mtech-ai-local-runner 0.1.72 → 0.1.74

package/dist/src/daemon/runtime.js

@@ -34,6 +34,9 @@ import { packagedHookCommandParts } from "../safety/hook-command.js";
 import { composeReviewedP1Host } from '../verification/p1-host-composition.js';
 import { AskRuntime, withAsks } from '../asks/runtime.js';
 import { GuideRuntime, withGuide } from '../guide/runtime.js';
+import { FixConsentRuntime } from './fix-consent.js';
+import { RoomActivityRuntime } from '../rooms/activity.js';
+import { notifyRoomActivity } from '../rooms/notifier.js';
 export async function buildDaemon(input) {
     const claudeParts = [input.claudeSecurityHost, input.claudeSupportedProbe, input.claudeBinaryIdentity].filter(Boolean).length;
     if (claudeParts !== 0 && claudeParts !== 3)
@@ -62,8 +65,11 @@ export async function buildDaemon(input) {
         pendingCodexClaim.job.lease_expires_at = expiresAt;
     };
     const gateway = new McpGatewayClient({ mcpUrl: input.gatewayMcpUrl, tokenProvider: input.tokenProvider, runnerId: input.runnerId, fetchFn: input.fetchFn });
+    const roomActivity = new RoomActivityRuntime({ stateRoot: input.stateRoot,
+        read: (cursor, limit) => gateway.readRoomActivity(cursor, limit), notify: notifyRoomActivity });
     // AI-first ask delivery (Work Item e1c08b33) rides on the session-open loop below; it starts no executor.
     const asks = new AskRuntime({ stateRoot: input.stateRoot, env: input.env,
+        claimRoomNotice: () => roomActivity.claimNotice(),
         report: (deliveryId, report, signal) => gateway.reportAskDelivery({ deliveryId, ...report }, signal),
         log: event => { process.stderr.write(`${JSON.stringify(event)}\n`); } });
     // Guide hooks (Work Item d38d60f9) ride on the same sync and heartbeat; they start no executor.
@@ -120,7 +126,7 @@ export async function buildDaemon(input) {
                 taskPackageFingerprint: job.gatewayTaskPackageFingerprint ?? "" }, signal),
             createBinding: async (job, signal) => gateway.createLocalJobBinding({
                 jobId: job.id, generation: job.generation, jobLeaseToken: job.leaseToken,
-                launchGrant: job.launchGrant, workLoopId: job.workLoopId, checkoutPath: job.checkoutPath,
+                launchGrant: job.launchGrant, workLoopId: job.workLoopId, checkoutPath: job.checkoutPath, claimedJob: job,
             }, signal),
             publicationRecoveryContext: bindingId => gateway.exportLocalPublicationRecoveryContext(bindingId),
             syncPublicationCursor: (bindingId, cursor, job, receipt) => gateway.syncLocalPublicationCursor(bindingId, cursor, job, receipt),
@@ -144,7 +150,7 @@ export async function buildDaemon(input) {
                 }
                 return registry.select(id, version, options);
             } },
-        workspaces: new WorkspaceManager({ root: input.workspaceRoot, git: new GitClient() }),
+        workspaces: new WorkspaceManager({ root: input.workspaceRoot, git: new GitClient(), registeredSubmodules: p1Host?.registeredSubmodules }),
         state,
     });
     let transport;
@@ -166,6 +172,7 @@ export async function buildDaemon(input) {
                 launchFingerprint: claim.job.launch_fingerprint, gatewayContractFingerprint: claim.contract_fingerprint,
                 gatewayTaskPackageFingerprint: claim.task_package_fingerprint,
                 leaseExpiresAt: claim.job.lease_expires_at,
+                executionAttempt: claim.attempt_context, executionAttemptFingerprint: claim.attempt_context_fingerprint,
             };
             await state.save({ jobId: job.id, generation: job.generation, leaseToken: job.leaseToken, phase: "claimed" });
             return { status: "claimed", job };
@@ -254,6 +261,12 @@ export async function buildDaemon(input) {
     });
     const stopping = new AbortController();
     const closureAcks = new PendingClosureAcks();
+    // Slack Fix consent (Work Item 6f9e64ae, decision baf0cd89): applied for this runner only while idle; a changed host
+    // restarts the daemon through its graceful stop, and launchd (KeepAlive) starts it again with the new host.
+    const fixConsent = new FixConsentRuntime({ stateRoot: input.stateRoot, runnerId: input.runnerId,
+        report: () => localFixHost?.report, jobRunning: () => poller.running,
+        restart: () => { daemon.stop(); },
+        log: event => { process.stderr.write(`${JSON.stringify(event)}\n`); } });
     const opener = new SessionOpener({ home: input.env.HOME ?? "" });
     const dispatch = createSyncDispatcher({
         open: request => opener.open(request),
@@ -263,9 +276,12 @@ export async function buildDaemon(input) {
         },
         guide,
         ...(claudeProduction ? { claude: claudeProduction } : {}),
+        fixConsent,
         asks,
         closureAcks,
-        jobs: poller,
+        // While a changed Fix host waits for its restart, the next runner claims the job instead.
+        jobs: { notify: () => { if (!fixConsent.restartDue)
+                poller.notify(); } },
         delay: abortableDelay,
         signal: stopping.signal,
         reportError: diagnostic => { process.stderr.write(`${JSON.stringify({ event: "session_open_poller_failed", ...diagnostic })}\n`); },
@@ -275,7 +291,7 @@ export async function buildDaemon(input) {
             const acknowledged = closureAcks.take();
             // A runner that takes no jobs right now (reconciling, or suspended for recovery) names no adapter.
             try {
-                return await gateway.syncRunner({ adapterVersions: poller.accepting ? versions : {}, reason, acknowledgedClosureIds: acknowledged, guidancePolicyVersion: await guide.policyVersion() }, signal);
+                return await gateway.syncRunner({ adapterVersions: poller.accepting ? versions : {}, reason, acknowledgedClosureIds: acknowledged, guidancePolicyVersion: await guide.policyVersion(), roomActivityV1: true }, signal);
             }
             catch (error) {
                 closureAcks.restore(acknowledged);
@@ -283,7 +299,17 @@ export async function buildDaemon(input) {
             }
         },
         authorize: (socketId, signal) => gateway.authorizeRunnerChannel(socketId, signal),
-        dispatch,
+        dispatch: async (result) => {
+            void roomActivity.handleSync(result.roomActivityEnabled === true).catch(() => {
+                process.stderr.write(`${JSON.stringify({ event: 'room_activity_scan_failed' })}\n`);
+            });
+            try {
+                await dispatch(result);
+            }
+            finally {
+                await fixConsent.afterSync(result);
+            }
+        },
         openSocket: (target, events) => new ReverbSocket(target, events, { packageVersion: packageVersion() }),
         report: event => { process.stderr.write(`${JSON.stringify(event)}\n`); },
     });

package/dist/src/gateway-client.js

@@ -1,3 +1,4 @@
+import { assertClaimedExecutionAttempt, assertBoundExecutionAttempt, CONTINUATION_SCHEMA, CONTINUATION_POLICY } from './verification/continuation-runner-contract.js';
 import { publicationError } from './publication/failure.js';
 import { issueTransportDiagnostic } from './safety/transport-diagnostic.js';
 import { hasP1 } from './verification/p1-execution-host.js';
@@ -17,6 +18,29 @@ export class GatewayToolError extends Error {
         this.code = code;
     }
 }
+const ROOM_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const FIX_CONSENT_GRANT_ID = /^[a-zA-Z0-9-]{1,64}$/;
+const FIX_CONSENT_REPOSITORY_KEY = /^[a-z0-9][a-z0-9._-]{0,99}$/;
+const FIX_CONSENT_GRANTS_MAX = 20;
+/** Keeps the well-formed grants, at most 20; a malformed entry is dropped, never a reason to refuse the sync. */
+function parseFixConsentGrants(value) {
+    const grants = [];
+    for (const item of value) {
+        if (grants.length >= FIX_CONSENT_GRANTS_MAX)
+            break;
+        if (!item || typeof item !== "object" || Array.isArray(item))
+            continue;
+        const { id, repository_key: repositoryKey, verification_mode: verificationMode } = item;
+        if (typeof id !== "string" || !FIX_CONSENT_GRANT_ID.test(id))
+            continue;
+        if (typeof repositoryKey !== "string" || !FIX_CONSENT_REPOSITORY_KEY.test(repositoryKey))
+            continue;
+        if (verificationMode !== "gateway_publish_v1" && verificationMode !== "gateway_ci_v1")
+            continue;
+        grants.push({ id, repositoryKey, verificationMode });
+    }
+    return grants;
+}
 const PUSH_CHANNEL = /^private-ai-gateway\.[a-z0-9_-]{1,32}\.runner\.[a-z0-9:_-]{1,128}$/;
 const PUSH_APP_KEY = /^[A-Za-z0-9_-]{1,128}$/;
 const CHANNEL_AUTH = /^[^:\s]{1,128}:[a-f0-9]{64}$/;
@@ -38,6 +62,8 @@ export function parseRunnerSync(result, runnerId) {
         ...(typeof body.guidance_policy_version === "string" ? { guidancePolicyVersion: body.guidance_policy_version } : {}),
         ...("claude_release" in body ? { claudeRelease: parseClaudeSyncRelease(body.claude_release) } : {}),
         ...(body.ask_alert === true ? { askAlert: true } : {}),
+        ...(body.room_activity_enabled === true ? { roomActivityEnabled: true } : {}),
+        ...(Array.isArray(body.fix_consent_grants) ? { fixConsentGrants: parseFixConsentGrants(body.fix_consent_grants) } : {}),
         jobAvailable: body.job_available === true,
         push: parsePush(body.push, runnerId),
         syncSeconds: clampSeconds(body.sync_seconds, 15, 120, 30),
@@ -93,7 +119,7 @@ export function shadowTaskPackage(contract) {
     const verification = hasP1(payload) ? payload.verification : undefined;
     if (hasP1(payload)) {
         const resolved = resolveRunnerVerification(verification);
-        if (resolved.version === 2 && (nested(payload, 'policy.policy_key') !== REVIEWED_POLICY || nested(payload, 'policy.loop_type') !== REVIEWED_LOOP_TYPE))
+        if (resolved.version !== 1 && (nested(payload, 'policy.policy_key') !== (resolved.version === 3 ? CONTINUATION_POLICY : REVIEWED_POLICY) || nested(payload, 'policy.loop_type') !== REVIEWED_LOOP_TYPE))
             throw Error('P1_CONTRACT_REJECTED');
     }
     const repositories = (payload.repositories ?? []).map((repository) => ({
@@ -292,10 +318,14 @@ export class McpGatewayClient {
         if (!this.checkoutPath) {
             throw new Error("local checkout path is required before creating an execution binding");
         }
-        const useProvidedLease = Boolean(this.initialLeaseToken) && !input.claimNext;
+        const qualified = input.expectedJobId !== undefined || input.expectedAttemptNumber !== undefined;
+        if (qualified && (typeof input.expectedJobId !== 'string' || !input.expectedJobId.trim() || !Number.isSafeInteger(input.expectedAttemptNumber) || input.expectedAttemptNumber < 1 || input.expectedAttemptNumber > 3))
+            throw new GatewayToolError('Qualified next identity is invalid', 'work_loop_next', 'CORRECTION_LINEAGE_MISMATCH');
+        const nextArguments = { work_loop_id: input.workLoopId, ...(qualified ? { expected_job_id: input.expectedJobId, expected_attempt_number: input.expectedAttemptNumber } : {}) };
+        const useProvidedLease = Boolean(this.initialLeaseToken) && !input.claimNext && !qualified;
         const claim = useProvidedLease
             ? await this.callTool("work_loop_show", { work_loop_id: input.workLoopId })
-            : await this.callTool("work_loop_next", { work_loop_id: input.workLoopId });
+            : await this.callTool("work_loop_next", nextArguments);
         const leaseToken = useProvidedLease
             ? this.initialLeaseToken
             : requiredString(claim.lease_token, "lease token");
@@ -482,12 +512,25 @@ export class McpGatewayClient {
         return { leaseExpiresAt: context.leaseExpiresAt };
     }
     async waitForLocalJob(adapterVersions, waitSeconds = 25, jobId) {
-        return this.callTool("local_agent_jobs_wait", {
+        const claim = await this.callTool("local_agent_jobs_wait", {
             runner_id: this.runnerId,
             adapter_versions: adapterVersions,
             ...(jobId ? { job_id: jobId } : {}),
             wait_seconds: Math.max(0, Math.min(30, waitSeconds)),
         });
+        if (['continuation', 'execution_attempt', 'execution_attempt_fingerprint'].some(key => Object.hasOwn(claim, key)))
+            throw new GatewayToolError('Unexpected claimed attempt identity', 'local_agent_jobs_wait', 'GATEWAY_INVALID_TOOL_RESULT');
+        if (claim.status === 'claimed' && claim.task_package && claim.job) {
+            try {
+                assertClaimedExecutionAttempt({ id: claim.job.id, generation: claim.job.generation, workLoopId: claim.job.work_loop_id, launchFingerprint: claim.job.launch_fingerprint, launchGrant: claim.launch_grant ?? '', leaseToken: claim.lease_token ?? '', taskPackage: claim.task_package, executionAttempt: claim.attempt_context, executionAttemptFingerprint: claim.attempt_context_fingerprint });
+            }
+            catch {
+                throw new GatewayToolError('Claimed attempt identity is invalid', 'local_agent_jobs_wait', 'CORRECTION_EXECUTION_UNAVAILABLE');
+            }
+        }
+        else if (claim.attempt_context !== undefined || claim.attempt_context_fingerprint !== undefined)
+            throw new GatewayToolError('Unexpected claimed attempt identity', 'local_agent_jobs_wait', 'GATEWAY_INVALID_TOOL_RESULT');
+        return claim;
     }
     async registerLocalRunner(input) {
         return this.callTool("local_agent_runner_register", {
@@ -564,9 +607,40 @@ export class McpGatewayClient {
             reason: input.reason,
             ...(acknowledged.length > 0 ? { acknowledged_closure_ids: acknowledged } : {}),
             ...(input.guidancePolicyVersion ? { guidance_policy_version: input.guidancePolicyVersion } : {}),
+            ...(input.roomActivityV1 ? { room_activity_v1: true } : {}),
         }, signal);
         return parseRunnerSync(result, this.runnerId);
     }
+    async readRoomActivity(afterRoomId = '', limit = 50, signal) {
+        if ((afterRoomId !== '' && !ROOM_ID.test(afterRoomId)) || !Number.isInteger(limit) || limit < 1 || limit > 100) {
+            throw new GatewayToolError('Invalid Room activity query', 'work_room_read', 'GATEWAY_INVALID_TOOL_RESULT');
+        }
+        const result = await this.callTool('work_room_read', { operation: 'activity', after_room_id: afterRoomId, limit, share_only: true }, signal);
+        const body = result && typeof result === 'object' && !Array.isArray(result) ? result : undefined;
+        if (!body || !Array.isArray(body.rooms) || body.rooms.length > limit
+            || !(body.next_cursor === null || (typeof body.next_cursor === 'string' && ROOM_ID.test(body.next_cursor)))) {
+            throw new GatewayToolError('Invalid Room activity page', 'work_room_read', 'GATEWAY_INVALID_TOOL_RESULT');
+        }
+        const rooms = body.rooms.map(row => {
+            const item = row && typeof row === 'object' && !Array.isArray(row) ? row : {};
+            if (typeof item.room_id !== 'string' || !ROOM_ID.test(item.room_id)
+                || !Number.isSafeInteger(item.unread_count) || item.unread_count < 0
+                || !Number.isSafeInteger(item.latest_message_sequence) || item.latest_message_sequence < 0) {
+                throw new GatewayToolError('Invalid Room activity entry', 'work_room_read', 'GATEWAY_INVALID_TOOL_RESULT');
+            }
+            return { roomId: item.room_id, unreadCount: item.unread_count, latestMessageSequence: item.latest_message_sequence };
+        });
+        let previous = afterRoomId;
+        for (const room of rooms) {
+            if (room.roomId <= previous)
+                throw new GatewayToolError('Room activity order is invalid', 'work_room_read', 'GATEWAY_INVALID_TOOL_RESULT');
+            previous = room.roomId;
+        }
+        if (body.next_cursor !== null && (rooms.length === 0 || body.next_cursor !== previous)) {
+            throw new GatewayToolError('Room activity cursor is invalid', 'work_room_read', 'GATEWAY_INVALID_TOOL_RESULT');
+        }
+        return { rooms, nextCursor: body.next_cursor };
+    }
     async authorizeRunnerChannel(socketId, signal) {
         const result = await this.callTool("local_agent_runner_channel_auth", {
             runner_id: this.runnerId,
@@ -617,6 +691,15 @@ export class McpGatewayClient {
         const bindingId = requiredString(result.binding.id, "binding ID");
         const iterationId = requiredString(result.binding.iteration_id, "iteration ID");
         signal?.throwIfAborted();
+        if (input.claimedJob) {
+            if (input.claimedJob.id !== input.jobId || input.claimedJob.generation !== input.generation || input.claimedJob.workLoopId !== input.workLoopId || input.claimedJob.leaseToken !== input.jobLeaseToken || input.claimedJob.launchGrant !== input.launchGrant || result.work_loop_id !== input.workLoopId)
+                throw Error('CORRECTION_LINEAGE_MISMATCH');
+            assertBoundExecutionAttempt(input.claimedJob, result.bundle, iterationId);
+            if (input.claimedJob.executionAttempt && typeof result.binding_replayed !== 'boolean')
+                throw Error('CORRECTION_BINDING_RECONCILIATION_REQUIRED');
+        }
+        else if (Object.hasOwn(result.bundle, 'attempt_context') || Object.hasOwn(result.bundle, 'attempt_context_fingerprint') || nested(result.bundle, 'contract.verification.schema_version') === CONTINUATION_SCHEMA)
+            throw Error('CORRECTION_LINEAGE_MISMATCH');
         this.context = {
             jobFence: { job_id: input.jobId, generation: input.generation, lease_token: input.jobLeaseToken },
             workLoopId: requiredString(result.work_loop_id, "Work Loop ID"),
@@ -630,7 +713,7 @@ export class McpGatewayClient {
             runtimeAdapterVersion: requiredString(result.binding.runtime_adapter_version, "runtime adapter version"),
         };
         return {
-            bindingId,
+            bindingId, iterationId, ...(input.claimedJob?.executionAttempt ? { bindingReplayed: result.binding_replayed } : {}),
             taskPackage: result.bundle,
             resolvedModelId: requiredString(result.binding.resolved_model_id, "resolved model ID"),
         };

package/dist/src/protocol.js

@@ -1,3 +1,5 @@
+import { validateAttemptContext, attemptContextFingerprint } from './verification/continuation-runner-contract.js';
+import { protocolHash } from './publication/candidate.js';
 export const PROTOCOL_VERSION = "agent-execution-v1";
 export const ROLES = ["planner", "supervisor", "executor", "reviewer"];
 export const EVENT_TYPES = [
@@ -73,3 +75,34 @@ export class TerminalGuard {
         return this.terminalSeen !== null;
     }
 }
+/** Wire-domain/identity check only. Scope, measured command results and grant authority
+ * are verified by their owners; a syntactically valid payload is not completion proof. */
+export function validateAttemptEvidence(value, expected) {
+    const c = validateAttemptContext(expected), fp = attemptContextFingerprint(c);
+    const reject = () => { throw Error('CORRECTION_LINEAGE_MISMATCH'); };
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        reject();
+    const p = value, m = p.changed_paths, receipts = p.receipts;
+    const hex = (v, n) => typeof v === 'string' && new RegExp(`^[a-f0-9]{${n}}$`).test(v);
+    if (!hex(p.candidate_commit_sha, 40) || !hex(p.snapshot_fingerprint, 64) || !m || m.schema_version !== 'runner-changed-paths-v2' || m.digest_domain !== 'p1-changed-paths-v2' || m.attempt_context_fingerprint !== fp || m.base_commit_sha !== c.attempt_base_commit_sha || m.candidate_commit_sha !== p.candidate_commit_sha || !Array.isArray(m.entries) || !m.entries.length || !Array.isArray(receipts) || !receipts.length)
+        reject();
+    const { manifest_sha256, ...unsigned } = m;
+    if (manifest_sha256 !== protocolHash(unsigned))
+        reject();
+    for (const value of receipts) {
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            reject();
+        const r = value;
+        if (r.schema_version !== 'runner-command-receipt-v2' || r.attempt_context_fingerprint !== fp || r.job_id !== c.job_id || r.generation !== c.generation || r.contract_fingerprint !== c.contract_fingerprint || r.candidate_commit_sha !== p.candidate_commit_sha || r.snapshot_fingerprint !== p.snapshot_fingerprint)
+            reject();
+    }
+}
+/** Versioned host handoff check, distinct from ordinary terminal event transport. */
+export function validateAttemptHandoff(value, expected) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw Error('CORRECTION_LINEAGE_MISMATCH');
+    const h = value, fp = attemptContextFingerprint(expected);
+    if (h.schema_version !== 'gateway-candidate-handoff-v2' || h.attempt_context_fingerprint !== fp || attemptContextFingerprint(h.attempt_context) !== fp)
+        throw Error('CORRECTION_LINEAGE_MISMATCH');
+    validateAttemptEvidence(h, expected);
+}

package/dist/src/publication/server-ci-host.js

@@ -101,8 +101,11 @@ export function createServerCiLocalFixHost(options) {
                         phase = 'current_fence';
                         await current();
                         host = new GitSnapshotHost({ root: input.checkoutPath, privateRoot: root, git: options.git, baseCommitSha: binding.base_commit_sha, workingBranch: binding.working_branch, maxFileBytes: SNAPSHOT_TREE_MAX_BYTES, maxTotalBytes: SNAPSHOT_TREE_MAX_BYTES });
-                        phase = 'snapshot_observe';
-                        const observed = await host.observe();
+                        // materialize captures once, checks live source again after copying, and seals every private byte.
+                        // Use that same observation for limits and upload; a separate observe() repeats two full captures.
+                        phase = 'snapshot_materialize';
+                        seal = await host.materialize();
+                        const observed = structuredClone(seal.observation);
                         phase = 'candidate_limits';
                         let split;
                         if (limits.version === 2) {
@@ -118,10 +121,6 @@ export function createServerCiLocalFixHost(options) {
                             throw publicationError(phase, 'LOCAL_FIX_DIFF_LIMIT_REJECTED');
                         if (!observed.changed_files.length || observed.changed_files.length > limits.max_changed_files)
                             throw publicationError(phase, 'LOCAL_FIX_FILE_COUNT_REJECTED');
-                        phase = 'snapshot_materialize';
-                        seal = await host.materialize();
-                        if (protocolHash(observed) !== protocolHash(seal.observation))
-                            throw denied();
                         // The v1 wire represents ordinary text bytes only. Refuse any change whose
                         // executable/type metadata would be lost by the provider's regular-file write.
                         phase = 'delta_format';

package/dist/src/rooms/activity.js

@@ -0,0 +1,84 @@
+import { RoomActivityStore } from './store.js';
+export const ROOM_CHAT_LINE = 'AI Gateway notice: Tell the person new Work Room activity is available. Read the Room only if they ask; do not reply automatically.';
+/** One actor-owned projection. Scans serialize so a signal and periodic sync cannot race the watermark file. */
+export class RoomActivityRuntime {
+    deps;
+    store;
+    queue = Promise.resolve();
+    constructor(deps) {
+        this.deps = deps;
+        this.store = new RoomActivityStore(deps.stateRoot);
+    }
+    exclusive(work) {
+        const result = this.queue.then(work);
+        this.queue = result.then(() => undefined, () => undefined);
+        return result;
+    }
+    async handleSync(enabled) {
+        await this.exclusive(async () => {
+            const state = await this.store.load();
+            if (!enabled) {
+                if (state.pendingChat.length || state.pendingOs.length) {
+                    state.pendingChat = [];
+                    state.pendingOs = [];
+                    await this.store.save(state);
+                }
+                return;
+            }
+            const rows = [];
+            const cursors = new Set();
+            let cursor = state.scanCursor ?? '';
+            let complete = false;
+            for (let page = 0; page < 20; page++) {
+                if (cursors.has(cursor))
+                    throw new Error('ROOM_ACTIVITY_CURSOR_LOOP');
+                cursors.add(cursor);
+                const result = await this.deps.read(cursor, 50);
+                rows.push(...result.rooms);
+                if (result.nextCursor === null) {
+                    cursor = '';
+                    complete = true;
+                    break;
+                }
+                cursor = result.nextCursor;
+            }
+            const visible = new Set([...(state.scanVisible ?? []), ...rows.map(row => row.roomId)]);
+            const next = {
+                version: 1, seen: complete ? {} : { ...state.seen },
+                pendingOs: complete ? state.pendingOs.filter(id => visible.has(id)) : [...state.pendingOs],
+                pendingChat: complete ? state.pendingChat.filter(id => visible.has(id)) : [...state.pendingChat],
+                ...(complete ? {} : { scanCursor: cursor, scanVisible: [...visible] }),
+            };
+            if (complete) {
+                for (const id of visible)
+                    if (id in state.seen)
+                        next.seen[id] = state.seen[id];
+            }
+            for (const row of rows) {
+                const previous = state.seen[row.roomId] ?? 0;
+                next.seen[row.roomId] = Math.max(previous, row.latestMessageSequence);
+                if (row.unreadCount > 0 && row.latestMessageSequence > previous) {
+                    if (!next.pendingOs.includes(row.roomId))
+                        next.pendingOs.push(row.roomId);
+                    if (!next.pendingChat.includes(row.roomId))
+                        next.pendingChat.push(row.roomId);
+                }
+            }
+            await this.store.save(next);
+            if (next.pendingOs.length && await this.deps.notify()) {
+                next.pendingOs = [];
+                await this.store.save(next);
+            }
+        });
+    }
+    async claimNotice() {
+        return this.exclusive(async () => {
+            const state = await this.store.load();
+            if (!state.pendingChat.length)
+                return null;
+            state.pendingChat = [];
+            await this.store.save(state);
+            return ROOM_CHAT_LINE;
+        });
+    }
+}

package/dist/src/rooms/notifier.js

@@ -0,0 +1,21 @@
+import { execFile } from 'node:child_process';
+export const ROOM_OS_LINE = 'AI Gateway: new Work Room activity. Open your AI chat to review it.';
+const SCRIPT = ['on run argv', 'display notification (item 1 of argv) with title "AI Gateway"', 'end run'];
+export function createRoomNotifier(deps = {}) {
+    const run = deps.run ?? ((file, args) => new Promise((resolve, reject) => {
+        execFile(file, args, { timeout: 3000, killSignal: 'SIGKILL' }, error => error ? reject(error) : resolve());
+    }));
+    return async () => {
+        if ((deps.platform ?? process.platform) !== 'darwin')
+            return false;
+        try {
+            await run('/usr/bin/osascript', [...SCRIPT.flatMap(line => ['-e', line]), ROOM_OS_LINE]);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    };
+}
+/** Generic macOS notice. No Room metadata enters the command line or error log. */
+export const notifyRoomActivity = createRoomNotifier();

package/dist/src/rooms/store.js

@@ -0,0 +1,56 @@
+import { promises as fs } from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import { join } from 'node:path';
+const EMPTY = () => ({ version: 1, seen: {}, pendingOs: [], pendingChat: [] });
+const ROOM_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+export class RoomActivityStore {
+    stateRoot;
+    path;
+    constructor(stateRoot) {
+        this.stateRoot = stateRoot;
+        this.path = join(stateRoot, 'room-activity.json');
+    }
+    async load() {
+        let content;
+        try {
+            content = await fs.readFile(this.path, 'utf8');
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return EMPTY();
+            throw error;
+        }
+        const raw = JSON.parse(content);
+        if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+            throw new Error('ROOM_ACTIVITY_STATE_INVALID');
+        const state = raw;
+        if (state.version !== 1 || !state.seen || typeof state.seen !== 'object' || Array.isArray(state.seen)
+            || !Array.isArray(state.pendingOs) || !Array.isArray(state.pendingChat))
+            throw new Error('ROOM_ACTIVITY_STATE_INVALID');
+        for (const [id, sequence] of Object.entries(state.seen)) {
+            if (!ROOM_ID.test(id) || !Number.isSafeInteger(sequence) || sequence < 0)
+                throw new Error('ROOM_ACTIVITY_STATE_INVALID');
+        }
+        for (const id of [...state.pendingOs, ...state.pendingChat]) {
+            if (typeof id !== 'string' || !ROOM_ID.test(id) || !(id in state.seen))
+                throw new Error('ROOM_ACTIVITY_STATE_INVALID');
+        }
+        if (state.scanCursor !== undefined && (typeof state.scanCursor !== 'string' || !ROOM_ID.test(state.scanCursor)))
+            throw new Error('ROOM_ACTIVITY_STATE_INVALID');
+        if (state.scanVisible !== undefined && (!Array.isArray(state.scanVisible)
+            || state.scanVisible.some(id => typeof id !== 'string' || !ROOM_ID.test(id))))
+            throw new Error('ROOM_ACTIVITY_STATE_INVALID');
+        return state;
+    }
+    async save(state) {
+        await fs.mkdir(this.stateRoot, { recursive: true, mode: 0o700 });
+        const temp = `${this.path}.${randomUUID()}.tmp`;
+        try {
+            await fs.writeFile(temp, JSON.stringify(state), { mode: 0o600, flag: 'wx' });
+            await fs.rename(temp, this.path);
+        }
+        finally {
+            await fs.rm(temp, { force: true });
+        }
+    }
+}

package/dist/src/safety/claude-managed-scope.js

@@ -1,8 +1,7 @@
 import os from 'node:os';
 import path from 'node:path';
 import { lstat, readdir } from 'node:fs/promises';
-import { createPolicyInventoryClient, verifyPolicyObserver } from './policy-inventory-client.js';
-import { CLAUDE_MANAGED_PREFERENCE_DOMAIN, CLAUDE_MANAGED_SETTINGS_DIRECTORY, CLAUDE_MANAGED_SETTINGS_FILES, CLAUDE_POLICY_OBSERVER, claudeCanonicalSha256 } from './claude-release.js';
+import { CLAUDE_MANAGED_PREFERENCE_DOMAIN, CLAUDE_MANAGED_SETTINGS_DIRECTORY, CLAUDE_MANAGED_SETTINGS_FILES, claudeCanonicalSha256 } from './claude-release.js';
 const unverified = () => Error('CLAUDE_MANAGED_SCOPE_UNVERIFIED');
 /** Claude managed sources the Runner checks on macOS (gate managed_scope_exclusion, scope unmanaged_personal_only). */
 export function claudeManagedPaths(user, root = '/') {
@@ -50,38 +49,27 @@ export async function assertClaudeManagedPathsAbsent(user, root = '/') {
     if (entries.length !== 0)
         throw unverified();
 }
-/** Compiled defaults: the pinned installed observer (single-use clients) and the real managed locations. */
+/** Compiled defaults: the real managed locations. */
 export function claudeManagedScopeDeps(root = '/') {
-    return {
-        checkReady: async () => { verifyPolicyObserver(CLAUDE_POLICY_OBSERVER); await createPolicyInventoryClient(CLAUDE_POLICY_OBSERVER).checkReady(); },
-        collect: () => createPolicyInventoryClient(CLAUDE_POLICY_OBSERVER).collectOnce(),
-        managedPathsAbsent: () => assertClaudeManagedPathsAbsent(os.userInfo().username, root),
-    };
+    return { managedPathsAbsent: () => assertClaudeManagedPathsAbsent(os.userInfo().username, root) };
 }
 export async function claudeManagedScopeReady(deps) {
     try {
-        await deps.checkReady();
         await deps.managedPathsAbsent();
     }
     catch {
         throw unverified();
     }
 }
-/** Per-job managed scope: no configuration profile at all for machine and user (complete, empty, at most 60 s old),
- * plus absent Claude managed files. Managed, partial, unknown or stale input blocks. */
+/** Per-job managed scope: absent Claude managed files and managed preferences. Present or unreadable input blocks. */
 export async function collectClaudeManagedScope(deps) {
     try {
-        const value = await deps.collect(), now = (deps.now ?? Date.now)();
-        const r = value && typeof value === 'object' && !Array.isArray(value) ? value : {};
-        const observedAt = r.observedAt;
-        if (r.complete !== true || r.empty !== true || r.scope !== 'machine_and_current_user' || typeof observedAt !== 'number' || !Number.isSafeInteger(observedAt)
-            || observedAt > now || now - observedAt > 60_000 || typeof r.inventoryFingerprint !== 'string' || !/^[a-f0-9]{64}$/.test(r.inventoryFingerprint))
-            throw unverified();
         await deps.managedPathsAbsent();
-        const bound = { observer_sha256: CLAUDE_POLICY_OBSERVER.sha256, inventory_fingerprint: r.inventoryFingerprint, managed_paths: 'absent' };
-        return Object.freeze({ observerSha256: CLAUDE_POLICY_OBSERVER.sha256, inventoryFingerprint: r.inventoryFingerprint, fingerprint: claudeCanonicalSha256(bound) });
     }
     catch {
         throw unverified();
     }
+    const bound = { basis: 'managed_paths_as_user', managed_paths: 'absent', directory: CLAUDE_MANAGED_SETTINGS_DIRECTORY,
+        files: [...CLAUDE_MANAGED_SETTINGS_FILES], preference_domain: CLAUDE_MANAGED_PREFERENCE_DOMAIN };
+    return Object.freeze({ fingerprint: claudeCanonicalSha256(bound) });
 }

package/dist/src/safety/claude-release.js

@@ -22,8 +22,6 @@ export const CLAUDE_TEAM_ID = 'Q6L2SF6YDW';
 export const CLAUDE_SIGNING_IDENTIFIER = 'com.anthropic.claude-code';
 /** Official native-build distribution. Never taken from the Gateway, a task, config or env. */
 export const CLAUDE_DOWNLOAD_BASE = 'https://downloads.claude.ai/claude-code-releases';
-/** The installed privileged observer; the same reviewed binary the Codex daemon release pins. */
-export const CLAUDE_POLICY_OBSERVER = Object.freeze({ protocol: 'policy-inventory-v1', sha256: '2a07812cd47782826a359b749096b681a6ee49e91f990d48abdc60f2d46e4c9c' });
 /** macOS managed sources (docs/superpowers/specs/2026-10-16-cli-managed-auth-lab-scope.json) and the MDM preference domain. */
 export const CLAUDE_MANAGED_SETTINGS_DIRECTORY = '/Library/Application Support/ClaudeCode';
 export const CLAUDE_MANAGED_SETTINGS_FILES = Object.freeze([`${CLAUDE_MANAGED_SETTINGS_DIRECTORY}/managed-settings.json`, `${CLAUDE_MANAGED_SETTINGS_DIRECTORY}/managed-mcp.json`]);

package/dist/src/safety/claude-review-evidence.js

@@ -24,8 +24,8 @@ export const CLAUDE_REVIEW_GATE_SCENARIOS = Object.freeze({
     required_mcp_startup: Object.freeze(['mcp_startup', 'tools_offered', 'allowed_read']),
     source_exclusion: Object.freeze(['allowed_read', 'source_exclusion', 'fake_credentials', 'communication_boundary']),
 });
-/** managed_scope_exclusion is checked per job by the installed observer and the managed-path check (claude-managed-scope.ts). */
-export const CLAUDE_MANAGED_SCOPE_BASIS = 'observer_inventory_and_managed_paths_per_job';
+/** managed_scope_exclusion is checked per job by the managed-path check as the user (claude-managed-scope.ts, decision 3dde6d80). */
+export const CLAUDE_MANAGED_SCOPE_BASIS = 'managed_paths_as_user_per_job';
 const gated = (gate) => Object.hasOwn(CLAUDE_REVIEW_GATE_SCENARIOS, gate);
 export function buildClaudeReviewEvidence(input) {
     if (!isDeepStrictEqual(input.scenarios.map(s => s.id), [...CLAUDE_REVIEW_SCENARIOS])