great-cto 3.61.0 → 3.62.1

package/board/packages/board/lib/projects.mjs

@@ -204,7 +204,15 @@ function getChangeTier(dir) {
     return { tier: 'T2', error: e.message };  // fail-safe: unknown → full gates
   }
 }
+function isGlobalStateProject(dir) {
+  const canonical = value => { try { return fs.realpathSync(value); } catch { return path.resolve(value); } };
+  const resolved = canonical(dir);
+  const state = canonical(GREAT_CTO_DIR);
+  return isInsideDir(state, resolved) || canonical(path.join(resolved, '.great_cto')) === state;
+}
+
 function autoRegisterProject(dir) {
+  if (isGlobalStateProject(dir)) return null;
   // The home directory is never a project.
   //
   // `~/.great_cto/` is the GLOBAL store — cross-project verdicts, decisions,
@@ -228,18 +236,29 @@ function autoRegisterProject(dir) {
   // the board there added it as a separate project reading great_cto's beads —
   // 228 tasks counted twice, under two names, in a fleet of seventeen.
   try {
+    // Automatic discovery/cwd must not bypass the raw-path registration
+    // boundary. An explicit isolated discovery scope replaces HOME, never
+    // falls back to it, and is canonicalized before containment checks.
+    const scope = getDiscoveryScope();
+    const boundary = fs.realpathSync(scope.includeClaudeProjects ? os.homedir() : scope.roots[0]);
+    const canonical = fs.realpathSync(dir);
+    if (!isInsideDir(boundary, canonical)) return null;
     const resolved = path.resolve(dir);
     if (resolved === path.resolve(os.homedir())) return null;
     if (isInsideDir(path.join(os.homedir(), '.claude', 'plugins'), resolved)) return null;
     const enclosing = readProjectsRegistry().projects
       .find((e) => e.path && path.resolve(e.path) !== resolved && isInsideDir(path.resolve(e.path), resolved));
     if (enclosing) return null;
-  } catch { /* if we cannot resolve it, fall through to the normal checks */ }
+  } catch { return null; } // Unknown scope is not permission to register it.
 
   const meta = readProjectMd(dir);
   if (!meta) return null;
   const reg = readProjectsRegistry();
-  const existingByPath = reg.projects.find(p => p.path === meta.path);
+  const existingByPath = reg.projects.find(p => {
+    if (p.path === meta.path) return true;
+    try { return fs.realpathSync(p.path) === fs.realpathSync(meta.path); }
+    catch { return false; }
+  });
   if (existingByPath) return meta; // already registered at this path, nothing to do
   // Only an entry whose path is GONE is this repo having moved. An entry whose
   // path still exists is a different project that happens to share a name, and
@@ -264,20 +283,40 @@ function autoRegisterProject(dir) {
 // project that ran /audit or /start (which writes .great_cto/PROJECT.md) gets
 // auto-registered without the user having to do anything.
 // Fully async — never blocks the event loop.
+function getDiscoveryScope() {
+  const scoped = process.env.GREAT_CTO_DISCOVERY_ROOT;
+  if (scoped) {
+    if (!path.isAbsolute(scoped)) throw new Error('GREAT_CTO_DISCOVERY_ROOT must be absolute');
+    const root = fs.realpathSync(scoped);
+    if (!fs.statSync(root).isDirectory()) throw new Error('GREAT_CTO_DISCOVERY_ROOT must be a directory');
+    return { roots: [root], includeClaudeProjects: false };
+  }
+  const home = os.homedir();
+  return { roots: [
+    path.join(home, 'work'), path.join(home, 'dev'),
+    path.join(home, 'development'), path.join(home, 'code'),
+    path.join(home, 'projects'), path.join(home, 'src'),
+    path.join(home, 'Documents', 'projects'), home,
+  ], includeClaudeProjects: true };
+}
+
 async function discoverProjects() {
   const fsAsync = fs.promises;
   const HOME = os.homedir();
   const seen = new Set();
   const found = [];
+  // Resolve before scanning. A broken explicit scope must never fall back to
+  // scanning the operator's home or Claude project cache.
+  const scope = getDiscoveryScope();
 
   async function scanDir(dir, depth) {
-    if (depth < 0 || seen.has(dir)) return;
+    if (depth < 0 || seen.has(dir) || isInsideDir(GREAT_CTO_DIR, dir)) return;
     seen.add(dir);
     try {
       // Check the dir itself first — but NEVER treat HOME's own .great_cto as a
       // project: ~/.great_cto is the global config dir, not a project. Without
       // this guard, $HOME gets registered as a bogus project (great_cto-…).
-      if (dir !== HOME) {
+      if (dir !== HOME && !isGlobalStateProject(dir)) {
         try {
           await fsAsync.access(path.join(dir, '.great_cto', 'PROJECT.md'));
           found.push(dir);
@@ -298,22 +337,13 @@ async function discoverProjects() {
   }
 
   // 1) Common dev folders — top-level scan, 1-level deep
-  const roots = [
-    path.join(HOME, 'work'),
-    path.join(HOME, 'dev'),
-    path.join(HOME, 'development'),
-    path.join(HOME, 'code'),
-    path.join(HOME, 'projects'),
-    path.join(HOME, 'src'),
-    path.join(HOME, 'Documents', 'projects'),
-    HOME,
-  ];
+  const roots = scope.roots;
   for (const root of roots) {
     try { await fsAsync.access(root); await scanDir(root, 1); } catch {}
   }
 
   // 2) Claude Code's known project list (~/.claude/projects/<encoded-path>/)
-  try {
+  if (scope.includeClaudeProjects) try {
     const ccProj = path.join(HOME, '.claude', 'projects');
     await fsAsync.access(ccProj);
     const entries = await fsAsync.readdir(ccProj);
@@ -322,7 +352,7 @@ async function discoverProjects() {
       const decoded = '/' + dir.replace(/^-+/, '').replace(/-/g, '/');
       try {
         await fsAsync.access(path.join(decoded, '.great_cto', 'PROJECT.md'));
-        found.push(decoded);
+        if (!isGlobalStateProject(decoded)) found.push(decoded);
       } catch {}
     }
   } catch {}
@@ -342,7 +372,7 @@ function listProjects() {
   // .great_cto has no project marker or task source left (no PROJECT.md,
   // no tasks.md, no .beads → nothing to show, just clutters the switcher).
   reg.projects = reg.projects.filter(p =>
-    p.path !== HOME &&
+    p.path !== HOME && !isGlobalStateProject(p.path) &&
     fs.existsSync(p.path) &&
     (fs.existsSync(path.join(p.path, '.great_cto', 'PROJECT.md')) ||
      fs.existsSync(path.join(p.path, '.great_cto', 'tasks.md')) ||
@@ -457,6 +487,7 @@ export {
   getChangeTier,
   autoRegisterProject,
   getRegistryDegradation,
+  getDiscoveryScope,
   discoverProjects,
   listProjects,
   resolveProjectCwd,

package/board/packages/board/lib/routes.mjs

@@ -27,9 +27,9 @@ import { status as routerKeyStatus, writeKey as writeRouterKey, verifyKey as ver
 let routerKeyCheck = null;
 import { broadcastTasks } from './sse.mjs';
 import { saveNotifHistory } from './notifications.mjs';
-import { getMemory, getPipeline, getCostHistory, getInbox, inboxElsewhere } from './data-readers.mjs';
+import { getMemory, getPipeline, getCostHistory, getInbox, getInboxAsync, inboxElsewhere } from './data-readers.mjs';
 import { log } from './log.mjs';
-import { bdCacheInvalidate, checkBeadsAvailable, bdWriteSerialised, bd, bdErr, getTasks, setTaskStatusInTasksMd, getReadDegradation } from './beads.mjs';
+import { bdCacheInvalidate, checkBeadsAvailable, bdWriteSerialised, bd, bdErr, getTasks, getTasksAsync, setTaskStatusInTasksMd, getReadDegradation } from './beads.mjs';
 import { getMetrics } from './metrics.mjs';
 import { agentActivity, agentActivitySince } from './agent-activity.mjs';
 import { issueTokens, checkToken, checkBinding, consumeToken } from './gate-tokens.mjs';
@@ -124,6 +124,32 @@ async function dispatch(req, res, url, cwd) {
   const scopedProject = ['/api/skills', '/api/usage', '/api/outcomes'].includes(pathname)
     ? scopedReadProject(cwd, serverCwd, requestedProject) : null;
 
+  // Existing synchronous projections may consume a completed snapshot, but
+  // HTTP cold reads must await async I/O instead of freezing unrelated clients.
+  const taskRead = ['/api/work', '/api/sse', '/api/tasks', '/api/metrics',
+    '/api/memory', '/api/pipeline', '/api/heartbeat', '/api/share', '/api/cost', '/api/resume'].includes(pathname)
+    || /^\/api\/tasks\/[^/]+\/history$/.test(pathname);
+  const unknownWork = pathname === '/api/work' && requestedProject
+    && resolveProjectInfo(requestedProject).resolved === 'fallback';
+  let sseClosed = false;
+  if (pathname === '/api/sse') {
+    // Install lifecycle ownership before the cold snapshot await. Request
+    // 'close' also occurs for normally completed GET bodies; response close
+    // is the actual stream lifetime signal.
+    res.once('close', () => { sseClosed = true; sseClients.delete(res); });
+  }
+  const closedSse = () => pathname === '/api/sse'
+    && (sseClosed || req.aborted || res.destroyed || res.writableEnded);
+  if (req.method === 'GET' && taskRead && !unknownWork) {
+    try { await getTasksAsync(cwd); }
+    catch {
+      if (closedSse()) return true;
+      res.writeHead(503, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+      res.end(JSON.stringify({ error: 'Task snapshot is unavailable; retry', state: 'unreadable' }));
+      return true;
+    }
+  }
+
   if (pathname === '/api/work/publication') {
     const respond = (status, body) => { res.writeHead(status, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' }); res.end(JSON.stringify(body)); };
     if (requestedProject && resolveProjectInfo(requestedProject).resolved === 'fallback') { respond(404, { error: 'Unknown project' }); return true; }
@@ -222,6 +248,7 @@ async function dispatch(req, res, url, cwd) {
 
   // SSE
   if (pathname === '/api/sse') {
+    if (closedSse()) return true;
     res.writeHead(200, {
       'Content-Type': 'text/event-stream',
       'Cache-Control': 'no-cache',
@@ -229,7 +256,11 @@ async function dispatch(req, res, url, cwd) {
     });
     res._gctoCwd = cwd;  // remember which project this client wants
     sseClients.add(res);
-    res.write(`event: tasks\ndata: ${JSON.stringify(getTasks(cwd))}\n\n`);
+    if (getReadDegradation(cwd)) {
+      res.write(`event: task-read-state\ndata: ${JSON.stringify({ ok: false, state: 'unreadable' })}\n\n`);
+    } else {
+      res.write(`event: tasks\ndata: ${JSON.stringify(getTasks(cwd))}\n\n`);
+    }
     // ADR-021: the agent activity strip starts from a snapshot, then follows pushes.
     // Phase 2: a client that hands back the cursor of the last frame it saw — the
     // Last-Event-ID header, or ?since= from a page that had to recreate its
@@ -243,7 +274,6 @@ async function dispatch(req, res, url, cwd) {
     }
     res._gctoAgentCursor = a.cursor;
     res.write(`${a.cursor ? `id: ${a.cursor}\n` : ''}event: agent\ndata: ${JSON.stringify(a)}\n\n`);
-    req.on('close', () => sseClients.delete(res));
     return true;
   }
 
@@ -598,7 +628,8 @@ async function dispatch(req, res, url, cwd) {
       let transitions = null;
       try {
         const { pipelineMapFor } = await import('../../../scripts/lib/pipeline-health.mjs');
-        const { parsePipelineToml } = await import('../../../scripts/hooks/pipeline-dispatcher.mjs');
+        // Use the pure parser, not the native hook that merely reexports it.
+        const { parsePipelineToml } = await import('../../../scripts/lib/pipeline-toml.mjs');
         const map = pipelineMapFor(cwd);
         if (map.path) transitions = parsePipelineToml(fs.readFileSync(map.path, 'utf8'));
       } catch { transitions = null; }
@@ -717,7 +748,7 @@ async function dispatch(req, res, url, cwd) {
       // Without this, concurrent approve+reject on the same gate produced
       // TWO appendDecisionLog entries (one wrong) — log says approved AND
       // rejected. bdWriteSerialised guarantees one-at-a-time semantics.
-      const result = await bdWriteSerialised(() => {
+      const result = await bdWriteSerialised(async () => {
         const status = action === 'approve' ? 'closed' : 'blocked';
         let via = 'beads';
         // Try beads first (unless there's no store at all); on any bd failure
@@ -760,7 +791,7 @@ async function dispatch(req, res, url, cwd) {
         const projectSlug = parsed.project && !/^[\/~]/.test(parsed.project) ? parsed.project : path.basename(gateCwd);
         let title = id;
         try {
-          const gateTask = getTasks(gateCwd).find((t) => t.id === id);
+          const gateTask = (await getTasksAsync(gateCwd)).find((t) => t.id === id);
           if (gateTask?.title) title = gateTask.title;
         } catch { /* the id is a documented fallback; the record still gets written */ }
         gateTitle = title;
@@ -846,7 +877,13 @@ async function dispatch(req, res, url, cwd) {
 
   // Inbox — what needs your attention right now
   if (pathname === '/api/inbox') {
-    const inbox = getInbox(cwd);
+    let inbox;
+    try { inbox = await getInboxAsync(cwd); }
+    catch {
+      res.writeHead(503, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+      res.end(JSON.stringify({ error: 'Task snapshot is unavailable; retry', state: 'unreadable' }));
+      return true;
+    }
     // BRD-R3: the Decisions row shows both reviewers. The second opinion is a
     // fact about the TREE, not about a gate — every pending gate on this tree
     // shares it — so it is resolved once: the newest cross-review line whose
@@ -860,7 +897,7 @@ async function dispatch(req, res, url, cwd) {
     // If the registry itself cannot be walked, say so — `unreadable` is not
     // `{p0: 0}`, and the page must not print "nothing elsewhere" from it.
     let elsewhere;
-    try { elsewhere = inboxElsewhere(listProjects(), cwd, { readInbox: getInbox }); }
+    try { elsewhere = inboxElsewhere(listProjects(), cwd); }
     catch (e) { elsewhere = { state: 'unreadable', why: String(e?.message || e) }; }
     // ADR-024 §1: each pending gate carries the token an approval must present,
     // bound to the project as it is now. The typed name stored with it is the one

package/board/packages/board/lib/share.mjs

@@ -3,7 +3,7 @@ import path from 'path';
 import { GREAT_CTO_DIR, PUBLIC, SHARE_ENDPOINT } from './config.mjs';
 import { readProjectMd } from './projects.mjs';
 import { getMetrics } from './metrics.mjs';
-import { getTasks } from './beads.mjs';
+import { getTasks, getTasksAsync, getReadDegradation } from './beads.mjs';
 import { readVerdicts } from './verdicts.mjs';
 import { readDecisionsLog } from './fleet.mjs';
 
@@ -87,8 +87,10 @@ async function toggleShare(enable, cwd = process.cwd(), force = false) {
     // Generate and publish
     // Share report is a marketing artifact — show LIFETIME numbers, not a
     // rolling window. 365 days × 100 = effectively-lifetime cap for any project.
-    const html = generateShareHTML(getTasks(cwd), getMetrics(cwd, 36500), cwd);
     try {
+      const tasks = await getTasksAsync(cwd);
+      if (getReadDegradation(cwd)) return { error: 'Task snapshot is unavailable; report not published' };
+      const html = generateShareHTML(tasks, getMetrics(cwd, 36500, { tasks }), cwd);
       const result = await publishReport(html);
       const newState = { enabled: true, url: result.url, hash: result.hash, published_at: new Date().toISOString() };
       saveShareState(newState, cwd);

package/board/packages/board/lib/sse.mjs

@@ -1,5 +1,6 @@
 import { sseClients } from './state.mjs';
-import { getTasks } from './beads.mjs';
+import { getTasksAsync, getReadDegradation, warmTasksAsync, checkBeadsAvailable } from './beads.mjs';
+import { getPipeline, getInbox } from './data-readers.mjs';
 
 function broadcast(event, data) {
   const msg = `event: ${event}\ndata: ${JSON.stringify(data)}\n\n`;
@@ -8,13 +9,41 @@ function broadcast(event, data) {
   }
 }
 
-function broadcastTasks(cwd) {
-  const msg = `event: tasks\ndata: ${JSON.stringify(getTasks(cwd))}\n\n`;
-  for (const res of sseClients) {
-    if (res._gctoCwd === cwd) {
+async function broadcastTasks(cwd, { fresh = false, projections = false } = {}) {
+  // A completed write invalidates its cache. Reading it synchronously here
+  // froze every HTTP client even though the write response was already sent.
+  // With no subscriber there is no projection to refresh at all.
+  for (const res of sseClients) if (res.destroyed || res.writableEnded) sseClients.delete(res);
+  const clients = [...sseClients].filter(res => res._gctoCwd === cwd);
+  if (!clients.length) return { ok: true, subscribers: 0 };
+  let msg, result;
+  try {
+    if (fresh && !checkBeadsAvailable(cwd)) {
+      const read = await warmTasksAsync(cwd);
+      if (!read.ok || read.discarded) throw Error('fresh snapshot unavailable');
+    }
+    const tasks = await getTasksAsync(cwd);
+    if (getReadDegradation(cwd)) throw Error('snapshot unavailable');
+    msg = `event: tasks\ndata: ${JSON.stringify(tasks)}\n\n`;
+    if (projections) {
+      // All projections describe the same snapshot, without another Beads read.
+      msg += `event: pipeline\ndata: ${JSON.stringify(getPipeline(cwd, { tasks }))}\n\n`;
+      msg += `event: inbox\ndata: ${JSON.stringify(getInbox(cwd, { tasks }))}\n\n`;
+    }
+    result = { ok: true };
+  } catch {
+    // Preserve the last visible tasks instead of publishing a fabricated [].
+    // Explicit transport state; clients retain the last visible snapshot.
+    result = { ok: false, state: 'unreadable' };
+    msg = `event: task-read-state\ndata: ${JSON.stringify(result)}\n\n`;
+  }
+  for (const res of clients) {
+    // A client may have disconnected or changed project while the read ran.
+    if (sseClients.has(res) && res._gctoCwd === cwd && !res.destroyed && !res.writableEnded) {
       try { res.write(msg); } catch { sseClients.delete(res); }
     }
   }
+  return result;
 }
 
 export { broadcast, broadcastTasks };

package/board/packages/board/lib/watchers.mjs

@@ -3,8 +3,8 @@ import path from 'path';
 import { GREAT_CTO_DIR } from './config.mjs';
 import { sseClients } from './state.mjs';
 import { listProjects } from './projects.mjs';
-import { bdCacheStale, getTasks, isSelfInflictedTouch } from './beads.mjs';
-import { getPipeline, getInbox } from './data-readers.mjs';
+import { bdCacheStale, isSelfInflictedTouch } from './beads.mjs';
+import { broadcastTasks } from './sse.mjs';
 import { agentActivitySince, activityStamp } from './agent-activity.mjs';
 
 // ── File watcher ───────────────────────────────────────────────────────────────
@@ -51,17 +51,9 @@ function watchBeads() {
     if (isSelfInflictedTouch(dir)) return;
     // Stale, not deleted. A change we NOTICED must not make the next reader pay
     // for it — they asked for something else. The broadcast below still reads
-    // fresh, because a stale entry refreshes on read.
+    // fresh, because it explicitly awaits the shared asynchronous refresh.
     bdCacheStale(dir);
-    for (const res of sseClients) {
-      if (res._gctoCwd === dir) {
-        try {
-          res.write(`event: tasks\ndata: ${JSON.stringify(getTasks(dir))}\n\n`);
-          res.write(`event: pipeline\ndata: ${JSON.stringify(getPipeline(dir))}\n\n`);
-          res.write(`event: inbox\ndata: ${JSON.stringify(getInbox(dir))}\n\n`);
-        } catch {}
-      }
-    }
+    void broadcastTasks(dir, { fresh: true, projections: true });
   };
 
   // Debounce per-dir: dolt writes can fire 3-5 events in <50ms during a single
@@ -130,12 +122,9 @@ function watchVerdicts() {
     if (pushTimer) clearTimeout(pushTimer);
     // debounce: collapse a burst of writes (multiple agents finishing within ~150ms)
     pushTimer = setTimeout(() => {
-      for (const res of sseClients) {
-        const dir = res._gctoCwd || process.cwd();
-        try {
-          res.write(`event: pipeline\ndata: ${JSON.stringify(getPipeline(dir))}\n\n`);
-          res.write(`event: inbox\ndata: ${JSON.stringify(getInbox(dir))}\n\n`);
-        } catch { sseClients.delete(res); }
+      const dirs = new Set([...sseClients].map(res => res._gctoCwd || process.cwd()));
+      for (const dir of dirs) {
+        void broadcastTasks(dir, { projections: true });
       }
     }, 150);
   };

package/board/packages/board/public/index.html

@@ -1768,8 +1768,8 @@ h1, h2, h3, h4 { font-weight: 600; font-family: var(--sans); }
 .pl-gate.active .pl-msg, .pl-gate.active .pl-meta { opacity: 1; color: var(--text); }
 .pl-gate .gate-badge {
   margin-left: auto;
-  background: var(--status-blocked); color: var(--on-solid);
-  font-size: var(--fs-eyebrow); font-weight: 700;
+  background: var(--status-blocked); color: var(--on-status);
+  font-size: var(--fs-eyebrow); font-weight: 500;
   min-width: 16px; height: 16px; padding: 0 4px;
   border-radius: 0;
   display: inline-flex; align-items: center; justify-content: center;
@@ -8117,6 +8117,12 @@ function connectSSE() {
   };
   es.addEventListener('tasks', e => {
     const newTasks = JSON.parse(e.data);
+    delete BOARD_DEGRADED['/api/tasks'];
+    renderDegradedBanner('degraded-read', null, '');
+    if (es.readyState === EventSource.OPEN) {
+      document.getElementById('live-dot').className = 'live-dot pulse';
+      document.getElementById('live-label').textContent = 'live · synced just now';
+    }
     // A transient bd failure (dolt lock, timeout) can produce an empty
     // snapshot indistinguishable from "no tasks" (great_cto-e2ew). Don't
     // blindly wipe a populated board — refetch once via the regular API
@@ -8130,6 +8136,20 @@ function connectSSE() {
     }
     applyTasksSnapshot(newTasks);
   });
+  es.addEventListener('task-read-state', e => {
+    try {
+      const state = JSON.parse(e.data);
+      if (state.state !== 'unreadable') return;
+      BOARD_DEGRADED['/api/tasks'] = 'Task snapshot is unavailable. Showing the last loaded tasks.';
+      document.getElementById('live-dot').className = 'live-dot error';
+      document.getElementById('live-label').textContent = 'connected · task data unavailable';
+      // Re-evaluate existing healthy claims as well as adding the banner.
+      // A previously painted "All clear" must not survive a failed refresh.
+      if (window.__inboxData) renderInbox(window.__inboxData);
+      renderDegradedBanner('degraded-read', degradedFor('/api/tasks'),
+        'Project data could not be refreshed. Counts may be out of date.');
+    } catch { /* Malformed transport data must not erase the last snapshot. */ }
+  });
   es.addEventListener('pipeline', e => {
     try {
       const stages = JSON.parse(e.data);
@@ -8165,8 +8185,10 @@ function connectSSE() {
   });
   es.onopen = () => {
     const d = document.getElementById('live-dot');
-    d.className = 'live-dot pulse';
-    document.getElementById('live-label').textContent = 'live · synced just now';
+    const unreadable = degradedFor('/api/tasks');
+    d.className = unreadable ? 'live-dot error' : 'live-dot pulse';
+    document.getElementById('live-label').textContent = unreadable
+      ? 'connected · task data unavailable' : 'live · synced just now';
   };
   es.onerror = () => {
     document.getElementById('live-dot').className = 'live-dot error';

package/board/packages/board/push-adapter.mjs

@@ -12,6 +12,7 @@ import http from 'node:http';
 import fs from 'node:fs';
 import path from 'node:path';
 import { URL } from 'node:url';
+import { readPrivateState, writePrivateState } from '../cli/src/private-state.mjs';
 
 // ── Helpers: base64url ────────────────────────────────────────────────────
 
@@ -74,7 +75,7 @@ export function getVapidKeys(keyPath) {
   // Load existing keys from disk
   if (fs.existsSync(keyPath)) {
     try {
-      const stored = JSON.parse(fs.readFileSync(keyPath, 'utf8'));
+      const stored = JSON.parse(readPrivateState(keyPath));
       if (stored.publicKey && stored.privateKey) return stored;
     } catch { /* regenerate if corrupt */ }
   }
@@ -93,8 +94,7 @@ export function getVapidKeys(keyPath) {
   const keys = { publicKey, privateKey: jwk };
 
   // Persist — best effort
-  try { fs.mkdirSync(path.dirname(keyPath), { recursive: true }); } catch { /* ignore */ }
-  try { fs.writeFileSync(keyPath, JSON.stringify(keys, null, 2)); } catch { /* best-effort */ }
+  writePrivateState(keyPath, JSON.stringify(keys, null, 2));
 
   return keys;
 }

package/board/packages/cli/src/private-state.mjs

@@ -0,0 +1,43 @@
+import fs from 'node:fs';
+import { dirname } from 'node:path';
+
+/** @param {string} file */
+function regularOrAbsent(file) {
+  try {
+    const stat = fs.lstatSync(file);
+    if (stat.isSymbolicLink() || !stat.isFile()) throw new Error('private state must be a regular file, not a symlink');
+  } catch (error) {
+    if (error.code !== 'ENOENT') throw error;
+  }
+}
+
+/** Tighten existing secrets as well as new files; never follow file symlinks.
+ * @param {string} file
+ * @returns {string}
+ */
+export function readPrivateState(file) {
+  regularOrAbsent(file);
+  const fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK);
+  try {
+    if (!fs.fstatSync(fd).isFile()) throw new Error('private state is not a regular file');
+    const stat = fs.fstatSync(fd);
+    if ((stat.mode & 0o777) !== 0o600) fs.fchmodSync(fd, 0o600);
+    return fs.readFileSync(fd, 'utf8');
+  } finally { fs.closeSync(fd); }
+}
+
+/** @param {string} file @param {string} text @param {boolean} [append] */
+export function writePrivateState(file, text, append = false) {
+  regularOrAbsent(file);
+  fs.mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
+  const flags = fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_NOFOLLOW
+    | fs.constants.O_NONBLOCK | (append ? fs.constants.O_APPEND : 0);
+  const fd = fs.openSync(file, flags, 0o600);
+  try {
+    if (!fs.fstatSync(fd).isFile()) throw new Error('private state is not a regular file');
+    fs.fchmodSync(fd, 0o600);
+    // Refuse permission failures before modifying existing bytes.
+    if (!append) fs.ftruncateSync(fd, 0);
+    fs.writeFileSync(fd, text);
+  } finally { fs.closeSync(fd); }
+}

package/board/packages/cli/src/state-home.mjs

@@ -0,0 +1,15 @@
+import { homedir } from 'node:os';
+import { isAbsolute, join, resolve } from 'node:path';
+
+/** One resolver for CLI and board, independent of their working directories.
+ * @param {Record<string, string | undefined>} [env]
+ * @param {string} [home]
+ */
+export function stateHome(env = process.env, home = homedir()) {
+  const configured = env.GREAT_CTO_HOME;
+  if (configured === undefined || configured === '') return join(home, '.great_cto');
+  if (typeof configured !== 'string' || !isAbsolute(configured) || configured.includes('\0')) {
+    throw new Error('GREAT_CTO_HOME must be an absolute dedicated state directory');
+  }
+  return resolve(configured);
+}

package/board/scripts/codex-pipeline.mjs

@@ -2,11 +2,13 @@
 import { mkdirSync, readFileSync, writeFileSync, renameSync, rmdirSync, realpathSync } from 'node:fs';
 import { join, resolve, relative, sep, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { newRun, runStage, runParallelWave, parallelPair, approve, recover, cancel } from './lib/codex-pipeline.mjs';
+import { newRun, runStage, runParallelWave, parallelPair, approve, reject, recover, cancel } from './lib/codex-pipeline.mjs';
 import { approveRelease } from './lib/codex-release.mjs';
 import { codexRunStore, listCodexRuns, codexHostDoctor } from './lib/codex-host-state.mjs';
 import { beginWork, finishWork, acquireProjectLease, readWorkTask, linkWork, observeWorkRun, controlledDecisions } from './lib/work-tasks.mjs';
 import { detectClaude } from './lib/claude-exec.mjs';
+import { dispatchEvidenceSummary } from './lib/controller-dispatch-evidence.mjs';
+import { readBenchmarkRegistration, bindBenchmarkTrial } from './lib/adaptive-benchmark-collector.mjs';
 
 // State is outside the worker workspace. A per-run exclusive lock covers the entire subprocess lifetime.
 const args = process.argv.slice(2);
@@ -81,11 +83,31 @@ try {
       if (rel !== '..' && !rel.startsWith(`..${sep}`)) throw Error('release policy must be operator-owned outside the target workspace');
       releasePolicy = JSON.parse(readFileSync(policyPath, 'utf8'));
     }
-    state = newRun({ root, prompt: value('--prompt'), checkPolicy, releasePolicy,
+    let gatePolicy = null;
+    if (args.includes('--gate-policy')) {
+      if (!value('--gate-policy')) throw Error('--gate-policy requires an operator-owned policy file');
+      const policyPath = realpathSync(value('--gate-policy'));
+      const rel = relative(root, policyPath);
+      if (rel === '' || (rel !== '..' && !rel.startsWith(`..${sep}`))) throw Error('gate policy must be operator-owned outside the target workspace');
+      gatePolicy = JSON.parse(readFileSync(policyPath, 'utf8'));
+    }
+    let specialistPolicy = null;
+    if (args.includes('--specialist-policy')) {
+      if (!value('--specialist-policy')) throw Error('--specialist-policy requires an operator-owned policy file');
+      const policyPath = realpathSync(value('--specialist-policy'));
+      const rel = relative(root, policyPath);
+      if (rel === '' || (rel !== '..' && !rel.startsWith(`..${sep}`))) throw Error('specialist policy must be operator-owned outside the target workspace');
+      specialistPolicy = JSON.parse(readFileSync(policyPath, 'utf8'));
+    }
+    state = newRun({ root, prompt: value('--prompt'), checkPolicy, releasePolicy, specialistPolicy,
       allowed, intent, entry: intent === 'research' ? 'project-auditor' : value('--entry') || 'product-owner',
-      maxAttempts, hostRoutes });
+      maxAttempts, hostRoutes, gatePolicy });
     state.taskId = taskId || work.task.taskId;
     state.acceptance = acceptance;
+    if (args.includes('--benchmark-trial')) {
+      if (!value('--benchmark-trial')) throw Error('--benchmark-trial requires an operator-owned trial registration');
+      bindBenchmarkTrial(state, readBenchmarkRegistration(root, value('--benchmark-trial')));
+    }
     linkWork(state.taskId, 'runs', state.id, { root, host: 'codex' });
     save(state);
   } else {
@@ -100,7 +122,7 @@ try {
       } else projectLease = acquireProjectLease(state.root, { reuseToken: inheritedLease });
     }
   }
-  if (!['start', 'resume', 'status', 'approve', 'approve-release', 'recover', 'cancel', 'approve-task'].includes(command)) throw Error('expected start, resume, status, approve, approve-release, recover, cancel, list or doctor');
+  if (!['start', 'resume', 'status', 'approve', 'reject', 'approve-release', 'recover', 'cancel', 'approve-task'].includes(command)) throw Error('expected start, resume, status, approve, reject, approve-release, recover, cancel, list or doctor');
   if (command !== 'status') {
     const lock = join(store, `${state.id}.lock`);
     mkdirSync(lock); locked = lock;
@@ -115,6 +137,7 @@ try {
       if (decision.kind === 'release') approveRelease(state, state.release.token); else approve(state, state.pending.token);
       save(state);
     } else if (command === 'approve') { approve(state, value('--token')); save(state); }
+    else if (command === 'reject') { reject(state, value('--token'), value('--reason')); save(state); }
     else if (command === 'approve-release') { approveRelease(state, value('--token')); save(state); }
     else if (command === 'recover') { recover(state); save(state); }
     else if (command === 'cancel') { cancel(state); save(state); }
@@ -126,10 +149,16 @@ try {
     }
   }
   console.log(JSON.stringify({ id: state.id, status: state.status, reason: state.reason,
+    controllerDispatch: dispatchEvidenceSummary(state),
     release: state.release ? { status: state.release.status, token: state.release.token, adapter: state.release.adapter,
       artifactDigest: state.release.artifactDigest, target: state.release.target, path: state.release.path, url: state.release.url,
       activation: state.release.activation, rollback: state.release.rollback } : null,
-    pending: state.pending, queue: state.queue, hostRoutes: state.hostRoutes || {}, wave: state.wave ? {
+    pending: state.pending, queue: state.queue, specialistPreparation: state.specialistPreparation ? {
+      roles: state.specialistPreparation.roles, status: state.specialistPreparation.status,
+      fingerprint: state.specialistPreparation.fingerprint, reusablePass: false } : null,
+    specialistReview: state.specialistReview ? {
+      roles: state.specialistReview.roles, fingerprint: state.specialistReview.fingerprint, reusablePass: false } : null,
+    hostRoutes: state.hostRoutes || {}, wave: state.wave ? {
       id: state.wave.id, roles: state.wave.roles, hosts: state.wave.hosts, status: state.wave.status } : null,
     rolesCompleted: Object.keys(state.results), stateFile: join(store, `${state.id}.json`) }, null, 2));
   process.exitCode = ['blocked', 'manual-action', 'join-wait'].includes(state.status) ? 2 : 0;