opencode-workflow-guard 1.15.0 → 1.15.2

package/docs/policies.md

@@ -31,7 +31,7 @@ It is a policy and enforcement layer, not an agent harness. Policies may constra
   - The branch diff modifies a `CHANGELOG` file, OR
   - The branch diff adds/modifies a `.changeset/*.md` fragment file (Changesets workflow), OR
   - The PR description (`--body`, `--description`, or `--body-file`/`-F`) contains a release-information section headed `Changelog`, `Changes`, `Release notes`, or `Summary`. Multiline Bash ANSI-C `\n`/`\r` quoting is supported for inline descriptions; inline descriptions that would render Markdown line breaks as literal `\n`/`\r` text are blocked with guidance to use real newlines or a description file.
-- **Lockfile Synchronization Gate:** Whenever package manifests (`package.json`, `Cargo.toml`, `go.mod`) are modified, PR creation is blocked until their corresponding lockfiles (`package-lock.json`/`bun.lock`/`pnpm-lock.yaml`/`yarn.lock`, `Cargo.lock`, `go.sum`) are updated.
+- **Lockfile Synchronization Gate:** Whenever package manifests (`package.json`, `Cargo.toml`, `go.mod`) are modified, PR creation is blocked until their corresponding lockfiles (`package-lock.json`/`bun.lock`/`pnpm-lock.yaml`/`yarn.lock`, `Cargo.lock`, `go.sum`) are updated. For `package.json` the demand is section-aware: it fires when a section the lockfile records changed (`dependencies`, `devDependencies`, `optionalDependencies`, `peerDependencies`, `peerDependenciesMeta`, `engines`, `packageManager`, `overrides`, `resolutions`, `workspaces`, `pnpm`, or the project `name`/`version`). Scripts- or metadata-only manifest edits regenerate the lockfile byte-identical and pass without one. `Cargo.toml` and `go.mod` changes conservatively keep demanding their lockfiles.
 - When multiple PR prerequisites fail at once, the guard reports all detected preflight failures together so they can be resolved before retrying PR creation.
 
 ### 4. Destructive CLI Operations Guard
@@ -143,7 +143,7 @@ It is a policy and enforcement layer, not an agent harness. Policies may constra
 
 ### 20. Merged Branch & Base Freshness Guard
 - Blocks pushing to branches already merged or associated with closed PRs in GitHub or Azure DevOps.
-- Blocks creating fresh feature branches when the local base branch is behind the remote, prompting the agent to pull latest changes first.
+- Blocks creating feature branches (`git switch -c`, `git checkout -b`) from a stale base: without an explicit start point, the current branch must be fresh against the remote default; an explicit start point that already contains the remote default (`origin/HEAD`) is accepted because the new branch is fresh by construction, and start points that cannot be resolved fail closed. Block reasons name the branch actually checked and remedies that work under the guard (rebase or ff-merge the branch, or branch from the remote default directly).
 - Tag push refspecs are exempt: publishing an existing tag (`git push origin v1.2.0`, `git push origin refs/tags/v1.2.0`) and creating tags (`git tag v1.2.0`, `git tag -a -m ...`) are release operations, not branch mutations - only tag deletions (`git tag -d`, `git push origin :refs/tags/v1.2.0`, `--delete`) stay blocked.
 
 ### 21. Documentation Review & Synchronization Guard

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-workflow-guard",
-  "version": "1.15.0",
+  "version": "1.15.2",
   "description": "Deterministic workflow and safety policy enforcement for OpenCode",
   "license": "MIT",
   "type": "module",

package/src/lib/custom-tools.ts

@@ -1,5 +1,6 @@
 import { tool } from "@opencode-ai/plugin";
 import { spawnSync } from "node:child_process";
+import { resolve } from "node:path";
 import type { AuditEntry, LearningEvidenceKind } from "./types.ts";
 import type { ProjectMemoryStore } from "./project-memory.ts";
 import {
@@ -31,10 +32,11 @@ import {
 	recordMutation,
 	recordReviewResult,
 	resolveEffectiveWorkspace,
+	resolveSessionBoundWorkspace,
 	runWithRuntimeState,
 } from "./state.ts";
 import { getRalphOutcome } from "../policies/continuation.ts";
-import { loadProjectConfig, projectRootKey } from "./project-config.ts";
+import { findGitRoot, loadProjectConfig, projectRootKey } from "./project-config.ts";
 import { detectVerifyCommand, getCurrentGitCommitHash, getGitWorktreeFingerprint, getTrackedWorktreeFingerprint } from "./verify.ts";
 import { buildReviewRubric } from "./review.ts";
 import { createGitWorktree, cleanupGitWorktree } from "./worktree.ts";
@@ -121,6 +123,27 @@ export function createCustomTools(options: {
 	client: unknown;
 }) {
 	const { effectiveRoot, projectMemoryEnabled, learningEnabled, projectMemory, followupStore, portableMemoryPath, learningInterventions, client } = options;
+	// Resolve the workspace for a tool call from the CALL's own context: an
+	// explicit argument first, then the host-provided per-call worktree or
+	// directory (even when unusable — the call declared its target), then the
+	// session's bound workspace. The plugin-instance default (`effectiveRoot`)
+	// is only the last resort — concurrent loops share one guard process, so
+	// an instance-derived root must never re-anchor another session's tool
+	// execution.
+	const resolveCallWorkspace = async (
+		toolContext: { sessionID?: string; worktree?: string; directory?: string } | undefined,
+		explicitDirectory?: string,
+	): Promise<string> => {
+		if (explicitDirectory) {
+			return findGitRoot(explicitDirectory) ?? projectRootKey(explicitDirectory);
+		}
+		const hostContext = toolContext?.worktree || toolContext?.directory;
+		const hostIsFilesystemRoot = hostContext ? resolve(hostContext) === resolve(hostContext, "..") : true;
+		if (hostContext && !hostIsFilesystemRoot) {
+			return findGitRoot(hostContext) ?? projectRootKey(hostContext);
+		}
+		return resolveEffectiveWorkspace({ sessionID: toolContext?.sessionID, fallback: effectiveRoot });
+	};
 	return {
 		...(isRecoveryCheckpointsEnabled(effectiveRoot) ? {
 			guard_recovery_restore: tool({
@@ -131,7 +154,7 @@ export function createCustomTools(options: {
 					const parent = await fetchParentSession(toolContext.sessionID);
 					if (!parent.ok) return "[workflow-guard] Recovery rejected: could not confirm this is a root session.";
 					if (parent.parentID) return "[workflow-guard] Recovery rejected: only root sessions can restore their checkpoints.";
-					const result = restoreRecoveryCheckpoint(effectiveRoot, toolContext.sessionID, args.run);
+					const result = restoreRecoveryCheckpoint(await resolveCallWorkspace(toolContext), toolContext.sessionID, args.run);
 					return result.ok ? `[workflow-guard] Restored recovery checkpoint for run ${args.run}.` : `[workflow-guard] Recovery rejected: ${result.error}`;
 				},
 			}),
@@ -139,8 +162,8 @@ export function createCustomTools(options: {
 		guard_next_tasks: tool({
 			description: "Load durable repository task context when deciding what to work on next or planning upcoming steps. Proactively call at session start or during planning to discover roadmap, plan, tasks, backlog, and TODO.md files.",
 			args: {},
-			execute: async () => {
-				const sources = discoverPlanningSources(effectiveRoot);
+			execute: async (_args, toolContext) => {
+				const sources = discoverPlanningSources(await resolveCallWorkspace(toolContext));
 				return sources.length > 0 ? JSON.stringify({ sources }, null, 2) : JSON.stringify({ sources: [], message: "No TODO, roadmap, plan, tasks, or backlog Markdown files found." });
 			},
 		}),
@@ -158,7 +181,7 @@ export function createCustomTools(options: {
 					if (!(["fact", "decision", "constraint", "lesson"] as string[]).includes(args.kind)) return "[workflow-guard] Project memory rejected: invalid kind.";
 					const detectedSecret = secretIn(args.content);
 					if (detectedSecret) return `[workflow-guard] Project memory rejected: possible secret detected (${detectedSecret}).`;
-					return JSON.stringify(recordProjectMemory(projectMemory, { kind: args.kind as "fact" | "decision" | "constraint" | "lesson", content: args.content, source: "agent", sessionID: toolContext.sessionID, commit: getCurrentGitCommitHash(effectiveRoot), paths: args.paths, supersedes: args.supersedes || undefined }));
+					return JSON.stringify(recordProjectMemory(projectMemory, { kind: args.kind as "fact" | "decision" | "constraint" | "lesson", content: args.content, source: "agent", sessionID: toolContext.sessionID, commit: getCurrentGitCommitHash(await resolveCallWorkspace(toolContext)), paths: args.paths, supersedes: args.supersedes || undefined }));
 				},
 			}),
 			project_memory_export: tool({
@@ -181,7 +204,7 @@ export function createCustomTools(options: {
 				execute: async (args, toolContext) => {
 					const valid = args.opportunities.slice(0, 20).filter((candidate): candidate is typeof candidate & { type: "design" | "debugging" | "new-concept" } => (candidate.type === "design" || candidate.type === "debugging" || candidate.type === "new-concept") && candidate.concept.length > 0 && candidate.concept.length <= 100 && candidate.relevance >= 0 && candidate.relevance <= 1 && candidate.consequence >= 0 && candidate.consequence <= 1);
 					const used = learningInterventions.get(toolContext.sessionID) ?? 0;
-					const selected = selectLearningOpportunity(loadLearnerProfile(), valid, { interventionsThisSession: used, maxInterventionsPerSession: getLearningInterventionBudget(effectiveRoot) });
+					const selected = selectLearningOpportunity(loadLearnerProfile(), valid, { interventionsThisSession: used, maxInterventionsPerSession: getLearningInterventionBudget(await resolveCallWorkspace(toolContext)) });
 					if (!selected) return JSON.stringify({ intervene: false, reason: "No opportunity selected or session learning budget reached." });
 					learningInterventions.set(toolContext.sessionID, used + 1);
 					return JSON.stringify({ intervene: true, opportunity: selected, guidance: "Ask one question, use the answer as task context, briefly reconcile if useful, then continue building." });
@@ -194,10 +217,11 @@ export function createCustomTools(options: {
 					const validKinds = new Set(["exposed", "developing", "demonstrated", "independent", "critique", "needs-reinforcement"]);
 					if (!validKinds.has(args.kind)) return "[workflow-guard] Learning evidence rejected: invalid evidence kind.";
 					if (args.concept.length < 1 || args.concept.length > 100 || args.summary.length < 1 || args.summary.length > 1000) return "[workflow-guard] Learning evidence rejected: concept must be 1-100 characters and summary 1-1000 characters.";
+					const learningWorkspace = await resolveCallWorkspace(toolContext);
 					try {
 						updateLearnerProfile((profile) => {
 							if (!profile.concepts[args.concept] && Object.keys(profile.concepts).length >= 500) throw new Error("concept-limit");
-							recordLearningEvidence(profile, { concept: args.concept, kind: args.kind as LearningEvidenceKind, summary: args.summary, timestamp: Date.now(), sessionID: toolContext.sessionID, project: effectiveRoot });
+							recordLearningEvidence(profile, { concept: args.concept, kind: args.kind as LearningEvidenceKind, summary: args.summary, timestamp: Date.now(), sessionID: toolContext.sessionID, project: learningWorkspace });
 						});
 					} catch (error) {
 						if ((error as Error).message === "concept-limit") return "[workflow-guard] Learning evidence rejected: learner profile concept limit reached.";
@@ -208,12 +232,12 @@ export function createCustomTools(options: {
 			}),
 		} : {}),
 		guard_status: tool({
-			description: "Inspect active guardrails, current branch protection, mutation count, outstanding verification/review requirements, and ralph status. The result includes pluginVersion, the version of the loaded guard package, so a stale installation is visible, and a read-only gitHygiene snapshot (local branches already merged into the mainline, prunable worktree admin entries, base-behind distance). Proactively call at session start and before completing tasks or creating PRs.",
+			description: "Inspect active guardrails, current branch protection, mutation count, outstanding verification/review requirements, and ralph status. The result includes pluginVersion, the version of the loaded guard package, so a stale installation is visible, and a read-only gitHygiene snapshot (local branches already merged into the mainline, prunable worktree admin entries, base-behind distance). Proactively call at session start and before completing tasks or creating PRs. Concurrent loops share one guard process, so pass 'directory' explicitly when inspecting a root other than this session's own workspace.",
 			args: {
-				directory: tool.schema.string().optional().describe("Target repository directory to inspect (defaults to active session directory or workspace root)"),
+				directory: tool.schema.string().optional().describe("Target repository directory to inspect (defaults to this session's own workspace binding, never another concurrent session's root)"),
 			},
 			execute: async (args, toolContext) => {
-				const root = await resolveEffectiveWorkspace({ sessionID: toolContext.sessionID, directory: args?.directory, fallback: toolContext.worktree || toolContext.directory || effectiveRoot });
+				const root = await resolveCallWorkspace(toolContext, args?.directory);
 				const branch = currentGitBranch(root) ?? "unknown"; const isProtected = onProtectedBranch(root); const lastV = getLastVerifyResultForWorkspace(root); const lastR = getLastReviewResultForWorkspace(root); const lastMut = getWorkspaceMutationTimestamp(root); const cfg = loadProjectConfig(root);
 				const subject = { workspace: projectRootKey(root), commitHash: getCurrentGitCommitHash(root), worktreeFingerprint: getGitWorktreeFingerprint(root) };
 				const verifyEvidence = lastV ? verificationEvidence(lastV) : undefined;
@@ -256,14 +280,14 @@ export function createCustomTools(options: {
 			},
 		}),
 		guard_audit: tool({ description: "View recent audit entries recorded by opencode-workflow-guard. Use to diagnose policy decisions, blocked commands, or outcome telemetry.", args: { limit: tool.schema.number().optional().describe("Maximum entries to return (default 10)") }, execute: async (args) => JSON.stringify(getRecentAuditEntries(typeof args?.limit === "number" ? Math.min(args.limit, 50) : 10), null, 2) }),
-		guard_why: tool({ description: "Simulate and return the structured policy decision for a specific tool call or command. Proactively use before executing questionable or complex commands to check if they would be blocked by guard policies.", args: { tool: tool.schema.string().describe("Tool name (e.g. bash, edit, write, read, apply_patch)"), input: tool.schema.record(tool.schema.string(), tool.schema.any()).optional().describe("Tool input arguments") }, execute: async (args, toolContext) => JSON.stringify(await runWithRuntimeState(effectiveRoot, client, () => guardToolCallImpl(args.tool, args.input ?? {}, { sessionID: toolContext.sessionID, worktree: toolContext.worktree, directory: toolContext.directory, simulate: true })), null, 2) }),
+		guard_why: tool({ description: "Simulate and return the structured policy decision for a specific tool call or command. Proactively use before executing questionable or complex commands to check if they would be blocked by guard policies.", args: { tool: tool.schema.string().describe("Tool name (e.g. bash, edit, write, read, apply_patch)"), input: tool.schema.record(tool.schema.string(), tool.schema.any()).optional().describe("Tool input arguments") }, execute: async (args, toolContext) => JSON.stringify(await runWithRuntimeState(await resolveCallWorkspace(toolContext), client, () => guardToolCallImpl(args.tool, args.input ?? {}, { sessionID: toolContext.sessionID, worktree: toolContext.worktree, directory: toolContext.directory, simulate: true })), null, 2) }),
 		record_review: tool({
 			description: "Record a secondary reviewer agent's approval or critique of the current changes. The summary must reference the 5 core review axes from guard_review_rubric (test integrity, task completeness, cleanliness, security, platform). Projects with requireSubagentReview enabled only accept APPROVALS recorded from a subagent session (one with a parent session), never from the root session itself.",
 			args: {
 				reviewer: tool.schema.string().describe("Identifier/name of the reviewer subagent"),
 				summary: tool.schema.string().describe("Review findings summary across the 5 core review axes"),
 				passed: tool.schema.boolean().describe("True if change is approved, false if changes requested"),
-				directory: tool.schema.string().optional().describe("Target repository directory being reviewed (defaults to parent session's repository or active directory)"),
+				directory: tool.schema.string().optional().describe("Target repository directory being reviewed. Pass it explicitly whenever the recorder session has no workspace binding: concurrent loops share one guard process, and a verdict is never bound to a guessed root."),
 			},
 			execute: async (args, toolContext) => {
 				const auditVerdict = (verdict: "approved" | "changes_requested" | "rejected", reason: string, binding?: NonNullable<AuditEntry["evidence"]>["binding"]) => audit({ ts: new Date().toISOString(), sessionID: toolContext.sessionID, tool: "record_review.verdict", decision: verdict === "rejected" ? "block" : "allow", phase: "event", reason, evidence: { reviewVerdict: verdict, ...(binding ? { binding } : {}) } });
@@ -277,7 +301,19 @@ export function createCustomTools(options: {
 				// hash + tracked worktree fingerprint); the recorder's lineage is
 				// captured in the audit trail. The review-before-PR requirement
 				// itself is unchanged.
-				const reviewWorkspace = await resolveEffectiveWorkspace({ sessionID: toolContext.sessionID, directory: args.directory, fallback: toolContext.worktree || toolContext.directory || effectiveRoot });
+				// Binding is never guessed: an explicit directory, the session's
+				// own workspace binding (direct or inherited from a bound
+				// parent), or a host-provided per-call worktree. When none of
+				// those exist the verdict is rejected instead of silently bound
+				// to a latched root — concurrent loops share one guard process,
+				// and a latched root can belong to another loop's repository.
+				const hostProvidesWorkspace = Boolean(toolContext?.worktree);
+				const sessionBinding = await resolveSessionBoundWorkspace(toolContext?.sessionID);
+				if (!args.directory && !sessionBinding && !hostProvidesWorkspace) {
+					auditVerdict("rejected", "review_binding_unresolved", { recorderSessionID: toolContext?.sessionID });
+					return "[workflow-guard] Review rejected: the reviewed workspace could not be resolved from this call (no explicit 'directory', no session workspace binding, no per-call worktree). Concurrent loops share one guard process, so a verdict is never bound to a guessed root. Call record_review with 'directory' set to the reviewed repository worktree.";
+				}
+				const reviewWorkspace = await resolveCallWorkspace(toolContext, args.directory);
 				const bindingFingerprint = getTrackedWorktreeFingerprint(reviewWorkspace);
 				if (!bindingFingerprint) {
 					auditVerdict("rejected", "review_workspace_unbindingable", { workspace: reviewWorkspace, recorderSessionID: toolContext.sessionID });
@@ -325,7 +361,7 @@ export function createCustomTools(options: {
 			execute: async (args, toolContext) => {
 				const sanitizedBase = typeof args.base === "string" && !args.base.startsWith("-") && !/[\s;'"\0]/.test(args.base) ? args.base : undefined;
 				const bases = sanitizedBase ? [sanitizedBase] : ["origin/main", "origin/master", "main", "master"];
-				const rubricWorkspace = await resolveEffectiveWorkspace({ sessionID: toolContext?.sessionID, directory: args?.directory, fallback: toolContext?.worktree || toolContext?.directory || effectiveRoot });
+				const rubricWorkspace = await resolveCallWorkspace(toolContext, args?.directory);
 				let diffText = "";
 				// Revision before the trailing `--` (LL-001) so the base ref is
 				// always parsed as a revision, never as a pathspec.
@@ -338,16 +374,20 @@ export function createCustomTools(options: {
 			description: "Create an isolated git worktree directory for concurrent subagent execution. Proactively call when launching parallel tasks/subagents to prevent file collision and maintain branch isolation.", args: { branch: tool.schema.string().describe("Branch name for the isolated worktree (e.g. 'feat/subagent-task')"), baseBranch: tool.schema.string().optional().describe("Base branch to branch off of (defaults to HEAD)") },
 			execute: async (args, toolContext) => {
 				const todos = await effectiveTodos(toolContext.sessionID); if (todos !== undefined && !hasActiveTodo(todos)) return "[workflow-guard] Blocked: worktree creation with no active todo item. Break the request down with todowrite first, then create worktrees.";
-				const toolRoot = toolContext.worktree || toolContext.directory || effectiveRoot; const res = createGitWorktree(args.branch, args.baseBranch ?? "HEAD", toolRoot); if (!res.success) return `[workflow-guard] Failed to create worktree: ${res.error}`;
-				recordMutation((await effectiveTodoOwnerSessionID(toolContext.sessionID)) ?? toolContext.sessionID, toolContext.sessionID); return `[workflow-guard] Worktree created successfully at: ${res.worktreePath}\nRun subagent tasks or pass worktree directory context to isolate file mutations.`;
+				const toolRoot = await resolveCallWorkspace(toolContext); const res = createGitWorktree(args.branch, args.baseBranch ?? "HEAD", toolRoot); if (!res.success) return `[workflow-guard] Failed to create worktree: ${res.error}`;
+				const mutationRoot = await resolveCallWorkspace(toolContext);
+				await runWithRuntimeState(mutationRoot, client, async () => recordMutation((await effectiveTodoOwnerSessionID(toolContext.sessionID)) ?? toolContext.sessionID, toolContext.sessionID));
+				return `[workflow-guard] Worktree created successfully at: ${res.worktreePath}\nRun subagent tasks or pass worktree directory context to isolate file mutations.`;
 			},
 		}),
 		guard_worktree_cleanup: tool({
 			description: "Commit a final snapshot and remove an isolated git worktree directory. Call to clean up worktrees created with guard_worktree_create after subagent tasks complete.", args: { worktreePath: tool.schema.string().describe("Path of the worktree directory to clean up") },
 			execute: async (args, toolContext) => {
 				const todos = await effectiveTodos(toolContext.sessionID); if (todos !== undefined && !hasActiveTodo(todos)) return "[workflow-guard] Blocked: worktree cleanup with no active todo item. Break the request down with todowrite first, then clean up worktrees.";
-				const toolRoot = toolContext.worktree || toolContext.directory || effectiveRoot; const res = cleanupGitWorktree(args.worktreePath, toolRoot); if (!res.success) return `[workflow-guard] Failed to clean up worktree: ${res.error}`;
-				recordMutation((await effectiveTodoOwnerSessionID(toolContext.sessionID)) ?? toolContext.sessionID, toolContext.sessionID); return `[workflow-guard] Worktree at '${args.worktreePath}' cleaned up successfully.`;
+				const toolRoot = await resolveCallWorkspace(toolContext); const res = cleanupGitWorktree(args.worktreePath, toolRoot); if (!res.success) return `[workflow-guard] Failed to clean up worktree: ${res.error}`;
+				const mutationRoot = await resolveCallWorkspace(toolContext);
+				await runWithRuntimeState(mutationRoot, client, async () => recordMutation((await effectiveTodoOwnerSessionID(toolContext.sessionID)) ?? toolContext.sessionID, toolContext.sessionID));
+				return `[workflow-guard] Worktree at '${args.worktreePath}' cleaned up successfully.`;
 			},
 		}),
 	};

package/src/lib/guard-dispatcher.ts

@@ -7,6 +7,7 @@ import {
 	getLastReviewResultForWorkspace,
 	getLiveControlPlaneRoots,
 	getSdkClient,
+	getSessionBoundWorkspace,
 	getWorkspaceRoot,
 	isDocumentationRequired,
 	isReviewRequired,
@@ -48,6 +49,7 @@ import {
 	GIT_WRITE_RE,
 	PUSH_TO_MAIN_RE,
 	branchGuardReason,
+	branchCreationStartPoint,
 	checkBranchBaseIsUpToDate,
 	checkMergeConflicts,
 	currentGitBranch,
@@ -113,7 +115,15 @@ export async function guardToolCallImpl(
 	context?: { sessionID?: string; callID?: string; worktree?: string; directory?: string; agent?: string; simulate?: boolean },
 ): Promise<PolicyDecision> {
 	const logPolicyBlock = (message: string) => logBlock(message, context?.simulate);
-	const currentRoot = getWorkspaceRoot();
+	// The workspace for THIS decision comes from the call's own context (the
+	// hook's per-call worktree/directory) or, failing that, the session's own
+	// bound workspace — never from one process-global slot: concurrent loops
+	// share this process, and the last-active instance must not re-anchor
+	// another session's policy evaluation.
+	const currentRoot = context?.worktree
+		|| context?.directory
+		|| getSessionBoundWorkspace(context?.sessionID)
+		|| getWorkspaceRoot();
 	const allow = (): PolicyDecision => ({ status: "allowed", code: "allowed", message: "Allowed by current guardrails." });
 	const block = (policy: string, code: string, message: string): PolicyDecision => ({ status: "blocked", policy, code, message });
 	const needsApproval = (policy: string, code: string, message: string): PolicyDecision => ({ status: "needs_approval", policy, code, message });
@@ -366,9 +376,27 @@ export async function guardToolCallImpl(
 			}
 		}
 		if (GIT_BRANCH_CREATE_RE.test(normalizedCommand)) {
-			const behindCheck = checkBranchBaseIsUpToDate(effectiveRoot);
+			// A branch created from an explicit start point that already contains
+			// the remote default is fresh by construction; only creations without
+			// one (or with an unclassifiable shape — fail closed) inherit the
+			// current branch's staleness.
+			const creationStarts: Array<string | undefined> = [];
+			let classifiable = true;
+			for (const invocation of gitInvocations) {
+				if (!GIT_BRANCH_CREATE_RE.test(`git ${invocation.rest}`)) continue;
+				const parsed = branchCreationStartPoint(invocation.rest);
+				if (parsed === undefined) {
+					classifiable = false;
+					break;
+				}
+				creationStarts.push(parsed.start);
+			}
+			const behindCheck = checkBranchBaseIsUpToDate(
+				effectiveRoot,
+				classifiable && creationStarts.length > 0 ? creationStarts : undefined,
+			);
 			if (behindCheck.isBehind) {
-				logPolicyBlock(`[workflow-guard] blocked branch creation: base is behind remote ${behindCheck.baseRef}`);
+				logPolicyBlock(`[workflow-guard] blocked branch creation: ${behindCheck.reason ?? "base is behind remote"}`);
 				return block("git", "branch_base_behind", `Blocked: ${behindCheck.reason}`);
 			}
 		}

package/src/lib/state.ts

@@ -1,5 +1,5 @@
-import { realpathSync, existsSync, unlinkSync } from "node:fs";
-import { resolve } from "node:path";
+import { existsSync, unlinkSync } from "node:fs";
+import { isAbsolute, resolve } from "node:path";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { getReviewCacheFilePath, loadReviewCache, persistReviewCache, persistVerifyCache, persistVerifyHistory } from "./audit.ts";
 import { findGitRoot, getCachedProjectConfig, isSameGitRepo, loadProjectConfig, projectRootKey } from "./project-config.ts";
@@ -13,36 +13,21 @@ import type {
 } from "./types.ts";
 
 export let workspaceRoot = process.cwd();
-export let workspaceRootReal = workspaceRoot;
 interface RuntimeState {
 	workspaceRoot: string;
-	workspaceRootReal: string;
 	sdkClient: TodoSdkClient | undefined;
 	projectConfig: ProjectConfig;
 }
 const runtimeState = new AsyncLocalStorage<RuntimeState>();
 
-try {
-	workspaceRootReal = realpathSync(workspaceRoot);
-} catch {}
-
 export function setWorkspaceRoot(root: string): void {
 	workspaceRoot = root;
-	try {
-		workspaceRootReal = realpathSync(root);
-	} catch {
-		workspaceRootReal = root;
-	}
 }
 
 export function getWorkspaceRoot(): string {
 	return runtimeState.getStore()?.workspaceRoot ?? workspaceRoot;
 }
 
-export function getWorkspaceRootReal(): string {
-	return runtimeState.getStore()?.workspaceRootReal ?? workspaceRootReal;
-}
-
 export let sdkClient: TodoSdkClient | undefined;
 
 export function setSdkClient(client: unknown): void {
@@ -54,14 +39,9 @@ export function getSdkClient(): TodoSdkClient | undefined {
 }
 
 export function runWithRuntimeState<T>(root: string, client: unknown, fn: () => T): T {
-	let realRoot = root;
-	try {
-		realRoot = realpathSync(root);
-	} catch {}
 	return runtimeState.run(
 		{
 			workspaceRoot: root,
-			workspaceRootReal: realRoot,
 			sdkClient: client as TodoSdkClient | undefined,
 			projectConfig: loadProjectConfig(root),
 		},
@@ -76,11 +56,18 @@ const workspaceMutationCounts = new Map<string, number>();
 export const sessionMutationTimestamps = new Map<string, number>();
 export const sessionMutationCounts = new Map<string, number>();
 export const sessionWorkspaces = new Map<string, string>();
+// Sessions whose workspace was registered from their OWN context (tool-call
+// arguments or a host-provided per-call worktree). A session registered only
+// from the plugin-instance default is deliberately left unmarked: concurrent
+// loops share this process, and a value derived from the last-active plugin
+// instance must never outrank the call's own context or the host fallback.
+const sessionWorkspaceBound = new Set<string>();
 
 export function setSessionWorkspace(sessionID: string, workspace: string): void {
 	if (!sessionID || !workspace) return;
 	const gitRoot = findGitRoot(workspace);
 	sessionWorkspaces.set(sessionID, gitRoot ?? projectRootKey(workspace));
+	sessionWorkspaceBound.add(sessionID);
 }
 
 export function getSessionWorkspace(sessionID?: string): string | undefined {
@@ -88,6 +75,75 @@ export function getSessionWorkspace(sessionID?: string): string | undefined {
 	return sessionWorkspaces.get(sessionID);
 }
 
+/**
+ * The session's workspace only when it was registered from the session's own
+ * context (tool-call arguments or a host-provided per-call worktree), never a
+ * plugin-instance-default bootstrap. Policy decisions that bind evidence or
+ * confine boundaries must consult this variant: two concurrent loops share one
+ * guard process, and an unbound bootstrap entry may have been derived from
+ * another session's plugin instance.
+ */
+export function getSessionBoundWorkspace(sessionID?: string): string | undefined {
+	if (!sessionID) return undefined;
+	return sessionWorkspaceBound.has(sessionID) ? sessionWorkspaces.get(sessionID) : undefined;
+}
+
+/**
+ * Register a session's workspace from a tool call's own context. Candidates in
+ * priority order: tool-argument paths (workdir/filePath — the call's own
+ * target), then a host-provided per-call worktree/directory. A session that is
+ * already registered is never re-anchored from the plugin-instance fallback:
+ * under concurrent loops that fallback can belong to a different session's
+ * workspace, which is exactly how workspaces cross-contaminate. Only a
+ * session with no registration at all is bootstrapped from the fallback, and
+ * such a bootstrap stays unbound (never used to bind review evidence).
+ */
+export function registerSessionWorkspaceFromToolCall(
+	sessionID: string | undefined,
+	call: { workdir?: string; filePath?: string; hostWorktree?: string; toolWorktree: string },
+): void {
+	if (!sessionID) return;
+	const rawCandidate = call.workdir ?? call.filePath ?? call.hostWorktree;
+	if (rawCandidate) {
+		const candidatePath = isAbsolute(rawCandidate) ? rawCandidate : resolve(call.toolWorktree, rawCandidate);
+		const gitRoot = findGitRoot(candidatePath);
+		if (gitRoot) {
+			sessionWorkspaces.set(sessionID, gitRoot);
+			sessionWorkspaceBound.add(sessionID);
+		}
+		return;
+	}
+	if (sessionWorkspaces.has(sessionID)) return;
+	const gitRoot = findGitRoot(call.toolWorktree);
+	sessionWorkspaces.set(sessionID, gitRoot ?? projectRootKey(call.toolWorktree));
+}
+
+/**
+ * The session's workspace resolved from its own bindings only: a directly
+ * registered bound workspace, else the nearest bound parent workspace
+ * (subagent sessions inherit their parent's binding for relay flows). Returns
+ * undefined when neither exists — callers that must not guess (review verdict
+ * binding) treat that as "resolve nothing, ask for an explicit directory".
+ */
+export async function resolveSessionBoundWorkspace(sessionID?: string): Promise<string | undefined> {
+	if (!sessionID) return undefined;
+	const direct = getSessionBoundWorkspace(sessionID);
+	if (direct) return direct;
+	try {
+		const client = getSdkClient();
+		const session = client?.session;
+		const get = session?.get;
+		if (typeof get === "function") {
+			const result = await get.call(session, { path: { id: sessionID } });
+			const parent = (result as { data?: { parentID?: unknown } } | undefined)?.data?.parentID;
+			if (typeof parent === "string" && parent && sessionWorkspaceBound.has(parent)) {
+				return sessionWorkspaces.get(parent);
+			}
+		}
+	} catch {}
+	return undefined;
+}
+
 export let lastVerify: VerifyResult | undefined;
 export const sessionVerifyResults = new Map<string, NonNullable<VerifyResult>>();
 
@@ -228,10 +284,28 @@ export function getLastReviewResult(): typeof lastReview {
 
 export function getLastReviewResultForWorkspace(root: string): typeof lastReview {
 	const workspace = projectRootKey(root);
-	const candidates = [lastReview, ...sessionReviews.values()].filter(
-		(result): result is ReviewResult => result?.workspace != null && (projectRootKey(result.workspace) === workspace || isSameGitRepo(result.workspace, root)),
+	const all = [lastReview, ...sessionReviews.values()].filter(
+		(result): result is ReviewResult & { workspace: string } => result?.workspace != null,
 	);
-	const latest = candidates.reduce<ReviewResult | undefined>((best, result) => !best || result.timestamp > best.timestamp ? result : best, undefined);
+	// Exact worktree binding wins: concurrent loops sharing one repository
+	// (different worktrees) must consume their own approvals independently —
+	// a newer sibling-worktree review must never displace this worktree's
+	// between record_review and PR creation.
+	const exact = all.filter((result) => projectRootKey(result.workspace) === workspace);
+	let preferred = exact;
+	if (preferred.length === 0) {
+		const sameRepo = all.filter((result) => isSameGitRepo(result.workspace, root));
+		if (sameRepo.length > 0) {
+			// Among same-repo candidates, prefer the review whose tracked
+			// content matches THIS worktree (the PR preflight consumes the
+			// approval bound to the tree it would publish); recency only
+			// breaks ties.
+			const prFingerprint = getTrackedWorktreeFingerprint(root);
+			const contentMatched = prFingerprint ? sameRepo.filter((result) => result.worktreeFingerprint === prFingerprint) : [];
+			preferred = contentMatched.length > 0 ? contentMatched : sameRepo;
+		}
+	}
+	const latest = preferred.reduce<ReviewResult | undefined>((best, result) => !best || result.timestamp > best.timestamp ? result : best, undefined);
 	if (latest) return latest;
 	const diskCached = loadReviewCache();
 	if (diskCached?.workspace && (projectRootKey(diskCached.workspace) === workspace || isSameGitRepo(diskCached.workspace, root))) {
@@ -254,41 +328,36 @@ export async function resolveEffectiveWorkspace(options: {
 	directory?: string;
 	fallback?: string;
 }): Promise<string> {
+	// Intended precedence. Custom tools (resolveCallWorkspace) consult the
+	// explicit argument and the host per-call context BEFORE calling this, so
+	// inside this function the remaining order is: bound session workspace >
+	// host fallback > unbound bootstrap hint > global latch/cwd. A future
+	// direct caller passing a per-call `fallback` should apply the same
+	// host-context-first step that resolveCallWorkspace does.
 	if (options.directory) {
 		const gitRoot = findGitRoot(options.directory);
 		return gitRoot ?? projectRootKey(options.directory);
 	}
+	// 1. The session's own binding (direct, or inherited from a bound parent
+	// for relay flows) wins over every ambient fallback. Concurrent loops
+	// share one guard process; a fallback derived from the last-active
+	// plugin instance must never re-anchor another session's context.
+	const bound = await resolveSessionBoundWorkspace(options.sessionID);
+	if (bound) return bound;
 	const fallbackRoot = options.fallback ? projectRootKey(options.fallback) : undefined;
 	const isFallbackFsRoot = fallbackRoot ? resolve(fallbackRoot) === resolve(fallbackRoot, "..") : true;
 
+	// 2. The call's own host-provided per-call worktree/directory.
 	if (fallbackRoot && !isFallbackFsRoot) {
-		if (options.sessionID) {
-			const sessionWs = sessionWorkspaces.get(options.sessionID);
-			if (sessionWs && isSameGitRepo(sessionWs, fallbackRoot)) {
-				return sessionWs;
-			}
-		}
 		return fallbackRoot;
 	}
 
-	if (options.sessionID) {
-		const sessionWs = sessionWorkspaces.get(options.sessionID);
-		if (sessionWs) return sessionWs;
-		try {
-			const client = getSdkClient();
-			const session = client?.session;
-			const get = session?.get;
-			if (typeof get === "function") {
-				const result = await get.call(session, { path: { id: options.sessionID } });
-				const parent = (result as { data?: { parentID?: unknown } } | undefined)?.data?.parentID;
-				if (typeof parent === "string" && parent && sessionWorkspaces.has(parent)) {
-					const parentWs = sessionWorkspaces.get(parent)!;
-					sessionWorkspaces.set(options.sessionID, parentWs);
-					return parentWs;
-				}
-			}
-		} catch {}
-	}
+	// 3. Unbound bootstrap hint: the session was registered only from the
+	// plugin-instance default, so it carries no per-session authority and
+	// loses to any real fallback (step 2). It is still better than the raw
+	// global latch when the fallback is absent or the filesystem root.
+	const hintRoot = options.sessionID ? sessionWorkspaces.get(options.sessionID) : undefined;
+	if (hintRoot) return hintRoot;
 	const activeRoot = getWorkspaceRoot();
 	if (activeRoot && resolve(activeRoot) !== resolve(activeRoot, "..")) {
 		const gitRoot = findGitRoot(activeRoot);

package/src/lib/v2-plugin.ts

@@ -25,8 +25,8 @@ import { findGitRoot, reloadProjectConfig } from "./project-config.ts";
 import {
 	setWorkspaceRoot,
 	setSdkClient,
-	getSessionWorkspace,
-	setSessionWorkspace,
+	getSessionBoundWorkspace,
+	registerSessionWorkspaceFromToolCall,
 	runWithRuntimeState,
 	getSessionMutationCount,
 	sessionVerifyResults,
@@ -193,10 +193,14 @@ export const WorkflowGuardV2 = async (ctx: V2Context) => {
 				// wrap it so the V2 registry receives a real StandardSchemaV1.
 				input: z.object(definition.args as unknown as z.ZodRawShape),
 				execute: async (rawInput: unknown, toolContext: { sessionID: string; id: string }) => {
+					// Only a session-bound workspace counts as the tool's own
+					// context; an unbound entry is a plugin-instance bootstrap
+					// and must not be presented to the tools as one.
+					const boundWorktree = getSessionBoundWorkspace(toolContext.sessionID);
 					const result = await (definition.execute as (input: unknown, context: unknown) => Promise<unknown>)(rawInput, {
 						sessionID: toolContext.sessionID,
-						worktree: getSessionWorkspace(toolContext.sessionID) ?? effectiveRoot,
-						directory: effectiveRoot,
+						...(boundWorktree ? { worktree: boundWorktree } : {}),
+						directory: boundWorktree ?? effectiveRoot,
 					});
 					const text = typeof result === "string" ? result : (result as { output?: string } | undefined)?.output;
 					return {
@@ -218,7 +222,7 @@ export const WorkflowGuardV2 = async (ctx: V2Context) => {
 
 	// ── Deterministic enforcement ──
 	await ctx.tool.hook("execute.before", (event) => {
-		const toolWorktree = getSessionWorkspace(event.sessionID) || effectiveRoot;
+		const toolWorktree = getSessionBoundWorkspace(event.sessionID) || effectiveRoot;
 		return runWithRuntimeState(toolWorktree, client, async () => {
 			const args = event.input;
 			const reason = await guardToolCall(event.tool, args, {
@@ -239,11 +243,7 @@ export const WorkflowGuardV2 = async (ctx: V2Context) => {
 			const record = asRecord(args);
 			const workdir = typeof record?.workdir === "string" ? record.workdir : undefined;
 			const filePath = typeof record?.filePath === "string" ? record.filePath : (typeof record?.path === "string" ? record.path : undefined);
-			const candidatePath = workdir ?? filePath ?? toolWorktree;
-			if (candidatePath) {
-				const gitRoot = findGitRoot(candidatePath);
-				if (gitRoot) setSessionWorkspace(event.sessionID, gitRoot);
-			}
+			registerSessionWorkspaceFromToolCall(event.sessionID, { workdir, filePath, toolWorktree });
 			if (event.tool === "read") {
 				const target = editTargets(args, toolWorktree)[0];
 				if (target) {

package/src/policies/boundary.ts

@@ -4,7 +4,6 @@ import { dirname, join, resolve } from "node:path";
 import type { ShellMutation } from "../lib/types.ts";
 import {
 	getWorkspaceRoot,
-	getWorkspaceRootReal,
 	recordMutation,
 } from "../lib/state.ts";
 import { prepareRedirectResidue, shellWords, unwrapShellCommand } from "../lib/shell.ts";
@@ -89,7 +88,15 @@ export function isPathOutsideWorkspace(targetPath: string, root: string): boolea
 	if (resolved !== root && !resolved.startsWith(normalizedRoot)) {
 		return true;
 	}
-	const realRootVal = getWorkspaceRootReal();
+	// The boundary is resolved against the workspace THIS call declares (the
+	// `root` argument), never against a process-global latched root: concurrent
+	// loops share one guard process, and a latched root must not redefine
+	// another session's boundary. Symlink-awareness is preserved (ancestor
+	// walk below) by canonicalizing the declared root itself.
+	let realRootVal = root;
+	try {
+		realRootVal = realpathSync(root);
+	} catch {}
 	try {
 		const real = realpathSync(resolved);
 		const realRoot = realRootVal.endsWith("/") ? realRootVal : realRootVal + "/";