opencode-workflow-guard 1.13.6 → 1.14.1

package/test/test.mts

@@ -27,6 +27,8 @@ import {
 	getCurrentGitCommitHash,
 	getGitStatusSummary,
 	getGitWorktreeFingerprint,
+	getTrackedWorktreeFingerprint,
+	resolveWorktreeTimeoutMs,
 	getVerifyCacheFilePath,
 	persistVerifyCache,
 	loadVerifyCache,
@@ -980,6 +982,56 @@ try {
 }
 check("stale-write protection allows creating a new file without a prior read", newFileAllowed);
 await staleAfter?.({ tool: "write", sessionID: "s-stale", callID: "new-file", args: {} }, { title: "write", output: "written", metadata: {} });
+// A successful mutation seeds the session's observation of the bytes it
+// authored, so iterating on a just-created/modified file needs no re-read;
+// a no-op mutation seeds nothing and external changes stay blocked.
+const mutationSession = "s-stale-mutation";
+todo(mutationSession, item("iterate on authored file", "in_progress"));
+const authoredPath = join(staleDir, "authored.ts");
+await staleBefore?.({ tool: "write", sessionID: mutationSession, callID: "write-authored" }, { args: { filePath: authoredPath, content: "v1" } });
+writeFileSync(authoredPath, "v1");
+await staleAfter?.({ tool: "write", sessionID: mutationSession, callID: "write-authored", args: {} }, { title: "write", output: "written", metadata: {} });
+let authoredEditAllowed = true;
+try {
+	await staleBefore?.({ tool: "edit", sessionID: mutationSession, callID: "edit-authored-1" }, { args: { filePath: authoredPath, oldString: "v1", newString: "v2" } });
+} catch {
+	authoredEditAllowed = false;
+}
+check("a successful write seeds the session observation so the authored file can be edited without a re-read", authoredEditAllowed);
+writeFileSync(authoredPath, "v2");
+await staleAfter?.({ tool: "edit", sessionID: mutationSession, callID: "edit-authored-1", args: {} }, { title: "edit", output: "edited", metadata: {} });
+let chainedEditAllowed = true;
+try {
+	await staleBefore?.({ tool: "edit", sessionID: mutationSession, callID: "edit-authored-2" }, { args: { filePath: authoredPath, oldString: "v2", newString: "v3" } });
+} catch {
+	chainedEditAllowed = false;
+}
+check("a successful edit seeds the observation so chained edits need no re-read", chainedEditAllowed);
+writeFileSync(authoredPath, "changed externally");
+let externalAfterMutationBlocked = false;
+try {
+	await staleBefore?.({ tool: "edit", sessionID: mutationSession, callID: "edit-authored-3" }, { args: { filePath: authoredPath, oldString: "v3", newString: "v4" } });
+} catch (error) {
+	externalAfterMutationBlocked = String(error).includes("changed since this session read it");
+}
+check("an external change after a successful mutation is still blocked", externalAfterMutationBlocked);
+// Negative branch: a mutation that leaves content unchanged must not seed.
+// apply_patch is not stale-write checked, so this unobserved session can run
+// it; because the file is left unchanged, the seed gate must skip and a
+// later edit must still demand a read.
+const noopSession = "s-stale-noop";
+todo(noopSession, item("no-op patch", "in_progress"));
+const noopPath = join(staleDir, "noop.ts");
+writeFileSync(noopPath, "stable");
+await staleBefore?.({ tool: "apply_patch", sessionID: noopSession, callID: "noop-patch" }, { args: { patchText: `*** Begin Patch\n*** Update File: ${noopPath}\n@@\n stable\n*** End Patch` } });
+await staleAfter?.({ tool: "apply_patch", sessionID: noopSession, callID: "noop-patch", args: {} }, { title: "patch", output: "done", metadata: {} });
+let noopEditBlocked = false;
+try {
+	await staleBefore?.({ tool: "edit", sessionID: noopSession, callID: "noop-edit" }, { args: { filePath: noopPath, oldString: "stable", newString: "changed" } });
+} catch (error) {
+	noopEditBlocked = String(error).includes("has not been read");
+}
+check("a no-op mutation does not seed an observation for a later edit", noopEditBlocked);
 const staleAlternateRoot = mkdtempSync(join(tmpdir(), "wg-stale-root-"));
 writeFileSync(join(staleAlternateRoot, "relative.ts"), "observed");
 todo("s-stale-root", item("edit relative file", "in_progress"));
@@ -1718,10 +1770,10 @@ check("evidence freshness requires exact subject and post-mutation observation",
 const missingProvenanceEvidence = verificationEvidence({ passed: true, command: "npm test", output: "ok", timestamp: 123, workspaceRoot: "/tmp/ws" }, "s-evidence");
 check("evidence freshness fails closed when Git provenance is unavailable", !isEvidenceFresh(missingProvenanceEvidence, { workspace: "/tmp/ws", sessionID: "s-evidence" }, 0) && !isEvidenceFresh(verificationEvidenceResult, { workspace: "/tmp/ws", sessionID: "s-evidence" }, 0));
 await call("edit", { filePath: join(root, "after-review.ts"), content: "changed" }, { sessionID: "s-active" });
-check("new mutation invalidates prior review approval", getLastReviewResult() === undefined);
+check("mutations no longer erase review approval state (freshness is re-evaluated against content)", getLastReviewResult() !== undefined);
 recordReviewResult("reviewer-subagent", "Child review passed all axes.", true, "s-reviewed-child");
 recordMutation("s-reviewed-parent", "s-reviewed-child");
-check("actor mutation invalidates child-targeted global review", getLastReviewResult() === undefined);
+check("actor mutation no longer erases child-targeted review evidence", getLastReviewResult()?.targetSessionID === "s-reviewed-child");
 
 const fingerprintRepo = mkdtempSync(join(tmpdir(), "wg-review-fingerprint-"));
 spawnSync("git", ["init", "-b", "feature/review"], { cwd: fingerprintRepo });
@@ -1791,6 +1843,29 @@ symlinkSync(join(specialRepo, "missing-target-2"), join(specialRepo, "broken-lin
 check("adding an untracked symlink updates the fingerprint", getGitWorktreeFingerprint(specialRepo) !== fpWithSpecials);
 rmSync(specialRepo, { recursive: true, force: true });
 rmSync(linkTargetBase, { recursive: true, force: true });
+// Review evidence binds to tracked content only: untracked scratch files are
+// not part of the reviewed diff, so creating or deleting them must keep the
+// approval fresh, while the full fingerprint still covers untracked contents
+// for verification evidence.
+const trackedFpRepo = mkdtempSync(join(tmpdir(), "wg-review-tracked-fp-"));
+spawnSync("git", ["init", "-b", "main"], { cwd: trackedFpRepo });
+spawnSync("git", ["config", "user.email", "test@test.local"], { cwd: trackedFpRepo });
+spawnSync("git", ["config", "user.name", "Test Runner"], { cwd: trackedFpRepo });
+writeFileSync(join(trackedFpRepo, "tracked.txt"), "tracked\n");
+spawnSync("git", ["add", "tracked.txt"], { cwd: trackedFpRepo });
+spawnSync("git", ["commit", "-m", "base"], { cwd: trackedFpRepo });
+const trackedFpBase = getTrackedWorktreeFingerprint(trackedFpRepo);
+check("tracked-content fingerprint is available for a git worktree", typeof trackedFpBase === "string" && trackedFpBase.length === 64);
+writeFileSync(join(trackedFpRepo, ".tmp-review-final.diff"), "scratch\n");
+check("untracked scratch creation does not change the tracked-content fingerprint", getTrackedWorktreeFingerprint(trackedFpRepo) === trackedFpBase);
+const fullFpWithScratch = getGitWorktreeFingerprint(trackedFpRepo);
+writeFileSync(join(trackedFpRepo, ".tmp-review-final.diff"), "scratch v2\n");
+check("full fingerprint still binds untracked contents for verification evidence", getGitWorktreeFingerprint(trackedFpRepo) !== fullFpWithScratch);
+rmSync(join(trackedFpRepo, ".tmp-review-final.diff"));
+check("untracked scratch deletion does not change the tracked-content fingerprint", getTrackedWorktreeFingerprint(trackedFpRepo) === trackedFpBase);
+writeFileSync(join(trackedFpRepo, "tracked.txt"), "tracked edit\n");
+check("tracked-content fingerprint changes on a tracked edit", getTrackedWorktreeFingerprint(trackedFpRepo) !== trackedFpBase);
+rmSync(trackedFpRepo, { recursive: true, force: true });
 
 // 9. Secret-File READ Blocks (Policy 17)
 console.log("- Policy 17: Secret-File READ Blocks -");
@@ -2237,6 +2312,17 @@ try {
 	rmSync(whyRemoteRoot, { recursive: true, force: true });
 }
 
+// record_review binds verdicts to tracked repository content, so its tool
+// tests need a real git worktree rather than the non-git test root.
+const reviewToolRepo = join(root, "wg-review-tool-repo");
+mkdirSync(reviewToolRepo, { recursive: true });
+spawnSync("git", ["init", "-b", "main"], { cwd: reviewToolRepo });
+spawnSync("git", ["config", "user.email", "test@test.local"], { cwd: reviewToolRepo });
+spawnSync("git", ["config", "user.name", "Test Runner"], { cwd: reviewToolRepo });
+writeFileSync(join(reviewToolRepo, "code.txt"), "reviewed\n");
+spawnSync("git", ["add", "code.txt"], { cwd: reviewToolRepo });
+spawnSync("git", ["commit", "-m", "base"], { cwd: reviewToolRepo });
+
 fakeParents.set("s-reviewer-tool", "s-active");
 const unrelatedClient = {
 	session: {
@@ -2255,15 +2341,15 @@ await (defaultExport?.server ?? WorkflowGuard)({
 });
 const reviewToolResult = await customPlugin.tool?.record_review?.execute(
 	{ reviewer: "subagent-1", summary: "Test integrity: real assertions. Task completeness: done. Cleanliness: no stubs. Security: clean. Platform fit: ok.", passed: true },
-	{ sessionID: "s-reviewer-tool", agent: "reviewer", worktree: root, directory: root } as any,
+	{ sessionID: "s-reviewer-tool", agent: "reviewer", worktree: reviewToolRepo, directory: reviewToolRepo } as any,
 );
-check("record_review resolves subagent lineage through its own plugin client", typeof reviewToolResult === "string" && reviewToolResult.includes("APPROVED"));
+check("record_review resolves subagent lineage through its own plugin client", typeof reviewToolResult === "string" && reviewToolResult.includes("APPROVED") && reviewToolResult.includes(reviewToolRepo));
 setSdkClient(fakeClient);
 
 fakeParents.set("s-reviewer-changes", "s-active");
 const changesReviewResult = await customPlugin.tool?.record_review?.execute(
 	{ reviewer: "subagent-changes", summary: "Test integrity: gap found. Task completeness: needs work. Cleanliness: ok. Security: ok. Platform: ok.", passed: false },
-	{ sessionID: "s-reviewer-changes", agent: "reviewer", worktree: root, directory: root } as any,
+	{ sessionID: "s-reviewer-changes", agent: "reviewer", worktree: reviewToolRepo, directory: reviewToolRepo } as any,
 );
 const changesReviewAudit = getRecentAuditEntries(20).find((entry) => entry.tool === "record_review.verdict" && entry.sessionID === "s-reviewer-changes");
 check("record_review audit distinguishes changes-requested verdict without persisting summary", typeof changesReviewResult === "string" && changesReviewResult.includes("CHANGES REQUESTED") && changesReviewAudit?.reason === "changes_requested" && !JSON.stringify(changesReviewAudit).includes("gap found"));
@@ -2275,7 +2361,7 @@ await customPlugin.tool?.record_review?.execute(
 		summary: "Test integrity: covered. Task completeness: done. Cleanliness: clean. Security: safe. Platform: compatible.\nP2: first durable issue\nP3: second durable issue",
 		passed: true,
 	},
-	{ sessionID: "s-reviewer-followups", agent: "reviewer", worktree: root, directory: root } as any,
+	{ sessionID: "s-reviewer-followups", agent: "reviewer", worktree: reviewToolRepo, directory: reviewToolRepo } as any,
 );
 const durableReviewFollowups = JSON.parse(String(await customPlugin.tool?.guard_review_followups?.execute({}, {} as any))) as Array<{ severity?: string; summary?: string }>;
 check("record_review persists multiple P2/P3 findings independently", durableReviewFollowups.some((item) => item.severity === "P2" && item.summary?.includes("first durable issue")) && durableReviewFollowups.some((item) => item.severity === "P3" && item.summary?.includes("second durable issue")));
@@ -2316,11 +2402,50 @@ check(
 const rubricOptionFlag = await customPlugin.tool?.guard_review_rubric?.execute({ base: "--output=injected" }, {} as any);
 check("guard_review_rubric sanitizes option flags in base ref", typeof rubricOptionFlag === "string" && !existsSync(join(root, "injected")));
 
+// Regression: the rubric must embed the real branch diff. The git argv
+// previously placed `--` before the revision, so the revision parsed as a
+// pathspec and every rubric carried an empty diff block.
+const rubricDiffRepo = join(root, "wg-review-rubric-diff");
+mkdirSync(rubricDiffRepo, { recursive: true });
+spawnSync("git", ["init", "-b", "main"], { cwd: rubricDiffRepo });
+spawnSync("git", ["config", "user.email", "test@test.local"], { cwd: rubricDiffRepo });
+spawnSync("git", ["config", "user.name", "Test Runner"], { cwd: rubricDiffRepo });
+writeFileSync(join(rubricDiffRepo, "seed.txt"), "base\n");
+spawnSync("git", ["add", "seed.txt"], { cwd: rubricDiffRepo });
+spawnSync("git", ["commit", "-m", "base"], { cwd: rubricDiffRepo });
+spawnSync("git", ["switch", "-c", "feature/rubric-diff"], { cwd: rubricDiffRepo });
+writeFileSync(join(rubricDiffRepo, "added.txt"), "export const rubricDiffMarker = 42;\n");
+spawnSync("git", ["add", "added.txt"], { cwd: rubricDiffRepo });
+spawnSync("git", ["commit", "-m", "add rubric marker"], { cwd: rubricDiffRepo });
+const rubricWithDiff = await customPlugin.tool?.guard_review_rubric?.execute(
+	{ base: "main", directory: rubricDiffRepo },
+	{ sessionID: "s-rubric-diff", worktree: rubricDiffRepo, directory: rubricDiffRepo } as any,
+);
+check(
+	"guard_review_rubric embeds the real branch diff content",
+	typeof rubricWithDiff === "string" && rubricWithDiff.includes("rubricDiffMarker") && rubricWithDiff.includes("added.txt"),
+);
+rmSync(rubricDiffRepo, { recursive: true, force: true });
+
+// Reviewer-type agents often lack record_review in their toolset entirely, so
+// the tool accepts recorders of any session type: the verdict binds to the
+// recording session's directory and the audit trail captures the recorder
+// lineage (recorderRole). The decision is documented in the changelog.
 const mainReviewToolResult = await customPlugin.tool?.record_review?.execute(
-	{ reviewer: "self", summary: "self approval", passed: true },
-	{ sessionID: "s-active", agent: "main", worktree: root, directory: root } as any,
+	{ reviewer: "root-relay", summary: "Test integrity: verified. Task completeness: complete. Cleanliness: clean. Security: safe. Platform: compatible.", passed: true },
+	{ sessionID: "s-active", agent: "main", worktree: reviewToolRepo, directory: reviewToolRepo } as any,
+);
+check(
+	"record_review accepts a root-session recorder and binds the verdict to its directory",
+	typeof mainReviewToolResult === "string" && mainReviewToolResult.includes("APPROVED") && mainReviewToolResult.includes(reviewToolRepo),
 );
-check("record_review rejects self-approval from main session", typeof mainReviewToolResult === "string" && mainReviewToolResult.includes("rejected"));
+const rootRecorderAudit = getRecentAuditEntries(30).find((entry) => entry.tool === "record_review.verdict" && entry.sessionID === "s-active");
+check(
+	"record_review audit includes the binding key and recorder lineage",
+	(rootRecorderAudit?.evidence as { binding?: { workspace?: string; recorderRole?: string } })?.binding?.workspace === reviewToolRepo &&
+		(rootRecorderAudit?.evidence as { binding?: { recorderRole?: string } })?.binding?.recorderRole === "root",
+);
+resetReviewState();
 
 // Secondary Review Approval Handoff & Durable Cache Tests
 console.log("- Secondary Review Approval Handoff & Durability -");
@@ -2412,6 +2537,146 @@ check("worktree and main repo recognized as same git repository", isSameGitRepo(
 rmSync(handoffRepo, { recursive: true, force: true });
 resetReviewState();
 
+// 5. Review binding across sessions and linked worktrees (regression): a
+// review recorded by a subagent rooted in a LINKED WORKTREE must satisfy the
+// PR preflight even when the PR is created from a DIFFERENT session, and must
+// stay valid across innocuous untracked-file cleanup.
+console.log("- Review Binding Across Sessions & Linked Worktrees -");
+const flowRepo = join(root, "wg-flow-repo");
+mkdirSync(flowRepo, { recursive: true });
+spawnSync("git", ["init", "-b", "main"], { cwd: flowRepo });
+spawnSync("git", ["config", "user.email", "test@test.local"], { cwd: flowRepo });
+spawnSync("git", ["config", "user.name", "Test Runner"], { cwd: flowRepo });
+writeFileSync(join(flowRepo, "seed.txt"), "base\n");
+spawnSync("git", ["add", "seed.txt"], { cwd: flowRepo });
+spawnSync("git", ["commit", "-m", "base"], { cwd: flowRepo });
+mkdirSync(join(flowRepo, ".opencode"), { recursive: true });
+writeFileSync(join(flowRepo, ".opencode", "workflow-guard.json"), JSON.stringify({ requireReview: true }));
+const prevWorktreeDirFlow = process.env.WORKFLOW_GUARD_WORKTREE_DIR;
+process.env.WORKFLOW_GUARD_WORKTREE_DIR = join(root, "wg-flow-worktrees");
+const flowWorktreeRes = createGitWorktree("fix/flow-branch", "HEAD", flowRepo);
+check("flow: linked worktree created", flowWorktreeRes.success && typeof flowWorktreeRes.worktreePath === "string");
+const flowWt = flowWorktreeRes.worktreePath!;
+writeFileSync(join(flowWt, "seed.txt"), "worktree change\n");
+spawnSync("git", ["add", "seed.txt"], { cwd: flowWt });
+spawnSync("git", ["commit", "-qm", "worktree change"], { cwd: flowWt });
+writeFileSync(join(flowWt, ".tmp-review-final.diff"), "scratch\n");
+
+const flowPlugin = await WorkflowGuard({
+	directory: root,
+	worktree: root,
+	client: fakeClient as any,
+	project: {} as any,
+	experimental_workspace: {} as any,
+	serverUrl: new URL("http://localhost:4096"),
+	$: undefined as any,
+});
+// The orchestrator session moved itself into the linked worktree
+// (tools.opencode.session_move): its file tools are rooted at the worktree.
+setSessionWorkspace("s-flow-orch", flowWt);
+fakeParents.set("s-flow-reviewer", "s-flow-orch");
+fakeParents.set("s-flow-pr", "s-flow-orch");
+todo("s-flow-orch", item("drive the flow", "in_progress"));
+const flowCtx = (sessionID: string) => ({ sessionID, worktree: flowWt, directory: flowWt }) as any;
+
+const flowReview = await flowPlugin.tool?.record_review?.execute(
+	{ reviewer: "secondary-reviewer", summary: "Test integrity: covered. Task completeness: complete. Cleanliness: clean. Security: safe. Platform: compatible.", passed: true },
+	{ ...flowCtx("s-flow-reviewer"), agent: "general" },
+);
+check("flow: review recorded from a subagent rooted in the linked worktree binds to it", typeof flowReview === "string" && flowReview.includes("APPROVED") && flowReview.includes(flowWt));
+
+const flowStatus = JSON.parse(String(await flowPlugin.tool?.guard_status?.execute({ directory: flowWt }, flowCtx("s-flow-orch"))));
+check("flow: guard_status reports fresh lastReview for the linked worktree", flowStatus.lastReview?.fresh === true && !flowStatus.outstandingRequirements.includes("review"));
+
+const flowPrevPath = process.env.PATH;
+const flowBin = join(root, "wg-flow-bin");
+mkdirSync(flowBin, { recursive: true });
+writeFileSync(join(flowBin, "gh"), "#!/bin/sh\nexit 1\n");
+writeFileSync(join(flowBin, "az"), "#!/bin/sh\nexit 1\n");
+chmodSync(join(flowBin, "gh"), 0o755);
+chmodSync(join(flowBin, "az"), 0o755);
+process.env.PATH = `${flowBin}:${flowPrevPath ?? ""}`;
+const flowPrBody = "gh pr create --title 'fix: flow' --body 'Changelog: flow'";
+try {
+	const flowPrParent = await call("bash", { command: flowPrBody, workdir: flowWt }, flowCtx("s-flow-orch"));
+	check("flow: PR from the reviewer's parent session is allowed", !blocked(flowPrParent));
+	const flowPrOther = await call("bash", { command: flowPrBody, workdir: flowWt }, flowCtx("s-flow-pr"));
+	check("flow: PR from a DIFFERENT session in the same worktree is allowed (content binding, not session identity)", !blocked(flowPrOther));
+	if (blocked(flowPrOther)) console.log("   blocked:", flowPrOther);
+
+	// Untracked scratch cleanup must not invalidate the approval
+	const flowRm = await call("bash", { command: "rm -f .tmp-review-final.diff", workdir: flowWt }, flowCtx("s-flow-orch"));
+	check("flow: untracked scratch deletion is a permitted cleanup", !blocked(flowRm));
+	const flowStatusAfterRm = JSON.parse(String(await flowPlugin.tool?.guard_status?.execute({ directory: flowWt }, flowCtx("s-flow-orch"))));
+	check("flow: review stays fresh after untracked scratch deletion", flowStatusAfterRm.lastReview?.fresh === true && !flowStatusAfterRm.outstandingRequirements.includes("review"));
+	const flowPrAfterRm = await call("bash", { command: flowPrBody, workdir: flowWt }, flowCtx("s-flow-pr"));
+	check("flow: PR still allowed after innocuous untracked-file mutations", !blocked(flowPrAfterRm));
+
+	// Tracked content changes still invalidate (the gate is not weakened)
+	writeFileSync(join(flowWt, "seed.txt"), "post-review tracked edit\n");
+	const flowStatusAfterEdit = JSON.parse(String(await flowPlugin.tool?.guard_status?.execute({ directory: flowWt }, flowCtx("s-flow-orch"))));
+	check("flow: tracked edit after review makes the approval stale", flowStatusAfterEdit.outstandingRequirements.includes("review"));
+	const flowPrAfterEdit = await call("bash", { command: flowPrBody, workdir: flowWt }, flowCtx("s-flow-orch"));
+	check("flow: PR blocked after tracked content changed post-review", blocked(flowPrAfterEdit) && String(flowPrAfterEdit).includes("tracked content changed after review"));
+	spawnSync("git", ["checkout", "--", "seed.txt"], { cwd: flowWt });
+} finally {
+	process.env.PATH = flowPrevPath;
+}
+
+// Reviewer-type agents cannot call record_review themselves (their toolset has
+// no record_review), so the orchestrator relays the verdict from its own
+// session; the verdict must still bind to the reviewed worktree.
+const relayedReview = await flowPlugin.tool?.record_review?.execute(
+	{ reviewer: "relayed-reviewer", summary: "Test integrity: covered. Task completeness: complete. Cleanliness: clean. Security: safe. Platform: compatible.", passed: true },
+	{ ...flowCtx("s-flow-orch"), agent: "reviewer" },
+);
+check("flow: relayed verdict from a root session binds to the reviewed worktree", typeof relayedReview === "string" && relayedReview.includes("APPROVED") && relayedReview.includes(flowWt));
+
+// A verdict recorded against a non-git directory can never bind to a PR
+// preflight; it must fail loudly instead of silently not binding.
+const flowNonGit = join(root, "wg-flow-nongit");
+mkdirSync(flowNonGit, { recursive: true });
+const flowBadReview = await flowPlugin.tool?.record_review?.execute(
+	{ reviewer: "unbindingable", summary: "Test integrity: covered. Task completeness: complete. Cleanliness: clean. Security: safe. Platform: compatible.", passed: true },
+	{ ...flowCtx("s-flow-reviewer"), worktree: flowNonGit, directory: flowNonGit },
+);
+check(
+	"flow: verdict against a non-git directory returns an explicit bind error",
+	typeof flowBadReview === "string" && flowBadReview.includes("rejected") && flowBadReview.includes("cannot be bound") && !flowBadReview.includes("APPROVED"),
+);
+
+rmSync(flowNonGit, { recursive: true, force: true });
+rmSync(flowBin, { recursive: true, force: true });
+rmSync(flowRepo, { recursive: true, force: true });
+if (prevWorktreeDirFlow === undefined) delete process.env.WORKFLOW_GUARD_WORKTREE_DIR;
+else process.env.WORKFLOW_GUARD_WORKTREE_DIR = prevWorktreeDirFlow;
+rmSync(join(root, "wg-flow-worktrees"), { recursive: true, force: true });
+resetReviewState();
+
+// Commit drift: a review recorded with its change already staged stays
+// fingerprint-identical once that change is committed, so the commit-hash
+// binding is the invalidation signal and the preflight must name it.
+const driftRepo = join(root, "wg-review-commit-drift");
+mkdirSync(driftRepo, { recursive: true });
+spawnSync("git", ["init", "-b", "feature/commit-drift"], { cwd: driftRepo });
+spawnSync("git", ["config", "user.email", "test@test.local"], { cwd: driftRepo });
+spawnSync("git", ["config", "user.name", "Test Runner"], { cwd: driftRepo });
+writeFileSync(join(driftRepo, "code.txt"), "base\n");
+spawnSync("git", ["add", "code.txt"], { cwd: driftRepo });
+spawnSync("git", ["commit", "-m", "base"], { cwd: driftRepo });
+mkdirSync(join(driftRepo, ".opencode"), { recursive: true });
+writeFileSync(join(driftRepo, ".opencode", "workflow-guard.json"), JSON.stringify({ requireReview: true }));
+writeFileSync(join(driftRepo, "code.txt"), "reviewed staged edit\n");
+spawnSync("git", ["add", "code.txt"], { cwd: driftRepo });
+const driftFingerprintBefore = getTrackedWorktreeFingerprint(driftRepo);
+recordReviewResult("commit-drift-reviewer", "Test integrity: covered. Task completeness: complete. Cleanliness: clean. Security: safe. Platform: compatible.", true, "s-drift", driftRepo);
+spawnSync("git", ["commit", "-qm", "commit reviewed change"], { cwd: driftRepo });
+check("committing staged reviewed content keeps the tracked fingerprint", getTrackedWorktreeFingerprint(driftRepo) === driftFingerprintBefore);
+const driftPr = await call("bash", { command: "gh pr create --title t --body 'Changelog: drift'", workdir: driftRepo }, { sessionID: "s-drift", worktree: driftRepo, directory: driftRepo });
+check("PR blocked when only the reviewed commit drifted, with a commit-specific cause", blocked(driftPr) && String(driftPr).includes("bound to commit"));
+rmSync(driftRepo, { recursive: true, force: true });
+resetReviewState();
+
 // Event hook handles permission events
 if (typeof customPlugin.event === "function") {
 	await customPlugin.event({
@@ -2743,6 +3008,17 @@ check("checkInteractiveTtyCommand permits top long-form batch flag", !checkInter
 check("checkInteractiveTtyCommand permits hyphenated top-like filename", !checkInteractiveTtyCommand("ls top-level-dir").isInteractive);
 check("top batch mode does not hide another interactive monitor", checkInteractiveTtyCommand("top -b -n 1; htop").isInteractive);
 check("top batch mode does not hide a later interactive top", checkInteractiveTtyCommand("top -b -n 1; top").isInteractive);
+check("checkInteractiveTtyCommand permits top as an argument value", !checkInteractiveTtyCommand("az keyvault secret show --vault-name jcs-pim-vault-nz --name top").isInteractive);
+check("checkInteractiveTtyCommand permits an unquoted top argument", !checkInteractiveTtyCommand("echo top").isInteractive);
+check("checkInteractiveTtyCommand still detects a monitor after a pipe", checkInteractiveTtyCommand("cat file | top").isInteractive);
+check("checkInteractiveTtyCommand still detects a wrapped monitor", checkInteractiveTtyCommand("sudo top").isInteractive);
+check("checkInteractiveTtyCommand still detects busybox top", checkInteractiveTtyCommand("busybox top").isInteractive);
+check("checkInteractiveTtyCommand detects eval-wrapped monitor", checkInteractiveTtyCommand("eval top").isInteractive);
+check("checkInteractiveTtyCommand detects shell -c monitor", checkInteractiveTtyCommand("bash -c top").isInteractive);
+check("checkInteractiveTtyCommand detects shell -lc quoted monitor", checkInteractiveTtyCommand("sh -lc 'htop'").isInteractive);
+check("checkInteractiveTtyCommand permits a quoted separator before a monitor name", !checkInteractiveTtyCommand('echo "run; top"').isInteractive);
+check("checkInteractiveTtyCommand detects timeout-wrapped monitor", checkInteractiveTtyCommand("timeout 5 top").isInteractive);
+check("checkInteractiveTtyCommand detects a backgrounded-wrapper monitor", checkInteractiveTtyCommand("sudo -b top").isInteractive);
 check("checkInteractiveTtyCommand detects sudo", checkInteractiveTtyCommand("sudo apt-get update").isInteractive);
 check("checkInteractiveTtyCommand detects git rebase -i", checkInteractiveTtyCommand("git rebase -i HEAD~2").isInteractive);
 check("checkInteractiveTtyCommand detects npm init without -y", checkInteractiveTtyCommand("npm init").isInteractive);
@@ -2757,6 +3033,7 @@ check("shell tool blocks less", blocked(await shell("less package.json")));
 check("shell tool blocks top", blocked(await shell("top")));
 check("shell tool allows top batch mode", !(await shell("top -b -n 1")));
 check("shell tool allows top long-form batch flag", !(await shell("top --batch -n 1")));
+check("shell tool allows top as an argument value", !(await shell("az keyvault secret show --vault-name jcs-pim-vault-nz --name top")));
 check("shell tool blocks npm init without flag", blocked(await shell("npm init")));
 check("shell tool allows npm init -y", !(await shell("npm init -y")));
 
@@ -2974,6 +3251,21 @@ check(
 	!rogueCleanup.success && existsSync(join(roguePath, "keep.txt")),
 );
 
+// Idempotent cleanup: a registered worktree whose directory vanished (the
+// prunable admin entry `git worktree list` shows) must be deregistered rather
+// than refused, while unregistered missing paths stay refused.
+const prunableCreate = createGitWorktree("feat/prunable-cleanup", "HEAD", worktreeBaseRepo);
+check("prunable-cleanup setup creates a worktree", prunableCreate.success && typeof prunableCreate.worktreePath === "string");
+const prunablePath = prunableCreate.worktreePath!;
+rmSync(prunablePath, { recursive: true, force: true });
+const prunableListedBefore = (spawnSync("git", ["worktree", "list", "--porcelain"], { cwd: worktreeBaseRepo, encoding: "utf8" }).stdout ?? "").includes(prunablePath);
+check("a removed-directory worktree is still listed as prunable before cleanup", prunableListedBefore);
+const prunableCleanup = cleanupGitWorktree(prunablePath, worktreeBaseRepo);
+const prunableStillListed = (spawnSync("git", ["worktree", "list", "--porcelain"], { cwd: worktreeBaseRepo, encoding: "utf8" }).stdout ?? "").includes(prunablePath);
+check("cleanupGitWorktree deregisters a registered worktree whose directory is missing", prunableCleanup.success && !prunableStillListed);
+const missingRogue = cleanupGitWorktree(join(storageBase, "missing-rogue"), worktreeBaseRepo);
+check("cleanupGitWorktree still refuses an unregistered missing path", !missingRogue.success);
+
 // Snapshot integrity: when the snapshot commit cannot be established (e.g. a
 // failing pre-commit hook), cleanup must abort and preserve the worktree.
 const failingHooks = mkdtempSync(join(tmpdir(), "wg-wt-hooks-"));
@@ -3067,6 +3359,53 @@ delete process.env.GIT_INDEX_FILE;
 delete process.env.GIT_DIR;
 check("getCleanGitEnv strips git context variables", typeof getCleanGitEnv().GIT_INDEX_FILE === "undefined");
 
+// Partial-failure rollback: git creates the branch ref before the worktree
+// checkout, so a failure after that point must not leave the branch behind,
+// must not delete a branch that already existed, must leave a pre-existing
+// target path intact, and must report the git exit status rather than only
+// stderr progress text.
+const storageBaseForRollback = getWorktreeStorageDir(worktreeBaseRepo);
+mkdirSync(storageBaseForRollback, { recursive: true });
+const rollbackBranch = "feat/rollback-partial";
+const rollbackCollision = join(storageBaseForRollback, "feat-rollback-partial");
+writeFileSync(rollbackCollision, "path collision\n");
+const rollbackRes = createGitWorktree(rollbackBranch, "HEAD", worktreeBaseRepo);
+check(
+	"partial worktree add failure reports git exit status, not only stderr progress",
+	rollbackRes.success === false && /exit status/.test(String(rollbackRes.error)),
+);
+check(
+	"partial worktree add failure rolls back the created branch",
+	spawnSync("git", ["show-ref", "--verify", "--quiet", `refs/heads/${rollbackBranch}`], { cwd: worktreeBaseRepo }).status !== 0,
+);
+check("partial worktree add failure leaves a pre-existing target path intact", existsSync(rollbackCollision) && readFileSync(rollbackCollision, "utf8") === "path collision\n");
+const preservedBranch = "feat/preserve-on-fail";
+spawnSync("git", ["branch", preservedBranch], { cwd: worktreeBaseRepo });
+writeFileSync(join(storageBaseForRollback, "feat-preserve-on-fail"), "blocker\n");
+createGitWorktree(preservedBranch, "HEAD", worktreeBaseRepo);
+check(
+	"a pre-existing branch is not deleted when worktree add fails",
+	spawnSync("git", ["show-ref", "--verify", "--quiet", `refs/heads/${preservedBranch}`], { cwd: worktreeBaseRepo }).status === 0,
+);
+// A colliding sanitized path must never let rollback destroy a live
+// registered worktree (duplicate names, concurrent subagents, feat/x vs
+// feat:x). The failed add must leave it and its uncommitted work intact.
+const liveCollision = createGitWorktree("feat/live-collision", "HEAD", worktreeBaseRepo);
+check("live-collision setup creates a registered worktree", liveCollision.success && typeof liveCollision.worktreePath === "string");
+const liveCollisionPath = liveCollision.worktreePath!;
+writeFileSync(join(liveCollisionPath, "uncommitted-work.txt"), "do not lose me\n");
+const duplicateCreate = createGitWorktree("feat/live-collision", "HEAD", worktreeBaseRepo);
+const liveSurvived = existsSync(liveCollisionPath) && existsSync(join(liveCollisionPath, "uncommitted-work.txt"));
+const liveCleanup = cleanupGitWorktree(liveCollisionPath, worktreeBaseRepo);
+check(
+	"failed duplicate create leaves a live registered worktree and its uncommitted work intact",
+	duplicateCreate.success === false && liveSurvived && liveCleanup.success,
+);
+process.env.WORKFLOW_GUARD_WORKTREE_TIMEOUT_MS = "2500";
+check("resolveWorktreeTimeoutMs honors WORKFLOW_GUARD_WORKTREE_TIMEOUT_MS", resolveWorktreeTimeoutMs() === 2500);
+delete process.env.WORKFLOW_GUARD_WORKTREE_TIMEOUT_MS;
+check("resolveWorktreeTimeoutMs falls back to the 15s default", resolveWorktreeTimeoutMs() === 15_000);
+
 rmSync(worktreeBaseRepo, { recursive: true, force: true });
 delete process.env.WORKFLOW_GUARD_WORKTREE_DIR;
 rmSync(worktreeStorage, { recursive: true, force: true });
@@ -3915,6 +4254,43 @@ check("project-memory initialization failure leaves core guard hooks active", ty
 if (prevDataHome === undefined) delete process.env.XDG_DATA_HOME;
 else process.env.XDG_DATA_HOME = prevDataHome;
 
+console.log("- live control-plane paths (tier port: config-path facts) -");
+const liveBase = mkdtempSync(join(tmpdir(), "wg-lcp-base-"));
+const livePlane = join(liveBase, ".config", "open" + "code");
+mkdirSync(livePlane, { recursive: true });
+const lcpRoot = mkdtempSync(join(tmpdir(), "wg-lcp-root-"));
+mkdirSync(join(lcpRoot, ".opencode"), { recursive: true });
+const ocJson = "open" + "code.json";
+const ocJsonc = "open" + "code.jsonc";
+setWorkspaceRoot(root);
+
+// Legacy (no live roots configured): the copy SOURCE under a config path alone
+// blocks the command — the F3 false positive, pinned as current behavior.
+check("legacy: cp FROM a .config/opencode source is blocked without live roots", blocked(await call("bash", { command: `cp ${livePlane}/agent/x.md ./draft.md` }, { sessionID: "s-active" })));
+
+// Declare the live control plane via project config, then reload.
+writeFileSync(join(lcpRoot, ".opencode", "workflow-guard.json"), JSON.stringify({ liveControlPlanePaths: [livePlane] }));
+reloadProjectConfig(lcpRoot);
+setWorkspaceRoot(lcpRoot);
+
+// With facts: the same copy is allowed — the SOURCE is no longer matched and
+// the destination is a sanctioned workspace draft (F3 fixed).
+check("facts: cp FROM live config into a workspace draft is allowed", !(await call("bash", { command: `cp ${livePlane}/agent/x.md ./draft.md` }, { sessionID: "s-active" })));
+// The live destination stays protected.
+check("facts: cp INTO the live config is blocked", blocked(await call("bash", { command: `cp ./draft.md ${livePlane}/agent/x.md` }, { sessionID: "s-active" })));
+check("facts: redirect into the live config is blocked", blocked(await call("bash", { command: `echo x > ${livePlane}/${ocJsonc}` }, { sessionID: "s-active" })));
+// A config-shaped draft inside the workspace is allowed.
+check("facts: write to a project .opencode draft is allowed", !(await call("write", { filePath: join(lcpRoot, ".opencode", ocJson), content: "{}" }, { sessionID: "s-active" })));
+
+// An unusable declared root rejects the whole fact set -> fail-closed legacy.
+writeFileSync(join(lcpRoot, ".opencode", "workflow-guard.json"), JSON.stringify({ liveControlPlanePaths: ["relative/dir"] }));
+reloadProjectConfig(lcpRoot);
+check("facts: an unusable declared root falls back to legacy segment matching", blocked(await call("write", { filePath: join(lcpRoot, ".opencode", ocJson), content: "{}" }, { sessionID: "s-active" })));
+
+setWorkspaceRoot(root);
+rmSync(lcpRoot, { recursive: true, force: true });
+rmSync(liveBase, { recursive: true, force: true });
+
 rmSync(root, { recursive: true, force: true });
 if (prevLive !== undefined) process.env.WORKFLOW_GUARD_ALLOW_LIVE = prevLive;
 console.log(`\n${pass} passed, ${fail} failed`);