harnery 0.40.0 → 0.41.0

package/src/core/conversations/archive.ts

@@ -5,6 +5,7 @@ import {
   type DurableHistoryFaultBoundary,
   readDurableHistorySync,
 } from "../storage/durable-history.ts";
+import { stateDirMode, stateFileMode } from "../storage/modes.ts";
 import type {
   HarneryConversationAccessMode,
   HarneryConversationArchiveAuthorityMode,
@@ -69,10 +70,10 @@ export async function captureProviderConversation(
     provider.capabilities.provider_id,
     options.conversation_id,
   );
-  mkdirSync(objectDir, { recursive: true, mode: 0o700 });
+  mkdirSync(objectDir, { recursive: true, mode: stateDirMode() });
   const lease = join(objectDir, ".capture.lease");
   try {
-    mkdirSync(lease, { mode: 0o700 });
+    mkdirSync(lease, { mode: stateDirMode() });
   } catch {
     throw new Error(`conversation capture lease busy: ${options.conversation_id}`);
   }
@@ -223,7 +224,7 @@ function manifestFor(
 function publishManifest(objectDir: string, manifest: HarneryConversationArchiveManifest): void {
   const path = join(objectDir, "manifest.json");
   const temp = `${path}.tmp-${process.pid}`;
-  writeFileSync(temp, `${JSON.stringify(manifest, null, 2)}\n`, { mode: 0o600 });
+  writeFileSync(temp, `${JSON.stringify(manifest, null, 2)}\n`, { mode: stateFileMode() });
   renameSync(temp, path);
 }
 

package/src/core/diagnostics/bundle.ts

@@ -25,6 +25,7 @@ import {
 } from "../artifacts/index.ts";
 import { currentHarneryRuntimeBuild } from "../events/v3/runtime-build.ts";
 import { writePrivateJsonAtomic } from "../storage/atomic-json.ts";
+import { stateDirMode } from "../storage/modes.ts";
 import {
   SUPERVISOR_DIAGNOSTIC_LIMITS,
   SUPERVISOR_EXPLANATION_SCHEMA_VERSION,
@@ -171,8 +172,8 @@ export function captureDiagnosticBundle(
     now,
   });
   const inputsPath = join(created.path, "inputs");
-  mkdirSync(inputsPath, { recursive: true, mode: 0o700 });
-  tryChmod(inputsPath, 0o700);
+  mkdirSync(inputsPath, { recursive: true, mode: stateDirMode() });
+  tryChmod(inputsPath, stateDirMode());
 
   const payloads: Record<(typeof PAYLOAD_FILES)[number], unknown> = {
     "inputs/observations.json": observations,

package/src/core/events/legacy-storage/canary.ts

@@ -4,6 +4,7 @@ import { chmod, lstat, mkdir, open, rename, rm } from "node:fs/promises";
 import { basename, join, resolve } from "node:path";
 import { pipeline } from "node:stream/promises";
 import { createGzip } from "node:zlib";
+import { stateDirMode, stateFileMode } from "../../storage/modes.ts";
 import { canonicalJsonV3 } from "../v3/canonical.ts";
 import { verifyLegacyV1HardFence } from "./fence.ts";
 import { type LegacyV1SegmentManifest, validateLegacyV1SegmentManifest } from "./manifest.ts";
@@ -46,8 +47,8 @@ export async function writeLegacyV1Canary(input: {
     .digest("hex")
     .slice(0, 32)}` as const;
   const outputDirectory = resolve(input.output_directory);
-  await mkdir(outputDirectory, { recursive: true, mode: 0o700 });
-  await chmod(outputDirectory, 0o700);
+  await mkdir(outputDirectory, { recursive: true, mode: stateDirMode() });
+  await chmod(outputDirectory, stateDirMode());
   const payloadPath = join(outputDirectory, `${segmentId}.ndjson.gz`);
   const manifestPath = join(outputDirectory, `${segmentId}.manifest.json`);
   const partialPayload = `${payloadPath}.partial`;
@@ -57,7 +58,7 @@ export async function writeLegacyV1Canary(input: {
     await pipeline(
       createReadStream(source),
       createGzip({ level: 9 }),
-      createWriteStream(partialPayload, { flags: "wx", mode: 0o600 }),
+      createWriteStream(partialPayload, { flags: "wx", mode: stateFileMode() }),
     );
     await rename(partialPayload, payloadPath);
     const payloadStat = await lstat(payloadPath);
@@ -85,7 +86,7 @@ export async function writeLegacyV1Canary(input: {
     const handle = await open(
       partialManifest,
       constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL,
-      0o600,
+      stateFileMode(),
     );
     try {
       await handle.writeFile(`${canonicalJsonV3(manifest)}\n`, "utf8");

package/src/core/events/legacy-storage/compression.ts

@@ -5,6 +5,7 @@ import { chmod, lstat, rename, rm } from "node:fs/promises";
 import { basename } from "node:path";
 import { pipeline } from "node:stream/promises";
 import { createGzip } from "node:zlib";
+import { stateFileMode } from "../../storage/modes.ts";
 import { verifyLegacyV1HardFence } from "./fence.ts";
 import { inventoryLegacyV1Segments } from "./inventory.ts";
 import { streamLegacyV1Rows } from "./reader.ts";
@@ -84,7 +85,7 @@ export async function compressSealedLegacyV1Segments(
       await pipeline(
         createReadStream(row.path),
         createGzip({ level: 9 }),
-        createWriteStream(temporary, { flags: "wx", mode: 0o600 }),
+        createWriteStream(temporary, { flags: "wx", mode: stateFileMode() }),
       );
       await proveRowParity(row.path, temporary);
       const unchanged = (await inventoryLegacyV1Segments(coordRoot)).find(

package/src/core/events/v3/adapter-id.ts

@@ -1,4 +1,10 @@
-import type { Adapter } from "../../adapter.ts";
+import {
+  type Adapter,
+  type AdapterFallbackOptions,
+  DEFAULT_ADAPTER,
+  normalizeAdapterId,
+  resolveAdapterId,
+} from "../../adapter.ts";
 
 /** Harness identities that may produce or describe Event Ledger V3 evidence. */
 export type EventAdapterIdV3 = Adapter | "openclaw";
@@ -8,5 +14,27 @@ export const EVENT_ADAPTER_IDS_V3 = [
   "claude-code",
   "codex",
   "cursor",
+  "opencode",
   "openclaw",
 ] as const satisfies readonly EventAdapterIdV3[];
+
+type MissingEventAdapterId = Exclude<EventAdapterIdV3, (typeof EVENT_ADAPTER_IDS_V3)[number]>;
+const eventAdapterIdsComplete: [MissingEventAdapterId] extends [never] ? true : never = true;
+void eventAdapterIdsComplete;
+
+/** Strict event-adapter normalizer: a known id or `null`. */
+export function normalizeEventAdapterIdV3(value: unknown): EventAdapterIdV3 | null {
+  return normalizeAdapterId(value, EVENT_ADAPTER_IDS_V3);
+}
+
+/**
+ * Heartbeat `platform` to an event adapter id, substituting `DEFAULT_ADAPTER`
+ * and reporting the substitution. Use this wherever a row must be attributed
+ * to some adapter; use `normalizeEventAdapterIdV3` when `null` is acceptable.
+ */
+export function eventAdapterIdV3FromPlatform(
+  value: unknown,
+  options?: AdapterFallbackOptions,
+): EventAdapterIdV3 {
+  return resolveAdapterId(value, EVENT_ADAPTER_IDS_V3, DEFAULT_ADAPTER, options);
+}

package/src/core/events/v3/authority-outbox.ts

@@ -11,6 +11,7 @@ import {
   writeFileSync,
 } from "node:fs";
 import { join } from "node:path";
+import { stateFileMode } from "../../storage/modes.ts";
 import { fsyncParentDirectory } from "../../workflow/durable-record.ts";
 import { canonicalJsonV3, sha256V3 } from "./canonical.ts";
 import type { EventV3 } from "./contract.ts";
@@ -540,7 +541,7 @@ function publishExclusive(path: string, serialized: string): void {
   const temporary = `${path}.tmp-${process.pid}-${randomUUID()}`;
   let fd: number | undefined;
   try {
-    fd = openSync(temporary, "wx", 0o600);
+    fd = openSync(temporary, "wx", stateFileMode());
     writeFileSync(fd, serialized, "utf8");
     fsyncSync(fd);
     closeSync(fd);

package/src/core/events/v3/bootstrap.ts

@@ -16,6 +16,7 @@ import {
 import { hostname } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { stateDirMode, stateFileMode } from "../../storage/modes.ts";
 import { fsyncParentDirectory } from "../../workflow/durable-record.ts";
 import { acquireNoClobberLease } from "../../workflow/workspaces/leases.ts";
 import { canonicalJsonV3, sha256V3 } from "./canonical.ts";
@@ -524,7 +525,7 @@ function archiveCurrentEpoch(root: string, createdAt: string): string | undefine
   const current = join(root, ".harnery", "ledgers", "v3");
   if (!existsSync(current)) return undefined;
   const archives = join(root, ".harnery", "ledgers", "v3-archives");
-  mkdirSync(archives, { recursive: true, mode: 0o700 });
+  mkdirSync(archives, { recursive: true, mode: stateDirMode() });
   const stamp = createdAt.replace(/[^0-9]/g, "");
   let target = join(archives, `epoch-${stamp}`);
   let suffix = 0;
@@ -535,20 +536,20 @@ function archiveCurrentEpoch(root: string, createdAt: string): string | undefine
 }
 
 function publishControlFile(path: string, value: unknown): void {
-  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+  mkdirSync(dirname(path), { recursive: true, mode: stateDirMode() });
   const temp = `${path}.tmp.${process.pid}`;
   // A prior failed publish by this same pid would otherwise make every retry
   // fail on the exclusive create, which is exactly how one transient error
   // turns into a permanently stranded epoch.
   if (existsSync(temp)) unlinkSync(temp);
-  const fd = openSync(temp, "wx", 0o600);
+  const fd = openSync(temp, "wx", stateFileMode());
   try {
     writeFileSync(fd, `${canonicalJsonV3(value)}\n`, "utf8");
     fsyncSync(fd);
   } finally {
     closeSync(fd);
   }
-  chmodSync(temp, 0o600);
+  chmodSync(temp, stateFileMode());
   renameSync(temp, path);
   fsyncParentDirectory(path);
 }

package/src/core/events/v3/capabilities.ts

@@ -115,6 +115,19 @@ const BASE_SIGNAL_SUPPORT: Record<
     post_compaction: "unsupported",
     context_usage: "conditional",
   },
+  opencode: {
+    ...SHARED_SIGNAL_SUPPORT,
+    // OpenCode sessions are persistent server objects; the plugin observes a
+    // turn boundary (session.idle) rather than a clean session close, so end is
+    // conditional. Turns group by messageID without a first-class turn id.
+    session_end: "conditional",
+    turn_id: "conditional",
+    permission: "native",
+    // Compaction is intercepted (session.hook("compaction")); post-compaction
+    // recovery and SQLite-backed context usage are not yet certified.
+    post_compaction: "unsupported",
+    context_usage: "unsupported",
+  },
   openclaw: {
     session_start: "conditional",
     session_end: "native",
@@ -169,6 +182,10 @@ export const ADAPTER_CAPABILITY_PROFILES_V3: Record<EventAdapterIdV3, AdapterCap
       model_usage: "unsupported",
       inference_timing: "unsupported",
     }),
+    opencode: profile("opencode", {
+      model_usage: "conditional",
+      inference_timing: "unsupported",
+    }),
     openclaw: profile(
       "openclaw",
       {

package/src/core/events/v3/contract.ts

@@ -123,8 +123,15 @@ export const TurnCompletedV3Schema = eventV3("turn.completed", {
   }),
 });
 
+export const ToolLineChangesV3Schema = StrictObject({
+  added: Type.Integer({ minimum: 0 }),
+  removed: Type.Integer({ minimum: 0 }),
+});
+
 export const ToolCompletedV3Schema = eventV3("tool.completed", {
-  payload: terminalPayloadV3("tool.completed"),
+  payload: terminalPayloadV3("tool.completed", {
+    line_changes: Type.Optional(ObservationV3Schema(ToolLineChangesV3Schema)),
+  }),
 });
 
 export const CommandCompletedV3Schema = eventV3("command.completed", {
@@ -260,6 +267,7 @@ type ToolCompletedEventV3 = ReplaceEventV3<
   Omit<EventOfTypeV3Base<"tool.completed">["payload"], "duration_ms"> & {
     duration_ms: SpanSummaryValueV3["duration_ms"];
     span: SpanSummaryValueV3;
+    line_changes?: Static<ReturnType<typeof ObservationV3Schema<typeof ToolLineChangesV3Schema>>>;
   }
 >;
 type CommandCompletedEventV3 = ReplaceEventV3<

package/src/core/events/v3/control-witness.ts

@@ -10,6 +10,7 @@ import {
   unlinkSync,
   writeFileSync,
 } from "node:fs";
+import { stateFileMode } from "../../storage/modes.ts";
 import { fsyncParentDirectory } from "../../workflow/durable-record.ts";
 import { canonicalJsonV3, type FingerprintV3, fingerprintV3, sha256V3 } from "./canonical.ts";
 import type { ActivationManifestV3, CandidateGenesisManifestV3 } from "./control.ts";
@@ -332,12 +333,12 @@ function publishCanonicalFileV3(path: string, value: unknown): boolean {
   const temporary = `${path}.tmp-${process.pid}-${randomUUID()}`;
   let fd: number | undefined;
   try {
-    fd = openSync(temporary, "wx", 0o600);
+    fd = openSync(temporary, "wx", stateFileMode());
     writeFileSync(fd, `${canonicalJsonV3(value)}\n`, "utf8");
     fsyncSync(fd);
     closeSync(fd);
     fd = undefined;
-    chmodSync(temporary, 0o600);
+    chmodSync(temporary, stateFileMode());
     renameSync(temporary, path);
     fsyncParentDirectory(path);
     return true;

package/src/core/events/v3/coordination-transaction-recovery.ts

@@ -13,6 +13,7 @@ import {
   writeFileSync,
 } from "node:fs";
 import { join } from "node:path";
+import { stateDirMode, stateFileMode } from "../../storage/modes.ts";
 import { fsyncParentDirectory } from "../../workflow/durable-record.ts";
 import {
   type AuthorityTransactionV3,
@@ -306,8 +307,8 @@ function recoveryPaths(coordRoot: string, transactionId: string) {
 
 function ensureRecoveryLayout(paths: ReturnType<typeof recoveryPaths>): void {
   for (const path of [paths.root, paths.quarantineRoot]) {
-    mkdirSync(path, { recursive: true, mode: 0o700 });
-    chmodSync(path, 0o700);
+    mkdirSync(path, { recursive: true, mode: stateDirMode() });
+    chmodSync(path, stateDirMode());
   }
 }
 
@@ -325,7 +326,7 @@ function publishSerializedExclusive(path: string, serialized: string): void {
   const temporary = `${path}.tmp-${process.pid}-${randomUUID()}`;
   let fd: number | undefined;
   try {
-    fd = openSync(temporary, "wx", 0o600);
+    fd = openSync(temporary, "wx", stateFileMode());
     writeFileSync(fd, serialized, "utf8");
     fsyncSync(fd);
     closeSync(fd);

package/src/core/events/v3/fingerprint-keys.ts

@@ -14,6 +14,7 @@ import {
 } from "node:fs";
 import { hostname } from "node:os";
 import { join, resolve } from "node:path";
+import { stateDirMode, stateFileMode, stateModeTooOpen } from "../../storage/modes.ts";
 import { fsyncParentDirectory } from "../../workflow/durable-record.ts";
 import { acquireNoClobberLease } from "../../workflow/workspaces/leases.ts";
 import type { FingerprintContextV3 } from "./canonical.ts";
@@ -78,8 +79,8 @@ export function readFingerprintKeyStoreV3(coordRoot: string): FingerprintKeyStor
 
 function readKeyStoreValue(path: string): unknown {
   const mode = statSync(path).mode & 0o777;
-  if ((mode & 0o077) !== 0) {
-    throw new Error("fingerprint key store permissions are not owner-only");
+  if (stateModeTooOpen(mode)) {
+    throw new Error("fingerprint key store is open to other users");
   }
   let parsed: unknown;
   try {
@@ -135,8 +136,8 @@ export function fingerprintContextV3(
 
 function withKeyStoreLock<T>(coordRoot: string, operation: () => T): T {
   const privateDir = join(resolve(coordRoot), ".harnery/private");
-  mkdirSync(privateDir, { recursive: true, mode: 0o700 });
-  chmodSync(privateDir, 0o700);
+  mkdirSync(privateDir, { recursive: true, mode: stateDirMode() });
+  chmodSync(privateDir, stateDirMode());
   const leasePath = join(privateDir, "fingerprint-key-lease");
   const authority = createHash("sha256").update(resolve(coordRoot)).digest("hex");
   let lease: ReturnType<typeof acquireNoClobberLease> | undefined;
@@ -178,12 +179,12 @@ function publishKeyStore(path: string, store: FingerprintKeyStoreV3, replacing:
   const temporary = `${path}.tmp-${process.pid}-${randomUUID()}`;
   let fd: number | undefined;
   try {
-    fd = openSync(temporary, "wx", 0o600);
+    fd = openSync(temporary, "wx", stateFileMode());
     writeFileSync(fd, `${JSON.stringify(store)}\n`, "utf8");
     fsyncSync(fd);
     closeSync(fd);
     fd = undefined;
-    chmodSync(temporary, 0o600);
+    chmodSync(temporary, stateFileMode());
     if (!replacing && existsSync(path)) throw new Error("fingerprint key store already exists");
     renameSync(temporary, path);
     fsyncParentDirectory(path);

package/src/core/events/v3/generated.ts

@@ -1,6 +1,6 @@
 /** Generated by scripts/generate-event-v3-contract.ts. Do not edit. */
 export const EVENT_V3_SCHEMA_DIGEST =
-  "sha256:bdcee8d7839add0c786740ba9d5cfd0b6573f0ad4974bf53272737468734aa36" as const;
+  "sha256:07137e2cdf5eaed58d55a34e4036c87aa1f375d45c88274d07ad1cc69a6fe6f7" as const;
 export const EVENT_V3_GENERATED_CORE_TYPES = [
   "ledger.genesis",
   "ledger.activated",

package/src/core/events/v3/live-feed.ts

@@ -12,6 +12,7 @@ import {
   writeSync,
 } from "node:fs";
 import { basename, join, resolve } from "node:path";
+import { stateDirMode, stateFileMode } from "../../storage/modes.ts";
 
 const DEFAULT_TTL_MS = 15 * 60 * 1_000;
 const HARD_MAX_TTL_MS = 60 * 60 * 1_000;
@@ -92,16 +93,16 @@ export function writeLiveDisplayV3(
     throw new Error("V3 live-display row exceeds its bounded size");
   }
   const root = liveRoot(coordRoot);
-  mkdirSync(root, { recursive: true, mode: 0o700 });
-  chmodSync(root, 0o700);
+  mkdirSync(root, { recursive: true, mode: stateDirMode() });
+  chmodSync(root, stateDirMode());
   const path = join(root, `${input.generation_id}.ndjson`);
-  const fd = openSync(path, "a", 0o600);
+  const fd = openSync(path, "a", stateFileMode());
   try {
     writeSync(fd, serialized, undefined, "utf8");
   } finally {
     closeSync(fd);
   }
-  chmodSync(path, 0o600);
+  chmodSync(path, stateFileMode());
   return row;
 }
 

package/src/core/events/v3/producers/command-recorder.ts

@@ -15,6 +15,7 @@ import {
 } from "node:fs";
 import { hostname } from "node:os";
 import { join, resolve } from "node:path";
+import { stateDirMode, stateFileMode, stateModeTooOpen } from "../../../storage/modes.ts";
 import { fsyncParentDirectory } from "../../../workflow/durable-record.ts";
 import { acquireNoClobberLease } from "../../../workflow/workspaces/leases.ts";
 import { selectCommandParentSpan } from "../../span-parent.ts";
@@ -502,9 +503,9 @@ function commandStatePath(coordRoot: string, commandSource: `hid_${string}`): st
 function acquireCommandLease(coordRoot: string, statePath: string) {
   const directory = join(statePath, "..");
   const producerRoot = join(resolve(coordRoot), EVENT_V3_LEDGER_RELATIVE_ROOT, "private-producers");
-  mkdirSync(directory, { recursive: true, mode: 0o700 });
-  chmodSync(producerRoot, 0o700);
-  chmodSync(directory, 0o700);
+  mkdirSync(directory, { recursive: true, mode: stateDirMode() });
+  chmodSync(producerRoot, stateDirMode());
+  chmodSync(directory, stateDirMode());
   return acquireNoClobberLease({
     path: `${statePath}.lease`,
     scope: "event-v3-command-producer",
@@ -522,13 +523,13 @@ function publishCommandState(path: string, state: CommandRecorderStateV3): void
   const temporary = `${path}.tmp-${process.pid}-${randomUUID()}`;
   let fd: number | undefined;
   try {
-    fd = openSync(temporary, "wx", 0o600);
+    fd = openSync(temporary, "wx", stateFileMode());
     writeFileSync(fd, `${JSON.stringify(state)}\n`, "utf8");
     fsyncSync(fd);
     closeSync(fd);
     fd = undefined;
     renameSync(temporary, path);
-    chmodSync(path, 0o600);
+    chmodSync(path, stateFileMode());
     fsyncParentDirectory(path);
   } finally {
     if (fd !== undefined) closeSync(fd);
@@ -537,7 +538,8 @@ function publishCommandState(path: string, state: CommandRecorderStateV3): void
 }
 
 function readCommandState(path: string): CommandRecorderStateV3 {
-  if ((statSync(path).mode & 0o077) !== 0) throw new Error("V3 command state is not owner-only");
+  if (stateModeTooOpen(statSync(path).mode))
+    throw new Error("V3 command state is open to other users");
   let parsed: unknown;
   try {
     parsed = JSON.parse(readFileSync(path, "utf8"));

package/src/core/events/v3/producers/coordination-recorder.ts

@@ -15,6 +15,7 @@ import {
 } from "node:fs";
 import { hostname } from "node:os";
 import { basename, join, resolve } from "node:path";
+import { stateDirMode, stateFileMode, stateModeTooOpen } from "../../../storage/modes.ts";
 import { fsyncParentDirectory } from "../../../workflow/durable-record.ts";
 import { acquireNoClobberLease } from "../../../workflow/workspaces/leases.ts";
 import { EVENT_ADAPTER_IDS_V3, type EventAdapterIdV3 } from "../adapter-id.ts";
@@ -488,9 +489,9 @@ function coordinationProducerDirectory(coordRoot: string): string {
 function acquireCoordinationLease(coordRoot: string, statePath: string) {
   const directory = join(statePath, "..");
   const producerRoot = join(resolve(coordRoot), EVENT_V3_LEDGER_RELATIVE_ROOT, "private-producers");
-  mkdirSync(directory, { recursive: true, mode: 0o700 });
-  chmodSync(producerRoot, 0o700);
-  chmodSync(directory, 0o700);
+  mkdirSync(directory, { recursive: true, mode: stateDirMode() });
+  chmodSync(producerRoot, stateDirMode());
+  chmodSync(directory, stateDirMode());
   return acquireNoClobberLease({
     path: `${statePath}.lease`,
     scope: "event-v3-coordination-producer",
@@ -508,13 +509,13 @@ function publishCoordinationState(path: string, state: CoordinationRecorderState
   const temporary = `${path}.tmp-${process.pid}-${randomUUID()}`;
   let fd: number | undefined;
   try {
-    fd = openSync(temporary, "wx", 0o600);
+    fd = openSync(temporary, "wx", stateFileMode());
     writeFileSync(fd, `${JSON.stringify(state)}\n`, "utf8");
     fsyncSync(fd);
     closeSync(fd);
     fd = undefined;
     renameSync(temporary, path);
-    chmodSync(path, 0o600);
+    chmodSync(path, stateFileMode());
     fsyncParentDirectory(path);
   } finally {
     if (fd !== undefined) closeSync(fd);
@@ -523,8 +524,8 @@ function publishCoordinationState(path: string, state: CoordinationRecorderState
 }
 
 function readCoordinationState(path: string): CoordinationRecorderStateV3 {
-  if ((statSync(path).mode & 0o077) !== 0) {
-    throw new Error("V3 coordination state is not owner-only");
+  if (stateModeTooOpen(statSync(path).mode)) {
+    throw new Error("V3 coordination state is open to other users");
   }
   let parsed: unknown;
   try {

package/src/core/events/v3/producers/diagnostic-summaries.ts

@@ -19,6 +19,7 @@ import {
 import { hostname } from "node:os";
 import { join, resolve } from "node:path";
 import { coordEnv } from "../../../../lib/env.ts";
+import { stateDirMode, stateFileMode } from "../../../storage/modes.ts";
 import { fsyncParentDirectory } from "../../../workflow/durable-record.ts";
 import { acquireNoClobberLease } from "../../../workflow/workspaces/leases.ts";
 import { EVENT_V3_LEDGER_RELATIVE_ROOT } from "../writer.ts";
@@ -189,8 +190,8 @@ function summaryPath(root: string, category: string, window: string, digest: str
 }
 
 function ensureOwnerOnlyDirectory(path: string): void {
-  mkdirSync(path, { recursive: true, mode: 0o700 });
-  chmodSync(path, 0o700);
+  mkdirSync(path, { recursive: true, mode: stateDirMode() });
+  chmodSync(path, stateDirMode());
 }
 
 function publishOwnerOnlyJson(path: string, value: unknown, durable: boolean): void {
@@ -201,7 +202,7 @@ function publishOwnerOnlyJson(path: string, value: unknown, durable: boolean): v
   const temporary = `${path}.tmp-${process.pid}-${randomUUID()}`;
   let fd: number | undefined;
   try {
-    fd = openSync(temporary, "wx", 0o600);
+    fd = openSync(temporary, "wx", stateFileMode());
     writeFileSync(fd, contents, "utf8");
     if (durable) fsyncSync(fd);
     closeSync(fd);
@@ -401,7 +402,7 @@ function recordFailOpen(root: string, stage: string, nowMs: number): void {
       // Missing log starts fresh.
     }
     const line = JSON.stringify({ at: new Date(nowMs).toISOString(), stage, pid: process.pid });
-    appendFileSync(path, `${line}\n`, { mode: 0o600 });
+    appendFileSync(path, `${line}\n`, { mode: stateFileMode() });
   } catch {
     // The emergency log may undercount when storage is unavailable; it is a
     // signal, not accounting, and must never throw into the producer path.

package/src/core/events/v3/producers/hook-base.ts

@@ -85,6 +85,7 @@ export interface TurnRitualEvidenceV3 {
   status_box_present_strict: boolean;
   session_name_required: boolean;
   session_name_present: boolean;
+  session_name_unavailable_reason?: string;
 }
 
 type TurnRitualObservationV3 = NonNullable<
@@ -478,10 +479,16 @@ function turnRitualObservation(
   return {
     status_box_present: observed(evidence.status_box_present),
     status_box_present_strict: observed(evidence.status_box_present_strict),
-    session_name: observed({
-      required: evidence.session_name_required,
-      present: evidence.session_name_present,
-    }),
+    session_name: evidence.session_name_unavailable_reason
+      ? {
+          state: "expected_but_missing",
+          capability: "assistant_reply_text",
+          reason: evidence.session_name_unavailable_reason,
+        }
+      : observed({
+          required: evidence.session_name_required,
+          present: evidence.session_name_present,
+        }),
   };
 }
 

package/src/core/events/v3/producers/hook.ts

@@ -4,6 +4,7 @@ import { adapterDurationSupportV3, adapterSignalSupportV3 } from "../capabilitie
 import type { EventOfTypeV3, EventTypeV3, SpanSummaryV3 } from "../contract.ts";
 import { EVENT_V3_CONTRACT_MAJOR, EVENT_V3_CONTRACT_NAME } from "../contract.ts";
 import { EVENT_V3_SCHEMA_DIGEST } from "../generated.ts";
+import type { LineChanges } from "../tool-line-changes.ts";
 import {
   emptyHarnessTimingV3,
   extractTurnTelemetryV3,
@@ -19,6 +20,7 @@ import {
 } from "./hook-base.ts";
 
 export interface HookProducerContextV3 extends HookProducerContextV3Base {
+  tool_line_changes?: LineChanges;
   /** Required for terminal events; captured when the corresponding span opens. */
   terminal_span?: SpanSummaryV3;
   /** Required by V3 delegation starts so the child span is anchored in its parent tree. */
@@ -111,7 +113,23 @@ function terminalPayload(
   const span =
     duration === sourceSpan.duration_ms ? sourceSpan : { ...sourceSpan, duration_ms: duration };
   if (eventType === "tool.completed") {
-    return { ...basePayload, duration_ms: duration, span };
+    const counts = context.tool_line_changes;
+    const response = source.tool_response as { isError?: boolean } | undefined;
+    return {
+      ...basePayload,
+      duration_ms: duration,
+      span,
+      line_changes:
+        counts &&
+        (basePayload as { outcome?: string }).outcome === "succeeded" &&
+        response?.isError !== true
+          ? { state: "observed", value: counts, attestation: "derived", confidence: "high" }
+          : {
+              state: "expected_but_missing",
+              reason: "tool_line_changes_unmeasured",
+              capability: "tool_line_changes",
+            },
+    };
   }
   if (eventType !== "turn.completed") return { ...basePayload, span };