opencode-workflow-guard 1.12.0 → 1.12.1

package/docs/policies.md

@@ -85,7 +85,7 @@ It is a policy and enforcement layer, not an agent harness. Policies may constra
 - With project `recoveryCheckpoints: true`, or the `autonomous` operation profile unless explicitly overridden, genuine root-session user runs capture a private Git checkpoint before agent work starts. Checkpoints preserve tracked and untracked state without using the user's stash list; subagents and generated continuation prompts do not replace them. At `session.idle`, the run's resulting workspace fingerprint is recorded before automatic continuation. `guard_recovery_restore` is provenance-bound to the same root session and refuses restoration after any intervening workspace change. Operation profiles only set optional workflow defaults and cannot weaken core safety policies.
 - Automatic continuation remains synthetic. By default, an eligible root session with unfinished owned todos briefly waits for OpenCode's native asynchronous title generation before that continuation is sent; set `titleSettleWorkaround: false` to opt out. The bounded wait never rewrites titles or provider/model parameters.
 - **Git State & Snapshot Binding:** Verification evidence records the current git commit hash (`git rev-parse HEAD`) and working tree status. If unverified edits or index modifications occur after verification, fresh verification is enforced.
-- **Durable Disk Cache:** Passing verification results are cached to `~/.local/state/opencode/workflow-guard/last-verify.json`, allowing session restarts and multi-agent handoffs to retain valid verification evidence without redundant test runs. Durable evidence is **workspace-bound**: a cached result is only accepted for the workspace that produced it, so a passing run in one project can never satisfy finalization in another.
+- **Durable Disk Cache:** Passing verification results (`~/.local/state/opencode/workflow-guard/last-verify.json`) and passing secondary review approvals (`~/.local/state/opencode/workflow-guard/last-review.json`) are cached to disk, allowing session restarts and multi-agent handoffs to retain valid verification and review evidence without redundant test runs. Durable evidence is **workspace-bound**: a cached result is only accepted for the workspace that produced it, so a passing run in one project can never satisfy finalization in another.
 - If verification fails, finalization is blocked with a structured summary of error markers, stack traces, and failure output.
 - OpenCode's current `lsp.client.diagnostics` event identifies the server and path but does not expose the diagnostics themselves, so the guard deliberately does not claim an LSP-clean finalization gate until the SDK provides a supported diagnostics source.
 - The verify command is **disabled** when `WORKFLOW_GUARD_VERIFY` is empty (`""`).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-workflow-guard",
-  "version": "1.12.0",
+  "version": "1.12.1",
   "description": "Deterministic workflow and safety policy enforcement for OpenCode",
   "license": "MIT",
   "type": "module",

package/src/lib/audit.ts

@@ -3,7 +3,7 @@ import { createHash, randomUUID } from "node:crypto";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { Database, type SqliteDatabase } from "./sqlite.ts";
-import type { AuditEntry, PolicyDecision, VerifyResult } from "./types.ts";
+import type { AuditEntry, PolicyDecision, VerifyResult, ReviewResult } from "./types.ts";
 import { asRecord } from "./utils.ts";
 
 const AUDIT_DIR = join(
@@ -14,6 +14,7 @@ const AUDIT_DIR = join(
 const AUDIT_FILE = join(AUDIT_DIR, "workflow-guard.jsonl");
 const VERIFY_CACHE_FILE = join(AUDIT_DIR, "last-verify.json");
 const VERIFY_HISTORY_FILE = join(AUDIT_DIR, "verify-history.jsonl");
+const REVIEW_CACHE_FILE = join(AUDIT_DIR, "last-review.json");
 const MAX_AUDIT_BYTES = 4 * 1024 * 1024;
 const RETAIN_AUDIT_BYTES = 2 * 1024 * 1024;
 const MAX_VERIFY_HISTORY_BYTES = 1024 * 1024;
@@ -62,6 +63,10 @@ export function getVerifyHistoryFilePath(): string {
 	return VERIFY_HISTORY_FILE;
 }
 
+export function getReviewCacheFilePath(): string {
+	return REVIEW_CACHE_FILE;
+}
+
 function appendBoundedJsonlUnlocked(path: string, value: unknown, maxBytes: number, retainBytes: number): void {
 	appendFileSync(path, JSON.stringify(value) + "\n", { encoding: "utf8", mode: 0o600 });
 	chmodSync(path, 0o600);
@@ -156,6 +161,33 @@ export function loadVerifyCache(): VerifyResult | undefined {
 	return undefined;
 }
 
+/**
+ * Persists passing secondary review approval to disk so session restarts
+ * or multi-agent handoffs retain valid review approval state.
+ */
+export function persistReviewCache(reviewData: ReviewResult): void {
+	try {
+		mkdirSync(AUDIT_DIR, { recursive: true });
+		writeFileSync(REVIEW_CACHE_FILE, JSON.stringify(reviewData, null, 2), { encoding: "utf8", mode: 0o600 });
+		chmodSync(REVIEW_CACHE_FILE, 0o600);
+	} catch {}
+}
+
+/**
+ * Loads durable review approval from disk if present.
+ */
+export function loadReviewCache(): ReviewResult | undefined {
+	try {
+		if (!existsSync(REVIEW_CACHE_FILE)) return undefined;
+		const raw = readFileSync(REVIEW_CACHE_FILE, "utf8");
+		const data = JSON.parse(raw);
+		if (data && typeof data.reviewer === "string" && typeof data.timestamp === "number" && typeof data.passed === "boolean") {
+			return data;
+		}
+	} catch {}
+	return undefined;
+}
+
 /**
  * Reads recent audit entries from the end of the JSONL audit log with a bounded
  * buffer window to prevent memory spikes on long-lived installations.

package/src/lib/custom-tools.ts

@@ -29,6 +29,7 @@ import {
 	isReviewRequired,
 	recordMutation,
 	recordReviewResult,
+	resolveEffectiveWorkspace,
 	runWithRuntimeState,
 } from "./state.ts";
 import { getRalphOutcome } from "../policies/continuation.ts";
@@ -46,11 +47,19 @@ import { currentGitBranch, onProtectedBranch } from "../policies/git.ts";
 import { effectiveTodoOwnerSessionID, effectiveTodos, fetchParentSession, fetchParentSessionID, hasActiveTodo } from "../policies/todo.ts";
 
 export function extractReviewFollowups(summary: string): Array<{ severity: "P2" | "P3"; summary: string }> {
-	return summary.split(/\r?\n/).map((line) => ({
-		line: line.trim(),
-		severity: line.match(/(?:^|\s)(P[23])(?:\b|[:])/i)?.[1]?.toUpperCase() as "P2" | "P3" | undefined,
-	})).filter((finding): finding is { line: string; severity: "P2" | "P3" } => Boolean(finding.line && finding.severity))
-		.map((finding) => ({ severity: finding.severity, summary: finding.line }));
+	return summary.split(/\r?\n/).map((line) => {
+		const trimmed = line.trim();
+		const match = trimmed.match(/(?:^|\s)(P[23])(?:\b|[:])/i);
+		const severity = match?.[1]?.toUpperCase() as "P2" | "P3" | undefined;
+		return { line: trimmed, severity };
+	}).filter((finding): finding is { line: string; severity: "P2" | "P3" } => {
+		if (!finding.line || !finding.severity) return false;
+		const rest = finding.line.replace(new RegExp(`^.*?(?:${finding.severity})\\s*[:\\-]?\\s*`, "i"), "").trim();
+		if (!rest || /^(?:none|nil|n\/?a|0|zero|no\s+(?:issues|findings|defects|items|blockers)|clean|passed|ok|none\s+identified)\b/i.test(rest)) {
+			return false;
+		}
+		return true;
+	}).map((finding) => ({ severity: finding.severity, summary: finding.line }));
 }
 
 export function buildWorkflowGuardSystemGuidance(options: {
@@ -196,9 +205,13 @@ export function createCustomTools(options: {
 			}),
 		} : {}),
 		guard_status: tool({
-			description: "Inspect active guardrails, current branch protection, mutation count, outstanding verification/review requirements, and ralph status. Proactively call at session start and before completing tasks or creating PRs.", args: {},
-			execute: async (_args, toolContext) => {
-				const root = effectiveRoot; const branch = currentGitBranch(root) ?? "unknown"; const isProtected = onProtectedBranch(root); const lastV = getLastVerifyResultForWorkspace(root); const lastR = getLastReviewResultForWorkspace(root); const lastMut = getWorkspaceMutationTimestamp(root); const cfg = loadProjectConfig(root);
+			description: "Inspect active guardrails, current branch protection, mutation count, outstanding verification/review requirements, and ralph status. Proactively call at session start and before completing tasks or creating PRs.",
+			args: {
+				directory: tool.schema.string().optional().describe("Target repository directory to inspect (defaults to active session directory or workspace root)"),
+			},
+			execute: async (args, toolContext) => {
+				const root = await resolveEffectiveWorkspace({ sessionID: toolContext.sessionID, directory: args?.directory, fallback: toolContext.worktree || toolContext.directory || effectiveRoot });
+				const branch = currentGitBranch(root) ?? "unknown"; const isProtected = onProtectedBranch(root); const lastV = getLastVerifyResultForWorkspace(root); const lastR = getLastReviewResultForWorkspace(root); const lastMut = getWorkspaceMutationTimestamp(root); const cfg = loadProjectConfig(root);
 				const subject = { workspace: projectRootKey(root), commitHash: getCurrentGitCommitHash(root), worktreeFingerprint: getGitWorktreeFingerprint(root) };
 				const verifyEvidence = lastV ? verificationEvidence(lastV) : undefined;
 				const reviewEvidenceRecord = lastR ? reviewEvidence(lastR) : undefined;
@@ -238,7 +251,12 @@ export function createCustomTools(options: {
 		guard_why: tool({ description: "Simulate and return the structured policy decision for a specific tool call or command. Proactively use before executing questionable or complex commands to check if they would be blocked by guard policies.", args: { tool: tool.schema.string().describe("Tool name (e.g. bash, edit, write, read, apply_patch)"), input: tool.schema.record(tool.schema.string(), tool.schema.any()).optional().describe("Tool input arguments") }, execute: async (args, toolContext) => JSON.stringify(await runWithRuntimeState(effectiveRoot, client, () => guardToolCallImpl(args.tool, args.input ?? {}, { sessionID: toolContext.sessionID, worktree: toolContext.worktree, directory: toolContext.directory, simulate: true })), null, 2) }),
 		record_review: tool({
 			description: "Record a secondary reviewer agent's approval or critique of the current changes. The summary must reference the 5 core review axes from guard_review_rubric (test integrity, task completeness, cleanliness, security, platform).",
-			args: { reviewer: tool.schema.string().describe("Identifier/name of the reviewer subagent"), summary: tool.schema.string().describe("Review findings summary across the 5 core review axes"), passed: tool.schema.boolean().describe("True if change is approved, false if changes requested") },
+			args: {
+				reviewer: tool.schema.string().describe("Identifier/name of the reviewer subagent"),
+				summary: tool.schema.string().describe("Review findings summary across the 5 core review axes"),
+				passed: tool.schema.boolean().describe("True if change is approved, false if changes requested"),
+				directory: tool.schema.string().optional().describe("Target repository directory being reviewed (defaults to parent session's repository or active directory)"),
+			},
 			execute: async (args, toolContext) => {
 				const auditVerdict = (verdict: "approved" | "changes_requested" | "rejected", reason: string) => audit({ ts: new Date().toISOString(), sessionID: toolContext.sessionID, tool: "record_review.verdict", decision: verdict === "rejected" ? "block" : "allow", phase: "event", reason, evidence: { reviewVerdict: verdict } });
 				const parentSessionID = await runWithRuntimeState(effectiveRoot, client, () => fetchParentSessionID(toolContext.sessionID));
@@ -247,8 +265,9 @@ export function createCustomTools(options: {
 				const referenced = axesRefs.filter((axis) => args.summary.toLowerCase().includes(axis));
 				if (referenced.length < 3) { auditVerdict("rejected", "insufficient_rubric_axes"); return `[workflow-guard] Review rejected: summary must reference the review axes (found ${referenced.length}/5). Call guard_review_rubric to get the rubric, evaluate each axis, and include findings per axis in the summary.`; }
 				if (args.passed && /(?:^|\s)(?:\[p[01]\]|p[01]\s*:\s*(?:blocker|defect|vulnerability|error|bug|issue)|p[01]\s+blocker)/i.test(args.summary)) { auditVerdict("rejected", "approval_contains_blocker"); return "[workflow-guard] Review rejected: cannot record approval when P0 or P1 blockers are flagged in findings. Resolve all P0/P1 issues before approving or record review with passed=false."; }
-				recordReviewResult(args.reviewer, args.summary, args.passed, parentSessionID, toolContext.worktree || toolContext.directory);
-				if (followupStore && !secretIn(args.summary)) for (const finding of extractReviewFollowups(args.summary)) recordReviewFollowup(followupStore, { severity: finding.severity, summary: finding.summary, reviewer: args.reviewer, sessionID: toolContext.sessionID, commit: getCurrentGitCommitHash(effectiveRoot) });
+				const reviewWorkspace = await resolveEffectiveWorkspace({ sessionID: toolContext.sessionID, directory: args.directory, fallback: toolContext.worktree || toolContext.directory || effectiveRoot });
+				recordReviewResult(args.reviewer, args.summary, args.passed, parentSessionID, reviewWorkspace);
+				if (followupStore && !secretIn(args.summary)) for (const finding of extractReviewFollowups(args.summary)) recordReviewFollowup(followupStore, { severity: finding.severity, summary: finding.summary, reviewer: args.reviewer, sessionID: toolContext.sessionID, commit: getCurrentGitCommitHash(reviewWorkspace) });
 				auditVerdict(args.passed ? "approved" : "changes_requested", args.passed ? "approved" : "changes_requested");
 				return args.passed ? `[workflow-guard] Review recorded as APPROVED by ${args.reviewer}.` : `[workflow-guard] Review recorded as CHANGES REQUESTED by ${args.reviewer}.`;
 			},
@@ -256,13 +275,18 @@ export function createCustomTools(options: {
 		guard_review_followups: tool({ description: "List durable local P2/P3 review follow-ups (technical debt) for this project. Proactively check during planning or before final verification to address open findings.", args: {}, execute: async () => JSON.stringify(followupStore ? listReviewFollowups(followupStore) : [], null, 2) }),
 		guard_review_followup_resolve: tool({ description: "Resolve a durable local review follow-up after the underlying issue has been fixed and verified.", args: { id: tool.schema.string() }, execute: async (args) => followupStore && resolveReviewFollowup(followupStore, args.id) ? `[workflow-guard] Review follow-up ${args.id} resolved.` : `[workflow-guard] Review follow-up ${args.id} was not open or was not found.` }),
 		guard_review_rubric: tool({
-			description: "Get the secondary-review rubric for the current branch diff across 5 core review axes (test integrity, task completeness, cleanliness, security, platform). The orchestrator should call this before finalizing work or creating a PR, then spawn a reviewer subagent with the rubric as the prompt, which records its verdict via record_review.", args: { base: tool.schema.string().optional().describe("Base ref to diff against (default: origin/main, origin/master, main)") },
-			execute: async (args) => {
+			description: "Get the secondary-review rubric for the current branch diff across 5 core review axes (test integrity, task completeness, cleanliness, security, platform). The orchestrator should call this before finalizing work or creating a PR, then spawn a reviewer subagent with the rubric as the prompt, which records its verdict via record_review.",
+			args: {
+				base: tool.schema.string().optional().describe("Base ref to diff against (default: origin/main, origin/master, main)"),
+				directory: tool.schema.string().optional().describe("Target repository directory (defaults to active session directory or workspace root)"),
+			},
+			execute: async (args, toolContext) => {
 				const sanitizedBase = typeof args.base === "string" && !args.base.startsWith("-") && !/[\s;'"\0]/.test(args.base) ? args.base : undefined;
 				const bases = sanitizedBase ? [sanitizedBase] : ["origin/main", "origin/master", "main", "master"];
+				const rubricWorkspace = await resolveEffectiveWorkspace({ sessionID: toolContext?.sessionID, directory: args?.directory, fallback: toolContext?.worktree || toolContext?.directory || effectiveRoot });
 				let diffText = "";
-				for (const base of bases) { const res = spawnSync("git", ["diff", "--", `${base}...HEAD`], { cwd: getWorkspaceRoot(), encoding: "utf8", timeout: 10_000 }); if (res.status === 0 && res.stdout.trim()) { diffText = res.stdout; break; } }
-				if (!diffText) { const last = spawnSync("git", ["diff", "--", "HEAD~1"], { cwd: getWorkspaceRoot(), encoding: "utf8", timeout: 10_000 }); diffText = last.status === 0 ? last.stdout : "(no diff available)"; }
+				for (const base of bases) { const res = spawnSync("git", ["diff", "--", `${base}...HEAD`], { cwd: rubricWorkspace, encoding: "utf8", timeout: 10_000 }); if (res.status === 0 && res.stdout.trim()) { diffText = res.stdout; break; } }
+				if (!diffText) { const last = spawnSync("git", ["diff", "--", "HEAD~1"], { cwd: rubricWorkspace, encoding: "utf8", timeout: 10_000 }); diffText = last.status === 0 ? last.stdout : "(no diff available)"; }
 				return buildReviewRubric(diffText);
 			},
 		}),

package/src/lib/evidence.ts

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import type { ToolOutcome } from "./tool-outcomes.ts";
 import type { EvidenceRecord, EvidenceSubject, PolicyDecision, ReviewResult, VerifyResult } from "./types.ts";
+import { isSameGitRepo } from "./project-config.ts";
 
 function evidenceId(kind: EvidenceRecord["kind"], observedAt: number, subject: EvidenceRecord["subject"], source: Record<string, unknown>): string {
 	return createHash("sha256").update(JSON.stringify({ kind, observedAt, subject, source })).digest("hex");
@@ -40,7 +41,11 @@ export function agentAssertionEvidence(assertion: string, observedAt: number, su
 }
 
 export function evidenceMatchesSubject(evidence: EvidenceRecord, subject: EvidenceSubject): boolean {
-	return evidence.subject.workspace === subject.workspace &&
+	const workspaceMatches =
+		evidence.subject.workspace === subject.workspace ||
+		(Boolean(evidence.subject.workspace && subject.workspace) &&
+			isSameGitRepo(evidence.subject.workspace, subject.workspace));
+	return workspaceMatches &&
 		evidence.subject.commitHash === subject.commitHash &&
 		evidence.subject.worktreeFingerprint === subject.worktreeFingerprint &&
 		evidence.subject.sessionID === subject.sessionID;

package/src/lib/guard-dispatcher.ts

@@ -1,8 +1,8 @@
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
-import { loadVerifyCache } from "./audit.ts";
+import { loadReviewCache, loadVerifyCache } from "./audit.ts";
 import { isEvidenceFresh, reviewEvidence, verificationEvidence } from "./evidence.ts";
-import { projectRootKey } from "./project-config.ts";
+import { findGitRoot, isSameGitRepo, projectRootKey } from "./project-config.ts";
 import {
 	getLastReviewResult,
 	getSdkClient,
@@ -435,7 +435,13 @@ export async function guardToolCallImpl(
 				if (mergedStatus.merged) preflightFailures.push(mergedStatus.reason ?? "Branch is already merged or closed.");
 			}
 			if (isReviewRequired(prRoot)) {
-				const review = context?.sessionID ? (sessionReviews.get(context.sessionID) ?? getLastReviewResult()) : getLastReviewResult();
+				let review = context?.sessionID ? (sessionReviews.get(context.sessionID) ?? getLastReviewResult()) : getLastReviewResult();
+				if (!review) {
+					const diskCached = loadReviewCache();
+					if (diskCached && diskCached.passed && diskCached.workspace && (projectRootKey(diskCached.workspace) === projectRootKey(prRoot) || isSameGitRepo(diskCached.workspace, prRoot))) {
+						review = diskCached;
+					}
+				}
 				const reviewMatchesContext = review?.passed === true && isEvidenceFresh(reviewEvidence(review), { workspace: projectRootKey(prRoot), commitHash: getCurrentGitCommitHash(prRoot), worktreeFingerprint: getGitWorktreeFingerprint(prRoot), sessionID: review.targetSessionID }, 0) && (!review.targetSessionID || review.targetSessionID === context?.sessionID);
 				if (!reviewMatchesContext) preflightFailures.push("Passing secondary review approval is required; invoke a secondary review subagent and record approval with record_review.");
 			}

package/src/lib/project-config.ts

@@ -1,5 +1,6 @@
-import { existsSync, readFileSync, realpathSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { join, resolve, dirname } from "node:path";
+import { spawnSync } from "node:child_process";
 import type { ProjectConfig } from "./types.ts";
 
 const projectConfigCache = new Map<string, ProjectConfig>();
@@ -12,6 +13,55 @@ export function projectRootKey(root: string): string {
 	}
 }
 
+export function findGitRoot(startPath?: string): string | undefined {
+	if (!startPath || typeof startPath !== "string") return undefined;
+	try {
+		const resolved = resolve(startPath);
+		let dir = resolved;
+		try {
+			const stat = statSync(resolved);
+			dir = stat.isDirectory() ? resolved : dirname(resolved);
+		} catch {
+			dir = dirname(resolved);
+		}
+		const res = spawnSync("git", ["-C", dir, "rev-parse", "--show-toplevel"], {
+			encoding: "utf8",
+			timeout: 5_000,
+		});
+		if (res.status === 0 && res.stdout.trim()) {
+			return projectRootKey(res.stdout.trim());
+		}
+	} catch {}
+	return undefined;
+}
+
+export function getGitCommonDir(root: string): string | undefined {
+	try {
+		const res = spawnSync("git", ["-C", root, "rev-parse", "--path-format=absolute", "--git-common-dir"], {
+			encoding: "utf8",
+			timeout: 5_000,
+		});
+		if (res.status === 0 && res.stdout.trim()) {
+			return projectRootKey(res.stdout.trim());
+		}
+	} catch {}
+	return undefined;
+}
+
+export function isSameGitRepo(pathA?: string, pathB?: string): boolean {
+	if (!pathA || !pathB) return false;
+	const keyA = projectRootKey(pathA);
+	const keyB = projectRootKey(pathB);
+	if (keyA === keyB) return true;
+	const commonA = getGitCommonDir(keyA);
+	const commonB = getGitCommonDir(keyB);
+	if (commonA && commonB && commonA === commonB) return true;
+	const rootA = findGitRoot(keyA);
+	const rootB = findGitRoot(keyB);
+	if (rootA && rootB && rootA === rootB) return true;
+	return false;
+}
+
 export function projectConfigCandidates(root: string): string[] {
 	return [
 		join(root, ".opencode", "workflow-guard.json"),

package/src/lib/state.ts

@@ -1,8 +1,8 @@
-import { realpathSync } from "node:fs";
+import { realpathSync, existsSync, unlinkSync } from "node:fs";
 import { resolve } from "node:path";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { persistVerifyCache, persistVerifyHistory } from "./audit.ts";
-import { getCachedProjectConfig, loadProjectConfig, projectRootKey } from "./project-config.ts";
+import { getReviewCacheFilePath, loadReviewCache, persistReviewCache, persistVerifyCache, persistVerifyHistory } from "./audit.ts";
+import { findGitRoot, getCachedProjectConfig, isSameGitRepo, loadProjectConfig, projectRootKey } from "./project-config.ts";
 import { snipVerifyOutput, getCurrentGitCommitHash, getGitStatusSummary, getGitWorktreeFingerprint } from "./verify.ts";
 import type {
 	TodoSdkClient,
@@ -74,6 +74,18 @@ const workspaceMutationTimestamps = new Map<string, number>();
 const workspaceMutationCounts = new Map<string, number>();
 export const sessionMutationTimestamps = new Map<string, number>();
 export const sessionMutationCounts = new Map<string, number>();
+export const sessionWorkspaces = new Map<string, string>();
+
+export function setSessionWorkspace(sessionID: string, workspace: string): void {
+	if (!sessionID || !workspace) return;
+	const gitRoot = findGitRoot(workspace);
+	sessionWorkspaces.set(sessionID, gitRoot ?? projectRootKey(workspace));
+}
+
+export function getSessionWorkspace(sessionID?: string): string | undefined {
+	if (!sessionID) return undefined;
+	return sessionWorkspaces.get(sessionID);
+}
 
 export let lastVerify: VerifyResult | undefined;
 export const sessionVerifyResults = new Map<string, NonNullable<VerifyResult>>();
@@ -95,6 +107,10 @@ export function recordMutation(sessionID?: string, actorSessionID?: string): voi
 	}
 	if (!lastReview?.targetSessionID || lastReview.targetSessionID === sessionID || lastReview.targetSessionID === actorSessionID) {
 		lastReview = undefined;
+		try {
+			const p = getReviewCacheFilePath();
+			if (existsSync(p)) unlinkSync(p);
+		} catch {}
 	}
 }
 
@@ -192,23 +208,95 @@ export function recordReviewResult(
 		worktreeFingerprint: getGitWorktreeFingerprint(root),
 	};
 	if (targetSessionID) sessionReviews.set(targetSessionID, lastReview);
+	if (passed) {
+		persistReviewCache(lastReview);
+	}
 }
 
 export function getLastReviewResult(): typeof lastReview {
-	return lastReview;
+	if (lastReview) return lastReview;
+	const diskCached = loadReviewCache();
+	if (diskCached) {
+		lastReview = diskCached;
+		return lastReview;
+	}
+	return undefined;
 }
 
 export function getLastReviewResultForWorkspace(root: string): typeof lastReview {
 	const workspace = projectRootKey(root);
 	const candidates = [lastReview, ...sessionReviews.values()].filter(
-		(result): result is ReviewResult => result?.workspace != null && projectRootKey(result.workspace) === workspace,
+		(result): result is ReviewResult => result?.workspace != null && (projectRootKey(result.workspace) === workspace || isSameGitRepo(result.workspace, root)),
 	);
-	return candidates.reduce<ReviewResult | undefined>((latest, result) => !latest || result.timestamp > latest.timestamp ? result : latest, undefined);
+	const latest = candidates.reduce<ReviewResult | undefined>((best, result) => !best || result.timestamp > best.timestamp ? result : best, undefined);
+	if (latest) return latest;
+	const diskCached = loadReviewCache();
+	if (diskCached?.workspace && (projectRootKey(diskCached.workspace) === workspace || isSameGitRepo(diskCached.workspace, root))) {
+		return diskCached;
+	}
+	return undefined;
 }
 
 export function resetReviewState(): void {
 	lastReview = undefined;
 	sessionReviews.clear();
+	try {
+		const p = getReviewCacheFilePath();
+		if (existsSync(p)) unlinkSync(p);
+	} catch {}
+}
+
+export async function resolveEffectiveWorkspace(options: {
+	sessionID?: string;
+	directory?: string;
+	fallback?: string;
+}): Promise<string> {
+	if (options.directory) {
+		const gitRoot = findGitRoot(options.directory);
+		return gitRoot ?? projectRootKey(options.directory);
+	}
+	const fallbackRoot = options.fallback ? projectRootKey(options.fallback) : undefined;
+	const isFallbackFsRoot = fallbackRoot ? resolve(fallbackRoot) === resolve(fallbackRoot, "..") : true;
+
+	if (fallbackRoot && !isFallbackFsRoot) {
+		if (options.sessionID) {
+			const sessionWs = sessionWorkspaces.get(options.sessionID);
+			if (sessionWs && isSameGitRepo(sessionWs, fallbackRoot)) {
+				return sessionWs;
+			}
+		}
+		return fallbackRoot;
+	}
+
+	if (options.sessionID) {
+		const sessionWs = sessionWorkspaces.get(options.sessionID);
+		if (sessionWs) return sessionWs;
+		try {
+			const client = getSdkClient();
+			const session = client?.session;
+			const get = session?.get;
+			if (typeof get === "function") {
+				const result = await get.call(session, { path: { id: options.sessionID } });
+				const parent = (result as { data?: { parentID?: unknown } } | undefined)?.data?.parentID;
+				if (typeof parent === "string" && parent && sessionWorkspaces.has(parent)) {
+					const parentWs = sessionWorkspaces.get(parent)!;
+					sessionWorkspaces.set(options.sessionID, parentWs);
+					return parentWs;
+				}
+			}
+		} catch {}
+	}
+	const activeRoot = getWorkspaceRoot();
+	if (activeRoot && resolve(activeRoot) !== resolve(activeRoot, "..")) {
+		const gitRoot = findGitRoot(activeRoot);
+		if (gitRoot) return gitRoot;
+		return activeRoot;
+	}
+	try {
+		const cwdGitRoot = findGitRoot(process.cwd());
+		if (cwdGitRoot) return cwdGitRoot;
+	} catch {}
+	return fallbackRoot || activeRoot || getWorkspaceRoot();
 }
 
 export function getProjectConfig(root: string): ProjectConfig {

package/src/policies/continuation.ts

@@ -73,7 +73,7 @@ export async function continueUnfinishedSession(sessionID: string, settleTitle =
 		const session = getSdkClient()?.session;
 		if (typeof session?.promptAsync !== "function") return false;
 
-		const messageID = `workflow-guard-${randomUUID()}`;
+		const messageID = `msg_wg_${randomUUID().replace(/-/g, "")}`;
 		state.counts.set(sessionID, count + 1);
 		if (ralph) state.ralphOutcomes.set(sessionID, "running");
 		const generatedIDs = state.generatedMessageIDs.get(sessionID) ?? new Set<string>();

package/src/workflow-guard.ts

@@ -74,10 +74,14 @@ import {
 	getLearningInterventionBudget,
 	recordReviewResult,
 	getLastReviewResult,
+	getLastReviewResultForWorkspace,
 	resetReviewState,
 	sessionReviews,
+	setSessionWorkspace,
+	getSessionWorkspace,
+	resolveEffectiveWorkspace,
 } from "./lib/state.ts";
-import { loadProjectConfig, reloadProjectConfig, stripJsonComments } from "./lib/project-config.ts";
+import { findGitRoot, isSameGitRepo, loadProjectConfig, reloadProjectConfig, stripJsonComments } from "./lib/project-config.ts";
 
 export {
 	setWorkspaceRoot,
@@ -101,11 +105,18 @@ export {
 	getLearningInterventionBudget,
 	recordReviewResult,
 	getLastReviewResult,
+	getLastReviewResultForWorkspace,
 	resetReviewState,
+	setSessionWorkspace,
+	getSessionWorkspace,
+	resolveEffectiveWorkspace,
+	findGitRoot,
+	isSameGitRepo,
 };
 
 // ── Shared shell/env utilities ───────────────────────────────────────────────
 import {
+	asRecord,
 	extractRecordTargetPath,
 	getCleanEnv,
 	showBlockToast,
@@ -149,14 +160,17 @@ import { ensureProjectMemoryExcluded, getProjectMemoryIdentity, getRecentProject
 import {
 	getAuditFilePath,
 	getVerifyCacheFilePath,
+	getReviewCacheFilePath,
 	persistVerifyCache,
 	loadVerifyCache,
+	persistReviewCache,
+	loadReviewCache,
 	audit,
 	logDecision,
 	summarizeInput,
 } from "./lib/audit.ts";
 
-export { getAuditFilePath, getVerifyCacheFilePath, getVerifyHistoryFilePath, persistVerifyCache, loadVerifyCache, getRecentAuditEntries, getRecentVerifyHistory } from "./lib/audit.ts";
+export { getAuditFilePath, getVerifyCacheFilePath, getReviewCacheFilePath, getVerifyHistoryFilePath, persistVerifyCache, loadVerifyCache, persistReviewCache, loadReviewCache, getRecentAuditEntries, getRecentVerifyHistory } from "./lib/audit.ts";
 export { summarizeInput };
 
 export function managedConfigDiagnostic(platform = process.platform, env: NodeJS.ProcessEnv = process.env): string {
@@ -369,9 +383,16 @@ export const WorkflowGuard: Plugin = async (ctx) => {
 	// reports the filesystem root, use the SDK's actual project worktree instead.
 	const hostRoot = ctx.worktree || ctx.directory || process.cwd();
 	const hostIsFilesystemRoot = resolve(hostRoot) === resolve(hostRoot, "..");
-	const effectiveRoot = hostIsFilesystemRoot && ctx.project?.worktree
+	let effectiveRoot = hostIsFilesystemRoot && ctx.project?.worktree && resolve(ctx.project.worktree) !== resolve(ctx.project.worktree, "..")
 		? ctx.project.worktree
 		: hostRoot;
+	if (resolve(effectiveRoot) === resolve(effectiveRoot, "..")) {
+		const nonRootCandidate = [ctx.directory, process.cwd()].find((p) => typeof p === "string" && resolve(p) !== resolve(p, ".."));
+		if (nonRootCandidate) {
+			const gitRoot = findGitRoot(nonRootCandidate);
+			effectiveRoot = gitRoot ?? nonRootCandidate;
+		}
+	}
 	setWorkspaceRoot(effectiveRoot);
 	setSdkClient(ctx.client);
 	reloadProjectConfig(effectiveRoot);
@@ -439,6 +460,16 @@ export const WorkflowGuard: Plugin = async (ctx) => {
 					throw new Error(`[workflow-guard] ${reason}${circuitBreakerSuffix}`);
 				}
 				toolLifecycle.start(input.sessionID, input.callID);
+				if (input.sessionID) {
+					const record = asRecord(args);
+					const workdir = typeof record?.workdir === "string" ? record.workdir : undefined;
+					const filePath = typeof record?.filePath === "string" ? record.filePath : (typeof record?.path === "string" ? record.path : undefined);
+					const candidatePath = workdir ?? filePath ?? toolWorktree;
+					if (candidatePath) {
+						const gitRoot = findGitRoot(candidatePath);
+						if (gitRoot) setSessionWorkspace(input.sessionID, gitRoot);
+					}
+				}
 				if (input.tool === "read") {
 					const target = editTargets(args, toolWorktree)[0];
 					if (target) {

package/test/test.mts

@@ -36,6 +36,14 @@ import {
 	getRecentAuditEntries,
 	getRecentVerifyHistory,
 	getVerifyHistoryFilePath,
+	getReviewCacheFilePath,
+	loadReviewCache,
+	persistReviewCache,
+	setSessionWorkspace,
+	getSessionWorkspace,
+	resolveEffectiveWorkspace,
+	getLastReviewResultForWorkspace,
+	isSameGitRepo,
 	managedConfigDiagnostic,
 	summarizeInput,
 	extractReviewFollowups,
@@ -2100,6 +2108,96 @@ const mainReviewToolResult = await customPlugin.tool?.record_review?.execute(
 );
 check("record_review rejects self-approval from main session", typeof mainReviewToolResult === "string" && mainReviewToolResult.includes("rejected"));
 
+// Secondary Review Approval Handoff & Durable Cache Tests
+console.log("- Secondary Review Approval Handoff & Durability -");
+
+// 1. Negative review statements do not create bogus technical debt items
+const negativeFollowups = extractReviewFollowups(
+	"Test integrity: ok. Task completeness: ok. Cleanliness: ok. Security: ok. Platform: ok.\n" +
+	"P2: None\n" +
+	"P3: 0\n" +
+	"P2: N/A\n" +
+	"P3: No issues identified\n" +
+	"P2: 0 defects\n" +
+	"P3: ok\n" +
+	"P2: clean\n" +
+	"P2: memory leak in worker pool"
+);
+check("extractReviewFollowups filters out negative statements and retains real issues", negativeFollowups.length === 1 && negativeFollowups[0]?.summary.includes("memory leak in worker pool"));
+
+// 2. Secondary review approval handoff from subagent to parent session
+const handoffRepo = join(root, "wg-handoff-repo");
+mkdirSync(handoffRepo, { recursive: true });
+spawnSync("git", ["init", "-b", "feature/handoff"], { cwd: handoffRepo });
+spawnSync("git", ["config", "user.email", "test@test.local"], { cwd: handoffRepo });
+spawnSync("git", ["config", "user.name", "Test Runner"], { cwd: handoffRepo });
+writeFileSync(join(handoffRepo, "code.txt"), "initial\n");
+spawnSync("git", ["add", "code.txt"], { cwd: handoffRepo });
+spawnSync("git", ["commit", "-m", "initial"], { cwd: handoffRepo });
+mkdirSync(join(handoffRepo, ".opencode"), { recursive: true });
+writeFileSync(join(handoffRepo, ".opencode", "workflow-guard.json"), JSON.stringify({ requireReview: true }));
+
+// Simulate host root being the filesystem root ("/") while session operates in handoffRepo
+const handoffPlugin = await WorkflowGuard({
+	directory: root,
+	worktree: "/",
+	client: fakeClient as any,
+	project: {} as any,
+	experimental_workspace: {} as any,
+	serverUrl: new URL("http://localhost:4096"),
+	$: undefined as any,
+});
+
+// Parent session sets active workspace in handoffRepo
+setSessionWorkspace("s-handoff-parent", handoffRepo);
+fakeParents.set("s-handoff-reviewer", "s-handoff-parent");
+
+// Before review: guard_status on parent reports review is unsatisfied
+const statusBeforeReview = JSON.parse(String(await handoffPlugin.tool?.guard_status?.execute({}, { sessionID: "s-handoff-parent", worktree: "/", directory: root } as any)));
+check("before review: guard_status reports review in outstandingRequirements", statusBeforeReview.outstandingRequirements.includes("review") && (statusBeforeReview.lastReview === null || statusBeforeReview.lastReview.fresh === false));
+
+// Before review: PR creation is blocked by missing review
+const prBeforeReview = JSON.parse(String(await handoffPlugin.tool?.guard_why?.execute({ tool: "bash", input: { command: "gh pr create --title test --body 'Summary\n\nRelease notes'", workdir: handoffRepo } }, { sessionID: "s-handoff-parent", worktree: "/", directory: root } as any)));
+check("before review: PR creation blocked by review requirement", prBeforeReview.status === "blocked" && prBeforeReview.message.includes("Passing secondary review approval is required"));
+
+// Subagent calls record_review with passed: true (without explicit directory argument)
+const subagentReviewResult = await handoffPlugin.tool?.record_review?.execute(
+	{
+		reviewer: "secondary-reviewer",
+		summary: "Test integrity: all tests pass. Task completeness: complete. Cleanliness: clean diff. Security: zero secrets. Platform: standard.",
+		passed: true,
+	},
+	{ sessionID: "s-handoff-reviewer", agent: "reviewer", worktree: "/", directory: root } as any,
+);
+check("subagent records review approval successfully", typeof subagentReviewResult === "string" && subagentReviewResult.includes("APPROVED"));
+
+// Parent checks guard_status: handoff succeeds!
+const statusAfterReview = JSON.parse(String(await handoffPlugin.tool?.guard_status?.execute({}, { sessionID: "s-handoff-parent", worktree: "/", directory: root } as any)));
+check("secondary review handoff: lastReview.fresh is true in parent session", statusAfterReview.lastReview?.fresh === true && statusAfterReview.lastReview?.passed === true);
+check("secondary review handoff: review removed from outstandingRequirements", !statusAfterReview.outstandingRequirements.includes("review"));
+
+// Parent checks PR creation via guard_why: handoff allows PR creation!
+const prAfterReview = JSON.parse(String(await handoffPlugin.tool?.guard_why?.execute({ tool: "bash", input: { command: "gh pr create --title test --body 'Summary\n\nRelease notes'", workdir: handoffRepo } }, { sessionID: "s-handoff-parent", worktree: "/", directory: root } as any)));
+check("secondary review handoff: PR creation allowed after review approval", prAfterReview.status !== "blocked" && (prAfterReview.status === "allowed" || prAfterReview.code === "remote_state_unchecked"));
+
+// 3. Durable disk cache persistence & recovery
+check("durable review cache file created on disk", existsSync(getReviewCacheFilePath()));
+const loadedDiskReview = loadReviewCache();
+check("loadReviewCache returns valid passing review", loadedDiskReview?.passed === true && loadedDiskReview?.reviewer === "secondary-reviewer");
+
+// Simulate new session / restart: clear in-memory sessionReviews and lastReview
+const memoryClearedStatus = JSON.parse(String(await handoffPlugin.tool?.guard_status?.execute({ directory: handoffRepo }, { sessionID: "s-fresh-session", worktree: "/", directory: root } as any)));
+check("fresh session recovers durable review cache from disk", memoryClearedStatus.lastReview?.fresh === true && !memoryClearedStatus.outstandingRequirements.includes("review"));
+
+// 4. Worktree compatibility: review recorded in linked worktree is recognized by main repo
+todo("s-handoff-parent", item("worktree test", "in_progress"));
+const handoffWorktreeRes = (await handoffPlugin.tool?.guard_worktree_create?.execute({ branch: "feat/handoff-worktree" }, { sessionID: "s-handoff-parent", worktree: handoffRepo, directory: handoffRepo } as any)) as string;
+check("worktree created for handoff test", typeof handoffWorktreeRes === "string" && handoffWorktreeRes.includes("Worktree created"));
+check("worktree and main repo recognized as same git repository", isSameGitRepo(join(getWorktreeStorageDir(handoffRepo), "feat-handoff-worktree"), handoffRepo));
+
+rmSync(handoffRepo, { recursive: true, force: true });
+resetReviewState();
+
 // Event hook handles permission events
 if (typeof customPlugin.event === "function") {
 	await customPlugin.event({
@@ -2783,6 +2881,7 @@ writeFileSync(join(checkpointHookDir, "tracked.txt"), "agent result\n");
 await checkpointHooks.event?.({ event: { type: "session.idle", properties: { sessionID: "checkpoint-root" } } } as any);
 const generatedCheckpointMessage = checkpointHookPrompts.find((entry) => entry.sessionID === "checkpoint-root")?.messageID;
 check("idle finalizes recovery checkpoint before continuation", Boolean(listRecoveryCheckpoints(checkpointHookDir, "checkpoint-root")[0]?.endFingerprint && generatedCheckpointMessage));
+check("synthetic continuation messageID conforms to OpenCode msg_ prefix schema", typeof generatedCheckpointMessage === "string" && generatedCheckpointMessage.startsWith("msg_"));
 await checkpointHooks["chat.message"]?.({ sessionID: "checkpoint-root", messageID: generatedCheckpointMessage } as any, {} as any);
 check("synthetic continuation does not replace recovery checkpoint", listRecoveryCheckpoints(checkpointHookDir, "checkpoint-root").length === 1);
 checkpointHookParents.set("checkpoint-child", "checkpoint-root");