great-cto 3.70.1 → 3.71.1

package/board/scripts/lib/claude-exec.mjs

@@ -1,5 +1,6 @@
 /** Restricted Claude Code subprocess for controller-owned, read-only proposals. */
 import { spawn, spawnSync } from 'node:child_process';
+import { performance } from 'node:perf_hooks';
 
 const PROPOSAL_SCHEMA = JSON.stringify({
   type: 'object',
@@ -35,24 +36,56 @@ export function parseClaudeResult(raw) {
     usage: body.usage || null, model: body.model || null };
 }
 
-export function runClaudeExec({ prompt, cwd, timeoutMs = 300000, bin = process.env.GREAT_CTO_CLAUDE_BIN || 'claude' }) {
+export function runClaudeExec({ prompt, cwd, timeoutMs = 300000, bin = process.env.GREAT_CTO_CLAUDE_BIN || 'claude', onEvent = null }) {
   return new Promise(resolve => {
+    const deadline = performance.now() + timeoutMs;
     // Safe mode removes hooks, skills, plugins and project instructions. Restricted
     // mode confines file tools to cwd. The tools allow only inspection; the
     // controller remains the sole writer and gate owner.
-    const args = ['--print', '--output-format', 'json', '--no-session-persistence',
+    const streaming = typeof onEvent === 'function';
+    const args = ['--print', '--output-format', streaming ? 'stream-json' : 'json', ...(streaming ? ['--verbose'] : []), '--no-session-persistence',
       '--safe-mode', '--restricted', '--strict-mcp-config', '--tools', 'Read,Glob,Grep',
       '--permission-mode', 'dontAsk', '--permission-prompts', 'none', '--json-schema', PROPOSAL_SCHEMA];
     const group = process.platform !== 'win32';
     const proc = spawn(bin, args, { cwd, stdio: ['pipe', 'pipe', 'pipe'], detached: group });
     let out = '', err = '', settled = false, timedOut = false, stdinError = null;
+    let observationHealth = 'ok', line = '', dropping = false;
+    const observationLimit = 1024 * 1024;
+    const observeLine = value => {
+      if (!value.trim()) return;
+      try {
+        const event = JSON.parse(value);
+        if (!event || typeof event !== 'object' || Array.isArray(event)) { observationHealth = 'degraded'; return; }
+        const pending = onEvent(event);
+        if (pending && typeof pending.then === 'function') {
+          // Observations are synchronous: do not create an untracked writer lifetime.
+          observationHealth = 'degraded'; Promise.resolve(pending).catch(() => {});
+        }
+      } catch { observationHealth = 'degraded'; }
+    };
+    const observeChunk = chunk => {
+      let offset = 0;
+      while (offset < chunk.length) {
+        const newline = chunk.indexOf('\n', offset), end = newline < 0 ? chunk.length : newline;
+        if (!dropping) {
+          const part = chunk.slice(offset, end);
+          if (Buffer.byteLength(line, 'utf8') + Buffer.byteLength(part, 'utf8') > observationLimit) {
+            line = ''; dropping = true; observationHealth = 'degraded';
+          } else line += part;
+        }
+        if (newline < 0) break;
+        if (!dropping) observeLine(line);
+        line = ''; dropping = false; offset = newline + 1;
+      }
+    };
     const finish = result => { if (!settled) { settled = true; clearTimeout(timer); resolve(result); } };
     const kill = () => {
       try { if (group && proc.pid) process.kill(-proc.pid, 'SIGKILL'); else proc.kill('SIGKILL'); }
       catch { try { proc.kill('SIGKILL'); } catch { /* process already exited */ } }
     };
     const timer = setTimeout(() => { timedOut = true; kill(); }, timeoutMs);
-    proc.stdout.on('data', bytes => { out += String(bytes); });
+    proc.stdout.setEncoding('utf8');
+    proc.stdout.on('data', bytes => { out += bytes; if (streaming) observeChunk(bytes); });
     proc.stderr.on('data', bytes => { err += String(bytes); });
     const inputFailed = error => {
       stdinError ||= typeof error?.code === 'string' ? error.code : 'STDIN_ERROR';
@@ -62,14 +95,24 @@ export function runClaudeExec({ prompt, cwd, timeoutMs = 300000, bin = process.e
     proc.on('error', error => finish({ state: 'unreadable', finalText: null, errors: [String(error.message)], usage: null, code: null }));
     proc.on('close', code => {
       if (group && proc.pid) { try { process.kill(-proc.pid, 'SIGKILL'); } catch { /* gone */ } }
-      const parsed = parseClaudeResult(out);
+      if (streaming && line && !dropping) observeLine(line);
+      // Final execution parsing is independent of the bounded observer and its callback.
+      let final = out;
+      if (streaming) {
+        final = '';
+        for (const candidate of out.split('\n')) {
+          try { if (JSON.parse(candidate)?.type === 'result') final = candidate; } catch { /* observer reports malformed lines */ }
+        }
+      }
+      const parsed = parseClaudeResult(final);
       if (err.trim()) parsed.errors.push(err.trim().slice(-4000));
       if (stdinError) {
         parsed.state = 'unreadable'; parsed.text = null; parsed.finalText = null;
         parsed.errors.push(`prompt transport failed: ${stdinError}`);
       }
-      if (timedOut) { parsed.state = 'unreadable'; parsed.errors.push(`timed out after ${timeoutMs}ms`); }
-      finish({ ...parsed, code, timedOut });
+      if (performance.now() >= deadline) timedOut = true;
+      if (timedOut) { parsed.state = 'unreadable'; parsed.text = null; parsed.finalText = null; parsed.errors.push(`timed out after ${timeoutMs}ms`); }
+      finish({ ...parsed, code, timedOut, ...(streaming ? { observationHealth } : {}) });
     });
     try { proc.stdin.end(prompt); } catch (error) { inputFailed(error); }
   });

package/board/scripts/lib/codex-exec.mjs

@@ -13,6 +13,7 @@
  *   available   version, auth mode and the model it will run, read from disk
  */
 import { spawn, spawnSync } from 'node:child_process';
+import { performance } from 'node:perf_hooks';
 import { existsSync, readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
@@ -115,6 +116,7 @@ export function runCodexExec({
   sandbox = 'read-only', ephemeral = true, extraArgs = [], onEvent = null,
 }) {
   return new Promise((resolve) => {
+    const deadline = performance.now() + timeoutMs;
     const args = ['exec', '--json', '--skip-git-repo-check'];
     if (sandbox) args.push('-s', sandbox);
     if (ephemeral) args.push('--ephemeral');
@@ -139,24 +141,41 @@ export function runCodexExec({
     };
     const timer = setTimeout(() => { timedOut = true; killGroup(); }, timeoutMs);
 
-    // Each JSON event is handed to onEvent as it arrives, so a watcher sees a tool
-    // call while the run is still going. A listener that throws is its own bug:
-    // it must not fail the run, and the final parse below is unchanged.
-    let pending = '';
-    proc.stdout.on('data', (b) => {
-      const chunk = String(b);
-      out += chunk;
-      if (typeof onEvent !== 'function') return;
-      pending += chunk;
-      let nl;
-      while ((nl = pending.indexOf('\n')) >= 0) {
-        const line = pending.slice(0, nl).trim();
-        pending = pending.slice(nl + 1);
-        if (!line.startsWith('{')) continue;
-        let ev;
-        try { ev = JSON.parse(line); } catch { continue; }
-        try { onEvent(ev); } catch { /* a failing listener must not fail the run */ }
+    // Observation failures remain separate from the final execution parser.
+    const observing = typeof onEvent === 'function';
+    let observationHealth = 'ok', pending = '', dropping = false;
+    const observationLimit = 1024 * 1024;
+    const observeLine = line => {
+      const text = line.trim();
+      if (!text.startsWith('{') && !text.startsWith('[')) return;
+      try {
+        const event = JSON.parse(text);
+        if (!event || typeof event !== 'object' || Array.isArray(event)) { observationHealth = 'degraded'; return; }
+        const result = onEvent(event);
+        if (result && typeof result.then === 'function') {
+          observationHealth = 'degraded'; Promise.resolve(result).catch(() => {});
+        }
+      } catch { observationHealth = 'degraded'; }
+    };
+    const observeChunk = chunk => {
+      let offset = 0;
+      while (offset < chunk.length) {
+        const newline = chunk.indexOf('\n', offset), end = newline < 0 ? chunk.length : newline;
+        if (!dropping) {
+          const part = chunk.slice(offset, end);
+          if (Buffer.byteLength(pending, 'utf8') + Buffer.byteLength(part, 'utf8') > observationLimit) {
+            pending = ''; dropping = true; observationHealth = 'degraded';
+          } else pending += part;
+        }
+        if (newline < 0) break;
+        if (!dropping) observeLine(pending);
+        pending = ''; dropping = false; offset = newline + 1;
       }
+    };
+    proc.stdout.setEncoding('utf8');
+    proc.stdout.on('data', chunk => {
+      out += chunk;
+      if (observing) observeChunk(chunk);
     });
     proc.stderr.on('data', (b) => { err += String(b); });
     const inputFailed = error => {
@@ -174,6 +193,7 @@ export function runCodexExec({
       clearTimeout(timer);
       // Best effort: a child the CLI left behind must not outlive the review.
       if (group && proc.pid) { try { process.kill(-proc.pid, 'SIGKILL'); } catch { /* group already gone */ } }
+      if (observing && pending && !dropping) observeLine(pending);
       const parsed = parseCodexStream(out);
       // stderr is kept even on success: Codex writes warnings there that change
       // how a result should be read.
@@ -188,11 +208,15 @@ export function runCodexExec({
       }
       // A run cut off by the clock may have printed a verdict before it was done.
       // That is a truncated answer, and a truncated answer is not an answer.
+      const returnedAfterDeadline = performance.now() >= deadline;
+      if (returnedAfterDeadline && !timedOut) parsed.text = null;
+      if (returnedAfterDeadline) timedOut = true;
       if (timedOut) {
+        parsed.finalText = null;
         parsed.errors.push(`timed out after ${timeoutMs}ms`);
         if (parsed.state === 'ok') parsed.state = 'unreadable';
       }
-      resolve({ ...parsed, code, model, timedOut });
+      resolve({ ...parsed, code, model, timedOut, ...(observing ? { observationHealth } : {}) });
     });
 
     try { proc.stdin.end(prompt); } catch (error) { inputFailed(error); }

package/board/scripts/lib/codex-host-state.mjs

@@ -7,11 +7,22 @@ import { detectCodex } from './codex-exec.mjs';
 import { detectClaude } from './claude-exec.mjs';
 import { dispatchEvidenceSummary } from './controller-dispatch-evidence.mjs';
 import { projectExecutionTrace } from './execution-trace.mjs';
+import { graphBinding, projectHostObservations } from './host-graph-observer.mjs';
+import { invocationIdentity } from './invocation-identity.mjs';
 
 export const codexRunStore = ({ home = homedir(), env = process.env } = {}) =>
   env.GREAT_CTO_CODEX_RUNS_DIR || join(home, '.great_cto', 'codex-runs');
 
 export function projectCodexState(state) {
+  const observationInvocations = (state.attempts || []).flatMap(a => [{ ...a, observationHost: a.host || 'codex', observationId: a.invocationId }, ...(a.verifierInvocationId ? [{ ...a, observationHost: 'codex', observationId: a.verifierInvocationId }] : [])]).filter(a => a.observationId);
+  // A frozen wave is persisted before dispatch; prepared attempts appear later.
+  for (const role of state.wave?.roles || []) {
+    const id = state.wave.attemptIds?.[role], observationHost = state.wave.hosts?.[role];
+    const observationId = invocationIdentity({ session_id: state.id, agent_id: id });
+    if (observationId && ['codex', 'claude-code'].includes(observationHost)
+      && !observationInvocations.some(a => a.observationId === observationId && a.observationHost === observationHost))
+      observationInvocations.push({ id, observationHost, observationId });
+  }
   return {
     id: state.id,
     version: state.version,
@@ -23,11 +34,16 @@ export function projectCodexState(state) {
     hostRoutes: state.hostRoutes || {},
     controllerDispatch: dispatchEvidenceSummary(state),
     executionGraph: projectExecutionTrace(state),
+    hostObservationHealth: state.hostObservationHealth || null,
+    hostObservationBindings: observationInvocations.map(a => ({ attemptId: a.id, sessionId: a.observationId, host: a.observationHost })),
+    hostObservationOmittedAttempts: Math.max(0, observationInvocations.length - 8),
+    hostObservations: state.observeHostGraph === true ? observationInvocations.slice(-8).map(a =>
+      projectHostObservations(graphBinding({ root: state.root, runId: state.id, sessionId: a.observationId, attemptId: a.id, host: a.observationHost }))) : [],
     wave: state.wave ? { id: state.wave.id, roles: state.wave.roles, hosts: state.wave.hosts, status: state.wave.status } : null,
     rolesCompleted: Object.keys(state.results || {}),
-    attempts: (state.attempts || []).map(({ id, role, host, number, phase, status, startedAt, finishedAt, invocationId }) =>
+    attempts: (state.attempts || []).map(({ id, role, host, number, phase, status, startedAt, finishedAt, invocationId, verifierInvocationId }) =>
       ({ id, role, host: host || 'codex', number, phase, status, startedAt, finishedAt,
-        ...(invocationId ? { invocationId } : {}) })),
+        ...(invocationId ? { invocationId } : {}), ...(verifierInvocationId ? { verifierInvocationId } : {}) })),
     pending: state.pending ? { role: state.pending.role, gates: state.pending.gates || [], createdAt: state.pending.createdAt } : null,
     release: state.release ? {
       adapter: state.release.adapter,

package/board/scripts/lib/codex-pipeline.mjs

@@ -7,6 +7,8 @@ import { parsePipelineToml } from './pipeline-toml.mjs';
 import { scan } from './secret-patterns.mjs';
 import { runCodexExec, codexToolEvent } from './codex-exec.mjs';
 import { runClaudeExec } from './claude-exec.mjs';
+import { auditHostGraphRuntimes } from './host-graph-runtime.mjs';
+import { graphBinding, observeHostGraph, recordHostGraphGap } from './host-graph-observer.mjs';
 import { appendEvent } from './agent-events.mjs';
 import { snapshotTurn, pruneTurns } from './turn-snapshot.mjs';
 import { treeReceipt } from './receipt.mjs';
@@ -74,11 +76,37 @@ function emit(state, event) {
   // The user ran this pipeline here, so it keeps its log here even before /start.
   return appendEvent(join(state.root, '.great_cto'), { ...event, session: state.id }, { explicit: true });
 }
-const toolListener = (state, agent, invocationId = null) => (ev) => {
+const toolListener = (state, agent, invocationId = null, sourceAudited = false, trustedAttemptId = null) => (ev) => {
+  if (state.observeHostGraph === true && invocationId) {
+    const attempt = (state.attempts || []).find(a => a.invocationId === invocationId || a.verifierInvocationId === invocationId);
+    // Parallel worker callbacks precede prepared attempts, but their wave ID is durable.
+    const host = agent.startsWith('claude-') ? 'claude-code' : 'codex';
+    const observed = observeHostGraph({ binding: graphBinding({ root: state.root, runId: state.id, sessionId: invocationId, attemptId: attempt?.id || trustedAttemptId, host }),
+      host, mode: 'controlled', sourceVersion: sourceAudited ? state.hostObservationSources?.find(s => s.host === host)?.sourceVersion || null : null, event: ev });
+    state.hostObservationHealth ||= { state: 'recorded', recorded: 0 };
+    state.hostObservationHealth.recorded += observed.recorded;
+    if (observed.state === 'degraded') state.hostObservationHealth.state = 'degraded';
+  }
   const e = codexToolEvent(ev);
   if (e) emit(state, { ...e, agent, invocation_id: invocationId });
 };
 
+/** Provider-free audit is refreshed for each controller action, never a completeness attestation. */
+export function refreshHostObservationSources(state, { save = () => {}, audit = auditHostGraphRuntimes } = {}) {
+  if (state.observeHostGraph !== true) return;
+  state.hostObservationSources = audit({ binaries: {
+    codex: process.env.GREAT_CTO_CODEX_BIN || 'codex', 'claude-code': process.env.GREAT_CTO_CLAUDE_BIN || 'claude',
+  } });
+  save(state);
+}
+
+function observeRunnerHealth(state, response, { host, invocationId, attemptId }) {
+  if (!state.observeHostGraph || response.observationHealth !== 'degraded') return;
+  state.hostObservationHealth ||= { state: 'recorded', recorded: 0 };
+  state.hostObservationHealth.state = 'degraded';
+  recordHostGraphGap(graphBinding({ root: state.root, runId: state.id, sessionId: invocationId, attemptId, host }), host, 'controlled', ['observer-transport-failure']);
+}
+
 /**
  * ADR-026 — what a stage is told about the stages before it.
  *
@@ -175,8 +203,10 @@ function releaseSummary(state) {
 
 export async function verifyStage(state, role, proposal, execute) {
   const agent = 'codex-verifier';
+  const verifierAttempt = state.attempts?.findLast(a => a.role === role);
   const invocationId = invocationIdentity({ session_id: state.id,
-    agent_id: `${state.attempts?.findLast(a => a.role === role)?.id || randomUUID()}:verifier` });
+    agent_id: `${verifierAttempt?.id || randomUUID()}:verifier` });
+  if (verifierAttempt) verifierAttempt.verifierInvocationId = invocationId;
   const t0 = Date.now();
   let ok = false;
   emit(state, { kind: 'agent-start', agent, invocation_id: invocationId });
@@ -189,10 +219,10 @@ export async function verifyStage(state, role, proposal, execute) {
       if (attempt && admitted.evidence) attempt.domainVerifierContext = admitted.evidence;
       return execute(admitted.options);
     };
-    const result = cleanResponse(await invoke({
+    const verifierResponse = await invoke({
       cwd: state.root, sandbox: 'read-only', ephemeral: true, extraArgs: workerArgs,
       bin: process.env.GREAT_CTO_CODEX_BIN || 'codex', timeoutMs: 300000,
-      invocationId, onEvent: toolListener(state, agent, invocationId),
+      invocationId, onEvent: toolListener(state, agent, invocationId, execute === runCodexExec),
       prompt: `You are an independent verifier for the ${role} stage. Read the ACTUAL files and assess whether they satisfy the task for this stage.\n` +
         frozenPolicyContext(state) +
         (state.specialistStages?.[role] ? `Controlled phase: ${state.specialistStages[role].phase}, before implementation. Verify an implementable contract/threat model and its evidence; do not require nonexistent implementation or treat design sign-off as code approval. Capability: ${codexRoleProfile(specialistRole(state, role))}\n` : '') +
@@ -220,7 +250,9 @@ export async function verifyStage(state, role, proposal, execute) {
         `Do not treat file existence, a previous agent's statement or tests that were not executed as evidence of correctness. ` +
         `Return ONLY JSON {"state":"verified|rework|unverifiable","findings":["..."],"checks":["what you actually inspected or ran"]}, plus dependencyAttestation when scoped dependency evidence is provided. ` +
         `Use unverifiable if unable to inspect the evidence. Use rework when you find defects. No gate approval or file proposals.`,
-    }));
+    });
+    observeRunnerHealth(state, verifierResponse, { host: 'codex', invocationId, attemptId: verifierAttempt?.id || null });
+    const result = cleanResponse(verifierResponse);
     if (!['verified', 'rework', 'unverifiable'].includes(result.state) || !Array.isArray(result.findings) || !Array.isArray(result.checks) || !result.checks.length) throw Error('invalid or empty verifier evidence');
     if (attestWorkflow && result.state === 'verified') {
       const a = result.workflowAttestation;
@@ -650,6 +682,7 @@ export async function runStage(state, { execute = null, runners = { codex: runCo
   if (state.status === 'cancelled') return state;
   if (state.active) throw Error('interrupted stage: inspect state and files before starting a new run');
   if (state.status !== 'ready') return state;
+  refreshHostObservationSources(state, { save });
   preflightSpecialistEpoch(state, save);
   if (state.steps >= 32) throw Error('32-stage run limit reached');
   assertArtifacts(state);
@@ -753,8 +786,9 @@ export async function runStage(state, { execute = null, runners = { codex: runCo
       stageStarted = true; emit(state, { kind: 'agent-start', agent, invocation_id: attempt.invocationId });
       return observeControllerCall(state, { id: `${attempt.id}:worker`, attemptId: attempt.id, host: roleHost(state, role), role, kind: 'worker' }, () => runner({ prompt: admitted.options.prompt, cwd: state.root, sandbox: 'read-only', ephemeral: true,
       bin: roleHost(state, role) === 'codex' ? process.env.GREAT_CTO_CODEX_BIN || 'codex' : process.env.GREAT_CTO_CLAUDE_BIN || 'claude',
-      invocationId: attempt.invocationId, timeoutMs: 300000, extraArgs: roleHost(state, role) === 'codex' ? workerArgs : [], onEvent: toolListener(state, agent, attempt.invocationId) }), save);
+      invocationId: attempt.invocationId, timeoutMs: 300000, extraArgs: roleHost(state, role) === 'codex' ? workerArgs : [], onEvent: roleHost(state, role) === 'codex' || state.observeHostGraph === true ? toolListener(state, agent, attempt.invocationId, runner === runCodexExec || runner === runClaudeExec) : null }), save);
     });
+    observeRunnerHealth(state, response, { host: roleHost(state, role), invocationId: attempt.invocationId, attemptId: attempt.id });
     const proposalSource = traceKey(state, `dispatch:${attempt.id}`) || traceKey(state, `reuse:${attempt.id}`) || contextNode;
     // Codex can recover its session-index lookup without degrading the worker.
     // Keep the diagnostic in the receipt; every other warning/error blocks.
@@ -833,6 +867,7 @@ export async function runStage(state, { execute = null, runners = { codex: runCo
     const beforeVerifier = stageReceipt(state, treeReceipt(state.root), 'verifier input');
     if (JSON.stringify(beforeVerifier) !== JSON.stringify(receipt)) throw Error('working tree changed before verification');
     if (!attempt.checks || attempt.checks.state === 'passed') {
+      attempt.verifierInvocationId = invocationIdentity({ session_id: state.id, agent_id: `${attempt.id}:verifier` });
       recordTrace(state, 'verifier', { key: `verifier:${attempt.id}`, role, attemptId: attempt.id, host: 'codex', status: 'intent',
         parents: [traceKey(state, `checks:${attempt.id}`) || proposalSource,
           ...traceParents(state, Object.keys(state.results), false)], relation: 'verification', input: receipt });
@@ -959,6 +994,7 @@ function preflightParallelProposals(state, roles, responses) {
 /** Dispatch two read-only workers together, then apply their proposals one by one. */
 export async function runParallelWave(state, { runners = { codex: runCodexExec, 'claude-code': runClaudeExec },
   verify = verifyStage, checks = runChecks, save = () => {}, contextStore = null } = {}) {
+  refreshHostObservationSources(state, { save });
   preflightSpecialistEpoch(state, save);
   if (!state.wave) {
     const roles = parallelPair(state);
@@ -998,7 +1034,8 @@ export async function runParallelWave(state, { runners = { codex: runCodexExec,
         const result = await observeControllerCall(state, { id: `${waveId}:${role}`, attemptId: state.wave.attemptIds[role], host: roleHost(state, role), role, kind: 'worker' }, () => runner({ prompt: admitted.options.prompt, cwd: state.root,
           sandbox: 'read-only', ephemeral: true, timeoutMs: 300000,
           bin: roleHost(state, role) === 'codex' ? process.env.GREAT_CTO_CODEX_BIN || 'codex' : process.env.GREAT_CTO_CLAUDE_BIN || 'claude',
-          invocationId, extraArgs: roleHost(state, role) === 'codex' ? workerArgs : [], onEvent: toolListener(state, agent, invocationId) }), save);
+          invocationId, extraArgs: roleHost(state, role) === 'codex' ? workerArgs : [], onEvent: roleHost(state, role) === 'codex' || state.observeHostGraph === true ? toolListener(state, agent, invocationId, runner === runCodexExec || runner === runClaudeExec, state.wave.attemptIds[role]) : null }), save);
+        observeRunnerHealth(state, result, { host: roleHost(state, role), invocationId, attemptId: state.wave.attemptIds[role] });
         ok = true;
         return result;
       } finally {

package/board/scripts/lib/host-graph-bindings.mjs

@@ -0,0 +1,135 @@
+/** Explicit local enrollment; native observation grants no execution authority. */
+import { createHash, randomUUID } from 'node:crypto';
+import { constants, openSync, closeSync, fstatSync, fsyncSync, linkSync, mkdirSync, lstatSync, existsSync, readFileSync, writeFileSync, realpathSync, readdirSync, rmSync } from 'node:fs';
+import { join, resolve, dirname } from 'node:path';
+import { homedir } from 'node:os';
+import { assertExternal, projectIdentity } from './work-tasks.mjs';
+import { readHostGraph } from './host-graph-journal.mjs';
+import { graphBinding, observeHostGraph, projectHostObservations, recordHostGraphGap } from './host-graph-observer.mjs';
+import { codexNativeTurnIdentity } from './host-graph-events.mjs';
+const hostSet = new Set(['codex', 'claude-code']);
+const validVersion = value => value === null || (typeof value === 'string' && value.length <= 80 && /^\d{1,5}\.\d{1,5}\.\d{1,5}(?:[-.+][A-Za-z0-9.-]{1,32})?$/.test(value));
+const identity = value => typeof value === 'string' && /^[A-Za-z0-9_.:-]{1,128}$/.test(value);
+export const nativeGraphStore = () => process.env.GREAT_CTO_GRAPH_BINDINGS_DIR || join(homedir(), '.great_cto', 'graph-bindings');
+const key = (root, host, sessionId) => createHash('sha256').update(JSON.stringify([projectIdentity(root), host, sessionId])).digest('hex');
+function secure(root, store, create = false) {
+  assertExternal(root, store);
+  let current = resolve(store);
+  while (current !== dirname(current)) {
+    if (existsSync(current) && lstatSync(current).isSymbolicLink()) throw Error('graph binding store has a symbolic link');
+    current = dirname(current);
+  }
+  if (create) mkdirSync(store, { recursive: true, mode: 0o700 });
+  if (existsSync(store) && (!lstatSync(store).isDirectory() || (lstatSync(store).mode & 0o077) || (process.getuid && lstatSync(store).uid !== process.getuid()))) throw Error('graph bindings require private permissions');
+}
+function syncDirectory(store) { const fd = openSync(store, constants.O_RDONLY); try { fsyncSync(fd); } finally { closeSync(fd); } }
+function readPrivate(file) {
+  const fd = openSync(file, constants.O_RDONLY | (constants.O_NOFOLLOW || 0) | (constants.O_NONBLOCK || 0));
+  try {
+    const stat = fstatSync(fd);
+    if (!stat.isFile() || stat.nlink !== 1 || stat.mode & 0o077 || stat.size > 4096 || (process.getuid && stat.uid !== process.getuid())) throw Error('unsafe graph enrollment');
+    return JSON.parse(readFileSync(fd, 'utf8'));
+  } finally { closeSync(fd); }
+}
+function load(root, host, sessionId, store) {
+  secure(root, store);
+  const file = join(store, `${key(root, host, sessionId)}.json`);
+  if (!existsSync(file)) return null;
+  const b = readPrivate(file);
+  if (b.version !== 1 || b.root !== realpathSync(root) || b.projectId !== projectIdentity(root) || b.host !== host || b.sessionId !== sessionId || b.runId !== sessionId) throw Error('graph enrollment binding mismatch');
+  return b;
+}
+export function bindNativeGraph({ root, host, sessionId, sourceVersion = null }, { store = nativeGraphStore() } = {}) {
+  if (!hostSet.has(host) || !identity(sessionId) || !validVersion(sourceVersion)) throw Error('invalid native graph binding');
+  secure(root, store, true);
+  const binding = { version: 1, ...graphBinding({ root: realpathSync(root), runId: sessionId, sessionId }), host, sourceVersion };
+  const file = join(store, `${key(root, host, sessionId)}.json`), tmp = `${file}.${process.pid}.tmp`;
+  if (existsSync(file)) { load(root, host, sessionId, store); throw Error('session already enrolled; remove binding before changing capabilities'); }
+  try { writeFileSync(tmp, JSON.stringify(binding), { mode: 0o600, flag: 'wx' });
+    const fd = openSync(tmp, constants.O_RDONLY); try { fsyncSync(fd); } finally { closeSync(fd); }
+    linkSync(tmp, file); }
+  finally { rmSync(tmp, { force: true }); syncDirectory(store); }
+  return { state: 'enrolled', host, sessionId, projectId: binding.projectId, authority: 'observation-only' };
+}
+export function unbindNativeGraph({ root, host, sessionId }, { store = nativeGraphStore() } = {}) {
+  if (!hostSet.has(host) || !identity(sessionId)) throw Error('invalid native graph binding');
+  const b = load(root, host, sessionId, store);
+  if (b) { rmSync(join(store, `${key(root, host, sessionId)}.json`)); syncDirectory(store); }
+  return { state: b ? 'unenrolled' : 'absent', authority: 'observation-only' };
+}
+export function observeNativeGraphHook({ root, host, event }, { store = nativeGraphStore(), journalStore } = {}) {
+  const sessionId = event?.session_id;
+  if (!hostSet.has(host) || !identity(sessionId)) return { state: 'ignored' };
+  let b = load(root, host, sessionId, store);
+  if (!b && event.hook_event_name === 'SessionStart') {
+    const policyFile = join(store, `${key(root, host, 'project-policy')}.policy`);
+    if (existsSync(policyFile)) {
+      const policy = readPrivate(policyFile);
+      if (policy.version !== 1 || policy.projectId !== projectIdentity(root) || policy.root !== realpathSync(root) || policy.host !== host || policy.enabled !== true) throw Error('invalid graph observation policy');
+      bindNativeGraph({ root, host, sessionId, sourceVersion: policy.sourceVersion }, { store });
+      b = load(root, host, sessionId, store);
+    }
+  }
+  if (!b) return { state: 'not-enrolled' };
+  const turnHook = ['UserPromptSubmit', 'Stop'].includes(event.hook_event_name);
+  const sourceIdentityPresent = host === 'codex' && turnHook ? !!codexNativeTurnIdentity(event) : !!event.event_id;
+  if ((turnHook || (event.hook_event_name === 'SessionStart' && event.source === 'resume')) && !sourceIdentityPresent) {
+    // Retain each received delivery without pretending it has a replay-safe host ID.
+    b = { ...b, sourceEventId: randomUUID() };
+    recordHostGraphGap(b, host, 'native', ['missing-source-event-identity'], { store: journalStore });
+  }
+  if (['SubagentStart', 'SubagentStop'].includes(event.hook_event_name)) {
+    const roots = readHostGraph(b, { store: journalStore }).events.filter(e => e.host === host && e.kind === 'session' && e.phase === 'started');
+    if (roots.length) b = { ...b, parentIds: [roots[0].id] }; // Same explicitly enrolled session; containment, not dispatch order.
+  }
+  return observeHostGraph({ binding: b, host, mode: 'native', sourceVersion: b.sourceVersion, event, store: journalStore });
+}
+export function nativeGraphObservations(root, { store = nativeGraphStore(), journalStore } = {}) {
+  secure(root, store);
+  if (!existsSync(store)) return [];
+  const rows = [];
+  // Enrollment files are bounded and read only after exact project matching.
+  const names = readdirSync(store).filter(n => /^[a-f0-9]{64}\.json$/.test(n));
+  if (names.length > 4096) throw Error('native graph enrollment read limit');
+  for (const name of names) {
+    const file = join(store, name);
+    const candidate = readPrivate(file);
+    if (candidate.projectId !== projectIdentity(root)) continue;
+    if (!hostSet.has(candidate.host) || !identity(candidate.sessionId)) throw Error('invalid graph enrollment');
+    const b = load(root, candidate.host, candidate.sessionId, store);
+    if (name !== `${key(root, b.host, b.sessionId)}.json`) throw Error('invalid graph enrollment filename');
+    rows.push({ host: b.host, sessionId: b.sessionId, runId: b.runId,
+      graph: projectHostObservations(b, { store: journalStore }) });
+  }
+  return rows;
+}
+
+/** Bounded page of exactly one explicitly enrolled session. */
+export function readNativeGraphPage({ root, host, sessionId, cursor = null, limit = 200 }, { store = nativeGraphStore(), journalStore } = {}) {
+  if (!hostSet.has(host) || !identity(sessionId)) throw Error('invalid native graph binding');
+  const b = load(root, host, sessionId, store);
+  if (!b) throw Error('native session is not enrolled in this project');
+  return projectHostObservations(b, { store: journalStore, cursor, limit });
+}
+
+/** Project opt-in before SessionStart permits observation from the real start event. */
+export function enableNativeGraph({ root, host, sourceVersion = null }, { store = nativeGraphStore() } = {}) {
+  if (!hostSet.has(host) || !validVersion(sourceVersion)) throw Error('invalid graph observation policy');
+  secure(root, store, true);
+  const file = join(store, `${key(root, host, 'project-policy')}.policy`);
+  const body = { version: 1, projectId: projectIdentity(root), root: realpathSync(root), host, sourceVersion, enabled: true };
+  const fd = openSync(file, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o600);
+  try { writeFileSync(fd, JSON.stringify(body)); fsyncSync(fd); } finally { closeSync(fd); }
+  syncDirectory(store);
+  return { state: 'enabled', host, projectId: body.projectId, scope: 'new native sessions in this exact project', authority: 'observation-only' };
+}
+export function disableNativeGraph({ root, host }, { store = nativeGraphStore() } = {}) {
+  if (!hostSet.has(host)) throw Error('invalid graph host');
+  secure(root, store);
+  const file = join(store, `${key(root, host, 'project-policy')}.policy`);
+  if (existsSync(file)) { const p = readPrivate(file); if (p.projectId !== projectIdentity(root) || p.host !== host) throw Error('graph policy mismatch'); rmSync(file); }
+  // Revocation also stops already-enrolled sessions for this host/project.
+  for (const row of nativeGraphObservations(root, { store })) if (row.host === host) unbindNativeGraph({ root, host, sessionId: row.sessionId }, { store });
+  if (existsSync(store)) syncDirectory(store);
+  return { state: 'disabled', authority: 'observation-only', retainedHistory: true };
+}