0); throw Error('lock owner still alive; recovery refused'); }
+  catch (e) { if (e.code !== 'ESRCH') throw e; }
+  const recovery = join(budget.store, 'recovery'); mkdirSync(recovery, { mode: 0o700 });
+  try {
+    if (JSON.parse(readFileSync(join(lock, 'owner.json'), 'utf8')).token !== token) throw Error('lock owner changed');
+    unlinkSync(join(lock, 'owner.json')); rmdirSync(lock);
+  } finally { rmdirSync(recovery); }
+}
+
+export function budgetSnapshot(budget) {
+  return transaction(budget, ledger => ({ active: Object.values(ledger.leases), calls: ledger.calls[budget.runKey] || 0, limits: ledger.limits, events: ledger.events.slice(-50) }));
+}
+
+export async function withAgentBudget(state, { callId, host, role }, run) {
+  const budget = state.executionBudget;
+  const [lease] = requireAgents(budget, [{ callId, host, role, depth: 1 }]);
+  try { return await run(); } finally { releaseAgent(budget, lease); }
+}

package/board/scripts/lib/approval-level.mjs

@@ -0,0 +1,174 @@
+// Which gates stop the human, for a given approval-level.
+//
+// The pipeline already chains itself: shared/pipeline.toml holds the transition
+// map and pipeline-dispatcher.mjs injects the next agent after each verdict. The
+// only question left is where it should PAUSE — and the existing levels could not
+// express the one an operator most often wants: "ask me about the product, decide
+// the technical parts yourself".
+//
+// `gates-only` (the default) stops at `arch` — an architectural question — and
+// never at `product`. `auto` asks nothing at all, including what to build. So the
+// operator had to either review architecture they did not want to review, or run
+// with no human decision anywhere. `product-only` closes that: the two gates it
+// keeps are exactly the two ADR-009 calls expensive to undo — choosing what to
+// build (a wrong answer wastes the entire build) and shipping it (it escapes the
+// machine and reaches users).
+//
+// This is a pure function on purpose. The rule used to live as prose in every
+// agent's prompt, re-derived each time; one testable definition means the agents
+// agree by construction.
+
+/** Gate sets per level, in pipeline order. */
+const LEVEL_GATES = Object.freeze({
+  auto:            [],
+  'product-only':  ['product', 'ship'],
+  // `product` joined the default on 2026-08-19. The set was ['arch', 'ship'],
+  // which gated HOW to build and WHETHER to release, and left WHAT to build
+  // ungated — the one decision in the chain that is most expensive to reverse,
+  // because you learn it was wrong only after architect, pm, senior-dev, qa,
+  // security and devops have all run. ADR-009 puts gates on cost-of-undo rather
+  // than on position, and by that rule this was inverted: the cheap-to-undo
+  // decision stopped, the expensive one did not.
+  //
+  // It costs one pause per PRODUCT, not per feature. product-owner is a pipeline
+  // entry point — nothing transitions into it — so it runs only from `/start`.
+  // `/audit` enters at project-auditor, and the request classifier sends both
+  // SIMPLE and COMPLEX CODE straight to senior-dev or architect. The pause lands
+  // at the moment someone typed `/start` and is by definition at the keyboard.
+  // One pipeline gate, and a briefing where the second one was.
+  //
+  // Four stops were measured at `gates-only` — product, arch, import, ship — and
+  // they do not collapse, because they guard different failures: `arch` is cheap
+  // to undo, `import` destroys data, `product` wastes the whole build, `ship`
+  // escapes the machine. Only the last is irreversible in ADR-009's sense, so it
+  // is the one that stops you.
+  //
+  // `product` does not disappear. A decision about WHAT to build that nobody sees
+  // is how a pipeline spends a day on the wrong thing — and that is precisely why
+  // it was added to the default on 2026-08-19. Here it is surfaced as a mandatory
+  // one-screen console briefing instead: stay silent and it proceeds, speak and it
+  // stops. Not a gate, and not silence either.
+  //
+  // See briefedGatesFor() below, and the fallback in gatesForApprovalLevel: a
+  // brief that cannot be READ re-gates product, because "I could not show you"
+  // must never be delivered as "you were shown and said nothing".
+  'ship-only':     ['ship'],
+  'gates-only':    ['product', 'arch', 'ship'],
+  strict:          ['arch', 'code', 'ship'],
+  expert:          ['product', 'arch', 'plan', 'code', 'qa', 'security', 'ship'],
+  'step-by-step':  ['product', 'arch', 'plan', 'code', 'qa', 'security', 'ship'],
+});
+
+export const APPROVAL_LEVELS = Object.freeze(Object.keys(LEVEL_GATES));
+export const DEFAULT_LEVEL = 'gates-only';
+
+/**
+ * Archetypes where a compliance/security sign-off is not the operator's to skip.
+ * SKILL.md already states these carry a `strict` minimum; encoding it here means
+ * a new level cannot become a bypass by omission.
+ */
+const REGULATED = new Set([
+  'ai-system', 'agent-product', 'commerce', 'web3', 'iot-embedded', 'regulated',
+  'fintech', 'healthcare', 'insurance', 'legal', 'gov-public', 'defense-govcon',
+]);
+const REGULATED_FLOOR = ['security', 'compliance'];
+
+/**
+ * Gates that apply at EVERY level, including `auto`.
+ *
+ * The levels above trade review depth for speed, which is the operator's call.
+ * This is a different axis, and ADR-009 states it: an operation that destroys
+ * evidence needs a human wherever it sits, regardless of position or policy.
+ *
+ * `import` is here because re-importing over records someone has since edited
+ * cannot be undone — `migration-import-engineer` says so in its own prompt. A
+ * level is a statement about how much review you want; it is not permission to
+ * overwrite a client's data unattended, and a floor of `[]` at `auto` would have
+ * made it exactly that.
+ */
+const IRREVERSIBLE_FLOOR = ['import'];
+
+export function isRegulated(archetype) {
+  return REGULATED.has(String(archetype || '').toLowerCase());
+}
+
+/**
+ * The gates that must stop a human for this level.
+ *
+ * @param {string} level
+ * @param {{archetype?: string}} [opts]
+ * @returns {string[]} gate names, pipeline order, deduped
+ */
+/**
+ * Decisions this level surfaces as a non-blocking console briefing rather than a
+ * gate. Empty for every level that either gates the decision or never reaches it.
+ * @returns {string[]}
+ */
+export function briefedGatesFor(level) {
+  return level === 'ship-only' ? ['product'] : [];
+}
+
+export function gatesForApprovalLevel(level, { archetype, briefReadable = true } = {}) {
+  // An unrecognised or missing level falls back to the default rather than to
+  // "no gates": a typo in PROJECT.md must not silently disable human review.
+  const key = LEVEL_GATES[level] ? level : DEFAULT_LEVEL;
+  const base = [...LEVEL_GATES[key]];
+
+  // Applies at every level, `auto` included — see IRREVERSIBLE_FLOOR.
+  for (const g of IRREVERSIBLE_FLOOR) if (!base.includes(g)) base.push(g);
+
+  // A briefing replaces a gate only while the briefing actually appears.
+  //
+  // `ship-only` trades the `product` gate for a mandatory console screen. If the
+  // brief cannot be read — absent, unreadable, written by a stage that failed —
+  // the trade is off and the gate comes back. Proceeding here would deliver "I
+  // could not show you" as "you were shown and said nothing", which is the exact
+  // substitution this project exists to refuse, arriving through a feature meant
+  // to reduce friction.
+  if (!briefReadable) {
+    for (const g of briefedGatesFor(key)) if (!base.includes(g)) base.push(g);
+  }
+
+  if (isRegulated(archetype)) {
+    for (const g of REGULATED_FLOOR) if (!base.includes(g)) base.push(g);
+    if (!base.includes('ship')) base.push('ship');
+  }
+
+  const order = ['product', 'arch', 'plan', 'code', 'import', 'qa', 'security', 'compliance', 'ship'];
+  return [...new Set(base)].sort((a, b) => order.indexOf(a) - order.indexOf(b));
+}
+
+/** Should this specific gate pause the human under this level? */
+export function gateApplies(gate, level, opts) {
+  return gatesForApprovalLevel(level, opts).includes(String(gate).replace(/^gate:/, ''));
+}
+
+/** Read the level out of a PROJECT.md body. Missing → the default. */
+export function levelFromProjectMd(text = '') {
+  const m = String(text).match(/^approval-level:\s*(\S+)/m);
+  const raw = m ? m[1].trim() : DEFAULT_LEVEL;
+  return LEVEL_GATES[raw] ? raw : DEFAULT_LEVEL;
+}
+
+/** One-line explanation for an operator asking why they were (not) asked. */
+export function describeLevel(level, opts) {
+  const gates = gatesForApprovalLevel(level, opts);
+  const key = LEVEL_GATES[level] ? level : `${level} (unknown → ${DEFAULT_LEVEL})`;
+  return gates.length
+    ? `${key}: pauses at ${gates.map((g) => `gate:${g}`).join(', ')}`
+    : `${key}: no human gates — fully unattended`;
+}
+
+// ── CLI ─────────────────────────────────────────────────────────────────────
+const isMain = import.meta.url === `file://${process.argv[1]}`;
+if (isMain) {
+  const argv = process.argv.slice(2);
+  const level = argv.find((a) => !a.startsWith('--')) || DEFAULT_LEVEL;
+  const i = argv.indexOf('--archetype');
+  const archetype = i > -1 ? argv[i + 1] : undefined;
+  if (argv.includes('--json')) {
+    process.stdout.write(JSON.stringify({ level, archetype: archetype ?? null, gates: gatesForApprovalLevel(level, { archetype }) }, null, 2) + '\n');
+  } else {
+    process.stdout.write(describeLevel(level, { archetype }) + '\n');
+  }
+}

package/board/scripts/lib/benchmark-review-dispatch.mjs

@@ -0,0 +1,52 @@
+/** Read-only controller trace audit, not domain/package/provider attestation. */
+import { dispatchEvidenceSummary } from './controller-dispatch-evidence.mjs';
+import { completeScopeAttestation } from './scoped-review-reuse.mjs';
+
+const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+const mandatory = new Set(['code-reviewer', 'qa-engineer', 'security-officer', 'ai-eval-engineer']);
+
+export function assertBenchmarkReviewDispatches(state, roles) {
+  if (!Array.isArray(roles) || !roles.length || new Set(roles).size !== roles.length
+    || roles.some(role => typeof role !== 'string' || !role)
+    || dispatchEvidenceSummary(state).evidenceLevel !== 'controller-invocations-recorded') throw Error('benchmark review dispatch: complete valid invocation history required');
+  const records = new Map(state.dispatchEvidence.records.map(record => [record.id, record]));
+  const used = new Set();
+  for (const role of roles) {
+    const result = state.results?.[role];
+    const matches = state.attempts?.filter(attempt => attempt.id === result?.attemptId) || [];
+    const attempt = matches[0];
+    const host = state.hostRoutes?.[role] || state.hostRoutes?.[state.specialistStages?.[role]?.role] || 'codex';
+    if (!result || typeof result.attemptId !== 'string' || !result.attemptId
+      || matches.length !== 1 || attempt.role !== role || attempt.status !== 'verified'
+      || attempt.host !== host || result.host !== host || !attempt.inputReceipt || attempt.inputReceipt.truncated
+      || !attempt.receipt || attempt.receipt.truncated || !same(result.receipt, attempt.receipt)
+      || attempt.verification?.state !== 'verified' || !Array.isArray(attempt.verification.checks)
+      || !attempt.verification.checks.length
+      || !same(result.verification, attempt.verification)) throw Error('benchmark review dispatch: required role attempt identity mismatch');
+    const verifier = records.get(`${attempt.id}:verifier`);
+    if (verifier?.kind !== 'verifier' || verifier.role !== 'codex-verifier' || verifier.host !== 'codex'
+      || verifier.outcome !== 'returned') throw Error('benchmark review dispatch: required independent verifier missing');
+    if (attempt.reuse) {
+      const prior = attempt.reuse, source = state.specialistPolicy?.reviewReuse?.sources?.[role];
+      if (mandatory.has(role) || attempt.workerCallId || records.has(`${attempt.id}:worker`)
+        || !source || !same(result.reuse, prior) || prior.role !== role || prior.runId === state.id
+        || typeof prior.runId !== 'string' || !prior.runId || typeof prior.attemptId !== 'string' || !prior.attemptId
+        || !/^[a-f0-9]{64}$/.test(prior.resultDigest || '') || !/^[a-f0-9]{64}$/.test(prior.sourceDigest || '') || prior.sourceDigest !== source.sha256
+        || !state.specialistPolicy.reviewReuse.scopes?.[role]
+        || !/^[a-f0-9]{64}$/.test(attempt.scopedInput?.digest || '')
+        || !completeScopeAttestation(attempt.verification, attempt.scopedInput)) throw Error('benchmark review dispatch: reuse lacks fresh scoped attestation');
+      continue;
+    }
+    const workerId = attempt.workerCallId || `${attempt.id}:worker`, worker = records.get(workerId);
+    if (attempt.workerCallId) {
+      const waves = state.waveHistory?.filter(wave => wave.status === 'verified'
+        && workerId === `${wave.id}:${role}` && wave.roles?.includes(role) && wave.hosts?.[role] === host) || [];
+      if (waves.length !== 1) throw Error('benchmark review dispatch: worker is not bound to a verified mixed-host wave');
+    }
+    if (used.has(workerId) || worker?.kind !== 'worker' || worker.role !== role || worker.host !== host
+      || worker.outcome !== 'returned' || Date.parse(worker.finishedAt) > Date.parse(verifier.startedAt)) throw Error('benchmark review dispatch: required worker missing, mismatched or after verification');
+    used.add(workerId);
+  }
+  return { version: 1, scope: 'required-controller-review-dispatches-only', roles: [...roles],
+    domainSelectionVerified: false, providerExecutionVerified: false };
+}

package/board/scripts/lib/benchmark-scorer-signature.mjs

@@ -0,0 +1,64 @@
+/** A registered trusted-launcher assertion, not hardware/OS/provider attestation. */
+import { createHash, createPrivateKey, createPublicKey, sign, verify } from 'node:crypto';
+const sha = bytes => createHash('sha256').update(bytes).digest('hex');
+const hex = value => typeof value === 'string' && /^[a-f0-9]{64}$/.test(value);
+export const SIGNED_SCORER_SOURCE = 'trusted-launcher-signed-pinned-scorer';
+function bytes(value, size) {
+  if (typeof value !== 'string') throw Error('invalid scorer signature encoding');
+  const decoded = Buffer.from(value, 'base64');
+  if (decoded.length !== size || decoded.toString('base64') !== value) throw Error('invalid scorer signature encoding');
+  return decoded;
+}
+function canonical(value) {
+  if (Array.isArray(value)) return value.map(canonical);
+  if (value && typeof value === 'object') return Object.fromEntries(Object.keys(value).sort().map(k => [k, canonical(value[k])]));
+  return value;
+}
+const message = payload => Buffer.from(JSON.stringify(canonical(payload)));
+
+export function scorerAuthority(scorer) {
+  if (scorer?.authority == null) return null;
+  const a = scorer.authority;
+  if (!hex(scorer.oracleSha256) || a.algorithm !== 'ed25519' || !hex(a.publicKeySha256)
+    || Object.keys(a).sort().join(',') !== 'algorithm,publicKeySha256,publicKeySpki') throw Error('invalid registered scorer authority');
+  try {
+    const der = bytes(a.publicKeySpki, 44), key = createPublicKey({ key: der, format: 'der', type: 'spki' });
+    if (key.asymmetricKeyType !== 'ed25519' || sha(der) !== a.publicKeySha256
+      || !key.export({ format: 'der', type: 'spki' }).equals(der)) throw Error();
+    return key;
+  } catch { throw Error('invalid registered scorer authority'); }
+}
+
+/** Caller supplies already bounded private key bytes; no secret values in errors. */
+export function signScorerPayload(payload, privateBytes, scorer) {
+  scorerAuthority(scorer);
+  if (!scorer.authority) throw Error('scorer signing authority was not preregistered');
+  let key;
+  try {
+    key = createPrivateKey(privateBytes);
+    const der = createPublicKey(key).export({ format: 'der', type: 'spki' });
+    if (key.asymmetricKeyType !== 'ed25519' || sha(der) !== scorer.authority.publicKeySha256) throw Error();
+  } catch { throw Error('private scorer signing key does not match registered authority'); }
+  return { version: 2, source: SIGNED_SCORER_SOURCE, payload,
+    signature: sign(null, message(payload), key).toString('base64') };
+}
+
+export function verifyScorerReport(report, scorer) {
+  const key = scorerAuthority(scorer);
+  if (!key || report?.version !== 2 || report.source !== SIGNED_SCORER_SOURCE
+    || Object.keys(report).sort().join(',') !== 'payload,signature,source,version') throw Error('signed scorer report required by registered authority');
+  const p = report.payload;
+  if (!p || Object.keys(p).sort().join(',') !== 'accepted,artifactSha256,candidateInputDigest,criteria,oracleSha256,process,receipt,registrationDigest,runId,scorerSha256,stateSha256'
+    || ![p.artifactSha256, p.candidateInputDigest, p.oracleSha256, p.registrationDigest, p.scorerSha256, p.stateSha256].every(hex)
+    || typeof p.runId !== 'string' || !p.runId || typeof p.accepted !== 'boolean'
+    || !Array.isArray(p.criteria) || !p.criteria.length || p.criteria.length > 100
+    || p.criteria.some(c => !c || typeof c.text !== 'string' || !c.text || c.text.length > 1024
+      || !['passed', 'failed'].includes(c.state) || typeof c.evidence !== 'string' || !c.evidence.trim() || c.evidence.length > 1024)
+    || p.accepted !== p.criteria.every(c => c.state === 'passed')
+    || !Number.isInteger(p.process?.pid) || p.process.pid <= 0 || p.process.exitCode !== 0
+    || !Number.isFinite(Date.parse(p.process.startedAt)) || !Number.isFinite(Date.parse(p.process.finishedAt))
+    || Date.parse(p.process.finishedAt) < Date.parse(p.process.startedAt)
+    || typeof p.process.node !== 'string' || !/^v\d+\./.test(p.process.node)) throw Error('invalid signed scorer payload');
+  if (!verify(null, message(p), key, bytes(report.signature, 64))) throw Error('scorer report signature mismatch');
+  return p;
+}

package/board/scripts/lib/claude-exec.mjs

@@ -45,7 +45,7 @@ export function runClaudeExec({ prompt, cwd, timeoutMs = 300000, bin = process.e
       '--permission-mode', 'dontAsk', '--permission-prompts', 'none', '--json-schema', PROPOSAL_SCHEMA];
     const group = process.platform !== 'win32';
     const proc = spawn(bin, args, { cwd, stdio: ['pipe', 'pipe', 'pipe'], detached: group });
-    let out = '', err = '', settled = false, timedOut = false;
+    let out = '', err = '', settled = false, timedOut = false, stdinError = null;
     const finish = result => { if (!settled) { settled = true; clearTimeout(timer); resolve(result); } };
     const kill = () => {
       try { if (group && proc.pid) process.kill(-proc.pid, 'SIGKILL'); else proc.kill('SIGKILL'); }
@@ -54,15 +54,23 @@ export function runClaudeExec({ prompt, cwd, timeoutMs = 300000, bin = process.e
     const timer = setTimeout(() => { timedOut = true; kill(); }, timeoutMs);
     proc.stdout.on('data', bytes => { out += String(bytes); });
     proc.stderr.on('data', bytes => { err += String(bytes); });
-    proc.stdin.on('error', () => { /* early CLI exit is reported by close */ });
+    const inputFailed = error => {
+      stdinError ||= typeof error?.code === 'string' ? error.code : 'STDIN_ERROR';
+      kill(); // incomplete input must not produce an accepted proposal
+    };
+    proc.stdin.on('error', inputFailed);
     proc.on('error', error => finish({ state: 'unreadable', finalText: null, errors: [String(error.message)], usage: null, code: null }));
     proc.on('close', code => {
       if (group && proc.pid) { try { process.kill(-proc.pid, 'SIGKILL'); } catch { /* gone */ } }
       const parsed = parseClaudeResult(out);
       if (err.trim()) parsed.errors.push(err.trim().slice(-4000));
+      if (stdinError) {
+        parsed.state = 'unreadable'; parsed.text = null; parsed.finalText = null;
+        parsed.errors.push(`prompt transport failed: ${stdinError}`);
+      }
       if (timedOut) { parsed.state = 'unreadable'; parsed.errors.push(`timed out after ${timeoutMs}ms`); }
       finish({ ...parsed, code, timedOut });
     });
-    proc.stdin.end(prompt);
+    try { proc.stdin.end(prompt); } catch (error) { inputFailed(error); }
   });
 }