gsd-pi 2.45.0-dev.fdcf73c → 2.46.0-dev.cc9d310

package/src/resources/extensions/gsd/tools/plan-slice.ts

@@ -1,6 +1,7 @@
 import { clearParseCache } from "../files.js";
 import {
   transaction,
+  getMilestone,
   getSlice,
   insertTask,
   upsertSlicePlanning,
@@ -9,6 +10,9 @@ import {
 } from "../gsd-db.js";
 import { invalidateStateCache } from "../state.js";
 import { renderPlanFromDb } from "../markdown-renderer.js";
+import { renderAllProjections } from "../workflow-projections.js";
+import { writeManifest } from "../workflow-manifest.js";
+import { appendEvent } from "../workflow-events.js";
 
 export interface PlanSliceTaskInput {
   taskId: string;
@@ -32,6 +36,10 @@ export interface PlanSliceParams {
   integrationClosure: string;
   observabilityImpact: string;
   tasks: PlanSliceTaskInput[];
+  /** Optional caller-provided identity for audit trail */
+  actorName?: string;
+  /** Optional caller-provided reason this action was triggered */
+  triggerReason?: string;
 }
 
 export interface PlanSliceResult {
@@ -136,10 +144,21 @@ export async function handlePlanSlice(
     return { error: `validation failed: ${(err as Error).message}` };
   }
 
+  const parentMilestone = getMilestone(params.milestoneId);
+  if (!parentMilestone) {
+    return { error: `milestone not found: ${params.milestoneId}` };
+  }
+  if (parentMilestone.status === "complete" || parentMilestone.status === "done") {
+    return { error: `cannot plan slice in a closed milestone: ${params.milestoneId} (status: ${parentMilestone.status})` };
+  }
+
   const parentSlice = getSlice(params.milestoneId, params.sliceId);
   if (!parentSlice) {
     return { error: `missing parent slice: ${params.milestoneId}/${params.sliceId}` };
   }
+  if (parentSlice.status === "complete" || parentSlice.status === "done") {
+    return { error: `cannot re-plan slice ${params.sliceId}: it is already complete — use gsd_slice_reopen first` };
+  }
 
   try {
     transaction(() => {
@@ -180,6 +199,25 @@ export async function handlePlanSlice(
     const renderResult = await renderPlanFromDb(basePath, params.milestoneId, params.sliceId);
     invalidateStateCache();
     clearParseCache();
+
+    // ── Post-mutation hook: projections, manifest, event log ─────────────
+    try {
+      await renderAllProjections(basePath, params.milestoneId);
+      writeManifest(basePath);
+      appendEvent(basePath, {
+        cmd: "plan-slice",
+        params: { milestoneId: params.milestoneId, sliceId: params.sliceId },
+        ts: new Date().toISOString(),
+        actor: "agent",
+        actor_name: params.actorName,
+        trigger_reason: params.triggerReason,
+      });
+    } catch (hookErr) {
+      process.stderr.write(
+        `gsd: plan-slice post-mutation hook warning: ${(hookErr as Error).message}\n`,
+      );
+    }
+
     return {
       milestoneId: params.milestoneId,
       sliceId: params.sliceId,

package/src/resources/extensions/gsd/tools/plan-task.ts

@@ -2,6 +2,9 @@ import { clearParseCache } from "../files.js";
 import { transaction, getSlice, getTask, insertTask, upsertTaskPlanning } from "../gsd-db.js";
 import { invalidateStateCache } from "../state.js";
 import { renderTaskPlanFromDb } from "../markdown-renderer.js";
+import { renderAllProjections } from "../workflow-projections.js";
+import { writeManifest } from "../workflow-manifest.js";
+import { appendEvent } from "../workflow-events.js";
 
 export interface PlanTaskParams {
   milestoneId: string;
@@ -16,6 +19,10 @@ export interface PlanTaskParams {
   expectedOutput: string[];
   observabilityImpact?: string;
   fullPlanMd?: string;
+  /** Optional caller-provided identity for audit trail */
+  actorName?: string;
+  /** Optional caller-provided reason this action was triggered */
+  triggerReason?: string;
 }
 
 export interface PlanTaskResult {
@@ -74,10 +81,18 @@ export async function handlePlanTask(
   if (!parentSlice) {
     return { error: `missing parent slice: ${params.milestoneId}/${params.sliceId}` };
   }
+  if (parentSlice.status === "complete" || parentSlice.status === "done") {
+    return { error: `cannot plan task in a closed slice: ${params.sliceId} (status: ${parentSlice.status})` };
+  }
+
+  const existingTask = getTask(params.milestoneId, params.sliceId, params.taskId);
+  if (existingTask && (existingTask.status === "complete" || existingTask.status === "done")) {
+    return { error: `cannot re-plan task ${params.taskId}: it is already complete — use gsd_task_reopen first` };
+  }
 
   try {
     transaction(() => {
-      if (!getTask(params.milestoneId, params.sliceId, params.taskId)) {
+      if (!existingTask) {
         insertTask({
           id: params.taskId,
           sliceId: params.sliceId,
@@ -106,6 +121,25 @@ export async function handlePlanTask(
     const renderResult = await renderTaskPlanFromDb(basePath, params.milestoneId, params.sliceId, params.taskId);
     invalidateStateCache();
     clearParseCache();
+
+    // ── Post-mutation hook: projections, manifest, event log ─────────────
+    try {
+      await renderAllProjections(basePath, params.milestoneId);
+      writeManifest(basePath);
+      appendEvent(basePath, {
+        cmd: "plan-task",
+        params: { milestoneId: params.milestoneId, sliceId: params.sliceId, taskId: params.taskId },
+        ts: new Date().toISOString(),
+        actor: "agent",
+        actor_name: params.actorName,
+        trigger_reason: params.triggerReason,
+      });
+    } catch (hookErr) {
+      process.stderr.write(
+        `gsd: plan-task post-mutation hook warning: ${(hookErr as Error).message}\n`,
+      );
+    }
+
     return {
       milestoneId: params.milestoneId,
       sliceId: params.sliceId,

package/src/resources/extensions/gsd/tools/reassess-roadmap.ts

@@ -3,6 +3,7 @@ import {
   transaction,
   getMilestone,
   getMilestoneSlices,
+  getSlice,
   insertSlice,
   updateSliceFields,
   insertAssessment,
@@ -10,6 +11,9 @@ import {
 } from "../gsd-db.js";
 import { invalidateStateCache } from "../state.js";
 import { renderRoadmapFromDb, renderAssessmentFromDb } from "../markdown-renderer.js";
+import { renderAllProjections } from "../workflow-projections.js";
+import { writeManifest } from "../workflow-manifest.js";
+import { appendEvent } from "../workflow-events.js";
 import { join } from "node:path";
 
 export interface SliceChangeInput {
@@ -30,6 +34,10 @@ export interface ReassessRoadmapParams {
     added: SliceChangeInput[];
     removed: string[];
   };
+  /** Optional caller-provided identity for audit trail */
+  actorName?: string;
+  /** Optional caller-provided reason this action was triggered */
+  triggerReason?: string;
 }
 
 export interface ReassessRoadmapResult {
@@ -96,11 +104,23 @@ export async function handleReassessRoadmap(
     return { error: `validation failed: ${(err as Error).message}` };
   }
 
-  // ── Verify milestone exists ───────────────────────────────────────
+  // ── Verify milestone exists and is active ────────────────────────
   const milestone = getMilestone(params.milestoneId);
   if (!milestone) {
     return { error: `milestone not found: ${params.milestoneId}` };
   }
+  if (milestone.status === "complete" || milestone.status === "done") {
+    return { error: `cannot reassess a closed milestone: ${params.milestoneId} (status: ${milestone.status})` };
+  }
+
+  // ── Verify completedSliceId is actually complete ──────────────────
+  const completedSlice = getSlice(params.milestoneId, params.completedSliceId);
+  if (!completedSlice) {
+    return { error: `completedSliceId not found: ${params.milestoneId}/${params.completedSliceId}` };
+  }
+  if (completedSlice.status !== "complete" && completedSlice.status !== "done") {
+    return { error: `completedSliceId ${params.completedSliceId} is not complete (status: ${completedSlice.status}) — reassess can only be called after a slice finishes` };
+  }
 
   // ── Structural enforcement ────────────────────────────────────────
   const existingSlices = getMilestoneSlices(params.milestoneId);
@@ -191,6 +211,24 @@ export async function handleReassessRoadmap(
     invalidateStateCache();
     clearParseCache();
 
+    // ── Post-mutation hook: projections, manifest, event log ─────
+    try {
+      await renderAllProjections(basePath, params.milestoneId);
+      writeManifest(basePath);
+      appendEvent(basePath, {
+        cmd: "reassess-roadmap",
+        params: { milestoneId: params.milestoneId, completedSliceId: params.completedSliceId },
+        ts: new Date().toISOString(),
+        actor: "agent",
+        actor_name: params.actorName,
+        trigger_reason: params.triggerReason,
+      });
+    } catch (hookErr) {
+      process.stderr.write(
+        `gsd: reassess-roadmap post-mutation hook warning: ${(hookErr as Error).message}\n`,
+      );
+    }
+
     return {
       milestoneId: params.milestoneId,
       completedSliceId: params.completedSliceId,

package/src/resources/extensions/gsd/tools/reopen-slice.ts

@@ -0,0 +1,125 @@
+/**
+ * reopen-slice handler — the core operation behind gsd_slice_reopen.
+ *
+ * Resets a completed slice back to "in_progress" and resets ALL of its
+ * tasks back to "pending". This is intentional — if you're reopening a
+ * slice, you're re-doing the work. Partial resets create ambiguous state.
+ *
+ * The parent milestone must still be open (not complete).
+ */
+
+// GSD — reopen-slice tool handler
+// Copyright (c) 2026 Jeremy McSpadden <jeremy@fluxlabs.net>
+
+import {
+  getMilestone,
+  getSlice,
+  getSliceTasks,
+  updateSliceStatus,
+  updateTaskStatus,
+  transaction,
+} from "../gsd-db.js";
+import { invalidateStateCache } from "../state.js";
+import { renderAllProjections } from "../workflow-projections.js";
+import { writeManifest } from "../workflow-manifest.js";
+import { appendEvent } from "../workflow-events.js";
+
+export interface ReopenSliceParams {
+  milestoneId: string;
+  sliceId: string;
+  reason?: string;
+  /** Optional caller-provided identity for audit trail */
+  actorName?: string;
+  /** Optional caller-provided reason this action was triggered */
+  triggerReason?: string;
+}
+
+export interface ReopenSliceResult {
+  milestoneId: string;
+  sliceId: string;
+  tasksReset: number;
+}
+
+export async function handleReopenSlice(
+  params: ReopenSliceParams,
+  basePath: string,
+): Promise<ReopenSliceResult | { error: string }> {
+  // ── Validate required fields ────────────────────────────────────────────
+  if (!params.sliceId || typeof params.sliceId !== "string" || params.sliceId.trim() === "") {
+    return { error: "sliceId is required and must be a non-empty string" };
+  }
+  if (!params.milestoneId || typeof params.milestoneId !== "string" || params.milestoneId.trim() === "") {
+    return { error: "milestoneId is required and must be a non-empty string" };
+  }
+
+  // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
+  let guardError: string | null = null;
+  let tasksResetCount = 0;
+
+  transaction(() => {
+    const milestone = getMilestone(params.milestoneId);
+    if (!milestone) {
+      guardError = `milestone not found: ${params.milestoneId}`;
+      return;
+    }
+    if (milestone.status === "complete" || milestone.status === "done") {
+      guardError = `cannot reopen slice inside a closed milestone: ${params.milestoneId} (status: ${milestone.status})`;
+      return;
+    }
+
+    const slice = getSlice(params.milestoneId, params.sliceId);
+    if (!slice) {
+      guardError = `slice not found: ${params.milestoneId}/${params.sliceId}`;
+      return;
+    }
+    if (slice.status !== "complete" && slice.status !== "done") {
+      guardError = `slice ${params.sliceId} is not complete (status: ${slice.status}) — nothing to reopen`;
+      return;
+    }
+
+    // Fetch tasks inside txn so the list is consistent with the slice status check
+    const tasks = getSliceTasks(params.milestoneId, params.sliceId);
+    tasksResetCount = tasks.length;
+
+    updateSliceStatus(params.milestoneId, params.sliceId, "in_progress");
+    for (const task of tasks) {
+      updateTaskStatus(params.milestoneId, params.sliceId, task.id, "pending");
+    }
+  });
+
+  if (guardError) {
+    return { error: guardError };
+  }
+
+  // ── Invalidate caches ────────────────────────────────────────────────────
+  invalidateStateCache();
+
+  // ── Post-mutation hook ───────────────────────────────────────────────────
+  try {
+    await renderAllProjections(basePath, params.milestoneId);
+    writeManifest(basePath);
+    appendEvent(basePath, {
+      cmd: "reopen-slice",
+      params: {
+        milestoneId: params.milestoneId,
+        sliceId: params.sliceId,
+        reason: params.reason ?? null,
+        tasksReset: tasksResetCount,
+      },
+      ts: new Date().toISOString(),
+      actor: "agent",
+      actor_name: params.actorName,
+      trigger_reason: params.triggerReason,
+    });
+  } catch (hookErr) {
+    process.stderr.write(
+      `gsd: reopen-slice post-mutation hook warning: ${(hookErr as Error).message}\n`,
+    );
+  }
+
+  return {
+    milestoneId: params.milestoneId,
+    sliceId: params.sliceId,
+    tasksReset: tasksResetCount,
+  };
+}

package/src/resources/extensions/gsd/tools/reopen-task.ts

@@ -0,0 +1,129 @@
+/**
+ * reopen-task handler — the core operation behind gsd_task_reopen.
+ *
+ * Resets a completed task back to "pending" so it can be re-done
+ * without manual SQL surgery. The parent slice and milestone must
+ * still be open (not complete) — you cannot reopen tasks inside a
+ * closed slice.
+ */
+
+// GSD — reopen-task tool handler
+// Copyright (c) 2026 Jeremy McSpadden <jeremy@fluxlabs.net>
+
+import {
+  getMilestone,
+  getSlice,
+  getTask,
+  updateTaskStatus,
+  transaction,
+} from "../gsd-db.js";
+import { invalidateStateCache } from "../state.js";
+import { renderAllProjections } from "../workflow-projections.js";
+import { writeManifest } from "../workflow-manifest.js";
+import { appendEvent } from "../workflow-events.js";
+
+export interface ReopenTaskParams {
+  milestoneId: string;
+  sliceId: string;
+  taskId: string;
+  reason?: string;
+  /** Optional caller-provided identity for audit trail */
+  actorName?: string;
+  /** Optional caller-provided reason this action was triggered */
+  triggerReason?: string;
+}
+
+export interface ReopenTaskResult {
+  milestoneId: string;
+  sliceId: string;
+  taskId: string;
+}
+
+export async function handleReopenTask(
+  params: ReopenTaskParams,
+  basePath: string,
+): Promise<ReopenTaskResult | { error: string }> {
+  // ── Validate required fields ────────────────────────────────────────────
+  if (!params.taskId || typeof params.taskId !== "string" || params.taskId.trim() === "") {
+    return { error: "taskId is required and must be a non-empty string" };
+  }
+  if (!params.sliceId || typeof params.sliceId !== "string" || params.sliceId.trim() === "") {
+    return { error: "sliceId is required and must be a non-empty string" };
+  }
+  if (!params.milestoneId || typeof params.milestoneId !== "string" || params.milestoneId.trim() === "") {
+    return { error: "milestoneId is required and must be a non-empty string" };
+  }
+
+  // ── Guards + DB write inside a single transaction (prevents TOCTOU) ────
+  let guardError: string | null = null;
+
+  transaction(() => {
+    const milestone = getMilestone(params.milestoneId);
+    if (!milestone) {
+      guardError = `milestone not found: ${params.milestoneId}`;
+      return;
+    }
+    if (milestone.status === "complete" || milestone.status === "done") {
+      guardError = `cannot reopen task in a closed milestone: ${params.milestoneId} (status: ${milestone.status})`;
+      return;
+    }
+
+    const slice = getSlice(params.milestoneId, params.sliceId);
+    if (!slice) {
+      guardError = `slice not found: ${params.milestoneId}/${params.sliceId}`;
+      return;
+    }
+    if (slice.status === "complete" || slice.status === "done") {
+      guardError = `cannot reopen task inside a closed slice: ${params.sliceId} (status: ${slice.status}) — use gsd_slice_reopen first`;
+      return;
+    }
+
+    const task = getTask(params.milestoneId, params.sliceId, params.taskId);
+    if (!task) {
+      guardError = `task not found: ${params.milestoneId}/${params.sliceId}/${params.taskId}`;
+      return;
+    }
+    if (task.status !== "complete" && task.status !== "done") {
+      guardError = `task ${params.taskId} is not complete (status: ${task.status}) — nothing to reopen`;
+      return;
+    }
+
+    updateTaskStatus(params.milestoneId, params.sliceId, params.taskId, "pending");
+  });
+
+  if (guardError) {
+    return { error: guardError };
+  }
+
+  // ── Invalidate caches ────────────────────────────────────────────────────
+  invalidateStateCache();
+
+  // ── Post-mutation hook ───────────────────────────────────────────────────
+  try {
+    await renderAllProjections(basePath, params.milestoneId);
+    writeManifest(basePath);
+    appendEvent(basePath, {
+      cmd: "reopen-task",
+      params: {
+        milestoneId: params.milestoneId,
+        sliceId: params.sliceId,
+        taskId: params.taskId,
+        reason: params.reason ?? null,
+      },
+      ts: new Date().toISOString(),
+      actor: "agent",
+      actor_name: params.actorName,
+      trigger_reason: params.triggerReason,
+    });
+  } catch (hookErr) {
+    process.stderr.write(
+      `gsd: reopen-task post-mutation hook warning: ${(hookErr as Error).message}\n`,
+    );
+  }
+
+  return {
+    milestoneId: params.milestoneId,
+    sliceId: params.sliceId,
+    taskId: params.taskId,
+  };
+}

package/src/resources/extensions/gsd/tools/replan-slice.ts

@@ -11,6 +11,9 @@ import {
 } from "../gsd-db.js";
 import { invalidateStateCache } from "../state.js";
 import { renderPlanFromDb, renderReplanFromDb } from "../markdown-renderer.js";
+import { renderAllProjections } from "../workflow-projections.js";
+import { writeManifest } from "../workflow-manifest.js";
+import { appendEvent } from "../workflow-events.js";
 
 export interface ReplanSliceTaskInput {
   taskId: string;
@@ -32,6 +35,10 @@ export interface ReplanSliceParams {
   whatChanged: string;
   updatedTasks: ReplanSliceTaskInput[];
   removedTaskIds: string[];
+  /** Optional caller-provided identity for audit trail */
+  actorName?: string;
+  /** Optional caller-provided reason this action was triggered */
+  triggerReason?: string;
 }
 
 export interface ReplanSliceResult {
@@ -83,11 +90,23 @@ export async function handleReplanSlice(
     return { error: `validation failed: ${(err as Error).message}` };
   }
 
-  // ── Verify parent slice exists ────────────────────────────────────
+  // ── Verify parent slice exists and is not closed ─────────────────
   const parentSlice = getSlice(params.milestoneId, params.sliceId);
   if (!parentSlice) {
     return { error: `missing parent slice: ${params.milestoneId}/${params.sliceId}` };
   }
+  if (parentSlice.status === "complete" || parentSlice.status === "done") {
+    return { error: `cannot replan a closed slice: ${params.sliceId} (status: ${parentSlice.status})` };
+  }
+
+  // ── Verify blocker task exists and is complete ────────────────────
+  const blockerTask = getTask(params.milestoneId, params.sliceId, params.blockerTaskId);
+  if (!blockerTask) {
+    return { error: `blockerTaskId not found: ${params.milestoneId}/${params.sliceId}/${params.blockerTaskId}` };
+  }
+  if (blockerTask.status !== "complete" && blockerTask.status !== "done") {
+    return { error: `blockerTaskId ${params.blockerTaskId} is not complete (status: ${blockerTask.status}) — the blocker task must be finished before a replan is triggered` };
+  }
 
   // ── Structural enforcement ────────────────────────────────────────
   const existingTasks = getSliceTasks(params.milestoneId, params.sliceId);
@@ -183,6 +202,24 @@ export async function handleReplanSlice(
     invalidateStateCache();
     clearParseCache();
 
+    // ── Post-mutation hook: projections, manifest, event log ─────
+    try {
+      await renderAllProjections(basePath, params.milestoneId);
+      writeManifest(basePath);
+      appendEvent(basePath, {
+        cmd: "replan-slice",
+        params: { milestoneId: params.milestoneId, sliceId: params.sliceId, blockerTaskId: params.blockerTaskId },
+        ts: new Date().toISOString(),
+        actor: "agent",
+        actor_name: params.actorName,
+        trigger_reason: params.triggerReason,
+      });
+    } catch (hookErr) {
+      process.stderr.write(
+        `gsd: replan-slice post-mutation hook warning: ${(hookErr as Error).message}\n`,
+      );
+    }
+
     return {
       milestoneId: params.milestoneId,
       sliceId: params.sliceId,

package/src/resources/extensions/gsd/types.ts

@@ -520,6 +520,10 @@ export interface CompleteTaskParams {
     verdict: string;
     durationMs: number;
   }>;
+  /** Optional caller-provided identity for audit trail */
+  actorName?: string;
+  /** Optional caller-provided reason this action was triggered */
+  triggerReason?: string;
 }
 
 // ─── Complete Slice Params (gsd_complete_slice tool input) ───────────────
@@ -548,4 +552,8 @@ export interface CompleteSliceParams {
   requires: Array<{ slice: string; provides: string }>;
   affects: string[];
   drillDownPaths: string[];
+  /** Optional caller-provided identity for audit trail */
+  actorName?: string;
+  /** Optional caller-provided reason this action was triggered */
+  triggerReason?: string;
 }

package/src/resources/extensions/gsd/unit-ownership.ts

@@ -0,0 +1,104 @@
+// GSD Extension — Unit Ownership
+// Opt-in per-unit ownership claims for multi-agent safety.
+//
+// An agent can claim a unit (task, slice) before working on it.
+// complete-task and complete-slice enforce ownership when claims exist.
+// If no claim file is present, ownership is not enforced (backward compatible).
+//
+// Claim file location: .gsd/unit-claims.json
+// Unit key format:
+//   task:  "<milestoneId>/<sliceId>/<taskId>"
+//   slice: "<milestoneId>/<sliceId>"
+//
+// Copyright (c) 2026 Jeremy McSpadden <jeremy@fluxlabs.net>
+
+import { existsSync, readFileSync, mkdirSync } from "node:fs";
+import { join } from "node:path";
+import { atomicWriteSync } from "./atomic-write.js";
+
+// ─── Types ───────────────────────────────────────────────────────────────
+
+export interface UnitClaim {
+  agent: string;
+  claimed_at: string;
+}
+
+type ClaimsMap = Record<string, UnitClaim>;
+
+// ─── Key Builders ────────────────────────────────────────────────────────
+
+export function taskUnitKey(milestoneId: string, sliceId: string, taskId: string): string {
+  return `${milestoneId}/${sliceId}/${taskId}`;
+}
+
+export function sliceUnitKey(milestoneId: string, sliceId: string): string {
+  return `${milestoneId}/${sliceId}`;
+}
+
+// ─── File Path ───────────────────────────────────────────────────────────
+
+function claimsPath(basePath: string): string {
+  return join(basePath, ".gsd", "unit-claims.json");
+}
+
+// ─── Read Claims ─────────────────────────────────────────────────────────
+
+function readClaims(basePath: string): ClaimsMap | null {
+  const path = claimsPath(basePath);
+  if (!existsSync(path)) return null;
+  try {
+    return JSON.parse(readFileSync(path, "utf-8")) as ClaimsMap;
+  } catch {
+    return null;
+  }
+}
+
+// ─── Public API ──────────────────────────────────────────────────────────
+
+/**
+ * Claim a unit for an agent.
+ * Overwrites any existing claim for this unit (last writer wins).
+ */
+export function claimUnit(basePath: string, unitKey: string, agentName: string): void {
+  const claims = readClaims(basePath) ?? {};
+  claims[unitKey] = { agent: agentName, claimed_at: new Date().toISOString() };
+  const dir = join(basePath, ".gsd");
+  mkdirSync(dir, { recursive: true });
+  atomicWriteSync(claimsPath(basePath), JSON.stringify(claims, null, 2) + "\n");
+}
+
+/**
+ * Release a unit claim (remove it from the claims map).
+ */
+export function releaseUnit(basePath: string, unitKey: string): void {
+  const claims = readClaims(basePath);
+  if (!claims || !(unitKey in claims)) return;
+  delete claims[unitKey];
+  atomicWriteSync(claimsPath(basePath), JSON.stringify(claims, null, 2) + "\n");
+}
+
+/**
+ * Get the current owner of a unit, or null if unclaimed / no claims file.
+ */
+export function getOwner(basePath: string, unitKey: string): string | null {
+  const claims = readClaims(basePath);
+  if (!claims) return null;
+  return claims[unitKey]?.agent ?? null;
+}
+
+/**
+ * Check if an actor is authorized to operate on a unit.
+ * Returns null if ownership passes (or is unclaimed / no file).
+ * Returns an error string if a different agent owns the unit.
+ */
+export function checkOwnership(
+  basePath: string,
+  unitKey: string,
+  actorName: string | undefined,
+): string | null {
+  if (!actorName) return null; // no actor identity provided — opt-in, so allow
+  const owner = getOwner(basePath, unitKey);
+  if (owner === null) return null; // unit unclaimed or no claims file
+  if (owner === actorName) return null; // actor is the owner
+  return `Unit ${unitKey} is owned by ${owner}, not ${actorName}`;
+}