great-cto 3.75.4 → 3.75.6

package/board/scripts/lib/cost-meter.mjs

@@ -17,6 +17,7 @@
 import { readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
+import { isMainModule } from './is-main.mjs';
 
 /**
  * Default list prices, USD per 1M tokens.
@@ -281,6 +282,5 @@ function main(argv) {
   process.stdout.write(String(round4(cost)));
 }
 
-import { fileURLToPath } from 'node:url';
-const isMain = process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1];
+const isMain = isMainModule(import.meta.url);
 if (isMain) main(process.argv.slice(2));

package/board/scripts/lib/cross-model-review.mjs

@@ -14,7 +14,6 @@
 //   GREAT_CTO_CROSS_REVIEW_MODEL=google/gemini-2.5-pro node ... --diff -
 
 import { readFileSync, lstatSync, openSync, closeSync, fstatSync, readSync, constants } from 'node:fs';
-import { fileURLToPath } from 'node:url';
 import { execFileSync } from 'node:child_process';
 import { costForUsage, round4, resolvePrice } from './cost-meter.mjs';
 import { resolveSecondOpinion, codexReview } from './second-opinion.mjs';
@@ -22,6 +21,7 @@ import { principalError } from './provider-exhaustion.mjs';
 import { existsSync, appendFileSync, mkdirSync } from 'node:fs';
 import { join, resolve, parse, sep } from 'node:path';
 import { reviewInputBinding, parseLegacyReview } from './review-contract.mjs';
+import { isMainModule } from './is-main.mjs';
 
 /**
  * Exit codes. The first version had two: 0 for PASS and 1 for everything else —
@@ -333,5 +333,5 @@ async function main(argv) {
   process.exit(verdict === 'BLOCK' ? EXIT.BLOCK : EXIT.PASS);
 }
 
-const isMain = process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1];
+const isMain = isMainModule(import.meta.url);
 if (isMain) main(process.argv.slice(2)).catch(e => { console.error('FATAL:', e.message); process.exit(EXIT.SKIPPED); });

package/board/scripts/lib/dag-metric.mjs

@@ -32,6 +32,7 @@
  */
 
 import { createHash } from 'node:crypto';
+import { isMainModule } from './is-main.mjs';
 
 const isLeafScore = (v) => typeof v === 'number' && Number.isFinite(v) && v >= 0 && v <= 1;
 
@@ -292,6 +293,6 @@ async function main(argv) {
   return result.score === null ? 1 : 0;
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (isMainModule(import.meta.url)) {
   main(process.argv.slice(2)).then((c) => { process.exitCode = c; });
 }

package/board/scripts/lib/gate-plan.mjs

@@ -20,13 +20,13 @@
 
 import { execFileSync } from 'node:child_process';
 import { readFileSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
 
 import { classify } from './change-tier.mjs';
 import { selectJudgeModel } from './judge-model.mjs';
 // Generated from the canonical CLI policy, but shipped in Git too: marketplace
 // installs do not contain the gitignored CLI build.
 import { effectiveGates } from './gate-policy.mjs';
+import { isMainModule } from './is-main.mjs';
 
 /** Parse archetype + project_size out of a .great_cto/PROJECT.md body. */
 export function parseProject(text) {
@@ -90,7 +90,7 @@ function readProject() {
   return { archetype: 'greenfield', size: 'medium' };
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (isMainModule(import.meta.url)) {
   const argv = process.argv.slice(2);
   const opt = (name) => { const i = argv.indexOf(name); return i >= 0 ? argv[i + 1] : null; };
   const json = argv.includes('--json');

package/board/scripts/lib/gate-tier.mjs

@@ -41,6 +41,7 @@
  * the machine, costs money, or cannot be undone needs a human in the loop, and
  * "it scored well" is not the same as "a human decided".
  */
+import { isMainModule } from './is-main.mjs';
 export const CLASS_A = Object.freeze(['devops', 'infra-provisioner']);
 
 /** The run shape a tier decision may be based on. Anything else is not evidence. */
@@ -243,7 +244,7 @@ export async function notifyOnlyForProject(cwd = process.cwd()) {
 // Prints who qualifies and, for everyone else, the specific reason — because
 // "inconclusive" and "fixture-inlined" are different work.
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (isMainModule(import.meta.url)) {
   const { readFileSync, existsSync } = await import('node:fs');
   const { join, dirname } = await import('node:path');
   const { fileURLToPath } = await import('node:url');

package/board/scripts/lib/is-main.mjs

@@ -0,0 +1,24 @@
+// scripts/lib/is-main.mjs — was this module started as the program, or imported?
+//
+// great_cto-hu2l. The scripts used to answer that by comparing process.argv[1]
+// with import.meta.url as strings. Node resolves the module URL through
+// symlinks and leaves argv[1] as typed, so the two disagree whenever the path
+// crosses a link: macOS /var → /private/var and /tmp → /private/tmp, a
+// symlinked home, the plugin cache links under ~/.claude/plugins/cache. The CLI
+// then ran nothing and exited 0, and a caller that checks only the exit code
+// took that for success.
+//
+// Both sides go through realpath. A path that cannot be resolved is not this
+// module, so a failed realpath answers false instead of guessing from strings.
+// tests/main-guard-scan.test.mjs refuses a new guard that skips this.
+import { realpathSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+export function isMainModule(importMetaUrl, argv1 = process.argv[1]) {
+  if (!argv1 || !importMetaUrl) return false;
+  try {
+    return realpathSync(argv1) === realpathSync(fileURLToPath(importMetaUrl));
+  } catch {
+    return false;
+  }
+}

package/board/scripts/lib/judge-model.mjs

@@ -11,6 +11,7 @@
 //
 // Pairs with change-tier.mjs (the tier) + gate-plan.mjs (per-change plan) + ADR-004.
 
+import { isMainModule } from './is-main.mjs';
 export const DEFAULT_FRONTIER_JUDGE = 'claude-opus-5';
 export const DEFAULT_CHEAP_JUDGE = 'claude-haiku-4-5';
 
@@ -36,7 +37,7 @@ export function selectJudgeModel(changeTier, opts = {}) {
 }
 
 // CLI: node scripts/lib/judge-model.mjs T1  → prints the model + reason
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (isMainModule(import.meta.url)) {
   const r = selectJudgeModel(process.argv[2]);
   process.stdout.write(`${r.tier}  model=${r.model}  human=${r.human}\n  ${r.reason}\n`);
 }

package/board/scripts/lib/pipeline-health.mjs

@@ -21,6 +21,7 @@ import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import os from 'node:os';
+import { isMainModule } from './is-main.mjs';
 
 const REPO = join(dirname(fileURLToPath(import.meta.url)), '..', '..');
 
@@ -105,7 +106,7 @@ export function auditPipelineHealth({ registry = join(os.homedir(), '.great_cto'
 //
 //   node scripts/lib/pipeline-health.mjs [--strict] [--json]
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (isMainModule(import.meta.url)) {
   const r = auditPipelineHealth();
   if (process.argv.includes('--json')) {
     console.log(JSON.stringify(r, null, 2));

package/board/scripts/lib/receipt.mjs

@@ -30,7 +30,8 @@ import { createHash } from 'node:crypto';
 import { readFileSync } from 'node:fs';
 import * as fsModule from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
+import { isMainModule } from './is-main.mjs';
+import { checkVerdictSeal, checkAcceptanceSeal, sealAcceptance, loadSealKey } from './verdict-seal.mjs';
 
 const sha = (s) => createHash('sha256').update(String(s)).digest('hex');
 
@@ -196,6 +197,12 @@ export function treeReceipt(cwd = process.cwd(), { base = null, maxFiles = MAX_F
   }
   const changedOutput = git(['diff', '--name-only', '--diff-filter=d', ref, '--', ':/', ...pathspecExclude], cwd);
   if (changedOutput === null) return null;
+  // Deletions, kept apart: a file deleted after an approval changes what ships, and
+  // the file map — which holds content digests — cannot hold a file that is gone.
+  const deletedOutput = git(['diff', '--name-only', '--diff-filter=D', ref, '--', ':/', ...pathspecExclude], cwd);
+  if (deletedOutput === null) return null;
+  const allDeleted = deletedOutput.split('\n').map((x) => x.trim()).filter(Boolean).sort();
+  const deleted = allDeleted.slice(0, maxFiles);
   const names = [
     ...changedOutput
       .split('\n').map((s) => s.trim()).filter(Boolean),
@@ -213,7 +220,9 @@ export function treeReceipt(cwd = process.cwd(), { base = null, maxFiles = MAX_F
     files[p] = blob;
   }
 
-  return { head, dirty, base: ref, base_from: baseFrom, files, ...(truncated ? { truncated: true } : {}) };
+  // A cut deletion list is a partial receipt like a cut file map: say so.
+  if (allDeleted.length > maxFiles) truncated = true;
+  return { head, dirty, base: ref, base_from: baseFrom, files, deleted, ...(truncated ? { truncated: true } : {}) };
 }
 
 /**
@@ -289,6 +298,33 @@ export function mergeBase(cwd) {
  * whose receipt matched, and collapsing them is the defect this whole ladder
  * exists to remove.
  */
+// Inside .great_cto/, only what DECIDES behaviour is compared: PROJECT.md (project_size
+// and the tier, which decide the stages a deploy checks), exceptions/ (signed
+// overrides), configuration files (*.toml, *.yml — security-allowlist.yml is one),
+// security-signals.log (it raises the tier from baseline), slo-budget-current.md
+// (an exhausted budget blocks a deploy) and env.sh (sourced into the deploy shell).
+// Deleting or editing any of them after an approval is drift.
+// Everything else there is what the pipeline writes while it runs — verdicts, logs,
+// lessons, the review marker, handoffs, an acceptance — and in a project that does
+// not gitignore .great_cto/ (init does not) each of those, written AFTER an approval,
+// made the approval drift from itself, so a deploy could never pass.
+//
+// A list of what counts, not of what to ignore. The first fix listed the writers and
+// missed three (review-marker.json, .last-auto-learn, the learner's file); the writers grow
+// with every hook, the configuration does not.
+const COUNTED_STATE = /^(PROJECT\.md|exceptions(\/|$)|security-signals\.log$|slo-budget-current\.md$|env\.sh$|[^/]+\.(toml|ya?ml)$)/;
+export function isPipelineOutput(p) {
+  if (!p.startsWith('.great_cto/')) return false;
+  return !COUNTED_STATE.test(p.slice('.great_cto/'.length));
+}
+/** The top-level entries of .great_cto/ that are pipeline output, as paths to exclude. */
+export function pipelineOutputPaths(cwd) {
+  let names;
+  try { names = requireFs().readdirSync(join(cwd, '.great_cto')); } catch { return []; }
+  return names.filter((n) => !n.includes(':') && isPipelineOutput(`.great_cto/${n}`)).map((n) => `.great_cto/${n}`);
+}
+const codeOnly = (files) => Object.fromEntries(Object.entries(files || {}).filter(([p]) => !isPipelineOutput(p)));
+
 export function compareReceipts(recorded, current, { digest = null, cwd = process.cwd() } = {}) {
   if (!recorded) return { state: 'no-receipt', why: 'the approving verdict carries no receipt — nothing to compare against' };
   if (!current) return { state: 'unreadable', why: 'the current tree state could not be read' };
@@ -297,8 +333,8 @@ export function compareReceipts(recorded, current, { digest = null, cwd = proces
   const added = [];
   const removed = [];
   const landed = [];
-  const before = recorded.files || {};
-  const now = current.files || {};
+  const before = codeOnly(recorded.files);
+  const now = codeOnly(current.files);
   // Falling out of the CHANGE SET is not the same as being deleted.
   //
   // The file map is the diff against the merge-base, so the moment a reviewed
@@ -321,6 +357,12 @@ export function compareReceipts(recorded, current, { digest = null, cwd = proces
     else changed.push(p);                        // still here, and edited
   }
   for (const p of Object.keys(now)) if (!(p in before)) added.push(p);
+  // Deleted since the approval. Only when the recorded receipt says what was deleted
+  // then; one from before this field cannot tell a new deletion from the change's own.
+  if (Array.isArray(recorded.deleted)) {
+    const was = new Set(recorded.deleted);
+    for (const p of current.deleted || []) if (!was.has(p) && !isPipelineOutput(p) && !removed.includes(p)) removed.push(p);
+  }
 
   // A file the review covered, edited since. This is the finding; the rest is
   // context. `added` in particular is usually ordinary work continuing, not a
@@ -386,6 +428,9 @@ export function latestApproval(cwd = process.cwd(), { agents = APPROVING_AGENTS,
       try { rec = JSON.parse(line); } catch { continue; }
       if (!APPROVING_VERDICTS.has(String(rec.verdict || '').toUpperCase())) continue;
       if (!rec.receipt?.head) continue;
+      // A line belongs to the log it sits in. A code-reviewer line copied into
+      // qa-engineer.log carries a valid seal, for the wrong stage (review of 3.75.6).
+      if (rec.agent !== agent) continue;
       if (!best || String(rec.ts) > String(best.ts)) best = rec;
     }
   }
@@ -426,11 +471,13 @@ export function receiptHash(receipt) {
  * Single-use by design: an acceptance authorises ONE push. An acceptance that
  * outlives its push is a standing permission, and nobody asked for one.
  */
-export function writeAcceptance(cwd, { hash, why = '', at = Date.now() } = {}) {
+export function writeAcceptance(cwd, { hash, why = '', at = Date.now(), agent = null, seal = sealAcceptance } = {}) {
   const { writeFileSync, mkdirSync } = requireFs();
   mkdirSync(join(cwd, '.great_cto'), { recursive: true });
-  writeFileSync(join(cwd, ACCEPT_PATH), JSON.stringify({ hash, why, at }) + '\n');
-  return { hash, why, at };
+  const rec = { hash, why, at, ...(agent ? { agent } : {}) };
+  const s = seal ? seal(rec) : null;
+  writeFileSync(join(cwd, ACCEPT_PATH), JSON.stringify({ ...rec, ...(s ? { seal: s } : {}) }) + '\n');
+  return { hash, why, at, agent };
 }
 
 /**
@@ -440,7 +487,7 @@ export function writeAcceptance(cwd, { hash, why = '', at = Date.now() } = {}) {
  * state" and "valid" are different situations, and the third is the one worth
  * naming out loud: it means the tree moved after a human looked at it.
  */
-export function readAcceptance(cwd, currentHash) {
+export function readAcceptance(cwd, currentHash, { agent = null } = {}) {
   const { readFileSync } = requireFs();
   let raw;
   try { raw = readFileSync(join(cwd, ACCEPT_PATH), 'utf8'); }
@@ -451,10 +498,25 @@ export function readAcceptance(cwd, currentHash) {
   catch { return { valid: false, unreadable: true, why: 'the acceptance record could not be parsed' }; }
 
   if (!rec?.hash) return { valid: false, unreadable: true, why: 'the acceptance record names no state' };
+  // great_cto-dv3b: an acceptance not written by `--accept` is not one. A hand-
+  // written file carrying the right hash read as "accepted by the operator".
+  const sealed = checkAcceptanceSeal(rec);
+  if (sealed !== 'valid') {
+    return { valid: false, stale: true, rec,
+      why: sealed === 'unsealed' ? 'the acceptance carries no seal — it was not written by receipt.mjs --accept'
+        : sealed === 'invalid' ? 'the acceptance seal does not match — the file was written or edited outside receipt.mjs --accept'
+        : 'the acceptance cannot be checked on this machine (no seal key)' };
+  }
   if (rec.hash !== currentHash) {
     return { valid: false, stale: true, rec,
       why: 'the acceptance names a different state — the tree changed after it was accepted' };
   }
+  // An acceptance given while looking at one stage's drift does not cover another's:
+  // the operator saw code-reviewer's files, not qa-engineer's.
+  if (agent && rec.agent !== agent) {
+    return { valid: false, stale: true, rec,
+      why: `the acceptance was given for ${rec.agent || 'the whole tree'}, not for ${agent} — accept ${agent}'s drift separately` };
+  }
   return { valid: true, rec, why: `accepted at ${new Date(rec.at).toISOString()}` };
 }
 
@@ -475,6 +537,12 @@ function requireFs() {
 // `--emit`   prints a receipt for the current tree (used by log-verdict.sh).
 // `--check <file>`  compares a recorded receipt held in a file.
 // `--verify` compares the newest approving verdict's receipt against now.
+//    `--agent <name>` narrows it to one approving stage. The newest approval of
+//    any stage is the wrong question before a deploy: a review of today's tree
+//    must not stand in for a QA pass on yesterday's.
+//    `--require` is the deploy question: "no approval carries a receipt" exits 3,
+//    not 0, and files ADDED since the approval count as drift. Before a push they
+//    are work continuing; before a deploy they are code nobody reviewed, shipping.
 
 function currentForReceipt(cwd, receipt) {
   // Persisted evidence is data, not Git options or a new revision expression.
@@ -487,10 +555,13 @@ function currentForReceipt(cwd, receipt) {
     base = receipt.head;
   }
   if (base != null && (typeof base !== 'string' || !/^[0-9a-f]{7,64}$/i.test(base))) return null;
-  return treeReceipt(cwd, { base: base || null });
+  // Without the pipeline's own state: an approval, an acceptance and a verdict all
+  // write under .great_cto/, and in a project that does not ignore it each write
+  // would change the state it is about (an acceptance voiding itself on write).
+  return treeReceipt(cwd, { base: base || null, exclude: pipelineOutputPaths(cwd) });
 }
 
-if (process.argv[1] && fileURLToPath(import.meta.url) === resolve(process.argv[1])) {
+if (isMainModule(import.meta.url)) {
   const argv = process.argv.slice(2);
   if (argv.includes('--state-dir')) {
     console.log(verdictStateDir());
@@ -510,27 +581,63 @@ if (process.argv[1] && fileURLToPath(import.meta.url) === resolve(process.argv[1
     process.stdout.write(r ? JSON.stringify(r) : '');
     process.exit(r ? 0 : 1);
   }
+  const agentsArg = () => {
+    const i = argv.indexOf('--agent');
+    if (i < 0) return APPROVING_AGENTS;
+    const name = argv[i + 1];
+    if (!APPROVING_AGENTS.includes(name)) {
+      console.error(`receipt: --agent must be one of ${APPROVING_AGENTS.join(', ')}, got ${name}`);
+      process.exit(2);
+    }
+    return [name];
+  };
   if (argv.includes('--verify')) {
     const cwd = process.cwd();
-    const approval = latestApproval(cwd);
+    const agents = agentsArg();
+    const approval = latestApproval(cwd, { agents });
     const current = currentForReceipt(cwd, approval?.receipt);
     const cmp = compareReceipts(approval?.receipt ?? null, current);
     if (cmp.state === 'no-receipt') {
       // Not silence. A push with no approval to compare against and a push whose
       // receipt matched are different facts, and only one of them is evidence.
-      console.log('receipt: no approving verdict carries a receipt — nothing was verified');
-      process.exit(0);
+      const whom = agents.length === 1 ? `${agents[0]} verdict` : 'verdict';
+      console.log(`receipt: no approving ${whom} carries a receipt — nothing was verified`);
+      process.exit(argv.includes('--require') ? 3 : 0);
     }
     const who = approval ? `${approval.agent} ${approval.verdict} at ${approval.ts}` : 'an approval';
     console.log(`receipt: against ${who}`);
     console.log(describeDrift(cmp).split('\n').map((l) => `  ${l}`).join('\n'));
 
     if (cmp.state === 'unreadable') process.exit(2);
-    if (cmp.state !== 'differs') process.exit(0);
+    const requireMode = argv.includes('--require');
+    // great_cto-dv3b: the deploy question trusts only a sealed approval. A newest
+    // line whose seal does not match was written or edited outside log-verdict.sh:
+    // exit 4, a block. One with no seal (older than 3.75.6, or a machine without the
+    // key) is not verified: exit 3, said, never passed as verified.
+    if (requireMode) {
+      const sealed = checkVerdictSeal(approval);
+      if (sealed === 'invalid') {
+        console.log(`  the ${approval.agent} approval's seal does not match — the line was written or edited outside log-verdict.sh`);
+        process.exit(4);
+      }
+      if (sealed !== 'valid') {
+        console.log(`  the ${approval.agent} approval is ${sealed === 'unsealed' ? 'not sealed (written before 3.75.6, or not by log-verdict.sh)' : 'not checkable here (no seal key on this machine)'} — freshness not verified`);
+        process.exit(3);
+      }
+    }
+    // A receipt capped at MAX_FILES lists only part of the change, so a file past
+    // the cap could change unseen. For the deploy question that is not a match.
+    if (requireMode && (approval?.receipt?.truncated || current?.truncated)) {
+      console.log(`  the receipt lists only the first ${MAX_FILES} files of this change — a match cannot be shown; re-run the stage on a smaller change`);
+      process.exit(2);
+    }
+    const drifted = cmp.state === 'differs' || (cmp.state === 'extended' && requireMode);
+    if (!drifted) process.exit(0);
 
     // Drift, but a human may already have looked at exactly this state.
     const hash = receiptHash(current);
-    const acc = readAcceptance(cwd, hash);
+    const narrowed = agents.length === 1 ? agents[0] : null;
+    const acc = readAcceptance(cwd, hash, { agent: narrowed });
     if (acc.valid) {
       console.log(`  accepted by the operator for this exact state (${acc.why})`);
       // Consumed here rather than by the caller: whoever asked the question is
@@ -540,7 +647,7 @@ if (process.argv[1] && fileURLToPath(import.meta.url) === resolve(process.argv[1
       process.exit(0);
     }
     if (acc.stale) console.log(`  ${acc.why} — accept again if this state is fine`);
-    console.log(`  to accept this state: node scripts/lib/receipt.mjs --accept`);
+    console.log(`  to accept this state: node scripts/lib/receipt.mjs --accept${narrowed ? ` --agent ${narrowed}` : ''}${requireMode ? ' --require' : ''}`);
     process.exit(1);
   }
 
@@ -553,14 +660,21 @@ if (process.argv[1] && fileURLToPath(import.meta.url) === resolve(process.argv[1
   // behaviour — an agent asked to approve its own work will comply.
   if (argv.includes('--accept')) {
     const cwd = process.cwd();
-    const approval = latestApproval(cwd);
+    const approval = latestApproval(cwd, { agents: agentsArg() });
     const current = currentForReceipt(cwd, approval?.receipt);
     const cmp = compareReceipts(approval?.receipt ?? null, current);
     if (cmp.state === 'unreadable') {
       console.error(`receipt: cannot accept — ${cmp.why}`);
       process.exit(2);
     }
-    if (cmp.state !== 'differs') {
+    const requireMode = argv.includes('--require');
+    if (requireMode && (approval?.receipt?.truncated || current?.truncated)) {
+      console.error(`receipt: cannot accept — the receipt lists only the first ${MAX_FILES} files; what you would accept is not all on screen`);
+      process.exit(2);
+    }
+    // Under --require an added file is drift, so it must be acceptable too —
+    // otherwise verify says "accept it" and accept says "nothing to accept".
+    if (!(cmp.state === 'differs' || (cmp.state === 'extended' && requireMode))) {
       console.log(`receipt: nothing to accept — ${cmp.why}`);
       process.exit(0);
     }
@@ -568,6 +682,9 @@ if (process.argv[1] && fileURLToPath(import.meta.url) === resolve(process.argv[1
     const hash = receiptHash(current);
     console.log(`\nstate: ${hash.slice(0, 16)}…`);
 
+    // The acceptance must be sealable before a human is asked to confirm it.
+    try { if (!loadSealKey({ create: true })) throw new Error('no usable seal key'); }
+    catch (e) { console.error(`\nreceipt: cannot record an acceptance — ${e.message}`); process.exit(2); }
     if (!process.stdin.isTTY) {
       console.error('\nreceipt: --accept needs a terminal. Run it yourself, in your own shell —');
       console.error('an acceptance from inside an agent session is the agent approving its own work.');
@@ -578,7 +695,9 @@ if (process.argv[1] && fileURLToPath(import.meta.url) === resolve(process.argv[1
     const answer = await new Promise((res) => rl.question('\nShip this state anyway? [y/N] ', (a) => { rl.close(); res(a); }));
     if (!/^y(es)?$/i.test(answer.trim())) { console.log('not accepted — nothing recorded.'); process.exit(1); }
 
-    writeAcceptance(cwd, { hash, why: `drift accepted over ${cmp.changed.length} changed file(s)` });
+    const stage = argv.includes('--agent') ? argv[argv.indexOf('--agent') + 1] : null;
+    writeAcceptance(cwd, { hash, agent: stage,
+      why: `drift accepted over ${cmp.changed.length} changed and ${cmp.added.length} added file(s)${stage ? ` for ${stage}` : ''}` });
     console.log('accepted. This authorises ONE push of this exact state; any further edit voids it.');
     process.exit(0);
   }

package/board/scripts/lib/second-opinion.mjs

@@ -33,6 +33,7 @@
  */
 
 import { pendingQuestion, evaluateDag, parseAnswer } from './dag-metric.mjs';
+import { isMainModule } from './is-main.mjs';
 
 export const DIVERGENCE = Object.freeze({
   AGREE: 'agree',
@@ -240,7 +241,7 @@ async function main(argv) {
   return cmp.diverged.length ? 1 : 0;
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (isMainModule(import.meta.url)) {
   main(process.argv.slice(2)).then((c) => { process.exitCode = c; });
 }
 

package/board/scripts/lib/session-usage.mjs

@@ -39,6 +39,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { createHash } from 'node:crypto';
 import { priceUsage, effectivePrices } from './cost-meter.mjs';
+import { isMainModule } from './is-main.mjs';
 
 const INDEX_VERSION = 3;          // 2: hourly buckets, limit kinds, Codex limit series · 3: hook blocks, errors, timeouts
 const RING = 256;                 // recent response ids remembered across reads
@@ -1067,7 +1068,7 @@ export function usageIndexSnapshot({ scan = () => scanUsage(), ttlMs = 60 * 1000
 }
 
 // CLI: node scripts/lib/session-usage.mjs [--days N] [--json]
-const isMain = process.argv[1] && path.resolve(process.argv[1]) === path.resolve(new URL(import.meta.url).pathname);
+const isMain = isMainModule(import.meta.url);
 if (isMain) {
   const i = process.argv.indexOf('--days');
   const days = i > -1 ? Number(process.argv[i + 1]) : 30;

package/board/scripts/lib/stack-capabilities.mjs

@@ -35,6 +35,8 @@
  * "there is none" stops looking for something that exists.
  */
 
+import { isMainModule } from './is-main.mjs';
+
 /** The closed vocabulary. Adding one is a deliberate edit, not a free-text key. */
 export const CAPABILITIES = Object.freeze([
   'logs',      // where log lines are searched
@@ -141,7 +143,7 @@ export function describeCapabilities({ map, declaredCount, unknownKeys }) {
 // Exit 0 always. A project with nothing declared is a fact to report, not an
 // error to fail on — failing here would make an unconfigured project unable to
 // run an incident, which is exactly when you need the agent most.
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (isMainModule(import.meta.url)) {
   const { readFileSync } = await import('node:fs');
   const { join } = await import('node:path');
   const args = process.argv.slice(2);

package/board/scripts/lib/stand-down.mjs

@@ -26,6 +26,7 @@
 
 import { openSync, writeSync, fsyncSync, closeSync, readFileSync, existsSync, mkdirSync } from 'node:fs';
 import { join, dirname } from 'node:path';
+import { isMainModule } from './is-main.mjs';
 
 export const STAND_DOWN_PATH = join('.great_cto', 'stand-downs.jsonl');
 
@@ -123,7 +124,7 @@ export function readStandDowns(cwd, { limit = 0 } = {}) {
 // board's inbox answers for gates that waited, and nothing answered for gates
 // that did not.
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (isMainModule(import.meta.url)) {
   const argv = process.argv.slice(2);
   const li = argv.indexOf('--limit');
   const limit = li !== -1 ? Number(argv[li + 1]) : 0;

package/board/scripts/lib/system-map.mjs

@@ -26,6 +26,7 @@
 
 import { readdirSync, readFileSync, statSync, existsSync } from 'node:fs';
 import { join, relative, sep } from 'node:path';
+import { isMainModule } from './is-main.mjs';
 
 /**
  * The groups a great_cto project is built from, and what each one is.
@@ -191,7 +192,7 @@ export function pipelineMermaid(tomlText) {
 
 // ── CLI ─────────────────────────────────────────────────────────────────────
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (isMainModule(import.meta.url)) {
   const map = systemMap(process.cwd());
   if (process.argv.includes('--json')) {
     console.log(JSON.stringify(map, null, 2));

package/board/scripts/lib/verdict-record.mjs

@@ -28,6 +28,7 @@
  * Writing is strict: everything new is v1 NDJSON.
  */
 
+import { isMainModule } from './is-main.mjs';
 export const VERDICT_FORMAT_VERSION = 1;
 
 /** Verdict values with a defined meaning. Anything else is kept but flagged. */
@@ -93,6 +94,7 @@ export function validateVerdict(rec) {
   if ('meta' in rec && (typeof rec.meta !== 'object' || rec.meta === null || Array.isArray(rec.meta))) {
     errors.push('meta must be an object');
   }
+  if ('seal' in rec && (typeof rec.seal !== 'string' || !/^v1:[0-9a-f]{64}$/.test(rec.seal))) errors.push('seal must be v1:<64 hex>');
   return { valid: errors.length === 0, errors };
 }
 
@@ -265,7 +267,7 @@ async function main(argv) {
       if (i > 0) meta[kv.slice(0, i)] = kv.slice(i + 1);
     }
     try {
-      process.stdout.write(formatVerdict(makeVerdict({
+      const rec = makeVerdict({
         ts: process.env.TS,
         agent: process.env.AGENT,
         verdict: process.env.VERDICT,
@@ -273,7 +275,17 @@ async function main(argv) {
         cost_usd: process.env.COST === '' || process.env.COST === undefined ? undefined : Number(process.env.COST),
         meta,
         receipt: parseReceiptEnv(process.env.RECEIPT),
-      })) + '\n');
+      });
+      // great_cto-dv3b: the writer seals what it writes; a line written any other
+      // way reads as unsealed or invalid to a deploy. A seal that cannot be made
+      // (no writable home) leaves the line unsealed, said on stderr — not unwritten.
+      try {
+        const { sealVerdict } = await import('./verdict-seal.mjs');
+        const seal = sealVerdict(rec);
+        if (seal) rec.seal = seal;
+        else console.error('verdict-record: verdict not sealed (no usable seal key) — a deploy will read it as not verified');
+      } catch (e) { console.error(`verdict-record: verdict not sealed (${e.message})`); }
+      process.stdout.write(formatVerdict(rec) + '\n');
       return 0;
     } catch (e) {
       console.error(`verdict-record: ${e.message}`);
@@ -304,6 +316,6 @@ async function main(argv) {
   return argv.includes('--strict') && bad ? 1 : 0;
 }
 
-if (import.meta.url === `file://${process.argv[1]}`) {
+if (isMainModule(import.meta.url)) {
   main(process.argv.slice(2)).then((c) => { process.exitCode = c; });
 }