harnery 0.26.0 → 0.27.0

package/src/core/harnesses/bench.ts

@@ -285,6 +285,21 @@ function observeAdapter(
     planningFailed = true;
   }
 
+  // Plan a second invocation carrying a filesystem policy. Offline this can only
+  // show whether the adapter *renders* the projection, never whether the vendor
+  // enforces it; enforcement needs the live probe (ADR 0041). An adapter that
+  // declares no projection throws here, which is the correct rendering.
+  let projectionRendered = false;
+  try {
+    const projected = adapter.buildInvocation(
+      { ...request, filesystemPolicy: { mode: "read-only" } },
+      "/harnery-bench/final.txt",
+    ).argv;
+    projectionRendered = projected.join(" ") !== argv.join(" ");
+  } catch {
+    projectionRendered = false;
+  }
+
   let normalized: SpawnResult | null = null;
   try {
     normalized = adapter.normalizeResult(adapter.fixture.raw);
@@ -336,6 +351,7 @@ function observeAdapter(
       normalized && "toolEvidence" in normalized ? "supported" : "unsupported",
     ),
     policyMapping: NOT_CHECKED,
+    filesystemPolicyProjection: fromAdapter(projectionRendered ? "supported" : "unsupported"),
     interruption: NOT_CHECKED,
     streaming: NOT_CHECKED,
     steering: NOT_CHECKED,

package/src/core/harnesses/profiles.ts

@@ -16,6 +16,7 @@ function capabilities(overrides: Partial<HarnessCapabilities>): HarnessCapabilit
     cost: unsupported(),
     toolEvidence: unsupported("The final-result adapter does not retain tool events."),
     policyMapping: unsupported("No ALLOW/DENY/ASK translation at the workflow boundary."),
+    filesystemPolicyProjection: unsupported("The adapter declares no sandbox projection."),
     interruption: partial("Timeout kills the subprocess; no caller-driven interrupt handle."),
     streaming: unsupported("Workflow children return one normalized final result."),
     steering: unsupported("One prompt is fixed at subprocess launch."),
@@ -70,8 +71,18 @@ export const BUILTIN_HARNESS_PROFILES = {
     modelFamily: "gpt",
     effortValues: ["none", "minimal", "low", "medium", "high", "xhigh"],
     verified: { date: "2026-07-25", version: "codex-cli 0.144.5" },
+    // Verified against codex-cli 0.144.5: `--sandbox <mode>` plus
+    // `sandbox_workspace_write.writable_roots`. Without the writable-root entry
+    // a workspace-write child still cannot write a repository's .git directory.
+    sandboxProjection: {
+      modes: { "read-only": "read-only", "workspace-write": "workspace-write" },
+      writableRoots: true,
+    },
     capabilities: capabilities({
       effortSelection: supported('Mapped to `-c model_reasoning_effort="<level>"`.'),
+      filesystemPolicyProjection: supported(
+        "Mode renders to --sandbox; writable roots to sandbox_workspace_write.writable_roots.",
+      ),
       maxTurns: unsupported("codex exec exposes no turn-ceiling flag."),
       sessionId: unsupported("--output-last-message carries no session id."),
       cost: unsupported("The final-message path carries no usage or cost."),

package/src/core/harnesses/types.ts

@@ -16,6 +16,7 @@ export const HARNESS_CAPABILITY_DIMENSIONS = [
   "cost",
   "toolEvidence",
   "policyMapping",
+  "filesystemPolicyProjection",
   "interruption",
   "streaming",
   "steering",
@@ -38,6 +39,17 @@ export interface CapabilityClaim {
 
 export type HarnessCapabilities = Record<HarnessCapabilityDimension, CapabilityClaim>;
 
+/** What one harness can represent of a filesystem-policy projection
+ * (ADR 0039). `null` means the harness does not distinguish that, which is a
+ * fact about the harness rather than something to paper over: a projection the
+ * adapter would silently drop must be refused instead. */
+export interface HarnessSandboxProjection {
+  /** Native representation per canonical mode, or null when unrepresentable. */
+  modes: Record<"read-only" | "workspace-write", string | null>;
+  /** Whether the harness accepts an explicit writable-root set. */
+  writableRoots: boolean;
+}
+
 export interface HarnessProfile {
   id: HarnessId;
   displayName: string;
@@ -52,6 +64,9 @@ export interface HarnessProfile {
   capabilities: HarnessCapabilities;
   /** The last real vendor CLI contract used to validate this declaration. */
   verified?: { date: string; version: string };
+  /** How this adapter projects host filesystem policy into the vendor's own
+   * sandbox (ADR 0039). Absent means it cannot project any of it. */
+  sandboxProjection?: HarnessSandboxProjection;
 }
 
 /** Fully planned child invocation. `resultFile` is used by adapters such as

package/src/core/workflow/engine.ts

@@ -53,12 +53,15 @@ import {
   workflowScriptDigest,
   writeWorkflowRunManifest,
 } from "./run-state.ts";
+import { assertProjectionWithinWorkspace, resolveGitGrantRoots } from "./sandbox-projection.ts";
 import { normalizeWorkflowSpecialists, resolveSpecialistAssignment } from "./specialists.ts";
 import type {
   AgentOpts,
   EngineOpts,
+  GitAdministrativeGrant,
   HarnessName,
   RunReport,
+  SpawnFilesystemPolicy,
   SpawnResult,
   StageSchema,
   WorkflowAgentProof,
@@ -67,6 +70,7 @@ import type {
   WorkflowEvidenceRecord,
   WorkflowModule,
   WorkflowProof,
+  WorkflowSandboxProjectionEvidence,
   WorkflowWorkContext,
 } from "./types.ts";
 import { WORKFLOW_PROOF_SCHEMA_VERSION } from "./types.ts";
@@ -85,6 +89,21 @@ import type {
 } from "./workspaces/types.ts";
 import { isWorkspaceAttestation } from "./workspaces/validate.ts";
 
+/** Proof record of the filesystem projection a run applied (ADR 0039/0040).
+ * Absent when no policy was in force, which reads as "no projection applied"
+ * rather than "an empty one". */
+function sandboxProjectionEvidence(
+  policy: SpawnFilesystemPolicy | undefined,
+  gitWrite: GitAdministrativeGrant,
+): WorkflowSandboxProjectionEvidence | undefined {
+  if (!policy) return undefined;
+  return {
+    mode: policy.mode,
+    writable_roots: [...(policy.writableRoots ?? [])],
+    git_grant: gitWrite,
+  };
+}
+
 const DEFAULT_MAX_AGENTS = 50;
 const DEFAULT_CONCURRENCY = 4;
 const DEFAULT_MAX_ATTEMPTS = 2;
@@ -317,6 +336,10 @@ async function executeWorkflow(
         evidence: [],
         harnessEvidence: opts.harnessEvidence,
         harnessAttestations: opts.harnessAttestations,
+        sandboxProjection: sandboxProjectionEvidence(
+          opts.filesystemPolicy,
+          opts.gitWrite ?? "none",
+        ),
         policy: policy
           ? {
               config: policy,
@@ -342,6 +365,38 @@ async function executeWorkflow(
   }
   const effectiveIsolation = workspaceFallback?.effective_isolation ?? isolation;
   const executionCwd = workspaceBinding?.active_root ?? cwd;
+  // Validate the projection once, before any child launches, so a policy that
+  // would reach outside the provider's validated root fails the run rather than
+  // silently widening one child's write access (ADR 0039).
+  const requestedPolicy = opts.filesystemPolicy;
+  if (requestedPolicy?.writableRoots?.length) {
+    if (!workspaceBinding) {
+      throw new Error(
+        "a filesystem policy with writable roots requires an isolated workspace; none is bound to this run",
+      );
+    }
+    assertProjectionWithinWorkspace(
+      "workflow",
+      workspaceBinding.writable_root.realpath,
+      requestedPolicy.writableRoots,
+    );
+  }
+  // The Git grant is resolved after containment on purpose: caller-supplied
+  // roots must stay inside the workspace, while these come from the verified
+  // binding and are the one sanctioned way out of it (ADR 0040).
+  const gitWrite = opts.gitWrite ?? "none";
+  const gitGrantRoots = resolveGitGrantRoots(gitWrite, workspaceBinding);
+  if (gitGrantRoots.length > 0 && !requestedPolicy) {
+    throw new Error(
+      `gitWrite "${gitWrite}" has no effect without a filesystem policy to carry it; set filesystemPolicy or drop the grant`,
+    );
+  }
+  const filesystemPolicy: SpawnFilesystemPolicy | undefined = requestedPolicy
+    ? {
+        ...requestedPolicy,
+        writableRoots: [...(requestedPolicy.writableRoots ?? []), ...gitGrantRoots],
+      }
+    : undefined;
   const executionRepoBefore = resumeState?.manifest.repository_before ?? snapshotRepo(executionCwd);
   if (!resumeState) {
     writeWorkflowRunManifest({
@@ -841,6 +896,7 @@ async function executeWorkflow(
           cwd: executionCwd,
           runId,
           subscriptionOnly,
+          filesystemPolicy,
         });
         agentProof.attempts = attempt;
         agentProof.duration_ms += last.durationMs;
@@ -1056,6 +1112,7 @@ async function executeWorkflow(
         evidence: evidenceRecords,
         harnessEvidence: opts.harnessEvidence,
         harnessAttestations: opts.harnessAttestations,
+        sandboxProjection: sandboxProjectionEvidence(filesystemPolicy, gitWrite),
         policy: policy
           ? {
               config: policy,
@@ -1136,6 +1193,7 @@ async function executeWorkflow(
         evidence: evidenceRecords,
         harnessEvidence: opts.harnessEvidence,
         harnessAttestations: opts.harnessAttestations,
+        sandboxProjection: sandboxProjectionEvidence(filesystemPolicy, gitWrite),
         policy: policy
           ? {
               config: policy,

package/src/core/workflow/index.ts

@@ -154,6 +154,7 @@ export {
   isWorkspaceLifecycleState,
   listWorkflowWorkspaceInspections,
   prepareIntegration,
+  prepareReclaim,
   probeLocalGitWorktreeProvider,
   readWorkflowWorkspaceStatus,
   renderWorkflowWorkspaceStatus,

package/src/core/workflow/proof.ts

@@ -30,6 +30,7 @@ import type {
   WorkflowProofUnknown,
   WorkflowRepoEvidence,
   WorkflowRepoSnapshot,
+  WorkflowSandboxProjectionEvidence,
   WorkflowWorkContext,
 } from "./types.ts";
 import { WORKFLOW_PROOF_SCHEMA_VERSION } from "./types.ts";
@@ -82,6 +83,8 @@ export interface BuildWorkflowProofInput {
   agents: WorkflowAgentProof[];
   evidence: WorkflowEvidenceRecord[];
   harnessEvidence?: Readonly<Record<string, HarnessEvidenceCapability | undefined>>;
+  /** Filesystem policy actually projected into children (ADR 0039). */
+  sandboxProjection?: WorkflowSandboxProjectionEvidence;
   /** Live attestations backing each harness's claims (ADR 0038). Injected by
    * the caller so proof stays free of filesystem lookups. */
   harnessAttestations?: Readonly<Record<string, HarnessAttestationCitation | undefined>>;
@@ -254,6 +257,7 @@ export function buildWorkflowProof(input: BuildWorkflowProofInput): WorkflowProo
         ? buildExecutionEvidence(input.status, input.workspaceBinding, input.workspaceAttestation)
         : input.workspaceFallback,
     repository,
+    ...(input.sandboxProjection ? { sandbox_projection: input.sandboxProjection } : {}),
     harnesses,
     unknowns,
     integrity: {

package/src/core/workflow/sandbox-projection.ts

@@ -0,0 +1,150 @@
+/**
+ * Project the host's filesystem policy into a harness's own vendor sandbox
+ * (ADR 0039).
+ *
+ * Harnery decides where a workflow child may write. Until this existed it never
+ * told the child, so a child working in a provider-owned Git worktree could
+ * edit files and could not commit: the vendor excludes a repository's
+ * administrative directory from its writable set by policy, and Harnery had no
+ * way to name it as an exception.
+ *
+ * The one rule that matters here is that a projection an adapter cannot
+ * represent is refused before launch. Passing a policy that gets silently
+ * dropped would leave an operator believing a child was constrained when it was
+ * not, which is worse than refusing and worse than never offering the feature.
+ */
+
+import type { HarnessSandboxProjection } from "../harnesses/types.ts";
+import type { GitAdministrativeGrant, SpawnFilesystemPolicy } from "./types.ts";
+import type { WorkspaceBinding } from "./workspaces/types.ts";
+
+export class SandboxProjectionError extends Error {
+  readonly harness: string;
+  readonly reason:
+    | "mode_unrepresentable"
+    | "writable_roots_unrepresentable"
+    | "no_projection"
+    | "writable_root_escapes_workspace"
+    | "git_grant_unavailable";
+
+  constructor(harness: string, reason: SandboxProjectionError["reason"], message: string) {
+    super(message);
+    this.name = "SandboxProjectionError";
+    this.harness = harness;
+    this.reason = reason;
+  }
+}
+
+export interface ResolvedSandboxProjection {
+  /** Vendor-native name for the requested mode. */
+  nativeMode: string;
+  writableRoots: readonly string[];
+}
+
+/**
+ * Resolve a requested policy against what the adapter declares it can carry.
+ * Throws rather than degrading; see the module note.
+ */
+export function resolveSandboxProjection(
+  harness: string,
+  declaration: HarnessSandboxProjection | undefined,
+  policy: SpawnFilesystemPolicy,
+): ResolvedSandboxProjection {
+  if (!declaration) {
+    throw new SandboxProjectionError(
+      harness,
+      "no_projection",
+      `${harness} cannot project a filesystem policy into its sandbox; remove the policy or use a harness that can`,
+    );
+  }
+  const nativeMode = declaration.modes[policy.mode];
+  if (!nativeMode) {
+    throw new SandboxProjectionError(
+      harness,
+      "mode_unrepresentable",
+      `${harness} does not distinguish the "${policy.mode}" filesystem mode, so it cannot be enforced`,
+    );
+  }
+  const writableRoots = policy.writableRoots ?? [];
+  if (writableRoots.length > 0 && !declaration.writableRoots) {
+    throw new SandboxProjectionError(
+      harness,
+      "writable_roots_unrepresentable",
+      `${harness} does not accept an explicit writable-root set, so ${writableRoots.length} declared path(s) could not be enforced`,
+    );
+  }
+  for (const root of writableRoots) {
+    // Relative paths cannot be validated against the provider's roots and are
+    // resolved differently by every vendor, so they are refused outright.
+    if (typeof root !== "string" || !root.startsWith("/")) {
+      throw new SandboxProjectionError(
+        harness,
+        "writable_roots_unrepresentable",
+        `writable root ${JSON.stringify(root)} must be an absolute path`,
+      );
+    }
+  }
+  return { nativeMode, writableRoots };
+}
+
+/** True when `candidate` is `root` or lies beneath it, comparing whole path
+ * segments so `/a/bc` is not treated as inside `/a/b`. */
+function isWithin(root: string, candidate: string): boolean {
+  const normalizedRoot = root.endsWith("/") ? root.slice(0, -1) : root;
+  return candidate === normalizedRoot || candidate.startsWith(`${normalizedRoot}/`);
+}
+
+/**
+ * Refuse a projection that would grant write access outside the root the
+ * workspace provider already validated (ADR 0039).
+ *
+ * The renderer alone cannot do this: it never sees the binding. Granting a path
+ * the provider never sanctioned would let a projection quietly widen the blast
+ * radius of a run that the workspace lifecycle believes it has contained.
+ */
+export function assertProjectionWithinWorkspace(
+  harness: string,
+  allowedRootRealpath: string,
+  writableRoots: readonly string[],
+): void {
+  for (const root of writableRoots) {
+    if (!isWithin(allowedRootRealpath, root)) {
+      throw new SandboxProjectionError(
+        harness,
+        "writable_root_escapes_workspace",
+        `writable root ${JSON.stringify(root)} is outside the workspace root ${JSON.stringify(allowedRootRealpath)} the provider validated`,
+      );
+    }
+  }
+}
+
+/**
+ * Resolve a named Git administrative grant into concrete writable roots
+ * (ADR 0040).
+ *
+ * These are the only paths a run may write outside its workspace, and the
+ * caller never names them: they come from the binding the provider verified.
+ * A caller-supplied path is checked by `assertProjectionWithinWorkspace` and can
+ * never reach here, so asking for the grant is the whole of the widening.
+ *
+ * In a linked worktree both halves of the administrative directory live under
+ * the source repository, and a commit needs the shared half regardless, so the
+ * grant returns both rather than pretending the private half is useful alone.
+ */
+export function resolveGitGrantRoots(
+  grant: GitAdministrativeGrant,
+  binding: WorkspaceBinding | undefined,
+): readonly string[] {
+  if (grant === "none") return [];
+  const repository = binding?.repository;
+  if (!repository) {
+    throw new SandboxProjectionError(
+      "workflow",
+      "git_grant_unavailable",
+      `gitWrite "${grant}" needs a Git repository binding; this run has ${binding ? "a workspace with no repository" : "no isolated workspace"}`,
+    );
+  }
+  // Deduplicated: a full-clone topology reports the same path for both, and a
+  // repeated writable root is noise in the rendered argv and in proof.
+  return [...new Set([repository.gitdir.realpath, repository.common_dir.realpath])];
+}

package/src/core/workflow/spawn-claude.ts

@@ -19,10 +19,11 @@
  */
 
 import { exec } from "../../lib/exec.ts";
-import { validateHarnessEffort } from "../harnesses/profiles.ts";
+import { builtinHarnessProfile, validateHarnessEffort } from "../harnesses/profiles.ts";
 import type { HarnessInvocation, HarnessRawResult } from "../harnesses/types.ts";
 import { buildChildEnv } from "./child-env.ts";
 import { notFoundError } from "./harnesses.ts";
+import { resolveSandboxProjection } from "./sandbox-projection.ts";
 import { vendorFailureText } from "./spawn-failure.ts";
 import type { Spawner, SpawnRequest, SpawnResult } from "./types.ts";
 
@@ -38,6 +39,14 @@ interface ClaudeEnvelope {
 
 export function buildClaudeInvocation(req: SpawnRequest): HarnessInvocation {
   validateHarnessEffort("claude-code", req.effort);
+  if (req.filesystemPolicy) {
+    // Declared unrepresentable: refuse rather than drop it silently (ADR 0039).
+    resolveSandboxProjection(
+      "claude-code",
+      builtinHarnessProfile("claude-code")?.sandboxProjection,
+      req.filesystemPolicy,
+    );
+  }
   const argv = [
     "claude",
     "-p",

package/src/core/workflow/spawn-codex.ts

@@ -20,16 +20,25 @@ import { existsSync, readFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { exec } from "../../lib/exec.ts";
-import { validateHarnessEffort } from "../harnesses/profiles.ts";
+import { builtinHarnessProfile, validateHarnessEffort } from "../harnesses/profiles.ts";
 import type { HarnessInvocation, HarnessRawResult } from "../harnesses/types.ts";
 import { buildChildEnv } from "./child-env.ts";
 import { notFoundError } from "./harnesses.ts";
+import { resolveSandboxProjection } from "./sandbox-projection.ts";
 import { vendorFailureText } from "./spawn-failure.ts";
 import type { Spawner, SpawnRequest, SpawnResult } from "./types.ts";
 
 export function buildCodexInvocation(req: SpawnRequest, resultFile?: string): HarnessInvocation {
   validateHarnessEffort("codex", req.effort);
   if (!resultFile) throw new Error("codex adapter requires a final-message result file");
+  // Default stays workspace-write so an unprojected request is unchanged.
+  const projection = req.filesystemPolicy
+    ? resolveSandboxProjection(
+        "codex",
+        builtinHarnessProfile("codex")?.sandboxProjection,
+        req.filesystemPolicy,
+      )
+    : undefined;
   const argv = [
     "codex",
     "exec",
@@ -38,8 +47,14 @@ export function buildCodexInvocation(req: SpawnRequest, resultFile?: string): Ha
     resultFile,
     "--skip-git-repo-check",
     "--sandbox",
-    "workspace-write",
+    projection?.nativeMode ?? "workspace-write",
   ];
+  if (projection && projection.writableRoots.length > 0) {
+    argv.push(
+      "-c",
+      `sandbox_workspace_write.writable_roots=${JSON.stringify(projection.writableRoots)}`,
+    );
+  }
   if (req.model) argv.push("--model", req.model);
   if (req.effort) argv.push("-c", `model_reasoning_effort=${JSON.stringify(req.effort)}`);
   return { argv, resultFile };

package/src/core/workflow/spawn-cursor.ts

@@ -20,10 +20,11 @@
  */
 
 import { exec } from "../../lib/exec.ts";
-import { validateHarnessEffort } from "../harnesses/profiles.ts";
+import { builtinHarnessProfile, validateHarnessEffort } from "../harnesses/profiles.ts";
 import type { HarnessInvocation, HarnessRawResult } from "../harnesses/types.ts";
 import { buildChildEnv } from "./child-env.ts";
 import { notFoundError } from "./harnesses.ts";
+import { resolveSandboxProjection } from "./sandbox-projection.ts";
 import { vendorFailureText } from "./spawn-failure.ts";
 import type { Spawner, SpawnRequest, SpawnResult } from "./types.ts";
 
@@ -54,6 +55,14 @@ export function parseCursorOutput(stdout: string): {
 
 export function buildCursorInvocation(req: SpawnRequest): HarnessInvocation {
   validateHarnessEffort("cursor", req.effort);
+  if (req.filesystemPolicy) {
+    // Declared unrepresentable: refuse rather than drop it silently (ADR 0039).
+    resolveSandboxProjection(
+      "cursor",
+      builtinHarnessProfile("cursor")?.sandboxProjection,
+      req.filesystemPolicy,
+    );
+  }
   // --trust: headless cursor-agent refuses untrusted workspaces (exit 1,
   // "Workspace Trust Required"). --force: a print-mode child has no interactive
   // approval channel, so host-authorized workflow dispatch must let it run

package/src/core/workflow/types.ts

@@ -151,6 +151,13 @@ export interface HarnessEvidenceCoverage {
   attestation?: HarnessAttestationCitation;
 }
 
+export interface WorkflowSandboxProjectionEvidence {
+  mode: SpawnFilesystemPolicy["mode"];
+  writable_roots: string[];
+  /** Which Git administrative grant the run asked for (ADR 0040). */
+  git_grant: GitAdministrativeGrant;
+}
+
 export interface WorkflowProofUnknown {
   code:
     | "tool_evidence_unavailable"
@@ -190,6 +197,10 @@ export interface WorkflowProof {
   /** Immutable terminal provider evidence for isolated execution. */
   execution?: WorkspaceExecutionEvidence;
   repository: WorkflowRepoEvidence;
+  /** Filesystem policy projected into every child's vendor sandbox (ADR 0039).
+   * Absent means no projection was applied, which is the default. Present means
+   * the run can be audited for exactly what its children could write. */
+  sandbox_projection?: WorkflowSandboxProjectionEvidence;
   harnesses: HarnessEvidenceCoverage[];
   unknowns: WorkflowProofUnknown[];
   integrity: {
@@ -313,6 +324,33 @@ export interface SpawnRequest {
   /** Scrub all API-key vars from the child env so it can only authenticate
    * via its stored (subscription) login. See billing.ts. */
   subscriptionOnly?: boolean;
+  /** Filesystem policy to project into the child's own vendor sandbox
+   * (ADR 0039). Absent leaves the adapter's default invocation untouched, which
+   * is what shared-checkout runs use. An adapter that cannot represent the
+   * requested projection refuses before launch rather than downgrading. */
+  filesystemPolicy?: SpawnFilesystemPolicy;
+}
+
+/**
+ * Whether a run may write the Git administrative directory (ADR 0040).
+ *
+ * There is no middle setting, and the reason is a property of Git rather than a
+ * design choice. A linked worktree has a private administrative directory and a
+ * shared one, but object writes and branch refs live in the shared half, so even
+ * `git add` fails without it. A grant that enables a commit is therefore always
+ * a grant on the repository every worktree shares, including the operator's own
+ * checkout. That is why it has to be asked for by name.
+ */
+export type GitAdministrativeGrant = "none" | "shared-repository";
+
+/** What the host has decided the child may write. `full-access` is deliberately
+ * not a mode: Harnery does not project a no-sandbox state into a vendor CLI. */
+export interface SpawnFilesystemPolicy {
+  mode: "read-only" | "workspace-write";
+  /** Explicit absolute paths the child may write, declared rather than derived
+   * from `cwd`. The path that needs writing (a repository's administrative
+   * directory, for instance) is routinely outside the working directory. */
+  writableRoots?: readonly string[];
 }
 
 /** One headless-subagent runner. The engine is adapter-agnostic; claude-code
@@ -444,6 +482,22 @@ export interface EngineOpts {
   /** Live attestations backing each harness's claims (ADR 0038). Read once by
    * the host and injected, so the engine performs no capability lookups. */
   harnessAttestations?: Readonly<Record<HarnessName, HarnessAttestationCitation | undefined>>;
+  /** Filesystem policy projected into every child's own vendor sandbox
+   * (ADR 0039). Validated against the workspace binding before the first spawn,
+   * and recorded in proof. Absent leaves every adapter invocation unchanged. */
+  filesystemPolicy?: SpawnFilesystemPolicy;
+  /**
+   * Whether children may write the repository's administrative directory
+   * (ADR 0040). Defaults to `"none"`.
+   *
+   * The caller asks for the grant by name and never supplies the path: the
+   * engine resolves it from the workspace binding the provider already
+   * verified. That asymmetry is deliberate. `filesystemPolicy.writableRoots` is
+   * caller-supplied and must stay inside the workspace, so a caller cannot use
+   * it to reach the source repository; this grant can, which is exactly why it
+   * is a named capability rather than another path.
+   */
+  gitWrite?: GitAdministrativeGrant;
   /** Immutable host policy. Workflow scripts and model prompts cannot replace it. */
   policy?: PolicySpec | NormalizedPolicy;
   /** Host callback for ASK. Missing, invalid, throwing, or timed-out resolution denies. */

package/src/core/workflow/workspaces/index.ts

@@ -35,6 +35,8 @@ export {
   createLocalGitWorktreeProvider,
   probe as probeLocalGitWorktreeProvider,
 } from "./local-git.ts";
+export type { PrepareReclaimInput, ReclaimMode, ReclaimPreparation } from "./reclaim.ts";
+export { prepareReclaim } from "./reclaim.ts";
 export type {
   AuthorizedIntegrationPlan,
   AuthorizedProviderIntegrationInput,

package/src/core/workflow/workspaces/inspect.ts

@@ -337,9 +337,24 @@ export function renderWorkflowWorkspaceStatus(status: WorkflowWorkspaceStatus):
     `cleanup: ${status.cleanup.state}; ${status.cleanup.attempts} attempt`,
   );
   if (status.cleanup.reason) lines.push(`cleanup reason: ${status.cleanup.reason}`);
+  // A count alone cannot be acted on: an operator deciding whether to salvage or
+  // discard has to know what is actually uncommitted, and leaving Harnery to run
+  // `git status` is the gap `reclaim` exists to close (ADR 0042). Bounded,
+  // because a dirty tree can be arbitrarily large.
+  if (status.repository.dirty_paths.length > 0) {
+    // Entries arrive in porcelain form (` M path`), so the status code is worth
+    // keeping and the leading pad is not.
+    const shown = status.repository.dirty_paths
+      .slice(0, MAX_LISTED_DIRTY_PATHS)
+      .map((path) => path.trim());
+    const remainder = status.repository.dirty_paths.length - shown.length;
+    lines.push(`dirty paths: ${shown.join(", ")}${remainder > 0 ? ` (+${remainder} more)` : ""}`);
+  }
   return `${lines.join("\n")}\n`;
 }
 
+const MAX_LISTED_DIRTY_PATHS = 12;
+
 function readWorkspaceJournal(runDir: string, runId: string): WorkflowJournalProjectionEvent[] {
   const path = join(runDir, "journal.jsonl");
   if (!existsSync(path)) return [];