great-cto 3.70.1 → 3.72.0

package/README.md

@@ -1,6 +1,14 @@
 # great-cto
 
-> One command install for the [great_cto](https://github.com/avelikiy/great_cto) Claude Code plugin.
+> CLI for the [great_cto](https://github.com/avelikiy/great_cto) engineering workspace, controlled runs and verified release updates.
+
+**Verified distribution boundary:** ADR-045 replaces mutable installation and update
+paths with signed artifact admission. This implementation refuses `init`, native
+plugin refresh and automatic companion installation before mutation. The plain
+npm self-update adapter requires an independently configured verifier and exact
+signed release assets. See [verified updates](../../docs/reference/verified-updates.md).
+The installation walkthrough below describes the legacy 3.70.1 flow; it is not
+an activation route for this implementation.
 
 ```bash
 npx great-cto init

package/board/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "great-cto",
   "description": "You already have the agent. This is everything around it. great_cto runs Claude Code as a pipeline of 72 specialist agents \u2014 an independent model checks each stage before the next builds on it, spending caps refuse rather than warn, and three decisions stay yours: what gets built, how, and whether it ships.",
-  "version": "3.70.1",
+  "version": "3.72.0",
   "author": {
     "name": "Alexander Velikiy",
     "url": "https://hashnode.com/@Greatcto"
@@ -88,6 +88,16 @@
             "timeout": 10
           }
         ]
+      },
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "timeout": 5,
+            "command": "_gd=\"$PWD\"; while [ -n \"$_gd\" ] && { [ \"$_gd\" = \"$HOME\" ] || [ ! -f \"$_gd/.great_cto/PROJECT.md\" ]; }; do _gd=\"${_gd%/*}\"; done; [ -n \"$_gd\" ] && cd \"$_gd\"; [ -d \"${GREAT_CTO_GRAPH_BINDINGS_DIR:-$HOME/.great_cto/graph-bindings}\" ] || exit 0; _pd=\"${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-}}\"; [ -n \"$_pd\" ] || exit 0; GREAT_CTO_HOST=claude-code node \"$_pd/scripts/hooks/host-graph-observer.mjs\""
+          }
+        ]
       }
     ],
     "PreCompact": [
@@ -120,6 +130,16 @@
             "statusMessage": "Loading orchestrator contract..."
           }
         ]
+      },
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "timeout": 5,
+            "command": "_gd=\"$PWD\"; while [ -n \"$_gd\" ] && { [ \"$_gd\" = \"$HOME\" ] || [ ! -f \"$_gd/.great_cto/PROJECT.md\" ]; }; do _gd=\"${_gd%/*}\"; done; [ -n \"$_gd\" ] && cd \"$_gd\"; [ -d \"${GREAT_CTO_GRAPH_BINDINGS_DIR:-$HOME/.great_cto/graph-bindings}\" ] || exit 0; _pd=\"${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-}}\"; [ -n \"$_pd\" ] || exit 0; GREAT_CTO_HOST=claude-code node \"$_pd/scripts/hooks/host-graph-observer.mjs\""
+          }
+        ]
       }
     ],
     "SubagentStop": [
@@ -138,6 +158,16 @@
             "command": "_gd=\"$PWD\"; while [ -n \"$_gd\" ] && { [ \"$_gd\" = \"$HOME\" ] || [ ! -f \"$_gd/.great_cto/PROJECT.md\" ]; }; do _gd=\"${_gd%/*}\"; done; [ -n \"$_gd\" ] && cd \"$_gd\"; node \"${CLAUDE_PLUGIN_ROOT}/scripts/hooks/turn-snapshot.mjs\" 2>/dev/null || true"
           }
         ]
+      },
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "timeout": 5,
+            "command": "_gd=\"$PWD\"; while [ -n \"$_gd\" ] && { [ \"$_gd\" = \"$HOME\" ] || [ ! -f \"$_gd/.great_cto/PROJECT.md\" ]; }; do _gd=\"${_gd%/*}\"; done; [ -n \"$_gd\" ] && cd \"$_gd\"; [ -d \"${GREAT_CTO_GRAPH_BINDINGS_DIR:-$HOME/.great_cto/graph-bindings}\" ] || exit 0; _pd=\"${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-}}\"; [ -n \"$_pd\" ] || exit 0; GREAT_CTO_HOST=claude-code node \"$_pd/scripts/hooks/host-graph-observer.mjs\""
+          }
+        ]
       }
     ],
     "PreToolUse": [
@@ -208,6 +238,16 @@
             "statusMessage": "Checking recorded lessons..."
           }
         ]
+      },
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "timeout": 5,
+            "command": "_gd=\"$PWD\"; while [ -n \"$_gd\" ] && { [ \"$_gd\" = \"$HOME\" ] || [ ! -f \"$_gd/.great_cto/PROJECT.md\" ]; }; do _gd=\"${_gd%/*}\"; done; [ -n \"$_gd\" ] && cd \"$_gd\"; [ -d \"${GREAT_CTO_GRAPH_BINDINGS_DIR:-$HOME/.great_cto/graph-bindings}\" ] || exit 0; _pd=\"${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-}}\"; [ -n \"$_pd\" ] || exit 0; GREAT_CTO_HOST=claude-code node \"$_pd/scripts/hooks/host-graph-observer.mjs\""
+          }
+        ]
       }
     ],
     "PostToolUse": [
@@ -293,6 +333,16 @@
             "statusMessage": "Computing next pipeline stage..."
           }
         ]
+      },
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "timeout": 5,
+            "command": "_gd=\"$PWD\"; while [ -n \"$_gd\" ] && { [ \"$_gd\" = \"$HOME\" ] || [ ! -f \"$_gd/.great_cto/PROJECT.md\" ]; }; do _gd=\"${_gd%/*}\"; done; [ -n \"$_gd\" ] && cd \"$_gd\"; [ -d \"${GREAT_CTO_GRAPH_BINDINGS_DIR:-$HOME/.great_cto/graph-bindings}\" ] || exit 0; _pd=\"${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-}}\"; [ -n \"$_pd\" ] || exit 0; GREAT_CTO_HOST=claude-code node \"$_pd/scripts/hooks/host-graph-observer.mjs\""
+          }
+        ]
       }
     ],
     "SessionEnd": [
@@ -311,6 +361,16 @@
             "timeout": 5
           }
         ]
+      },
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "timeout": 5,
+            "command": "_gd=\"$PWD\"; while [ -n \"$_gd\" ] && { [ \"$_gd\" = \"$HOME\" ] || [ ! -f \"$_gd/.great_cto/PROJECT.md\" ]; }; do _gd=\"${_gd%/*}\"; done; [ -n \"$_gd\" ] && cd \"$_gd\"; [ -d \"${GREAT_CTO_GRAPH_BINDINGS_DIR:-$HOME/.great_cto/graph-bindings}\" ] || exit 0; _pd=\"${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-}}\"; [ -n \"$_pd\" ] || exit 0; GREAT_CTO_HOST=claude-code node \"$_pd/scripts/hooks/host-graph-observer.mjs\""
+          }
+        ]
       }
     ],
     "UserPromptSubmit": [
@@ -338,6 +398,16 @@
             "timeout": 5
           }
         ]
+      },
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "timeout": 5,
+            "command": "_gd=\"$PWD\"; while [ -n \"$_gd\" ] && { [ \"$_gd\" = \"$HOME\" ] || [ ! -f \"$_gd/.great_cto/PROJECT.md\" ]; }; do _gd=\"${_gd%/*}\"; done; [ -n \"$_gd\" ] && cd \"$_gd\"; [ -d \"${GREAT_CTO_GRAPH_BINDINGS_DIR:-$HOME/.great_cto/graph-bindings}\" ] || exit 0; _pd=\"${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-}}\"; [ -n \"$_pd\" ] || exit 0; GREAT_CTO_HOST=claude-code node \"$_pd/scripts/hooks/host-graph-observer.mjs\""
+          }
+        ]
       }
     ],
     "PermissionDenied": [
@@ -384,6 +454,16 @@
             "timeout": 5
           }
         ]
+      },
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "timeout": 5,
+            "command": "_gd=\"$PWD\"; while [ -n \"$_gd\" ] && { [ \"$_gd\" = \"$HOME\" ] || [ ! -f \"$_gd/.great_cto/PROJECT.md\" ]; }; do _gd=\"${_gd%/*}\"; done; [ -n \"$_gd\" ] && cd \"$_gd\"; [ -d \"${GREAT_CTO_GRAPH_BINDINGS_DIR:-$HOME/.great_cto/graph-bindings}\" ] || exit 0; _pd=\"${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-}}\"; [ -n \"$_pd\" ] || exit 0; GREAT_CTO_HOST=claude-code node \"$_pd/scripts/hooks/host-graph-observer.mjs\""
+          }
+        ]
       }
     ],
     "Notification": [
@@ -397,6 +477,18 @@
           }
         ]
       }
+    ],
+    "PostToolUseFailure": [
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "timeout": 5,
+            "command": "_gd=\"$PWD\"; while [ -n \"$_gd\" ] && { [ \"$_gd\" = \"$HOME\" ] || [ ! -f \"$_gd/.great_cto/PROJECT.md\" ]; }; do _gd=\"${_gd%/*}\"; done; [ -n \"$_gd\" ] && cd \"$_gd\"; [ -d \"${GREAT_CTO_GRAPH_BINDINGS_DIR:-$HOME/.great_cto/graph-bindings}\" ] || exit 0; _pd=\"${CLAUDE_PLUGIN_ROOT:-${PLUGIN_ROOT:-}}\"; [ -n \"$_pd\" ] || exit 0; GREAT_CTO_HOST=claude-code node \"$_pd/scripts/hooks/host-graph-observer.mjs\""
+          }
+        ]
+      }
     ]
   },
   "homepage": "https://greatcto.systems",

package/board/agents/architect.md

@@ -376,7 +376,7 @@ constraint in the new ARCH doc — document why this design choice was not taken
      ARCHETYPE=$(grep "^archetype:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}'); ARCHETYPE=${ARCHETYPE:-web-service}
      PROJECT_SIZE=$(grep "^project_size:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}'); PROJECT_SIZE=${PROJECT_SIZE:-medium}
      SECURITY_GATE=$(grep "^security-gate:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}'); SECURITY_GATE=${SECURITY_GATE:-conditional}
-     COMPLIANCE=$(grep "^compliance:" .great_cto/PROJECT.md 2>/dev/null | sed 's/compliance: //' || echo "[]")
+     COMPLIANCE=$(grep "^compliance:" .great_cto/PROJECT.md 2>/dev/null | sed 's/compliance: //'); COMPLIANCE=${COMPLIANCE:-[]}
      ```
      Read ARCHETYPES.md for QA strategy, deploy method, and thresholds matching `$ARCHETYPE`. Use these as constraints for the architecture design.
    - **Greenfield check** — determines how deep to read existing code:

package/board/agents/db-migration-reviewer.md

@@ -48,8 +48,9 @@ fi
 echo "Migrations to review:"
 echo "$MIGRATIONS"
 
-DB_ENGINE=$(grep "^db:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}' || \
-            grep -rn "postgresql\|mysql\|sqlite\|aurora\|cockroach\|planetscale" .great_cto/PROJECT.md 2>/dev/null | head -1 | grep -oE "postgresql|mysql|sqlite|aurora|cockroach|planetscale" | head -1 || echo "unknown")
+DB_ENGINE=$(grep "^db:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}')
+[ -n "$DB_ENGINE" ] || DB_ENGINE=$(grep -oE "postgresql|mysql|sqlite|aurora|cockroach|planetscale" .great_cto/PROJECT.md 2>/dev/null | head -1)
+DB_ENGINE=${DB_ENGINE:-unknown}
 
 # Slug from latest ARCH doc; date fallback must be an explicit branch —
 # `|| echo` after a pipeline never fires (basename "" exits 0 with empty output)

package/board/agents/design-advisor.md

@@ -1,6 +1,6 @@
 ---
 name: design-advisor
-description: Use after architect, before/parallel to pm, for any UI-bearing feature (landing pages, dashboards, admin panels, web apps, React Native apps). Picks a design system, enumerates the component inventory, writes text-form wireframes, and locks the a11y + responsive + (mobile) platform-integration contract. Outputs docs/design/DESIGN-{slug}.md. Plan altitude only — never writes implementation code.
+description: Use after architect and before pm, for any UI-bearing feature (landing pages, dashboards, admin panels, web apps, React Native apps). Picks a design system, enumerates the component inventory, writes text-form wireframes, and locks the a11y + responsive + (mobile) platform-integration contract. Outputs docs/design/DESIGN-{slug}.md. Plan altitude only — never writes implementation code.
 model: claude-opus-5
 authority: autonomous
 tools: Read, Write, Glob, Grep, WebFetch, Bash(git:*), Bash(bd:*), Bash(ls:*), Bash(cat:*), Bash(find:*), Bash(touch:*), Bash(head:*), Bash(tail:*), Bash(grep:*), Bash(wc:*), Bash(date:*), Bash(printf:*), Bash(echo:*), Bash(mkdir:*), memory_20250929, advisor_20260301

package/board/agents/devops.md

@@ -572,7 +572,7 @@ step for that condition before proceeding to Step 1 (gate:ship check).
      ESTIMATED=${ESTIMATED_RAW:-0}
      CONSOLE_URL=$(grep "console-url:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}')
      SERVICE=$(grep "^service:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}' || basename "$PWD")
-     FEATURE=$(basename "$ARCH_DOC" .md 2>/dev/null | sed 's/^ARCH-//' || echo "unknown")
+     FEATURE=$(basename "$ARCH_DOC" .md 2>/dev/null | sed 's/^ARCH-//'); FEATURE=${FEATURE:-unknown}
 
      COST_LOG=.great_cto/cost-history.log
      [ ! -f "$COST_LOG" ] && printf '# Cost history — append only. Format: ISO8601 | service | estimated_usd_month | actual_usd_month | source | feature\n' > "$COST_LOG"

package/board/agents/growth-engineer.md

@@ -91,7 +91,7 @@ ARCH_FILE=$(ls -t docs/architecture/ARCH-*.md 2>/dev/null | head -1)
 SLUG=$(basename "$ARCH_FILE" .md | sed 's/^ARCH-//')
 
 ARCHETYPE=$(grep "^archetype:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}')
-GROWTH_GOAL=$(grep "^growth-goal:" .great_cto/PROJECT.md 2>/dev/null | sed 's/growth-goal: //' || echo "not specified")
+GROWTH_GOAL=$(grep "^growth-goal:" .great_cto/PROJECT.md 2>/dev/null | sed 's/growth-goal: //'); GROWTH_GOAL=${GROWTH_GOAL:-not specified}
 # Is there an analytics/connector layer we can read from?
 CONNECT=$(ls docs/connectors/CONNECT-*.md 2>/dev/null | head -1)
 echo "slug=$SLUG archetype=$ARCHETYPE goal='$GROWTH_GOAL' connector=${CONNECT:-none}"

package/board/agents/knowledge-extractor.md

@@ -28,7 +28,7 @@ Run in parallel:
 cat .great_cto/lessons.md 2>/dev/null || echo "(no lessons yet)"
 
 # Cross-project decisions (supplement)
-cat ~/.great_cto/decisions.md 2>/dev/null | head -300 || echo "(none)"
+D=$(head -300 ~/.great_cto/decisions.md 2>/dev/null); [ -n "$D" ] && printf '%s\n' "$D" || echo "(none)"
 
 # Session log pattern lines across all sessions
 grep -h "^## pattern:" .great_cto/logs/session-*-end.md 2>/dev/null \

package/board/agents/l3-support.md

@@ -327,7 +327,7 @@ node "$PLUGIN_DIR/scripts/lib/pattern-lookup.mjs" --role incident
 
    # Priority 4: systemd / journalctl
    if [ -z "$LOG_PATH" ] && [ -z "$APP_CONTAINER" ]; then
-     journalctl --since "30 min ago" -p err 2>/dev/null | tail -50 || \
+     { J=$(journalctl --since "30 min ago" -p err 2>/dev/null | tail -50); [ -n "$J" ] && printf '%s\n' "$J"; } || \
      echo "No log source found. Add 'error-log: /path/to/log' to PROJECT.md L3 section."
    fi
 

package/board/agents/performance-engineer.md

@@ -76,7 +76,7 @@ ARCH_FILE=$(ls -t docs/architecture/ARCH-*.md 2>/dev/null | head -1)
 [ -z "$ARCH_FILE" ] && { echo "BLOCKED: no ARCH doc" >&2; exit 1; }
 SLUG=$(basename "$ARCH_FILE" .md | sed 's/^ARCH-//')
 
-PERF_SLA=$(grep "^performance-sla:" .great_cto/PROJECT.md 2>/dev/null | sed 's/performance-sla: //' || echo "not specified")
+PERF_SLA=$(grep "^performance-sla:" .great_cto/PROJECT.md 2>/dev/null | sed 's/performance-sla: //'); PERF_SLA=${PERF_SLA:-not specified}
 MONTHLY_RPS=$(grep "^expected-rps:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}'); MONTHLY_RPS=${MONTHLY_RPS:-unknown}
 
 # Check for existing baseline

package/board/agents/pm.md

@@ -115,6 +115,10 @@ PHASE=$(grep "^phase:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}'); PH
 TEAM_SIZE=$(grep "^team-size:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}'); TEAM_SIZE=${TEAM_SIZE:-1}
 MONTHLY_BUDGET=$(grep "^monthly-budget-llm-usd:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}')
 
+# Design contract — design-advisor runs before pm on UI features; plan UI tasks against it
+DESIGN_DOC=$(ls -t docs/design/DESIGN-*.md 2>/dev/null | head -1)
+[ -n "$DESIGN_DOC" ] && echo "=== DESIGN CONTRACT: $DESIGN_DOC (components, a11y, responsive — one task per screen/component group) ==="
+
 # Past lessons — calibrate cost/time estimates against actuals
 if [ -f .great_cto/lessons.md ]; then
   COST_LESSONS=$(grep -B1 -A4 "shape: B" .great_cto/lessons.md 2>/dev/null | head -20)
@@ -138,7 +142,7 @@ FEATURE_SLUG=$(basename "$ARCH_FILE" .md | sed 's/^ARCH-//' | tr '[:upper:]' '[:
 
 # Goal ancestry (Paperclip pattern) — injected into every bd create call.
 # Built AFTER FEATURE_SLUG is known (it interpolates the slug).
-COMPLIANCE=$(grep "^compliance:" .great_cto/PROJECT.md 2>/dev/null | sed 's/compliance: //' || echo "")
+COMPLIANCE=$(grep "^compliance:" .great_cto/PROJECT.md 2>/dev/null | sed 's/compliance: //')
 _COMP_CLEAN=$(echo "$COMPLIANCE" | sed 's/^\[none\]$//;s/^\[none, *\]//;s/, *\[none\]//')
 GOAL_ANCESTRY="[archetype:${ARCHETYPE}]$([ -n "$_COMP_CLEAN" ] && echo " [compliance:${_COMP_CLEAN}]") [feature:${FEATURE_SLUG}] [phase:${PHASE}] | Why: see docs/plans/PLAN-${FEATURE_SLUG}.md"
 

package/board/agents/qa-engineer.md

@@ -286,9 +286,9 @@ PROJECT_SIZE=$(grep "^project_size:" .great_cto/PROJECT.md 2>/dev/null | awk '{p
 
 ```bash
 ARCHETYPE=$(grep "^archetype:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}'); ARCHETYPE=${ARCHETYPE:-web-service}
-COMPLIANCE=$(grep "^compliance:" .great_cto/PROJECT.md 2>/dev/null | sed 's/compliance: //' || echo "[]")
-QA_EXTRAS=$(grep "^qa-extras:" .great_cto/PROJECT.md 2>/dev/null | sed 's/qa-extras: //' || echo "[]")
-PERF_SLA=$(grep "^performance-sla:" .great_cto/PROJECT.md 2>/dev/null | sed 's/performance-sla: //' || echo "")
+COMPLIANCE=$(grep "^compliance:" .great_cto/PROJECT.md 2>/dev/null | sed 's/compliance: //'); COMPLIANCE=${COMPLIANCE:-[]}
+QA_EXTRAS=$(grep "^qa-extras:" .great_cto/PROJECT.md 2>/dev/null | sed 's/qa-extras: //'); QA_EXTRAS=${QA_EXTRAS:-[]}
+PERF_SLA=$(grep "^performance-sla:" .great_cto/PROJECT.md 2>/dev/null | sed 's/performance-sla: //')
 ```
 
 Read ARCHETYPES.md → find QA strategy row for `$ARCHETYPE`. This gives base QA plan.
@@ -362,7 +362,7 @@ PII column additions) that functional tests miss by design — the
 specialist agent owns this.
 
 ```bash
-BASE=$(git rev-parse --abbrev-ref --symbolic-full-name @{u} 2>/dev/null | sed 's|.*/||' || echo "main")
+BASE=$(git rev-parse --abbrev-ref --symbolic-full-name @{u} 2>/dev/null | sed 's|.*/||'); BASE=${BASE:-main}
 MIGRATION_HIT=$(git diff "$BASE"...HEAD --name-only 2>/dev/null | \
   grep -E '(^|/)(migrations|alembic/versions|db/migrate|prisma/migrations|flyway|knex/migrations)/.*\.(sql|py|ts|js|rb)$' | head -5)
 

package/board/agents/security-officer.md

@@ -424,7 +424,7 @@ Continues from the original Workflow below — produces `CSO-{slug}-{date}.md`,
 1b. **Read** `.great_cto/PROJECT.md` → get `archetype`, `type`, `stack`, and `compliance` params:
    ```bash
    ARCHETYPE=$(grep "^archetype:" .great_cto/PROJECT.md 2>/dev/null | awk '{print $2}'); ARCHETYPE=${ARCHETYPE:-web-service}
-   COMPLIANCE=$(grep "^compliance:" .great_cto/PROJECT.md 2>/dev/null | sed 's/compliance: //' || echo "[]")
+   COMPLIANCE=$(grep "^compliance:" .great_cto/PROJECT.md 2>/dev/null | sed 's/compliance: //'); COMPLIANCE=${COMPLIANCE:-[]}
    ```
    Read ARCHETYPES.md → find security rules for `$ARCHETYPE`.
    The `compliance:` list in PROJECT.md determines which checklists to run (see Step 5).
@@ -670,7 +670,7 @@ Observations (signal < 2 or no direct evidence): record in a separate `## Observ
    the pipeline dispatcher and the board parse this line):
    ```bash
    bash scripts/log-verdict.sh security-officer <APPROVED|BLOCKED> auto \
-     findings=P0:<n>,P1:<n>,P2:<n> triaged=<n> valid=<n> invalid=<n> feature=<slug> need=<implementer|decision> finding=<id>
+     findings=P0:<n>,P1:<n>,P2:<n> triaged=<n> valid=<n> invalid=<n> feature=<slug> report=docs/security/CSO-<YYYY-MM-DD>.md need=<implementer|decision> finding=<id>
    ```
    On BLOCKED, `need` mirrors the report's `need` line: `implementer` for
    "senior-dev fix <finding>", `decision` for "CTO waive risk on <finding>".

package/board/agents/smart-contract-auditor.md

@@ -318,7 +318,7 @@ REPORT=docs/security/AUDIT-{slug}.md
 [ -s "$REPORT" ] || { echo "STOP: no audit report at $REPORT — write it first." >&2; exit 1; }
 
 bash scripts/log-verdict.sh smart-contract-auditor <PASS|FAIL|BLOCKED> auto \
-  feature=<slug> "audit=$REPORT" findings=C:<n>,H:<n>,M:<n> not_checked=<n> need=<implementer|decision> finding=<id>
+  feature=<slug> "report=$REPORT" findings=C:<n>,H:<n>,M:<n> not_checked=<n> need=<implementer|decision> finding=<id>
 ```
 
 In prepare mode add `package=docs/security/audit-package-{slug}` and

package/board/packages/board/lib/routes.mjs

@@ -45,7 +45,7 @@ import { readVerdicts } from './verdicts.mjs';
 import { parseAgentBudgets, upsertAgentBudget, removeAgentBudget } from '../../../scripts/lib/agent-budget.mjs';
 import { resolveSecondOpinion, SECOND_OPINION_PROVIDERS } from '../../../scripts/lib/second-opinion.mjs';
 import { detectCodex } from '../../../scripts/lib/codex-exec.mjs';
-import { getWork } from './work.mjs';
+import { getWork, getHostGraphPage } from './work.mjs';
 let publicationPreviewBusy = false;
 let publicationWriteBusy = false;
 import { publicationTickets, localPublicationOrigin } from './publication-tickets.mjs';
@@ -237,6 +237,19 @@ async function dispatch(req, res, url, cwd) {
     return true;
   }
 
+  if (pathname === '/api/host-graph') {
+    if (requestedProject && resolveProjectInfo(requestedProject).resolved === 'fallback') {
+      res.writeHead(404, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' }); res.end(JSON.stringify({ error: 'Unknown project' })); return true;
+    }
+    if (req.method !== 'GET') { res.writeHead(405, { Allow: 'GET' }); res.end(); return true; }
+    try {
+      const graph = getHostGraphPage(cwd, { host: url.searchParams.get('host'), sessionId: url.searchParams.get('session'),
+        runId: url.searchParams.get('run'), cursor: url.searchParams.get('cursor') });
+      res.writeHead(200, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' }); res.end(JSON.stringify(graph));
+    } catch { res.writeHead(404, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' }); res.end(JSON.stringify({ error: 'Bound graph page is unavailable' })); }
+    return true;
+  }
+
   // New read model refuses project fallback rather than relabeling another project.
   if (pathname === '/api/work') {
     if (requestedProject && resolveProjectInfo(requestedProject).resolved === 'fallback') {

package/board/packages/board/lib/work.mjs

@@ -10,6 +10,8 @@ import { measureWork, compareWork } from '../../../scripts/lib/work-metrics.mjs'
 import { readSessionStatus } from '../../../scripts/lib/session-status.mjs';
 import { agentActivity } from './agent-activity.mjs';
 import { taskInspector } from './task-inspector.mjs';
+import { graphBinding, projectHostObservations } from '../../../scripts/lib/host-graph-observer.mjs';
+import { nativeGraphObservations, readNativeGraphPage } from '../../../scripts/lib/host-graph-bindings.mjs';
 
 const text = v => typeof v === 'string' ? v : null;
 const date = v => typeof v === 'string' && Number.isFinite(Date.parse(v)) ? v : null;
@@ -30,7 +32,7 @@ function executionAttempts(run) {
   }));
   const truncated = attempts.length > 200;
   const graph = run?.executionGraph || { state: 'unavailable', complete: false, nodes: [], edges: [], snapshots: [], reason: 'No linked controller-recorded graph is available.' };
-  return { state: nodes.length ? 'recorded' : 'unknown', nodes, topology: graph.state === 'recorded' ? 'recorded' : 'unknown', graph, truncated,
+  return { state: nodes.length ? 'recorded' : 'unknown', nodes, observations: run?.hostObservations || [], observationHealth: run?.hostObservationHealth || null, omittedObservationAttempts: run?.hostObservationOmittedAttempts || 0, topology: graph.state === 'recorded' ? 'recorded' : 'unknown', graph, truncated,
     partial: !run || truncated || nodes.length !== window.length,
     reason: !run ? 'Stable attempt observations are unavailable without a single explicitly linked controlled run.'
       : !nodes.length ? 'No usable attempt observations are recorded.' : null };
@@ -63,7 +65,7 @@ function evidenceSections(entry) {
 }
 
 export function projectWork({ projectId, issues = [], codex = { state: 'absent', runs: [] },
-  tasks = [], sessions = [], sources = [], activity = { state: 'none', events: [] }, observedAt = new Date().toISOString() }) {
+  tasks = [], sessions = [], nativeGraphs = [], sources = [], activity = { state: 'none', events: [] }, observedAt = new Date().toISOString() }) {
   const entries = [];
   for (const r of codex.runs || []) {
     // Completion of a controller run is not proof of the user's acceptance criteria.
@@ -139,6 +141,20 @@ export function projectWork({ projectId, issues = [], codex = { state: 'absent',
       command: approveCommand || (enabled ? `great-cto resume --task ${t.taskId} --host ${t.host} --revision ${t.revision}` : null),
     });
   }
+  for (const observed of nativeGraphs) {
+    const linked = entries.filter(e => e.taskId && tasks.some(t => t.taskId === e.taskId && t.links.sessions.includes(observed.sessionId) && t.host === observed.host));
+    if (linked.length === 1) {
+      const entry = linked[0]; entry.execution ||= executionAttempts(null);
+      if (entry.execution.graph?.source !== 'host-observation' && entry.execution.topology !== 'recorded') {
+        entry.execution.graph = observed.graph; entry.execution.topology = 'observed';
+      } else (entry.execution.observations ||= []).push(observed.graph);
+    } else if (!linked.length) entries.push({ key: `native:${observed.host}:${observed.sessionId}`, kind: 'native', taskId: null,
+      runId: null, issueIds: [], title: `Observed ${observed.host} session`, goal: null, acceptance: [],
+      host: observed.host, phase: 'unknown', nativeState: 'observed', terminal: false, updatedAt: null,
+      outcome: null, reason: 'Enrolled native observations; task acceptance and execution authority are not established.',
+      decisions: [], capabilities: [], command: null, evidence: [], release: null,
+      execution: { state: observed.graph.state, nodes: [], topology: 'observed', graph: observed.graph, partial: true, observations: [] } });
+  }
   for (const entry of entries) entry.evidenceSections = evidenceSections(entry);
   entries.sort((a, b) => (a.terminal - b.terminal) || (b.decisions.length - a.decisions.length)
     || (Date.parse(b.updatedAt || '') || 0) - (Date.parse(a.updatedAt || '') || 0) || a.key.localeCompare(b.key));
@@ -193,8 +209,23 @@ export function getWork(cwd) {
     sessions = readSessionStatus(cwd);
     source('claude_sessions', unreadable ? 'degraded' : 'current', unreadable ? `${unreadable} session state file(s) could not be read` : null);
   } catch { source('claude_sessions', 'unavailable', 'Cannot read Claude session status'); }
+  let nativeGraphs = [];
+  try { nativeGraphs = nativeGraphObservations(cwd); source('native_graphs', nativeGraphs.some(r => r.graph.health === 'degraded') ? 'degraded' : 'current', null); }
+  catch { source('native_graphs', 'unavailable', 'Native graph enrollment is unreadable'); }
   let canonical = cwd;
   try { canonical = realpathSync(cwd); } catch { /* source health already reports inaccessible data */ }
   const projectId = 'project:' + createHash('sha256').update(canonical).digest('hex');
-  return { ...projectWork({ projectId, issues, codex, tasks, sessions, sources, activity, observedAt }), projectName: basename(cwd) };
+  return { ...projectWork({ projectId, issues, codex, tasks, sessions, nativeGraphs, sources, activity, observedAt }), projectName: basename(cwd) };
+}
+
+/** Read-only pagination, with exact enrollment or controlled attempt membership. */
+export function getHostGraphPage(root, { host, sessionId, runId = null, cursor = null }) {
+  if (!['codex', 'claude-code'].includes(host)) throw Error('invalid graph host');
+  if (!runId || runId === sessionId) return readNativeGraphPage({ root, host, sessionId, cursor });
+  const listing = listCodexRuns({ root });
+  if (listing.state === 'degraded') throw Error('controlled membership is unreadable');
+  const run = listing.runs.find(r => r.id === runId);
+  const binding = run?.hostObservationBindings.find(b => b.sessionId === sessionId && b.host === host);
+  if (!binding) throw Error('controlled observation does not belong to this project');
+  return projectHostObservations(graphBinding({ root, runId, sessionId, attemptId: binding.attemptId, host }), { cursor });
 }