opencode-workflow-guard 1.15.1 → 1.15.2

package/docs/policies.md

@@ -31,7 +31,7 @@ It is a policy and enforcement layer, not an agent harness. Policies may constra
   - The branch diff modifies a `CHANGELOG` file, OR
   - The branch diff adds/modifies a `.changeset/*.md` fragment file (Changesets workflow), OR
   - The PR description (`--body`, `--description`, or `--body-file`/`-F`) contains a release-information section headed `Changelog`, `Changes`, `Release notes`, or `Summary`. Multiline Bash ANSI-C `\n`/`\r` quoting is supported for inline descriptions; inline descriptions that would render Markdown line breaks as literal `\n`/`\r` text are blocked with guidance to use real newlines or a description file.
-- **Lockfile Synchronization Gate:** Whenever package manifests (`package.json`, `Cargo.toml`, `go.mod`) are modified, PR creation is blocked until their corresponding lockfiles (`package-lock.json`/`bun.lock`/`pnpm-lock.yaml`/`yarn.lock`, `Cargo.lock`, `go.sum`) are updated.
+- **Lockfile Synchronization Gate:** Whenever package manifests (`package.json`, `Cargo.toml`, `go.mod`) are modified, PR creation is blocked until their corresponding lockfiles (`package-lock.json`/`bun.lock`/`pnpm-lock.yaml`/`yarn.lock`, `Cargo.lock`, `go.sum`) are updated. For `package.json` the demand is section-aware: it fires when a section the lockfile records changed (`dependencies`, `devDependencies`, `optionalDependencies`, `peerDependencies`, `peerDependenciesMeta`, `engines`, `packageManager`, `overrides`, `resolutions`, `workspaces`, `pnpm`, or the project `name`/`version`). Scripts- or metadata-only manifest edits regenerate the lockfile byte-identical and pass without one. `Cargo.toml` and `go.mod` changes conservatively keep demanding their lockfiles.
 - When multiple PR prerequisites fail at once, the guard reports all detected preflight failures together so they can be resolved before retrying PR creation.
 
 ### 4. Destructive CLI Operations Guard

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-workflow-guard",
-  "version": "1.15.1",
+  "version": "1.15.2",
   "description": "Deterministic workflow and safety policy enforcement for OpenCode",
   "license": "MIT",
   "type": "module",

package/src/lib/custom-tools.ts

@@ -1,5 +1,6 @@
 import { tool } from "@opencode-ai/plugin";
 import { spawnSync } from "node:child_process";
+import { resolve } from "node:path";
 import type { AuditEntry, LearningEvidenceKind } from "./types.ts";
 import type { ProjectMemoryStore } from "./project-memory.ts";
 import {
@@ -31,10 +32,11 @@ import {
 	recordMutation,
 	recordReviewResult,
 	resolveEffectiveWorkspace,
+	resolveSessionBoundWorkspace,
 	runWithRuntimeState,
 } from "./state.ts";
 import { getRalphOutcome } from "../policies/continuation.ts";
-import { loadProjectConfig, projectRootKey } from "./project-config.ts";
+import { findGitRoot, loadProjectConfig, projectRootKey } from "./project-config.ts";
 import { detectVerifyCommand, getCurrentGitCommitHash, getGitWorktreeFingerprint, getTrackedWorktreeFingerprint } from "./verify.ts";
 import { buildReviewRubric } from "./review.ts";
 import { createGitWorktree, cleanupGitWorktree } from "./worktree.ts";
@@ -121,6 +123,27 @@ export function createCustomTools(options: {
 	client: unknown;
 }) {
 	const { effectiveRoot, projectMemoryEnabled, learningEnabled, projectMemory, followupStore, portableMemoryPath, learningInterventions, client } = options;
+	// Resolve the workspace for a tool call from the CALL's own context: an
+	// explicit argument first, then the host-provided per-call worktree or
+	// directory (even when unusable — the call declared its target), then the
+	// session's bound workspace. The plugin-instance default (`effectiveRoot`)
+	// is only the last resort — concurrent loops share one guard process, so
+	// an instance-derived root must never re-anchor another session's tool
+	// execution.
+	const resolveCallWorkspace = async (
+		toolContext: { sessionID?: string; worktree?: string; directory?: string } | undefined,
+		explicitDirectory?: string,
+	): Promise<string> => {
+		if (explicitDirectory) {
+			return findGitRoot(explicitDirectory) ?? projectRootKey(explicitDirectory);
+		}
+		const hostContext = toolContext?.worktree || toolContext?.directory;
+		const hostIsFilesystemRoot = hostContext ? resolve(hostContext) === resolve(hostContext, "..") : true;
+		if (hostContext && !hostIsFilesystemRoot) {
+			return findGitRoot(hostContext) ?? projectRootKey(hostContext);
+		}
+		return resolveEffectiveWorkspace({ sessionID: toolContext?.sessionID, fallback: effectiveRoot });
+	};
 	return {
 		...(isRecoveryCheckpointsEnabled(effectiveRoot) ? {
 			guard_recovery_restore: tool({
@@ -131,7 +154,7 @@ export function createCustomTools(options: {
 					const parent = await fetchParentSession(toolContext.sessionID);
 					if (!parent.ok) return "[workflow-guard] Recovery rejected: could not confirm this is a root session.";
 					if (parent.parentID) return "[workflow-guard] Recovery rejected: only root sessions can restore their checkpoints.";
-					const result = restoreRecoveryCheckpoint(effectiveRoot, toolContext.sessionID, args.run);
+					const result = restoreRecoveryCheckpoint(await resolveCallWorkspace(toolContext), toolContext.sessionID, args.run);
 					return result.ok ? `[workflow-guard] Restored recovery checkpoint for run ${args.run}.` : `[workflow-guard] Recovery rejected: ${result.error}`;
 				},
 			}),
@@ -139,8 +162,8 @@ export function createCustomTools(options: {
 		guard_next_tasks: tool({
 			description: "Load durable repository task context when deciding what to work on next or planning upcoming steps. Proactively call at session start or during planning to discover roadmap, plan, tasks, backlog, and TODO.md files.",
 			args: {},
-			execute: async () => {
-				const sources = discoverPlanningSources(effectiveRoot);
+			execute: async (_args, toolContext) => {
+				const sources = discoverPlanningSources(await resolveCallWorkspace(toolContext));
 				return sources.length > 0 ? JSON.stringify({ sources }, null, 2) : JSON.stringify({ sources: [], message: "No TODO, roadmap, plan, tasks, or backlog Markdown files found." });
 			},
 		}),
@@ -158,7 +181,7 @@ export function createCustomTools(options: {
 					if (!(["fact", "decision", "constraint", "lesson"] as string[]).includes(args.kind)) return "[workflow-guard] Project memory rejected: invalid kind.";
 					const detectedSecret = secretIn(args.content);
 					if (detectedSecret) return `[workflow-guard] Project memory rejected: possible secret detected (${detectedSecret}).`;
-					return JSON.stringify(recordProjectMemory(projectMemory, { kind: args.kind as "fact" | "decision" | "constraint" | "lesson", content: args.content, source: "agent", sessionID: toolContext.sessionID, commit: getCurrentGitCommitHash(effectiveRoot), paths: args.paths, supersedes: args.supersedes || undefined }));
+					return JSON.stringify(recordProjectMemory(projectMemory, { kind: args.kind as "fact" | "decision" | "constraint" | "lesson", content: args.content, source: "agent", sessionID: toolContext.sessionID, commit: getCurrentGitCommitHash(await resolveCallWorkspace(toolContext)), paths: args.paths, supersedes: args.supersedes || undefined }));
 				},
 			}),
 			project_memory_export: tool({
@@ -181,7 +204,7 @@ export function createCustomTools(options: {
 				execute: async (args, toolContext) => {
 					const valid = args.opportunities.slice(0, 20).filter((candidate): candidate is typeof candidate & { type: "design" | "debugging" | "new-concept" } => (candidate.type === "design" || candidate.type === "debugging" || candidate.type === "new-concept") && candidate.concept.length > 0 && candidate.concept.length <= 100 && candidate.relevance >= 0 && candidate.relevance <= 1 && candidate.consequence >= 0 && candidate.consequence <= 1);
 					const used = learningInterventions.get(toolContext.sessionID) ?? 0;
-					const selected = selectLearningOpportunity(loadLearnerProfile(), valid, { interventionsThisSession: used, maxInterventionsPerSession: getLearningInterventionBudget(effectiveRoot) });
+					const selected = selectLearningOpportunity(loadLearnerProfile(), valid, { interventionsThisSession: used, maxInterventionsPerSession: getLearningInterventionBudget(await resolveCallWorkspace(toolContext)) });
 					if (!selected) return JSON.stringify({ intervene: false, reason: "No opportunity selected or session learning budget reached." });
 					learningInterventions.set(toolContext.sessionID, used + 1);
 					return JSON.stringify({ intervene: true, opportunity: selected, guidance: "Ask one question, use the answer as task context, briefly reconcile if useful, then continue building." });
@@ -194,10 +217,11 @@ export function createCustomTools(options: {
 					const validKinds = new Set(["exposed", "developing", "demonstrated", "independent", "critique", "needs-reinforcement"]);
 					if (!validKinds.has(args.kind)) return "[workflow-guard] Learning evidence rejected: invalid evidence kind.";
 					if (args.concept.length < 1 || args.concept.length > 100 || args.summary.length < 1 || args.summary.length > 1000) return "[workflow-guard] Learning evidence rejected: concept must be 1-100 characters and summary 1-1000 characters.";
+					const learningWorkspace = await resolveCallWorkspace(toolContext);
 					try {
 						updateLearnerProfile((profile) => {
 							if (!profile.concepts[args.concept] && Object.keys(profile.concepts).length >= 500) throw new Error("concept-limit");
-							recordLearningEvidence(profile, { concept: args.concept, kind: args.kind as LearningEvidenceKind, summary: args.summary, timestamp: Date.now(), sessionID: toolContext.sessionID, project: effectiveRoot });
+							recordLearningEvidence(profile, { concept: args.concept, kind: args.kind as LearningEvidenceKind, summary: args.summary, timestamp: Date.now(), sessionID: toolContext.sessionID, project: learningWorkspace });
 						});
 					} catch (error) {
 						if ((error as Error).message === "concept-limit") return "[workflow-guard] Learning evidence rejected: learner profile concept limit reached.";
@@ -208,12 +232,12 @@ export function createCustomTools(options: {
 			}),
 		} : {}),
 		guard_status: tool({
-			description: "Inspect active guardrails, current branch protection, mutation count, outstanding verification/review requirements, and ralph status. The result includes pluginVersion, the version of the loaded guard package, so a stale installation is visible, and a read-only gitHygiene snapshot (local branches already merged into the mainline, prunable worktree admin entries, base-behind distance). Proactively call at session start and before completing tasks or creating PRs.",
+			description: "Inspect active guardrails, current branch protection, mutation count, outstanding verification/review requirements, and ralph status. The result includes pluginVersion, the version of the loaded guard package, so a stale installation is visible, and a read-only gitHygiene snapshot (local branches already merged into the mainline, prunable worktree admin entries, base-behind distance). Proactively call at session start and before completing tasks or creating PRs. Concurrent loops share one guard process, so pass 'directory' explicitly when inspecting a root other than this session's own workspace.",
 			args: {
-				directory: tool.schema.string().optional().describe("Target repository directory to inspect (defaults to active session directory or workspace root)"),
+				directory: tool.schema.string().optional().describe("Target repository directory to inspect (defaults to this session's own workspace binding, never another concurrent session's root)"),
 			},
 			execute: async (args, toolContext) => {
-				const root = await resolveEffectiveWorkspace({ sessionID: toolContext.sessionID, directory: args?.directory, fallback: toolContext.worktree || toolContext.directory || effectiveRoot });
+				const root = await resolveCallWorkspace(toolContext, args?.directory);
 				const branch = currentGitBranch(root) ?? "unknown"; const isProtected = onProtectedBranch(root); const lastV = getLastVerifyResultForWorkspace(root); const lastR = getLastReviewResultForWorkspace(root); const lastMut = getWorkspaceMutationTimestamp(root); const cfg = loadProjectConfig(root);
 				const subject = { workspace: projectRootKey(root), commitHash: getCurrentGitCommitHash(root), worktreeFingerprint: getGitWorktreeFingerprint(root) };
 				const verifyEvidence = lastV ? verificationEvidence(lastV) : undefined;
@@ -256,14 +280,14 @@ export function createCustomTools(options: {
 			},
 		}),
 		guard_audit: tool({ description: "View recent audit entries recorded by opencode-workflow-guard. Use to diagnose policy decisions, blocked commands, or outcome telemetry.", args: { limit: tool.schema.number().optional().describe("Maximum entries to return (default 10)") }, execute: async (args) => JSON.stringify(getRecentAuditEntries(typeof args?.limit === "number" ? Math.min(args.limit, 50) : 10), null, 2) }),
-		guard_why: tool({ description: "Simulate and return the structured policy decision for a specific tool call or command. Proactively use before executing questionable or complex commands to check if they would be blocked by guard policies.", args: { tool: tool.schema.string().describe("Tool name (e.g. bash, edit, write, read, apply_patch)"), input: tool.schema.record(tool.schema.string(), tool.schema.any()).optional().describe("Tool input arguments") }, execute: async (args, toolContext) => JSON.stringify(await runWithRuntimeState(effectiveRoot, client, () => guardToolCallImpl(args.tool, args.input ?? {}, { sessionID: toolContext.sessionID, worktree: toolContext.worktree, directory: toolContext.directory, simulate: true })), null, 2) }),
+		guard_why: tool({ description: "Simulate and return the structured policy decision for a specific tool call or command. Proactively use before executing questionable or complex commands to check if they would be blocked by guard policies.", args: { tool: tool.schema.string().describe("Tool name (e.g. bash, edit, write, read, apply_patch)"), input: tool.schema.record(tool.schema.string(), tool.schema.any()).optional().describe("Tool input arguments") }, execute: async (args, toolContext) => JSON.stringify(await runWithRuntimeState(await resolveCallWorkspace(toolContext), client, () => guardToolCallImpl(args.tool, args.input ?? {}, { sessionID: toolContext.sessionID, worktree: toolContext.worktree, directory: toolContext.directory, simulate: true })), null, 2) }),
 		record_review: tool({
 			description: "Record a secondary reviewer agent's approval or critique of the current changes. The summary must reference the 5 core review axes from guard_review_rubric (test integrity, task completeness, cleanliness, security, platform). Projects with requireSubagentReview enabled only accept APPROVALS recorded from a subagent session (one with a parent session), never from the root session itself.",
 			args: {
 				reviewer: tool.schema.string().describe("Identifier/name of the reviewer subagent"),
 				summary: tool.schema.string().describe("Review findings summary across the 5 core review axes"),
 				passed: tool.schema.boolean().describe("True if change is approved, false if changes requested"),
-				directory: tool.schema.string().optional().describe("Target repository directory being reviewed (defaults to parent session's repository or active directory)"),
+				directory: tool.schema.string().optional().describe("Target repository directory being reviewed. Pass it explicitly whenever the recorder session has no workspace binding: concurrent loops share one guard process, and a verdict is never bound to a guessed root."),
 			},
 			execute: async (args, toolContext) => {
 				const auditVerdict = (verdict: "approved" | "changes_requested" | "rejected", reason: string, binding?: NonNullable<AuditEntry["evidence"]>["binding"]) => audit({ ts: new Date().toISOString(), sessionID: toolContext.sessionID, tool: "record_review.verdict", decision: verdict === "rejected" ? "block" : "allow", phase: "event", reason, evidence: { reviewVerdict: verdict, ...(binding ? { binding } : {}) } });
@@ -277,7 +301,19 @@ export function createCustomTools(options: {
 				// hash + tracked worktree fingerprint); the recorder's lineage is
 				// captured in the audit trail. The review-before-PR requirement
 				// itself is unchanged.
-				const reviewWorkspace = await resolveEffectiveWorkspace({ sessionID: toolContext.sessionID, directory: args.directory, fallback: toolContext.worktree || toolContext.directory || effectiveRoot });
+				// Binding is never guessed: an explicit directory, the session's
+				// own workspace binding (direct or inherited from a bound
+				// parent), or a host-provided per-call worktree. When none of
+				// those exist the verdict is rejected instead of silently bound
+				// to a latched root — concurrent loops share one guard process,
+				// and a latched root can belong to another loop's repository.
+				const hostProvidesWorkspace = Boolean(toolContext?.worktree);
+				const sessionBinding = await resolveSessionBoundWorkspace(toolContext?.sessionID);
+				if (!args.directory && !sessionBinding && !hostProvidesWorkspace) {
+					auditVerdict("rejected", "review_binding_unresolved", { recorderSessionID: toolContext?.sessionID });
+					return "[workflow-guard] Review rejected: the reviewed workspace could not be resolved from this call (no explicit 'directory', no session workspace binding, no per-call worktree). Concurrent loops share one guard process, so a verdict is never bound to a guessed root. Call record_review with 'directory' set to the reviewed repository worktree.";
+				}
+				const reviewWorkspace = await resolveCallWorkspace(toolContext, args.directory);
 				const bindingFingerprint = getTrackedWorktreeFingerprint(reviewWorkspace);
 				if (!bindingFingerprint) {
 					auditVerdict("rejected", "review_workspace_unbindingable", { workspace: reviewWorkspace, recorderSessionID: toolContext.sessionID });
@@ -325,7 +361,7 @@ export function createCustomTools(options: {
 			execute: async (args, toolContext) => {
 				const sanitizedBase = typeof args.base === "string" && !args.base.startsWith("-") && !/[\s;'"\0]/.test(args.base) ? args.base : undefined;
 				const bases = sanitizedBase ? [sanitizedBase] : ["origin/main", "origin/master", "main", "master"];
-				const rubricWorkspace = await resolveEffectiveWorkspace({ sessionID: toolContext?.sessionID, directory: args?.directory, fallback: toolContext?.worktree || toolContext?.directory || effectiveRoot });
+				const rubricWorkspace = await resolveCallWorkspace(toolContext, args?.directory);
 				let diffText = "";
 				// Revision before the trailing `--` (LL-001) so the base ref is
 				// always parsed as a revision, never as a pathspec.
@@ -338,16 +374,20 @@ export function createCustomTools(options: {
 			description: "Create an isolated git worktree directory for concurrent subagent execution. Proactively call when launching parallel tasks/subagents to prevent file collision and maintain branch isolation.", args: { branch: tool.schema.string().describe("Branch name for the isolated worktree (e.g. 'feat/subagent-task')"), baseBranch: tool.schema.string().optional().describe("Base branch to branch off of (defaults to HEAD)") },
 			execute: async (args, toolContext) => {
 				const todos = await effectiveTodos(toolContext.sessionID); if (todos !== undefined && !hasActiveTodo(todos)) return "[workflow-guard] Blocked: worktree creation with no active todo item. Break the request down with todowrite first, then create worktrees.";
-				const toolRoot = toolContext.worktree || toolContext.directory || effectiveRoot; const res = createGitWorktree(args.branch, args.baseBranch ?? "HEAD", toolRoot); if (!res.success) return `[workflow-guard] Failed to create worktree: ${res.error}`;
-				recordMutation((await effectiveTodoOwnerSessionID(toolContext.sessionID)) ?? toolContext.sessionID, toolContext.sessionID); return `[workflow-guard] Worktree created successfully at: ${res.worktreePath}\nRun subagent tasks or pass worktree directory context to isolate file mutations.`;
+				const toolRoot = await resolveCallWorkspace(toolContext); const res = createGitWorktree(args.branch, args.baseBranch ?? "HEAD", toolRoot); if (!res.success) return `[workflow-guard] Failed to create worktree: ${res.error}`;
+				const mutationRoot = await resolveCallWorkspace(toolContext);
+				await runWithRuntimeState(mutationRoot, client, async () => recordMutation((await effectiveTodoOwnerSessionID(toolContext.sessionID)) ?? toolContext.sessionID, toolContext.sessionID));
+				return `[workflow-guard] Worktree created successfully at: ${res.worktreePath}\nRun subagent tasks or pass worktree directory context to isolate file mutations.`;
 			},
 		}),
 		guard_worktree_cleanup: tool({
 			description: "Commit a final snapshot and remove an isolated git worktree directory. Call to clean up worktrees created with guard_worktree_create after subagent tasks complete.", args: { worktreePath: tool.schema.string().describe("Path of the worktree directory to clean up") },
 			execute: async (args, toolContext) => {
 				const todos = await effectiveTodos(toolContext.sessionID); if (todos !== undefined && !hasActiveTodo(todos)) return "[workflow-guard] Blocked: worktree cleanup with no active todo item. Break the request down with todowrite first, then clean up worktrees.";
-				const toolRoot = toolContext.worktree || toolContext.directory || effectiveRoot; const res = cleanupGitWorktree(args.worktreePath, toolRoot); if (!res.success) return `[workflow-guard] Failed to clean up worktree: ${res.error}`;
-				recordMutation((await effectiveTodoOwnerSessionID(toolContext.sessionID)) ?? toolContext.sessionID, toolContext.sessionID); return `[workflow-guard] Worktree at '${args.worktreePath}' cleaned up successfully.`;
+				const toolRoot = await resolveCallWorkspace(toolContext); const res = cleanupGitWorktree(args.worktreePath, toolRoot); if (!res.success) return `[workflow-guard] Failed to clean up worktree: ${res.error}`;
+				const mutationRoot = await resolveCallWorkspace(toolContext);
+				await runWithRuntimeState(mutationRoot, client, async () => recordMutation((await effectiveTodoOwnerSessionID(toolContext.sessionID)) ?? toolContext.sessionID, toolContext.sessionID));
+				return `[workflow-guard] Worktree at '${args.worktreePath}' cleaned up successfully.`;
 			},
 		}),
 	};

package/src/lib/guard-dispatcher.ts

@@ -7,6 +7,7 @@ import {
 	getLastReviewResultForWorkspace,
 	getLiveControlPlaneRoots,
 	getSdkClient,
+	getSessionBoundWorkspace,
 	getWorkspaceRoot,
 	isDocumentationRequired,
 	isReviewRequired,
@@ -114,7 +115,15 @@ export async function guardToolCallImpl(
 	context?: { sessionID?: string; callID?: string; worktree?: string; directory?: string; agent?: string; simulate?: boolean },
 ): Promise<PolicyDecision> {
 	const logPolicyBlock = (message: string) => logBlock(message, context?.simulate);
-	const currentRoot = getWorkspaceRoot();
+	// The workspace for THIS decision comes from the call's own context (the
+	// hook's per-call worktree/directory) or, failing that, the session's own
+	// bound workspace — never from one process-global slot: concurrent loops
+	// share this process, and the last-active instance must not re-anchor
+	// another session's policy evaluation.
+	const currentRoot = context?.worktree
+		|| context?.directory
+		|| getSessionBoundWorkspace(context?.sessionID)
+		|| getWorkspaceRoot();
 	const allow = (): PolicyDecision => ({ status: "allowed", code: "allowed", message: "Allowed by current guardrails." });
 	const block = (policy: string, code: string, message: string): PolicyDecision => ({ status: "blocked", policy, code, message });
 	const needsApproval = (policy: string, code: string, message: string): PolicyDecision => ({ status: "needs_approval", policy, code, message });

package/src/lib/state.ts

@@ -1,5 +1,5 @@
-import { realpathSync, existsSync, unlinkSync } from "node:fs";
-import { resolve } from "node:path";
+import { existsSync, unlinkSync } from "node:fs";
+import { isAbsolute, resolve } from "node:path";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { getReviewCacheFilePath, loadReviewCache, persistReviewCache, persistVerifyCache, persistVerifyHistory } from "./audit.ts";
 import { findGitRoot, getCachedProjectConfig, isSameGitRepo, loadProjectConfig, projectRootKey } from "./project-config.ts";
@@ -13,36 +13,21 @@ import type {
 } from "./types.ts";
 
 export let workspaceRoot = process.cwd();
-export let workspaceRootReal = workspaceRoot;
 interface RuntimeState {
 	workspaceRoot: string;
-	workspaceRootReal: string;
 	sdkClient: TodoSdkClient | undefined;
 	projectConfig: ProjectConfig;
 }
 const runtimeState = new AsyncLocalStorage<RuntimeState>();
 
-try {
-	workspaceRootReal = realpathSync(workspaceRoot);
-} catch {}
-
 export function setWorkspaceRoot(root: string): void {
 	workspaceRoot = root;
-	try {
-		workspaceRootReal = realpathSync(root);
-	} catch {
-		workspaceRootReal = root;
-	}
 }
 
 export function getWorkspaceRoot(): string {
 	return runtimeState.getStore()?.workspaceRoot ?? workspaceRoot;
 }
 
-export function getWorkspaceRootReal(): string {
-	return runtimeState.getStore()?.workspaceRootReal ?? workspaceRootReal;
-}
-
 export let sdkClient: TodoSdkClient | undefined;
 
 export function setSdkClient(client: unknown): void {
@@ -54,14 +39,9 @@ export function getSdkClient(): TodoSdkClient | undefined {
 }
 
 export function runWithRuntimeState<T>(root: string, client: unknown, fn: () => T): T {
-	let realRoot = root;
-	try {
-		realRoot = realpathSync(root);
-	} catch {}
 	return runtimeState.run(
 		{
 			workspaceRoot: root,
-			workspaceRootReal: realRoot,
 			sdkClient: client as TodoSdkClient | undefined,
 			projectConfig: loadProjectConfig(root),
 		},
@@ -76,11 +56,18 @@ const workspaceMutationCounts = new Map<string, number>();
 export const sessionMutationTimestamps = new Map<string, number>();
 export const sessionMutationCounts = new Map<string, number>();
 export const sessionWorkspaces = new Map<string, string>();
+// Sessions whose workspace was registered from their OWN context (tool-call
+// arguments or a host-provided per-call worktree). A session registered only
+// from the plugin-instance default is deliberately left unmarked: concurrent
+// loops share this process, and a value derived from the last-active plugin
+// instance must never outrank the call's own context or the host fallback.
+const sessionWorkspaceBound = new Set<string>();
 
 export function setSessionWorkspace(sessionID: string, workspace: string): void {
 	if (!sessionID || !workspace) return;
 	const gitRoot = findGitRoot(workspace);
 	sessionWorkspaces.set(sessionID, gitRoot ?? projectRootKey(workspace));
+	sessionWorkspaceBound.add(sessionID);
 }
 
 export function getSessionWorkspace(sessionID?: string): string | undefined {
@@ -88,6 +75,75 @@ export function getSessionWorkspace(sessionID?: string): string | undefined {
 	return sessionWorkspaces.get(sessionID);
 }
 
+/**
+ * The session's workspace only when it was registered from the session's own
+ * context (tool-call arguments or a host-provided per-call worktree), never a
+ * plugin-instance-default bootstrap. Policy decisions that bind evidence or
+ * confine boundaries must consult this variant: two concurrent loops share one
+ * guard process, and an unbound bootstrap entry may have been derived from
+ * another session's plugin instance.
+ */
+export function getSessionBoundWorkspace(sessionID?: string): string | undefined {
+	if (!sessionID) return undefined;
+	return sessionWorkspaceBound.has(sessionID) ? sessionWorkspaces.get(sessionID) : undefined;
+}
+
+/**
+ * Register a session's workspace from a tool call's own context. Candidates in
+ * priority order: tool-argument paths (workdir/filePath — the call's own
+ * target), then a host-provided per-call worktree/directory. A session that is
+ * already registered is never re-anchored from the plugin-instance fallback:
+ * under concurrent loops that fallback can belong to a different session's
+ * workspace, which is exactly how workspaces cross-contaminate. Only a
+ * session with no registration at all is bootstrapped from the fallback, and
+ * such a bootstrap stays unbound (never used to bind review evidence).
+ */
+export function registerSessionWorkspaceFromToolCall(
+	sessionID: string | undefined,
+	call: { workdir?: string; filePath?: string; hostWorktree?: string; toolWorktree: string },
+): void {
+	if (!sessionID) return;
+	const rawCandidate = call.workdir ?? call.filePath ?? call.hostWorktree;
+	if (rawCandidate) {
+		const candidatePath = isAbsolute(rawCandidate) ? rawCandidate : resolve(call.toolWorktree, rawCandidate);
+		const gitRoot = findGitRoot(candidatePath);
+		if (gitRoot) {
+			sessionWorkspaces.set(sessionID, gitRoot);
+			sessionWorkspaceBound.add(sessionID);
+		}
+		return;
+	}
+	if (sessionWorkspaces.has(sessionID)) return;
+	const gitRoot = findGitRoot(call.toolWorktree);
+	sessionWorkspaces.set(sessionID, gitRoot ?? projectRootKey(call.toolWorktree));
+}
+
+/**
+ * The session's workspace resolved from its own bindings only: a directly
+ * registered bound workspace, else the nearest bound parent workspace
+ * (subagent sessions inherit their parent's binding for relay flows). Returns
+ * undefined when neither exists — callers that must not guess (review verdict
+ * binding) treat that as "resolve nothing, ask for an explicit directory".
+ */
+export async function resolveSessionBoundWorkspace(sessionID?: string): Promise<string | undefined> {
+	if (!sessionID) return undefined;
+	const direct = getSessionBoundWorkspace(sessionID);
+	if (direct) return direct;
+	try {
+		const client = getSdkClient();
+		const session = client?.session;
+		const get = session?.get;
+		if (typeof get === "function") {
+			const result = await get.call(session, { path: { id: sessionID } });
+			const parent = (result as { data?: { parentID?: unknown } } | undefined)?.data?.parentID;
+			if (typeof parent === "string" && parent && sessionWorkspaceBound.has(parent)) {
+				return sessionWorkspaces.get(parent);
+			}
+		}
+	} catch {}
+	return undefined;
+}
+
 export let lastVerify: VerifyResult | undefined;
 export const sessionVerifyResults = new Map<string, NonNullable<VerifyResult>>();
 
@@ -228,10 +284,28 @@ export function getLastReviewResult(): typeof lastReview {
 
 export function getLastReviewResultForWorkspace(root: string): typeof lastReview {
 	const workspace = projectRootKey(root);
-	const candidates = [lastReview, ...sessionReviews.values()].filter(
-		(result): result is ReviewResult => result?.workspace != null && (projectRootKey(result.workspace) === workspace || isSameGitRepo(result.workspace, root)),
+	const all = [lastReview, ...sessionReviews.values()].filter(
+		(result): result is ReviewResult & { workspace: string } => result?.workspace != null,
 	);
-	const latest = candidates.reduce<ReviewResult | undefined>((best, result) => !best || result.timestamp > best.timestamp ? result : best, undefined);
+	// Exact worktree binding wins: concurrent loops sharing one repository
+	// (different worktrees) must consume their own approvals independently —
+	// a newer sibling-worktree review must never displace this worktree's
+	// between record_review and PR creation.
+	const exact = all.filter((result) => projectRootKey(result.workspace) === workspace);
+	let preferred = exact;
+	if (preferred.length === 0) {
+		const sameRepo = all.filter((result) => isSameGitRepo(result.workspace, root));
+		if (sameRepo.length > 0) {
+			// Among same-repo candidates, prefer the review whose tracked
+			// content matches THIS worktree (the PR preflight consumes the
+			// approval bound to the tree it would publish); recency only
+			// breaks ties.
+			const prFingerprint = getTrackedWorktreeFingerprint(root);
+			const contentMatched = prFingerprint ? sameRepo.filter((result) => result.worktreeFingerprint === prFingerprint) : [];
+			preferred = contentMatched.length > 0 ? contentMatched : sameRepo;
+		}
+	}
+	const latest = preferred.reduce<ReviewResult | undefined>((best, result) => !best || result.timestamp > best.timestamp ? result : best, undefined);
 	if (latest) return latest;
 	const diskCached = loadReviewCache();
 	if (diskCached?.workspace && (projectRootKey(diskCached.workspace) === workspace || isSameGitRepo(diskCached.workspace, root))) {
@@ -254,41 +328,36 @@ export async function resolveEffectiveWorkspace(options: {
 	directory?: string;
 	fallback?: string;
 }): Promise<string> {
+	// Intended precedence. Custom tools (resolveCallWorkspace) consult the
+	// explicit argument and the host per-call context BEFORE calling this, so
+	// inside this function the remaining order is: bound session workspace >
+	// host fallback > unbound bootstrap hint > global latch/cwd. A future
+	// direct caller passing a per-call `fallback` should apply the same
+	// host-context-first step that resolveCallWorkspace does.
 	if (options.directory) {
 		const gitRoot = findGitRoot(options.directory);
 		return gitRoot ?? projectRootKey(options.directory);
 	}
+	// 1. The session's own binding (direct, or inherited from a bound parent
+	// for relay flows) wins over every ambient fallback. Concurrent loops
+	// share one guard process; a fallback derived from the last-active
+	// plugin instance must never re-anchor another session's context.
+	const bound = await resolveSessionBoundWorkspace(options.sessionID);
+	if (bound) return bound;
 	const fallbackRoot = options.fallback ? projectRootKey(options.fallback) : undefined;
 	const isFallbackFsRoot = fallbackRoot ? resolve(fallbackRoot) === resolve(fallbackRoot, "..") : true;
 
+	// 2. The call's own host-provided per-call worktree/directory.
 	if (fallbackRoot && !isFallbackFsRoot) {
-		if (options.sessionID) {
-			const sessionWs = sessionWorkspaces.get(options.sessionID);
-			if (sessionWs && isSameGitRepo(sessionWs, fallbackRoot)) {
-				return sessionWs;
-			}
-		}
 		return fallbackRoot;
 	}
 
-	if (options.sessionID) {
-		const sessionWs = sessionWorkspaces.get(options.sessionID);
-		if (sessionWs) return sessionWs;
-		try {
-			const client = getSdkClient();
-			const session = client?.session;
-			const get = session?.get;
-			if (typeof get === "function") {
-				const result = await get.call(session, { path: { id: options.sessionID } });
-				const parent = (result as { data?: { parentID?: unknown } } | undefined)?.data?.parentID;
-				if (typeof parent === "string" && parent && sessionWorkspaces.has(parent)) {
-					const parentWs = sessionWorkspaces.get(parent)!;
-					sessionWorkspaces.set(options.sessionID, parentWs);
-					return parentWs;
-				}
-			}
-		} catch {}
-	}
+	// 3. Unbound bootstrap hint: the session was registered only from the
+	// plugin-instance default, so it carries no per-session authority and
+	// loses to any real fallback (step 2). It is still better than the raw
+	// global latch when the fallback is absent or the filesystem root.
+	const hintRoot = options.sessionID ? sessionWorkspaces.get(options.sessionID) : undefined;
+	if (hintRoot) return hintRoot;
 	const activeRoot = getWorkspaceRoot();
 	if (activeRoot && resolve(activeRoot) !== resolve(activeRoot, "..")) {
 		const gitRoot = findGitRoot(activeRoot);

package/src/lib/v2-plugin.ts

@@ -25,8 +25,8 @@ import { findGitRoot, reloadProjectConfig } from "./project-config.ts";
 import {
 	setWorkspaceRoot,
 	setSdkClient,
-	getSessionWorkspace,
-	setSessionWorkspace,
+	getSessionBoundWorkspace,
+	registerSessionWorkspaceFromToolCall,
 	runWithRuntimeState,
 	getSessionMutationCount,
 	sessionVerifyResults,
@@ -193,10 +193,14 @@ export const WorkflowGuardV2 = async (ctx: V2Context) => {
 				// wrap it so the V2 registry receives a real StandardSchemaV1.
 				input: z.object(definition.args as unknown as z.ZodRawShape),
 				execute: async (rawInput: unknown, toolContext: { sessionID: string; id: string }) => {
+					// Only a session-bound workspace counts as the tool's own
+					// context; an unbound entry is a plugin-instance bootstrap
+					// and must not be presented to the tools as one.
+					const boundWorktree = getSessionBoundWorkspace(toolContext.sessionID);
 					const result = await (definition.execute as (input: unknown, context: unknown) => Promise<unknown>)(rawInput, {
 						sessionID: toolContext.sessionID,
-						worktree: getSessionWorkspace(toolContext.sessionID) ?? effectiveRoot,
-						directory: effectiveRoot,
+						...(boundWorktree ? { worktree: boundWorktree } : {}),
+						directory: boundWorktree ?? effectiveRoot,
 					});
 					const text = typeof result === "string" ? result : (result as { output?: string } | undefined)?.output;
 					return {
@@ -218,7 +222,7 @@ export const WorkflowGuardV2 = async (ctx: V2Context) => {
 
 	// ── Deterministic enforcement ──
 	await ctx.tool.hook("execute.before", (event) => {
-		const toolWorktree = getSessionWorkspace(event.sessionID) || effectiveRoot;
+		const toolWorktree = getSessionBoundWorkspace(event.sessionID) || effectiveRoot;
 		return runWithRuntimeState(toolWorktree, client, async () => {
 			const args = event.input;
 			const reason = await guardToolCall(event.tool, args, {
@@ -239,11 +243,7 @@ export const WorkflowGuardV2 = async (ctx: V2Context) => {
 			const record = asRecord(args);
 			const workdir = typeof record?.workdir === "string" ? record.workdir : undefined;
 			const filePath = typeof record?.filePath === "string" ? record.filePath : (typeof record?.path === "string" ? record.path : undefined);
-			const candidatePath = workdir ?? filePath ?? toolWorktree;
-			if (candidatePath) {
-				const gitRoot = findGitRoot(candidatePath);
-				if (gitRoot) setSessionWorkspace(event.sessionID, gitRoot);
-			}
+			registerSessionWorkspaceFromToolCall(event.sessionID, { workdir, filePath, toolWorktree });
 			if (event.tool === "read") {
 				const target = editTargets(args, toolWorktree)[0];
 				if (target) {

package/src/policies/boundary.ts

@@ -4,7 +4,6 @@ import { dirname, join, resolve } from "node:path";
 import type { ShellMutation } from "../lib/types.ts";
 import {
 	getWorkspaceRoot,
-	getWorkspaceRootReal,
 	recordMutation,
 } from "../lib/state.ts";
 import { prepareRedirectResidue, shellWords, unwrapShellCommand } from "../lib/shell.ts";
@@ -89,7 +88,15 @@ export function isPathOutsideWorkspace(targetPath: string, root: string): boolea
 	if (resolved !== root && !resolved.startsWith(normalizedRoot)) {
 		return true;
 	}
-	const realRootVal = getWorkspaceRootReal();
+	// The boundary is resolved against the workspace THIS call declares (the
+	// `root` argument), never against a process-global latched root: concurrent
+	// loops share one guard process, and a latched root must not redefine
+	// another session's boundary. Symlink-awareness is preserved (ancestor
+	// walk below) by canonicalizing the declared root itself.
+	let realRootVal = root;
+	try {
+		realRootVal = realpathSync(root);
+	} catch {}
 	try {
 		const real = realpathSync(resolved);
 		const realRoot = realRootVal.endsWith("/") ? realRootVal : realRootVal + "/";

package/src/policies/changelog.ts

@@ -193,16 +193,114 @@ export function prBodyHasLiteralLineBreakEscapes(command: string): boolean {
 	return false;
 }
 
+/**
+ * Top-level package.json sections whose change requires a matching lockfile
+ * update: the dependency maps (including peerDependenciesMeta) plus every
+ * other section a supported package manager records in its lockfile
+ * (engines/packageManager, overrides/resolutions, the pnpm section with
+ * pnpm.overrides and pnpm.patchedDependencies, the workspace graph, and the
+ * project name/version stored in the lockfile root). A scripts-only or
+ * metadata-only manifest edit regenerates the lockfile byte-identical —
+ * demanding a lockfile change for it is unsatisfiable and must not block PR
+ * creation.
+ */
+const LOCKFILE_RELEVANT_MANIFEST_KEYS = new Set([
+	"name",
+	"version",
+	"dependencies",
+	"devDependencies",
+	"optionalDependencies",
+	"peerDependencies",
+	"peerDependenciesMeta",
+	"engines",
+	"packageManager",
+	"overrides",
+	"resolutions",
+	"workspaces",
+	// pnpm-specific top-level section: pnpm.overrides and
+	// pnpm.patchedDependencies are recorded in pnpm-lock.yaml.
+	"pnpm",
+]);
+
+/** Order-insensitive JSON comparison: dependency maps are semantically
+ * unordered, so reordering keys alone is not a lockfile-relevant change. */
+function canonicalJsonValue(value: unknown): string {
+	if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "undefined";
+	if (Array.isArray(value)) return `[${value.map(canonicalJsonValue).join(",")}]`;
+	const entries = Object.entries(value as Record<string, unknown>).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+	return `{${entries.map(([key, item]) => `${JSON.stringify(key)}:${canonicalJsonValue(item)}`).join(",")}}`;
+}
+
+function manifestTouchesLockfileRelevantKeys(oldSource: string | undefined, newSource: string | undefined): boolean {
+	try {
+		const parse = (source: string | undefined): Record<string, unknown> | undefined => {
+			if (source === undefined) return undefined;
+			const parsed = JSON.parse(source) as unknown;
+			if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("not a manifest object");
+			return parsed as Record<string, unknown>;
+		};
+		const oldManifest = parse(oldSource);
+		const newManifest = parse(newSource);
+		const keys = new Set([...Object.keys(oldManifest ?? {}), ...Object.keys(newManifest ?? {})]);
+		for (const key of keys) {
+			if (!LOCKFILE_RELEVANT_MANIFEST_KEYS.has(key)) continue;
+			if (canonicalJsonValue(oldManifest?.[key]) !== canonicalJsonValue(newManifest?.[key])) return true;
+		}
+		return false;
+	} catch {
+		return true; // unreadable manifest: fail closed and keep demanding the lockfile
+	}
+}
+
+function manifestSourceAt(root: string, revision: string, manifestPath: string): string | undefined {
+	const res = spawnSync("git", ["show", `${revision}:${manifestPath}`], { cwd: root, encoding: "utf8", timeout: 10_000 });
+	if (res.status !== 0) return undefined;
+	return res.stdout;
+}
+
+function workingTreeManifestSource(root: string, manifestPath: string): string | undefined {
+	try {
+		return readFileSync(resolve(root, manifestPath), "utf8");
+	} catch {
+		return undefined; // deleted from the working tree
+	}
+}
+
+/**
+ * Whether a manifest change demands a lockfile update. package.json is
+ * compared section-by-section (scripts-only edits pass); Cargo.toml and
+ * go.mod have no dependency-section parser here, so any change to them
+ * conservatively demands the lockfile (unchanged behavior).
+ */
+function manifestChangeRequiresLockfile(root: string, mergeBaseCommit: string | undefined, manifestPath: string): boolean {
+	if (!/(?:^|\/)package\.json$/.test(manifestPath)) return true;
+	let oldSource: string | undefined;
+	if (mergeBaseCommit) {
+		// Absent at the merge base means the manifest was introduced on this
+		// branch (or is untracked): the pre-branch state had no manifest, so
+		// every lockfile-relevant key it has counts as new.
+		oldSource = manifestSourceAt(root, mergeBaseCommit, manifestPath);
+	} else {
+		oldSource = manifestSourceAt(root, "HEAD", manifestPath);
+	}
+	const newSource = workingTreeManifestSource(root, manifestPath);
+	if (oldSource === undefined && newSource === undefined) return true;
+	return manifestTouchesLockfileRelevantKeys(oldSource, newSource);
+}
+
 export function checkLockfileSync(root: string): { isOutOfSync: boolean; manifest?: string; lockfile?: string; reason?: string } {
 	try {
 		let modifiedFiles: string[] = [];
+		let mergeBaseCommit: string | undefined;
 		const baseCandidates = ["origin/HEAD", "origin/main", "origin/master", "main", "master"];
 		for (const base of baseCandidates) {
 			const mergeBase = spawnSync("git", ["merge-base", "HEAD", base], { cwd: root, encoding: "utf8", timeout: 10_000 });
 			if (mergeBase.status !== 0 || !mergeBase.stdout.trim()) continue;
-			const diff = spawnSync("git", ["diff", "--name-only", `${mergeBase.stdout.trim()}...HEAD`], { cwd: root, encoding: "utf8", timeout: 10_000 });
+			const baseCommit = mergeBase.stdout.trim();
+			const diff = spawnSync("git", ["diff", "--name-only", `${baseCommit}...HEAD`], { cwd: root, encoding: "utf8", timeout: 10_000 });
 			if (diff.status === 0 && diff.stdout.trim()) {
 				modifiedFiles = diff.stdout.split("\n").map((f) => f.trim()).filter(Boolean);
+				mergeBaseCommit = baseCommit;
 				break;
 			}
 		}
@@ -236,16 +334,19 @@ export function checkLockfileSync(root: string): { isOutOfSync: boolean; manifes
 		];
 
 		for (const item of manifestToLockfiles) {
-			const hasManifest = modifiedFiles.some((f) => item.manifest.test(f));
-			if (hasManifest) {
-				const hasLockfile = modifiedFiles.some((f) => item.lockfiles.test(f));
-				if (!hasLockfile) {
-					return {
-						isOutOfSync: true,
-						manifest: item.name,
-						reason: `Package manifest '${item.name}' was modified without updating its corresponding lockfile. Run the package manager install/lock command before opening a PR.`,
-					};
-				}
+			const manifestPaths = modifiedFiles.filter((f) => item.manifest.test(f));
+			if (manifestPaths.length === 0) continue;
+			const hasLockfile = modifiedFiles.some((f) => item.lockfiles.test(f));
+			if (hasLockfile) continue;
+			// Only a lockfile-relevant manifest change demands the lockfile: a
+			// scripts-only edit regenerates it byte-identical, so demanding one
+			// is unsatisfiable.
+			if (manifestPaths.some((manifestPath) => manifestChangeRequiresLockfile(root, mergeBaseCommit, manifestPath))) {
+				return {
+					isOutOfSync: true,
+					manifest: item.name,
+					reason: `Package manifest '${item.name}' was modified without updating its corresponding lockfile. Run the package manager install/lock command before opening a PR.`,
+				};
 			}
 		}
 	} catch {}

package/src/workflow-guard.ts

@@ -84,6 +84,9 @@ import {
 	sessionReviews,
 	setSessionWorkspace,
 	getSessionWorkspace,
+	getSessionBoundWorkspace,
+	registerSessionWorkspaceFromToolCall,
+	resolveSessionBoundWorkspace,
 	resolveEffectiveWorkspace,
 } from "./lib/state.ts";
 import { findGitRoot, isSameGitRepo, loadProjectConfig, reloadProjectConfig, stripJsonComments } from "./lib/project-config.ts";
@@ -116,6 +119,9 @@ export {
 	resetReviewState,
 	setSessionWorkspace,
 	getSessionWorkspace,
+	getSessionBoundWorkspace,
+	registerSessionWorkspaceFromToolCall,
+	resolveSessionBoundWorkspace,
 	resolveEffectiveWorkspace,
 	findGitRoot,
 	isSameGitRepo,
@@ -448,12 +454,16 @@ export const WorkflowGuard: V1Plugin = async (ctx: Parameters<V1Plugin>[0]) => {
 		tool: createCustomTools({ effectiveRoot, projectMemoryEnabled, learningEnabled, projectMemory, followupStore, portableMemoryPath, learningInterventions, client: ctx.client }),
 
 		"tool.execute.before": async (input, output) => {
-			const toolWorktree =
+			const hostWorktree =
 				(input as { worktree?: string })?.worktree ||
 				(input as { directory?: string })?.directory ||
 				(output as { worktree?: string })?.worktree ||
-				(output as { directory?: string })?.directory ||
-				effectiveRoot;
+				(output as { directory?: string })?.directory;
+			// Session-bound workspace before the plugin-instance fallback:
+			// concurrent loops share this process, and a fallback derived from
+			// the last-active instance must not re-anchor another session's
+			// policy context.
+			const toolWorktree = hostWorktree || getSessionBoundWorkspace(input.sessionID) || effectiveRoot;
 			const toolAgent =
 				(input as { agent?: string })?.agent ||
 				(output as { agent?: string })?.agent;
@@ -480,11 +490,7 @@ export const WorkflowGuard: V1Plugin = async (ctx: Parameters<V1Plugin>[0]) => {
 					const record = asRecord(args);
 					const workdir = typeof record?.workdir === "string" ? record.workdir : undefined;
 					const filePath = typeof record?.filePath === "string" ? record.filePath : (typeof record?.path === "string" ? record.path : undefined);
-					const candidatePath = workdir ?? filePath ?? toolWorktree;
-					if (candidatePath) {
-						const gitRoot = findGitRoot(candidatePath);
-						if (gitRoot) setSessionWorkspace(input.sessionID, gitRoot);
-					}
+					registerSessionWorkspaceFromToolCall(input.sessionID, { workdir, filePath, hostWorktree, toolWorktree });
 				}
 				if (input.tool === "read") {
 					const target = editTargets(args, toolWorktree)[0];

package/test/test.mts

@@ -45,6 +45,8 @@ import {
 	persistReviewCache,
 	setSessionWorkspace,
 	getSessionWorkspace,
+	getSessionBoundWorkspace,
+	registerSessionWorkspaceFromToolCall,
 	resolveEffectiveWorkspace,
 	getLastReviewResultForWorkspace,
 	isSameGitRepo,
@@ -3169,6 +3171,219 @@ writeFileSync(join(lockRepo, "package-lock.json"), "{\"name\":\"demo\",\"version
 check("checkLockfileSync passes when lockfile is updated", !checkLockfileSync(lockRepo).isOutOfSync);
 rmSync(lockRepo, { recursive: true, force: true });
 
+// Lockfile synchronization tracks lockfile-relevant manifest sections, not
+// the mere presence of package.json in the branch diff. A scripts-only edit
+// (the documented curation act of adding a suite to a test script) regenerates
+// package-lock.json byte-identical, so demanding a lockfile change for it is
+// unsatisfiable; dependency/engines/packageManager changes still demand one.
+const scriptLockRepo = mkdtempSync(join(tmpdir(), "wg-lock-scripts-"));
+spawnSync("git", ["init", "-b", "main"], { cwd: scriptLockRepo });
+spawnSync("git", ["config", "user.email", "test@test.local"], { cwd: scriptLockRepo });
+spawnSync("git", ["config", "user.name", "Test Runner"], { cwd: scriptLockRepo });
+const scriptManifestBase = { name: "demo", version: "1.0.0", scripts: { test: "node test.mjs" } };
+writeFileSync(join(scriptLockRepo, "package.json"), JSON.stringify(scriptManifestBase, null, 2) + "\n");
+writeFileSync(join(scriptLockRepo, "package-lock.json"), JSON.stringify({ name: "demo", version: "1.0.0", lockfileVersion: 3 }, null, 2) + "\n");
+// A nested manifest already present at the merge base, so its scripts-only
+// edit on the branch is a true edit (not a new manifest).
+mkdirSync(join(scriptLockRepo, "packages", "app"), { recursive: true });
+const nestedManifestBase = { name: "app", version: "0.0.0", scripts: { build: "node build.mjs" } };
+writeFileSync(join(scriptLockRepo, "packages", "app", "package.json"), JSON.stringify(nestedManifestBase, null, 2) + "\n");
+spawnSync("git", ["add", "-A"], { cwd: scriptLockRepo });
+spawnSync("git", ["commit", "-qm", "init"], { cwd: scriptLockRepo });
+spawnSync("git", ["switch", "-c", "feat/scripts-only"], { cwd: scriptLockRepo });
+const scriptManifestEdited = JSON.parse(JSON.stringify(scriptManifestBase)) as typeof scriptManifestBase;
+scriptManifestEdited.scripts.test = "node test.mjs && node test-ci.mjs";
+writeFileSync(join(scriptLockRepo, "package.json"), JSON.stringify(scriptManifestEdited, null, 2) + "\n");
+check("checkLockfileSync passes an uncommitted scripts-only manifest edit", !checkLockfileSync(scriptLockRepo).isOutOfSync);
+spawnSync("git", ["commit", "-qam", "curate test suite"], { cwd: scriptLockRepo });
+check("checkLockfileSync passes a committed scripts-only manifest edit", !checkLockfileSync(scriptLockRepo).isOutOfSync);
+// The observed false positive: a scripts-only edit alongside a lockfile that
+// npm rewrote byte-identical (present in the diff set, yet unchanged in
+// content — the old check demanded exactly this unsatisfiable combination).
+writeFileSync(join(scriptLockRepo, "package-lock.json"), readFileSync(join(scriptLockRepo, "package-lock.json"), "utf8"));
+check("checkLockfileSync passes a byte-identical lockfile rewrite next to a scripts-only edit", !checkLockfileSync(scriptLockRepo).isOutOfSync);
+// A nested manifest's scripts-only edit passes too.
+const nestedManifestEdited = JSON.parse(JSON.stringify(nestedManifestBase)) as typeof nestedManifestBase;
+nestedManifestEdited.scripts.build = "node build.mjs && node verify.mjs";
+writeFileSync(join(scriptLockRepo, "packages", "app", "package.json"), JSON.stringify(nestedManifestEdited, null, 2) + "\n");
+check("checkLockfileSync passes a scripts-only nested manifest edit", !checkLockfileSync(scriptLockRepo).isOutOfSync);
+// Contract pins: sections the lockfile records still demand the lockfile.
+const scriptsAfterNesting = scriptManifestEdited.scripts;
+const relevantManifest = { name: "demo", version: "1.0.0", scripts: scriptsAfterNesting };
+writeFileSync(join(scriptLockRepo, "package.json"), JSON.stringify({ ...relevantManifest, dependencies: { "left-pad": "^1.3.0" } }, null, 2) + "\n");
+check("checkLockfileSync flags a dependencies change without a lockfile update", checkLockfileSync(scriptLockRepo).isOutOfSync);
+writeFileSync(join(scriptLockRepo, "package.json"), JSON.stringify({ ...relevantManifest, engines: { node: ">=22" } }, null, 2) + "\n");
+check("checkLockfileSync flags an engines change without a lockfile update", checkLockfileSync(scriptLockRepo).isOutOfSync);
+writeFileSync(join(scriptLockRepo, "package.json"), JSON.stringify({ ...relevantManifest, packageManager: "pnpm@9.0.0" }, null, 2) + "\n");
+check("checkLockfileSync flags a packageManager change without a lockfile update", checkLockfileSync(scriptLockRepo).isOutOfSync);
+writeFileSync(join(scriptLockRepo, "package.json"), JSON.stringify({ ...relevantManifest, devDependencies: { typescript: "^5.0.0" } }, null, 2) + "\n");
+check("checkLockfileSync flags a devDependencies change without a lockfile update", checkLockfileSync(scriptLockRepo).isOutOfSync);
+writeFileSync(join(scriptLockRepo, "package.json"), JSON.stringify({ ...relevantManifest, pnpm: { overrides: { "left-pad": "^1.3.0" } } }, null, 2) + "\n");
+check("checkLockfileSync flags a pnpm-overrides change without a lockfile update", checkLockfileSync(scriptLockRepo).isOutOfSync);
+// And a relevant change WITH the lockfile updated passes.
+writeFileSync(join(scriptLockRepo, "package.json"), JSON.stringify({ ...relevantManifest, dependencies: { "left-pad": "^1.3.0" } }, null, 2) + "\n");
+writeFileSync(join(scriptLockRepo, "package-lock.json"), JSON.stringify({ name: "demo", version: "1.0.0", lockfileVersion: 3, dependencies: { "left-pad": "^1.3.0" } }, null, 2) + "\n");
+check("checkLockfileSync passes when the lockfile is updated alongside a relevant change", !checkLockfileSync(scriptLockRepo).isOutOfSync);
+rmSync(scriptLockRepo, { recursive: true, force: true });
+
+// Concurrent loops share ONE guard process: workspace resolution must come
+// from the call's own context or the session's own binding, never from the
+// last-active plugin instance. Two plugin instances in this process simulate
+// the two loops; instance B's roots must never re-anchor session A's context.
+const isoRepoA = mkdtempSync(join(tmpdir(), "wg-iso-a-"));
+spawnSync("git", ["init", "-b", "main"], { cwd: isoRepoA });
+spawnSync("git", ["config", "user.email", "test@test.local"], { cwd: isoRepoA });
+spawnSync("git", ["config", "user.name", "Test Runner"], { cwd: isoRepoA });
+writeFileSync(join(isoRepoA, "seed.txt"), "loop a\n");
+spawnSync("git", ["add", "-A"], { cwd: isoRepoA });
+spawnSync("git", ["commit", "-qm", "init a"], { cwd: isoRepoA });
+spawnSync("git", ["switch", "-c", "feat/iso-a"], { cwd: isoRepoA });
+const isoRepoB = mkdtempSync(join(tmpdir(), "wg-iso-b-"));
+spawnSync("git", ["init", "-b", "loop/other-loop"], { cwd: isoRepoB });
+spawnSync("git", ["config", "user.email", "test@test.local"], { cwd: isoRepoB });
+spawnSync("git", ["config", "user.name", "Test Runner"], { cwd: isoRepoB });
+writeFileSync(join(isoRepoB, "seed.txt"), "loop b\n");
+spawnSync("git", ["add", "-A"], { cwd: isoRepoB });
+spawnSync("git", ["commit", "-qm", "init b"], { cwd: isoRepoB });
+const isoPluginA = await WorkflowGuard({ directory: isoRepoA, worktree: isoRepoA, client: fakeClient as any, project: {} as any, experimental_workspace: {} as any, serverUrl: new URL("http://localhost:4096"), $: undefined as any });
+const isoPluginB = await WorkflowGuard({ directory: isoRepoB, worktree: isoRepoB, client: fakeClient as any, project: {} as any, experimental_workspace: {} as any, serverUrl: new URL("http://localhost:4096"), $: undefined as any });
+const isoHookOf = (plugin: unknown) => (plugin as { "tool.execute.before"?: (input: unknown, output: unknown) => Promise<unknown> })["tool.execute.before"];
+// Session A binds to repoA from its OWN call context (an edit/read target
+// inside repoA delivered through the call arguments).
+await isoHookOf(isoPluginA)?.({ sessionID: "s-iso-shared", tool: "read", callID: "c-iso-1" }, { args: { filePath: join(isoRepoA, "seed.txt") } });
+check("a session binds to its workspace from its own call context", getSessionBoundWorkspace("s-iso-shared") === isoRepoA);
+// The other loop's plugin instance must not re-anchor it from its own root.
+await isoHookOf(isoPluginB)?.({ sessionID: "s-iso-shared", tool: "bash", callID: "c-iso-2" }, { args: { command: "ls -la" } });
+check("an instance-derived fallback never re-anchors a bound session", getSessionBoundWorkspace("s-iso-shared") === isoRepoA);
+const isoStatus = JSON.parse(String(await isoPluginB.tool?.guard_status?.execute({}, { sessionID: "s-iso-shared" } as any)));
+check("guard_status resolves the session's own workspace under plugin-instance drift", isoStatus.workspaceRoot === isoRepoA && isoStatus.branch === "feat/iso-a");
+const isoStatusExplicit = JSON.parse(String(await isoPluginB.tool?.guard_status?.execute({ directory: isoRepoB }, { sessionID: "s-iso-shared" } as any)));
+check("guard_status honors an explicit directory over the session binding", isoStatusExplicit.workspaceRoot === isoRepoB && isoStatusExplicit.branch === "loop/other-loop");
+check("resolveEffectiveWorkspace keeps a bound session off a foreign fallback", (await resolveEffectiveWorkspace({ sessionID: "s-iso-shared", fallback: isoRepoB })) === isoRepoA);
+check("resolveEffectiveWorkspace keeps fallback semantics for an unbound session", (await resolveEffectiveWorkspace({ sessionID: "s-iso-unbound", fallback: isoRepoB })) === isoRepoB);
+// Policy decisions follow the call's own context: a boundary write inside the
+// session's repo passes even while the other loop's root is the fallback.
+todo("s-iso-shared", item("iso work", "in_progress"));
+const isoWrite = await guardToolDecision("write", { filePath: join(isoRepoA, "scratch.txt"), content: "safe" }, { sessionID: "s-iso-shared" });
+check("boundary checks use the session's own workspace, not the other loop's root", isoWrite.status === "allowed");
+if (isoWrite.status !== "allowed") console.log("   blocked:", isoWrite.message);
+// Review verdict binding is never guessed: no explicit directory, no session
+// binding, no per-call worktree — the verdict is rejected, not latched.
+const unboundReview = await isoPluginA.tool?.record_review?.execute(
+	{ reviewer: "no-binding", summary: "Test integrity: covered. Task completeness: complete. Cleanliness: clean. Security: safe. Platform: compatible.", passed: true },
+	{ sessionID: "s-iso-unbound-recorder" } as any,
+);
+check(
+	"record_review rejects a verdict it cannot bind instead of latching a root",
+	typeof unboundReview === "string" && unboundReview.includes("rejected") && unboundReview.includes("never bound to a guessed root") && !unboundReview.includes("APPROVED"),
+);
+const unboundReviewAudit = getRecentAuditEntries(20).find((entry) => entry.tool === "record_review.verdict" && entry.sessionID === "s-iso-unbound-recorder");
+check("unbindingable verdict audited as review_binding_unresolved", unboundReviewAudit?.reason === "review_binding_unresolved");
+// A bound session records through the OTHER loop's plugin instance: the
+// verdict binds to the session's own workspace, not the instance root.
+const isoBoundReview = await isoPluginB.tool?.record_review?.execute(
+	{ reviewer: "drift-proof", summary: "Test integrity: covered. Task completeness: complete. Cleanliness: clean. Security: safe. Platform: compatible.", passed: true },
+	{ sessionID: "s-iso-shared" } as any,
+);
+check(
+	"record_review binds to the session's own workspace, not the other loop's instance root",
+	typeof isoBoundReview === "string" && isoBoundReview.includes("APPROVED") && isoBoundReview.includes(isoRepoA) && !isoBoundReview.includes(isoRepoB),
+);
+rmSync(isoRepoA, { recursive: true, force: true });
+rmSync(isoRepoB, { recursive: true, force: true });
+resetReviewState();
+setWorkspaceRoot(root);
+
+// Review bindings are consumed per WORKTREE, not per repository-recency: two
+// loops sharing one repo must not displace each other's approvals between
+// record_review and PR creation.
+const raceRepo = join(root, "wg-race-repo");
+mkdirSync(raceRepo, { recursive: true });
+spawnSync("git", ["init", "-b", "main"], { cwd: raceRepo });
+spawnSync("git", ["config", "user.email", "test@test.local"], { cwd: raceRepo });
+spawnSync("git", ["config", "user.name", "Test Runner"], { cwd: raceRepo });
+writeFileSync(join(raceRepo, "seed.txt"), "base\n");
+spawnSync("git", ["add", "-A"], { cwd: raceRepo });
+spawnSync("git", ["commit", "-qm", "base"], { cwd: raceRepo });
+mkdirSync(join(raceRepo, ".opencode"), { recursive: true });
+writeFileSync(join(raceRepo, ".opencode", "workflow-guard.json"), JSON.stringify({ requireReview: true }));
+spawnSync("git", ["switch", "-c", "feat/race-a"], { cwd: raceRepo });
+writeFileSync(join(raceRepo, "a.txt"), "loop a change\n");
+spawnSync("git", ["add", "-A"], { cwd: raceRepo });
+spawnSync("git", ["commit", "-qm", "loop a change"], { cwd: raceRepo });
+const prevWorktreeDirRace = process.env.WORKFLOW_GUARD_WORKTREE_DIR;
+process.env.WORKFLOW_GUARD_WORKTREE_DIR = join(root, "wg-race-worktrees");
+const raceWtRes = createGitWorktree("feat/race-b", "HEAD", raceRepo);
+check("race: sibling worktree created", raceWtRes.success && typeof raceWtRes.worktreePath === "string");
+const raceWt = raceWtRes.worktreePath!;
+writeFileSync(join(raceWt, "b.txt"), "loop b change\n");
+spawnSync("git", ["add", "-A"], { cwd: raceWt });
+spawnSync("git", ["commit", "-qm", "loop b change"], { cwd: raceWt });
+const raceSummary = "Test integrity: covered. Task completeness: complete. Cleanliness: clean. Security: safe. Platform: compatible.";
+// Loop A records first; loop B records a NEWER review for the sibling
+// worktree. Each worktree must keep consuming its OWN approval.
+resetReviewState();
+recordReviewResult("reviewer-A", raceSummary, true, "s-race-a", raceRepo);
+recordReviewResult("reviewer-B", raceSummary, true, "s-race-b", raceWt);
+check("loop A consumes its own worktree review, not the newer sibling review", getLastReviewResultForWorkspace(raceRepo)?.reviewer === "reviewer-A");
+check("loop B consumes its own worktree review", getLastReviewResultForWorkspace(raceWt)?.reviewer === "reviewer-B");
+resetReviewState();
+recordReviewResult("reviewer-B", raceSummary, true, "s-race-b", raceWt);
+recordReviewResult("reviewer-A", raceSummary, true, "s-race-a", raceRepo);
+check("loop A keeps its own review when it was recorded first", getLastReviewResultForWorkspace(raceRepo)?.reviewer === "reviewer-A");
+check("loop B keeps its own review when it was recorded last", getLastReviewResultForWorkspace(raceWt)?.reviewer === "reviewer-B");
+// Preflight consumption with the remote state stubbed off: loop A's PR must
+// pass while the sibling loop's newer review exists, and must FAIL with a
+// worktree-mismatch cause when only the sibling review is present.
+const racePrevPath = process.env.PATH;
+const raceBin = join(root, "wg-race-bin");
+mkdirSync(raceBin, { recursive: true });
+writeFileSync(join(raceBin, "gh"), "#!/bin/sh\nexit 1\n");
+writeFileSync(join(raceBin, "az"), "#!/bin/sh\nexit 1\n");
+chmodSync(join(raceBin, "gh"), 0o755);
+chmodSync(join(raceBin, "az"), 0o755);
+process.env.PATH = `${raceBin}:${racePrevPath ?? ""}`;
+const racePrBody = "gh pr create --title 'fix: race' --body 'Changelog: race'";
+try {
+	const racePrA = await call("bash", { command: racePrBody, workdir: raceRepo }, { sessionID: "s-race-a", worktree: raceRepo, directory: raceRepo });
+	check("loop A's PR passes preflight while the sibling loop's newer review exists", !blocked(racePrA));
+	if (blocked(racePrA)) console.log("   blocked:", racePrA);
+	const racePrB = await call("bash", { command: racePrBody, workdir: raceWt }, { sessionID: "s-race-b", worktree: raceWt, directory: raceWt });
+	check("loop B's PR passes preflight independently", !blocked(racePrB));
+	if (blocked(racePrB)) console.log("   blocked:", racePrB);
+	// Negative control: only the sibling review present -> the mismatch is
+	// named instead of displacing the other loop's evidence.
+	resetReviewState();
+	recordReviewResult("reviewer-B", raceSummary, true, "s-race-b", raceWt);
+	const racePrOnlyB = await call("bash", { command: racePrBody, workdir: raceRepo }, { sessionID: "s-race-a", worktree: raceRepo, directory: raceRepo });
+	check(
+		"loop A's PR is blocked on the sibling review alone, naming the worktree mismatch",
+		blocked(racePrOnlyB) && String(racePrOnlyB).includes("does not match the current worktree contents"),
+	);
+	// Same-repo fallback still rescues content-identical trees: a review
+	// recorded from a worktree whose tracked content equals this one applies,
+	// even when a NEWER sibling review does not match this content.
+	const raceWtSameContentRes = createGitWorktree("feat/race-same", "feat/race-a", raceRepo);
+	const raceWtSame = raceWtSameContentRes.worktreePath!;
+	resetReviewState();
+	recordReviewResult("reviewer-same", raceSummary, true, "s-race-same", raceRepo);
+	recordReviewResult("reviewer-B", raceSummary, true, "s-race-b", raceWt);
+	check(
+		"a same-repo review whose tracked content matches this worktree is preferred over a newer mismatching one",
+		getLastReviewResultForWorkspace(raceWtSame)?.reviewer === "reviewer-same",
+	);
+	rmSync(raceWtSame, { recursive: true, force: true });
+} finally {
+	process.env.PATH = racePrevPath;
+}
+if (prevWorktreeDirRace === undefined) delete process.env.WORKFLOW_GUARD_WORKTREE_DIR;
+else process.env.WORKFLOW_GUARD_WORKTREE_DIR = prevWorktreeDirRace;
+rmSync(join(root, "wg-race-worktrees"), { recursive: true, force: true });
+rmSync(raceBin, { recursive: true, force: true });
+rmSync(raceRepo, { recursive: true, force: true });
+resetReviewState();
+setWorkspaceRoot(root);
+
 // 14. Documentation Review & Synchronization Guard (Policy 21)
 console.log("- Policy 21: Documentation Review & Synchronization Guard -");
 const docRepo = mkdtempSync(join(tmpdir(), "wg-doc-repo-"));