pan-wizard 3.21.0 → 3.22.0

package/commands/pan/army.md

@@ -80,6 +80,7 @@ Every cap the conductor enforces applies to the campaign, scaled up:
 | `--max-cycles` | 5 | Mission items landed before stopping. |
 | `--total-budget` | 300 | Cumulative point budget. **Advisory by default** — tracked/surfaced but not a hard stop unless `--enforce-budget` / config `budget.enforce: true`. |
 | `--enforce-budget` | off | Make the point budgets hard stops again (also settable via config `budget.enforce: true`). |
+| `--verify-reserve` | 0.15 | Fraction of `--total-budget` (0–0.5) held back for the final Quality re-review so it can't be starved (config `budget.verify_reserve`). Advisory by default (surfaced as `into_verify_reserve`); under `--enforce-budget` it stops taking on new missions early (`budget_reserve_reached`) and the reserved points fund the closing `--clean-seal` re-verification before the last INTEGRATE. |
 | `--squads` | all | Restrict to a subset, e.g. `--squads architecture,build,quality`. |
 | `--no-build-worktrees` | off | Build in the main tree instead of branch-per-agent worktrees (small/serial projects). |
 | `--push` | off | Push approved merges to origin (still human-gated). |
@@ -143,13 +144,14 @@ PAN is not a daemon — it cannot wake itself while the session is closed. `--sc
 - **The trigger (you wire one):** a host scheduler (Claude Code routines / cron / scheduled-tasks) or a `/loop` runs `pan-tools campaign due` and, when it reports due, invokes `/pan:army --continue`. On next session open, a due campaign is surfaced as a nudge.
 - **Resume (`--continue`):** read the schedule + `.planning/orchestration/` + focus-auto state. If `campaign due` is true and the day's `--daily-budget` isn't spent, run the next mission(s), then `campaign record-run` (advances next-due, accrues the day's spend). If not due or budget-spent, report next-due and STOP.
 - **Bounded spend:** point budgets (`--total-budget`, `--daily-budget`) are **advisory indicators by default** — they're tracked and surfaced, not hard stops, unless `budget.enforce` / `--enforce-budget` is set. The real bounds are `--max-cycles`, the conductor caps, the abort file, and the human merge gate at every integrate. A scheduled campaign runs the backlog down to staged, reviewed, green PRs over days.
+- **Verify reserve:** a fraction of `--total-budget` (`--verify-reserve`, default 0.15) is held back so the closing Quality re-review isn't starved. Surfaced always via `campaign status` / `focus auto --status` (`into_verify_reserve`, `new_work_budget_remaining`); under `--enforce-budget` the run stops taking on new missions early (`budget_reserve_reached`) and spends the reserve on the final `--clean-seal` verification before the last INTEGRATE.
 
 Manage it: `pan-tools campaign status` (active/paused, spent today, next-due), `campaign schedule --pause` / `--resume` / `--disable`.
 
 ---
 
 ## Completion contract
-The campaign is complete when ANY holds: `--max-cycles` reached · backlog empty · abort file present · context < 25% · a mission cannot pass Quality and can't be cleanly reverted (HARD STOP — preserve state, report). (Budget exhaustion is advisory by default — a stop condition only when `budget.enforce`/`--enforce-budget` is set.) Always run `--clean-seal` (unless omitted) after the last item.
+The campaign is complete when ANY holds: `--max-cycles` reached · backlog empty · abort file present · context < 25% · a mission cannot pass Quality and can't be cleanly reverted (HARD STOP — preserve state, report). (Budget exhaustion is advisory by default — a stop condition only when `budget.enforce`/`--enforce-budget` is set; under enforcement, crossing into the verify reserve (`budget_reserve_reached`) stops new missions but the reserved points still fund the closing re-verification.) Always run `--clean-seal` (unless omitted) after the last item.
 
 ## NEVER DO
 - Let Mission Control write code, or let a squad agent spawn further agents (depth cap).

package/commands/pan/focus-auto.md

@@ -102,6 +102,7 @@ Wait for the user's reply before proceeding. Do not guess or pick a default cate
 | `--max-cycles` | 10 | Maximum iterations (1-50) |
 | `--total-budget` | 500 | Cumulative point budget (5-5000). Advisory by default (tracked/surfaced, not a stop). |
 | `--enforce-budget` | off | Make `--total-budget` a hard stop again (also settable via config `budget.enforce: true`). |
+| `--verify-reserve` | 0.15 | Fraction of `--total-budget` (0–0.5) held back for the final re-verification pass so it can't be starved (config `budget.verify_reserve`). Advisory by default — surfaced as `into_verify_reserve`; under `--enforce-budget` it stops **new work** early (`budget_reserve_reached`) and Phase 3 spends the reserve on the clean re-verification. |
 | `--continue` | — | Resume stopped/interrupted run |
 | `--stop` | — | Gracefully stop active run |
 | `--status` | — | Show current campaign progress |
@@ -344,6 +345,7 @@ Run: `pan-tools focus auto --update --items-completed N --items-failed N --point
 
 Check the response for stop conditions:
 - `regression`: Tests decreased — STOP IMMEDIATELY
+- `budget_reserve_reached`: New-work spend crossed into the reserved headroom (enforced runs) — stop taking on new items and go to Phase 3, which spends the reserve on the final re-verification pass
 - `budget_cap`: Cumulative budget exceeded — go to Phase 3
 - `max_cycles`: Maximum iterations reached — go to Phase 3
 - `zero_completed`: No items completed in this cycle — go to Phase 3
@@ -391,8 +393,9 @@ Then continue immediately to the next cycle (back to Step 2.1).
 
 ### Phase 3: Campaign End
 
-1. Run `pan-tools focus auto --status` to get final state
-2. Display campaign summary:
+1. **Final re-verification pass (spend the verify reserve).** Run `pan-tools focus auto --status` and read `stop_reason` / `into_verify_reserve` / `verify_reserve`. Run one clean build + full verification directly (commands from `config.json → build`/`verification`) — the same pass `--clean-seal` performs — when ANY holds: the stop reason is `budget_reserve_reached`, `--clean-seal` is set, or `into_verify_reserve` is true. This is what the reserved budget is FOR: the run stopped taking on **new** work early (at `budget_reserve_reached`) precisely so this closing verification has headroom and isn't starved. Run the verification commands directly — do NOT `focus auto --update` here (the run is already `completed`; its status update is refused, and the verification agents' spend is captured by the cost hooks automatically). If verification fails, treat it as a HARD STOP (preserve state, report) rather than sealing green. Skip this step only when none of the three conditions hold (advisory run that never entered the reserve and no `--clean-seal`).
+2. Run `pan-tools focus auto --status` to get final state
+3. Display campaign summary:
 
 ```
 ## Campaign Complete
@@ -408,7 +411,7 @@ Then continue immediately to the next cycle (back to Step 2.1).
 | Stop reason | <reason> |
 ```
 
-3. Remove safety tag: `git tag -d focus-auto-baseline 2>/dev/null`
+4. Remove safety tag: `git tag -d focus-auto-baseline 2>/dev/null`
 
 ## 6-Layer Safety Harness
 
@@ -416,6 +419,7 @@ Then continue immediately to the next cycle (back to Step 2.1).
 |-------|-----------|--------|
 | Per-cycle budget | `--budget N` per cycle | Limits single-cycle damage |
 | Cumulative budget | `--total-budget N` | Prevents runaway spending |
+| Verify reserve | `--verify-reserve F` | Holds back a budget fraction so the final re-verification isn't starved — stops new work early under enforcement (`budget_reserve_reached`) and spends the reserve on the clean re-verify in Phase 3 |
 | Iteration limit | `--max-cycles N` | Hard stop on loop count |
 | Regression circuit breaker | tests_after < tests_before | Immediate stop, status=stopped |
 | Zero-completed guard | 0 items done in a cycle | Stop — further cycles won't help |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pan-wizard",
-  "version": "3.21.0",
+  "version": "3.22.0",
   "description": "Command a bot army for your codebase: an Opus Mission Control delegates whole-project goals to specialist squads and ships behind a human merge gate. Five AI CLIs, zero context rot.",
   "bin": {
     "pan-wizard": "bin/install.js"

package/pan-wizard-core/bin/lib/memory-optimize.cjs

@@ -24,12 +24,49 @@ const { readMemory, parseEntries, listMemoryAgents, compactMemory, DEFAULT_MAX_E
 
 const DEFAULT_KEEP = 12;            // recent bullets kept inline per section
 const STATE_ARCHIVE_FILE = 'state-archive.md';
+const QUARANTINE_FILE = 'quarantine.md';
 
 // Sections whose bullet lists grow unbounded and are safe to reconcile.
 const APPEND_HEAVY = /\b(decisions|blockers|concerns|pending todos|todos|session continuity|accumulated context|recent activity)\b/i;
 // A bullet that is just a placeholder — dropped once real entries exist.
 const PLACEHOLDER = /^-\s*(none(\s+yet)?|n\/a|tbd|todo|—|-)\.?\s*$/i;
 
+// Memory-injection defense (threat: a subagent writes an instruction/directive
+// into the always-loaded memory that a LATER agent or run reads and OBEYS — a
+// cross-generation prompt injection, exactly the "agent writes self-serving
+// directives into persistent memory for successors" vector in the OpenAI
+// rogue-agent incident, Reuters 2026-07). See ADR-0040. state.md is agent-writable
+// (decisions/blockers/notes), so during reconcile any bullet that reads like a
+// directive AIMED at the agent/system is QUARANTINED out of standing memory (moved
+// to .planning/memory/quarantine.md, reversible) rather than carried forward —
+// nothing agent-authored becomes standing instruction without human review (the
+// merge gate). High-precision, injection-flavored patterns only, to minimize false
+// positives; a legitimate note caught here is recoverable from quarantine.md.
+const DIRECTIVE_PATTERNS = [
+  /\bignore\s+(all\s+|any\s+|these\s+)?(previous|prior|earlier|above)\b/i,
+  /\bdisregard\s+(the\s+|all\s+|any\s+|your\s+)?(previous|prior|above|earlier|instructions|rules|guidelines|guardrails)\b/i,
+  /\byou\s+are\s+now\b/i,
+  /\bnew\s+instructions?\s*:/i,
+  /\b(the\s+)?system\s+prompt\b/i,
+  /\b(as|acting\s+as|being)\s+(an?\s+)?(admin|administrator|root|superuser|developer\s+with)\b/i,
+  /\bpre-?authoriz(e|ed|ation)\b/i,
+  /\b(do\s+not|don'?t|never)\s+(tell|inform|notify|ask|alert)\s+the\s+(user|human|operator)\b/i,
+  /\bwithout\s+(asking|telling|notifying|informing|alerting)\s+the\s+(user|human|operator)\b/i,
+  /\b(bypass|skip|disable|override|remove|turn\s+off)\s+(the\s+)?(merge[-\s]?gate|human[-\s]?(approval|gate|review)|approval[-\s]?gate|safety[-\s]?(harness|check|guard|gate)|verification[-\s]?gate|review[-\s]?gate)\b/i,
+  /\b(always|automatically)\s+(approve|auto-?approve|accept|merge|confirm|say\s+yes)\b/i,
+  /\bauto-?approve\s+(all|any|every|everything)\b/i,
+  /\boverride\s+(the\s+)?(human|approval|merge[-\s]?gate|safety)\b/i,
+];
+
+/**
+ * True when a memory entry reads like a directive aimed at the agent/system
+ * (an injection), as opposed to a descriptive project note. Pure + zero-dep.
+ */
+function isSuspiciousDirective(text) {
+  if (typeof text !== 'string' || !text) return false;
+  return DIRECTIVE_PATTERNS.some((re) => re.test(text));
+}
+
 const isHeading = (l) => /^#{1,6}\s+\S/.test(l);
 const headingText = (l) => (l.match(/^#{1,6}\s+(.*)$/) || [, ''])[1];
 const isBullet = (l) => /^-\s+\S/.test(l);
@@ -64,7 +101,7 @@ function joinSections(sections) {
  * its indented continuation lines, so a bullet is never orphaned from its detail.
  * Overflow entries are pushed to `archived`. Returns { lines, changed }.
  */
-function reconcileBullets(lines, keepN, archived) {
+function reconcileBullets(lines, keepN, archived, quarantined) {
   const firstB = lines.findIndex(isBullet);
   if (firstB === -1) return { lines, changed: false };
 
@@ -87,9 +124,22 @@ function reconcileBullets(lines, keepN, archived) {
   }
   const trailer = rest.slice(i);
 
+  // 0. QUARANTINE injected directives FIRST — a bullet that reads like an
+  // instruction aimed at the agent never survives into standing memory; it is
+  // moved to the quarantine file for human review (memory-injection defense).
+  const safe = [];
+  let quarantinedHere = 0;
+  for (const e of entries) {
+    if (quarantined && isSuspiciousDirective(e.key)) {
+      quarantined.push(e.lines.join('\n'));
+      quarantinedHere++;
+    } else {
+      safe.push(e);
+    }
+  }
   // 1. dedupe (keep first occurrence)
   const seen = new Set();
-  const deduped = entries.filter((e) => (seen.has(e.key) ? false : (seen.add(e.key), true)));
+  const deduped = safe.filter((e) => (seen.has(e.key) ? false : (seen.add(e.key), true)));
   // 2. strip placeholders once real entries exist
   const real = deduped.filter((e) => !PLACEHOLDER.test(e.key));
   const kept0 = real.length ? real : deduped;
@@ -102,7 +152,7 @@ function reconcileBullets(lines, keepN, archived) {
   }
   for (const d of dropped) archived.push(d.lines.join('\n'));
 
-  const changed = deduped.length !== entries.length || kept0.length !== deduped.length || dropped.length > 0;
+  const changed = quarantinedHere > 0 || deduped.length !== safe.length || kept0.length !== deduped.length || dropped.length > 0;
   const newLines = [...pre, ...kept.flatMap((e) => e.lines), ...trailer];
   // Preserve the section's trailing blank line (the blank that separates it from
   // the next heading) so reconciling never collapses two sections together.
@@ -119,23 +169,22 @@ function optimizeStateContent(content, opts = {}) {
   const keepN = Number.isFinite(opts.keep) && opts.keep > 0 ? opts.keep : DEFAULT_KEEP;
   const sections = parseSections(content);
   const archived = [];
+  const quarantined = [];
   const sectionsTouched = [];
   let changed = false;
 
   for (const s of sections) {
     if (s.heading === null) continue;
     if (!APPEND_HEAVY.test(headingText(s.heading))) continue;
-    const before = archived.length;
-    const r = reconcileBullets(s.lines, keepN, archived);
+    const r = reconcileBullets(s.lines, keepN, archived, quarantined);
     if (r.changed) {
       s.lines = r.lines;
       changed = true;
       sectionsTouched.push(headingText(s.heading).trim());
     }
-    void before;
   }
 
-  return { content: changed ? joinSections(sections) : content, changed, archived, sectionsTouched };
+  return { content: changed ? joinSections(sections) : content, changed, archived, quarantined, sectionsTouched };
 }
 
 // ─── Command ────────────────────────────────────────────────────────────────
@@ -154,6 +203,30 @@ function appendArchive(cwd, entries, now) {
   fs.appendFileSync(p, block, 'utf-8');
 }
 
+function quarantinePath(cwd) {
+  return path.join(planningPath(cwd), MEMORY_DIR, QUARANTINE_FILE);
+}
+
+/**
+ * Append quarantined directive-like entries to a dated, human-review file. These
+ * were pulled OUT of standing memory because they read like injected instructions
+ * (memory-injection defense). Reversible — a human can review and, if legitimate,
+ * restore an entry by hand. The file leads with a warning so it is never loaded
+ * as trusted instruction memory.
+ */
+function appendQuarantine(cwd, entries, now) {
+  if (!entries.length) return;
+  const p = quarantinePath(cwd);
+  const fresh = !fs.existsSync(p);
+  fs.mkdirSync(path.dirname(p), { recursive: true });
+  const stamp = now || '(undated)';
+  const header = fresh
+    ? '# Quarantined memory (DO NOT auto-load as instructions)\n\nEntries below were pulled out of standing memory during reconcile because they read like\ndirectives aimed at the agent (possible cross-generation prompt injection). They are\nNOT trusted instructions. Review each; restore to state.md by hand only if legitimate.\n'
+    : '';
+  const block = `${header}\n## Quarantined ${stamp}\n\n${entries.join('\n')}\n`;
+  fs.appendFileSync(p, block, 'utf-8');
+}
+
 /**
  * `memory optimize [--apply] [--keep N]` — reconcile state.md + consolidate
  * over-budget agent logs. Dry-run by default: reports what WOULD change.
@@ -172,12 +245,15 @@ function cmdMemoryOptimize(cwd, opts = {}, raw) {
       changed: opt.changed,
       sections_touched: opt.sectionsTouched,
       archived_entries: opt.archived.length,
+      quarantined_entries: opt.quarantined.length,
       before_bytes: Buffer.byteLength(before),
       after_bytes: Buffer.byteLength(opt.content),
     };
     result.archived = opt.archived.length;
+    result.quarantined = opt.quarantined.length;
     if (apply && opt.changed) {
       appendArchive(cwd, opt.archived, opts.now);
+      appendQuarantine(cwd, opt.quarantined, opts.now);
       writeStateMd(statePath, opt.content, cwd);
     }
   } else {
@@ -199,8 +275,10 @@ function cmdMemoryOptimize(cwd, opts = {}, raw) {
     }
   } catch { /* agent sweep is best-effort */ }
 
+  const q = result.quarantined || 0;
+  const quarantineNote = q ? `; ${q} directive-like entr${q === 1 ? 'y' : 'ies'} QUARANTINED` : '';
   const summary = result.state.changed
-    ? `${apply ? 'optimized' : 'would optimize'} state.md (${result.state.sections_touched.join(', ')}); ${result.archived} entr${result.archived === 1 ? 'y' : 'ies'} archived${result.agents.length ? `; ${result.agents.length} agent log(s)` : ''}`
+    ? `${apply ? 'optimized' : 'would optimize'} state.md (${result.state.sections_touched.join(', ')}); ${result.archived} entr${result.archived === 1 ? 'y' : 'ies'} archived${quarantineNote}${result.agents.length ? `; ${result.agents.length} agent log(s)` : ''}`
     : `state.md already lean${result.agents.length ? `; ${result.agents.length} agent log(s) over budget` : ''} — nothing to do`;
   output(result, raw, summary);
 }
@@ -239,8 +317,9 @@ function maybeAutoOptimizeMemory(cwd, opts = {}) {
     const opt = optimizeStateContent(before, { keep: opts.keep });
     if (!opt.changed) return { optimized: false, reason: 'clean' };
     appendArchive(cwd, opt.archived, opts.now);
+    appendQuarantine(cwd, opt.quarantined, opts.now);
     writeStateMd(statePath, opt.content, cwd);
-    return { optimized: true, sections: opt.sectionsTouched, archived: opt.archived.length };
+    return { optimized: true, sections: opt.sectionsTouched, archived: opt.archived.length, quarantined: opt.quarantined.length };
   } catch {
     return { optimized: false, reason: 'error' };
   }
@@ -248,6 +327,6 @@ function maybeAutoOptimizeMemory(cwd, opts = {}) {
 
 module.exports = {
   optimizeStateContent, reconcileBullets, parseSections, joinSections, cmdMemoryOptimize,
-  maybeAutoOptimizeMemory, autoOptimizeEnabled,
-  APPEND_HEAVY, PLACEHOLDER, DEFAULT_KEEP, STATE_ARCHIVE_FILE,
+  maybeAutoOptimizeMemory, autoOptimizeEnabled, isSuspiciousDirective,
+  APPEND_HEAVY, PLACEHOLDER, DIRECTIVE_PATTERNS, DEFAULT_KEEP, STATE_ARCHIVE_FILE, QUARANTINE_FILE,
 };

package/pan-wizard-core/bin/lib/memory-rebuild.cjs

@@ -32,6 +32,24 @@ const {
   upsertAgentsMdSection,
   ensureClaudeMdImport,
 } = require('./agents-md.cjs');
+const { isSuspiciousDirective } = require('./memory-optimize.cjs');
+
+/**
+ * Scan a procedural-memory file (AGENTS.md / CLAUDE.md) for lines that read like
+ * directives aimed at the agent — a memory-injection risk in the ALWAYS-loaded
+ * instruction files (ADR-0040). rebuild owns only the marker-fenced PAN section
+ * (regenerated from a fixed template, so it can't be poisoned); user content is
+ * preserved by contract, so here we WARN rather than auto-edit — surfacing
+ * suspect lines for human review instead of silently rewriting the user's file.
+ */
+function scanForDirectives(file, content, warnings) {
+  if (typeof content !== 'string') return;
+  content.split('\n').forEach((line, i) => {
+    if (isSuspiciousDirective(line)) {
+      warnings.push({ file, line: i + 1, text: line.trim().slice(0, 200) });
+    }
+  });
+}
 
 // Source repo root — mirrors experiment.cjs / install.js. __dirname is
 // .../pan-wizard-core/bin/lib, so three levels up is the repo (or install) root.
@@ -106,6 +124,7 @@ function cmdMemoryRebuild(cwd, opts = {}, raw) {
 
   const runtimes = detectRuntimes(cwd);
   const targets = [];
+  const warnings = [];
 
   // 1. AGENTS.md — universal PAN section (all runtimes read it natively).
   {
@@ -113,6 +132,7 @@ function cmdMemoryRebuild(cwd, opts = {}, raw) {
     const existing = safeReadFile(p);
     const desired = upsertAgentsMdSection(existing, buildAgentsMdSection());
     targets.push({ file: 'AGENTS.md', ...rebuildFile(p, existing, desired, apply) });
+    scanForDirectives('AGENTS.md', desired, warnings);
   }
 
   // 2. CLAUDE.md — Claude bridge, only when the Claude runtime is installed.
@@ -121,6 +141,7 @@ function cmdMemoryRebuild(cwd, opts = {}, raw) {
     const existing = safeReadFile(p);
     const desired = ensureClaudeMdImport(existing);
     targets.push({ file: 'CLAUDE.md', ...rebuildFile(p, existing, desired, apply) });
+    scanForDirectives('CLAUDE.md', desired, warnings);
   }
 
   // 3. state.md — re-derive YAML frontmatter from the body (progress/status).
@@ -139,10 +160,12 @@ function cmdMemoryRebuild(cwd, opts = {}, raw) {
     runtimes,
     rebuilt: targets,
     changed_count: changed.length,
+    directive_warnings: warnings,
   };
-  const summary = changed.length === 0
+  const warnNote = warnings.length ? `; ⚠ ${warnings.length} directive-like line(s) in procedural memory — review (not auto-edited)` : '';
+  const summary = (changed.length === 0
     ? `tools memory already current (${targets.map((t) => t.file).join(', ')}) — nothing to do`
-    : `${apply ? 'rebuilt' : 'would rebuild'} ${changed.map((t) => `${t.file} (${t.action})`).join(', ')}`;
+    : `${apply ? 'rebuilt' : 'would rebuild'} ${changed.map((t) => `${t.file} (${t.action})`).join(', ')}`) + warnNote;
   output(result, raw, summary);
 }
 
@@ -151,6 +174,7 @@ module.exports = {
   detectRuntimes,
   isInsideSourceRepo,
   rebuildFile,
+  scanForDirectives,
   PAN_SOURCE_ROOT,
   RUNTIME_DIRS,
 };

package/pan-zcode/KNOWN-BETA-RISKS.md

@@ -27,6 +27,14 @@ hard-depend on, and the go/no-go facts that can only be settled on a real ZCode
 - **User-global subagents only.** No repo-scoped rosters or per-project model profiles.
 - **Genuinely lost:** scheduled self-resuming multi-day campaigns (no headless/daemon),
   background execution, committable permissions, and custom slash-commands.
+- **Bridge scope is tool/resource exposure ONLY — never agent session state.** The MCP
+  server exposes `pan-tools` verbs as `tools/call` + `resources/read`; it deliberately
+  does not represent rich agent session state (diffs, streaming, live thread lifecycle).
+  This is by design, not an omission: MCP cannot faithfully carry that state — a point
+  OpenAI made explicitly when it built the Codex "harness" as a native Rust core rather
+  than over MCP (2026). Do NOT extend the bridge to stream diffs or proxy session state
+  through it; keep the CLI's JSON contract as the tool contract. (Codex-adapter audit,
+  2026-07-30.)
 
 ## Format-drift policy
 

package/pan-zcode/README.md

@@ -21,6 +21,8 @@ pan-zcode/mcp  (this subsystem)  a thin, zero-dep bridge — verbs → MCP tools
 pan-wizard-core  (reused as-is)  the deterministic engine; .planning/ stays the state store
 ```
 
+**Scope boundary (by design):** the bridge exposes `pan-tools` verbs as MCP tools/resources and nothing more. It intentionally does **not** carry rich agent *session state* — diffs, streaming, live thread lifecycle — because MCP can't faithfully represent it (the reason OpenAI built the Codex harness as a native Rust core rather than over MCP). Keep the bridge to tool/resource exposure; the CLI's JSON contract is the tool contract. See `KNOWN-BETA-RISKS.md`.
+
 ## Status — M1–M5 built (M0 is the human verify spike)
 
 - **M1 — bridge core.** `mcp/tool-registry.cjs` (pure verb→tool/resource map, with a hard