patchwarden 1.6.1 → 1.6.2

package/README.en.md

@@ -19,9 +19,9 @@ PatchWarden stores that plan as a workspace-scoped task, lets a preconfigured
 local agent execute it, and returns results, diffs, artifact manifests, and
 independent verification evidence.
 
-[Download Windows installer v1.6.0](https://github.com/jiezeng2004-design/PatchWarden/releases/download/v1.6.0/PatchWarden-Setup-1.6.0-x64.exe)
-· [Portable ZIP](https://github.com/jiezeng2004-design/PatchWarden/releases/download/v1.6.0/PatchWarden-Portable-1.6.0-x64.zip)
-· [Checksums](https://github.com/jiezeng2004-design/PatchWarden/releases/download/v1.6.0/PatchWarden-Desktop-SHA256SUMS.txt)
+[Download Windows installer v1.6.2](https://github.com/jiezeng2004-design/PatchWarden/releases/download/v1.6.2/PatchWarden-Setup-1.6.2-x64.exe)
+· [Portable ZIP](https://github.com/jiezeng2004-design/PatchWarden/releases/download/v1.6.2/PatchWarden-Portable-1.6.2-x64.zip)
+· [Checksums](https://github.com/jiezeng2004-design/PatchWarden/releases/download/v1.6.2/PatchWarden-Desktop-SHA256SUMS.txt)
 · [Three-minute quick start](#three-minute-quick-start)
 · [Discussions](https://github.com/jiezeng2004-design/PatchWarden/discussions)
 
@@ -29,12 +29,18 @@ independent verification evidence.
 
 <sub>Real PatchWarden Desktop first-run UI from a privacy-safe smoke run; no real workspace, account, or credential data is shown.</sub>
 
-Current source version: **v1.6.1**; current Windows Release: **v1.6.0**; npm
-`latest`: **v1.5.1**. Use the installer above for the first Windows experience;
-pin an actually published version for npm/CLI use. See the
+Current source version and Windows Release: **v1.6.2**. npm `latest` is
+published separately by the maintainer; use the npm badge above or query the
+registry for its current value. Use the installer above for the first Windows experience. See the
 [CHANGELOG](CHANGELOG.md), [migration guide](docs/migration-from-safe-bifrost.md), and
 [release checklist](docs/release-checklist.md).
 
+> [!NOTE]
+> The desktop installer is currently available for Windows x64 only. macOS,
+> Linux, and users who are not installing Desktop yet can continue using the
+> existing stable npm package and its built-in local Dashboard. This change
+> does not run `npm publish` automatically.
+
 > [!IMPORTANT]
 > PatchWarden is not a general-purpose remote shell. MCP clients cannot run
 > arbitrary commands: files must remain inside the configured workspace,
@@ -239,16 +245,15 @@ three minutes. A ChatGPT Tunnel is not required for this first run.
 
 ### Option A: Windows installer (recommended for a first run)
 
-1. Download the [Windows installer v1.6.0](https://github.com/jiezeng2004-design/PatchWarden/releases/download/v1.6.0/PatchWarden-Setup-1.6.0-x64.exe)
-   and its [SHA256 checksum file](https://github.com/jiezeng2004-design/PatchWarden/releases/download/v1.6.0/PatchWarden-Desktop-SHA256SUMS.txt).
+1. Download the [Windows installer v1.6.2](https://github.com/jiezeng2004-design/PatchWarden/releases/download/v1.6.2/PatchWarden-Setup-1.6.2-x64.exe)
+   and its [SHA256 checksum file](https://github.com/jiezeng2004-design/PatchWarden/releases/download/v1.6.2/PatchWarden-Desktop-SHA256SUMS.txt).
 2. Verify the installer in PowerShell:
 
 ```powershell
-Get-FileHash .\PatchWarden-Setup-1.6.0-x64.exe -Algorithm SHA256
+Get-FileHash .\PatchWarden-Setup-1.6.2-x64.exe -Algorithm SHA256
 ```
 
-The current published value is `77d655545925ae283a0caed0fff12554debac15b54c5decf1ae8f3867703058e`;
-always prefer the checksum file from the same Release. The installer is not
+Always use the checksum file from the same Release. The installer is not
 code-signed yet, so Windows SmartScreen may show an unknown-publisher warning.
 
 3. Install and open PatchWarden Desktop, then choose a dedicated workspace that
@@ -683,7 +688,7 @@ country list.
 Use this sequence:
 
 1. `health_check` — verify version, workspace, Watcher, and tool catalog.
-2. `list_agents` — confirm the local execution agent is available.
+2. `list_agents` — confirm the local agent executable is available. This read-only check does not verify provider balance, login state, or model permissions; `provider_status` is `not_checked` by default.
 3. `list_workspace` — identify the correct `repo_path`.
 4. `save_plan`, or provide an `inline_plan` when creating the task.
 5. `create_task` — specify the agent, repository, and verification commands.

package/README.md

@@ -15,9 +15,9 @@ ChatGPT、Codex、OpenCode 或其他 MCP 客户端负责规划与验收，
 PatchWarden 负责把计划保存成工作区内任务，再由预先配置的本地 Agent
 执行，并返回结果、代码差异和独立测试记录。
 
-[下载 Windows 安装版 v1.6.0](https://github.com/jiezeng2004-design/PatchWarden/releases/download/v1.6.0/PatchWarden-Setup-1.6.0-x64.exe)
-· [免安装 ZIP](https://github.com/jiezeng2004-design/PatchWarden/releases/download/v1.6.0/PatchWarden-Portable-1.6.0-x64.zip)
-· [校验文件](https://github.com/jiezeng2004-design/PatchWarden/releases/download/v1.6.0/PatchWarden-Desktop-SHA256SUMS.txt)
+[下载 Windows 安装版 v1.6.2](https://github.com/jiezeng2004-design/PatchWarden/releases/download/v1.6.2/PatchWarden-Setup-1.6.2-x64.exe)
+· [免安装 ZIP](https://github.com/jiezeng2004-design/PatchWarden/releases/download/v1.6.2/PatchWarden-Portable-1.6.2-x64.zip)
+· [校验文件](https://github.com/jiezeng2004-design/PatchWarden/releases/download/v1.6.2/PatchWarden-Desktop-SHA256SUMS.txt)
 · [三分钟快速开始](#三分钟快速开始)
 · [Discussions](https://github.com/jiezeng2004-design/PatchWarden/discussions)
 
@@ -25,11 +25,15 @@ PatchWarden 负责把计划保存成工作区内任务，再由预先配置的
 
 <sub>PatchWarden Desktop 真实首启界面，来自隐私安全的桌面 smoke 验收；截图未使用真实工作区、账号或凭据。</sub>
 
-当前源码版本：**v1.6.1**；当前 Windows Release：**v1.6.0**；npm `latest`：**v1.5.1**。
-Windows 首次体验推荐上面的安装版；npm/CLI 用户请固定已发布版本。查看
+当前源码版本和 Windows Release：**v1.6.2**。npm `latest` 由维护者独立手动发布，
+请以页面顶部的 npm 徽章和注册表查询结果为准。Windows 首次体验推荐上面的安装版；查看
 [CHANGELOG](CHANGELOG.md)、[迁移指南](docs/migration-from-safe-bifrost.md)和
 [发布检查清单](docs/release-checklist.md)。
 
+> [!NOTE]
+> 当前桌面安装包暂时只提供 Windows x64。macOS、Linux 或暂时不安装桌面版的用户，
+> 可以继续使用 npm 上已有的稳定版本及其内置本地 Dashboard；本次 GitHub Release 不自动执行 `npm publish`。
+
 > [!IMPORTANT]
 > PatchWarden 不是通用远程 Shell。MCP 客户端不能随意执行命令：
 > 文件必须位于配置的工作区内，Agent 必须预先登记，验证命令必须与白名单
@@ -148,16 +152,15 @@ CLI，或者先把 OpenCode 配置为执行 Agent。
 
 ### 方案 A：Windows 安装版（首次体验推荐）
 
-1. 下载 [Windows 安装版 v1.6.0](https://github.com/jiezeng2004-design/PatchWarden/releases/download/v1.6.0/PatchWarden-Setup-1.6.0-x64.exe)
-   和 [SHA256 校验文件](https://github.com/jiezeng2004-design/PatchWarden/releases/download/v1.6.0/PatchWarden-Desktop-SHA256SUMS.txt)。
+1. 下载 [Windows 安装版 v1.6.2](https://github.com/jiezeng2004-design/PatchWarden/releases/download/v1.6.2/PatchWarden-Setup-1.6.2-x64.exe)
+   和 [SHA256 校验文件](https://github.com/jiezeng2004-design/PatchWarden/releases/download/v1.6.2/PatchWarden-Desktop-SHA256SUMS.txt)。
 2. 在 PowerShell 中校验安装包：
 
 ```powershell
-Get-FileHash .\PatchWarden-Setup-1.6.0-x64.exe -Algorithm SHA256
+Get-FileHash .\PatchWarden-Setup-1.6.2-x64.exe -Algorithm SHA256
 ```
 
-当前发布值应为 `77d655545925ae283a0caed0fff12554debac15b54c5decf1ae8f3867703058e`；
-仍应以同一 Release 的校验文件为准。安装包尚未代码签名，Windows SmartScreen
+请以同一 Release 的校验文件为准。安装包尚未代码签名，Windows SmartScreen
 可能显示“未知发布者”。
 
 3. 安装并打开 PatchWarden Desktop，选择一个只包含项目的专用工作区。
@@ -565,7 +568,7 @@ Tunnel。支持范围可能变化，因此不要在项目里写死国家列表
 推荐顺序：
 
 1. `health_check`：确认版本、工作区、Watcher 和工具目录。
-2. `list_agents`：确认本地 Agent 命令可用。
+2. `list_agents`：确认本地 Agent 可执行文件可用；该检查不会验证模型提供商余额、登录态或调用权限，结果中的 `provider_status` 默认为 `not_checked`。
 3. `list_workspace`：确定 `repo_path`。
 4. `save_plan`，或在创建任务时提供 `inline_plan`。
 5. `create_task`：明确 Agent、仓库和验证命令。

package/dist/assessments/assessmentDiagnostics.d.ts

@@ -0,0 +1,29 @@
+import type { AssessmentValidationResult } from "./assessmentStore.js";
+export interface AssessmentValidationFailureDiagnostic {
+    diagnostic_version: string;
+    error_code: string;
+    reason_code: string;
+    assessment_id: string | null;
+    assessment_config_sha256: string | null;
+    current_config_sha256: string | null;
+    assessment_config_hash: string | null;
+    current_config_hash: string | null;
+    snapshot_version: string | null;
+    assessment_fingerprint_version: string | null;
+    current_fingerprint_version: string;
+    assessment_schema_epoch: string | null;
+    current_schema_epoch: string;
+    assessment_created_at: string | null;
+    assessment_expires_at: string | null;
+    config_changed: boolean;
+    changed_field_names: string[];
+    changed_config_sections: string[];
+    validator_module_path: string;
+    validator_build_id: string;
+    watcher_instance_id: string | null;
+    observed_at: string;
+}
+export declare function buildAssessmentValidationFailureDiagnostic(result: AssessmentValidationResult): AssessmentValidationFailureDiagnostic | null;
+/** Persist a bounded value-free failure summary without changing validation behavior. */
+export declare function recordAssessmentValidationFailure(result: AssessmentValidationResult): boolean;
+export declare function readLastAssessmentValidationFailure(): AssessmentValidationFailureDiagnostic | null;

package/dist/assessments/assessmentDiagnostics.js

@@ -0,0 +1,132 @@
+import { existsSync, mkdirSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { getAssessmentsDir, getConfig } from "../config.js";
+import { guardPath } from "../security/pathGuard.js";
+import { atomicWriteJsonFileSync } from "../utils/atomicFile.js";
+import { readJsonObjectFileSync } from "../utils/lockedJsonFile.js";
+import { ASSESSMENT_SECURITY_SNAPSHOT_VERSION } from "./securitySnapshot.js";
+import { PATCHWARDEN_VERSION, TOOL_SCHEMA_EPOCH } from "../version.js";
+const DIAGNOSTIC_VERSION = "assessment-validation-diagnostic-v2";
+const DIAGNOSTIC_FILE = "last-validation-failure.json";
+const VALIDATOR_MODULE_PATH = "dist/assessments/assessmentStore.js";
+const VALIDATOR_BUILD_ID = `patchwarden-${PATCHWARDEN_VERSION}:${TOOL_SCHEMA_EPOCH}:${ASSESSMENT_SECURITY_SNAPSHOT_VERSION}`;
+export function buildAssessmentValidationFailureDiagnostic(result) {
+    if (result.valid || !result.failure_reason)
+        return null;
+    const reasonCode = safeCode(result.failure_reason);
+    const assessmentHash = safeHash(result.expected_hash);
+    const currentHash = safeHash(result.actual_hash);
+    const changedSections = [...new Set((result.config_change_categories || [])
+            .map((name) => safeCode(name))
+            .filter(Boolean))]
+        .sort()
+        .slice(0, 32);
+    const assessmentVersion = safeText(result.assessment?.assessment_security_snapshot_version, 80);
+    return {
+        diagnostic_version: DIAGNOSTIC_VERSION,
+        error_code: reasonCode,
+        reason_code: reasonCode,
+        assessment_id: safeAssessmentId(result.assessment?.assessment_id),
+        assessment_config_sha256: assessmentHash,
+        current_config_sha256: currentHash,
+        assessment_config_hash: assessmentHash,
+        current_config_hash: currentHash,
+        snapshot_version: assessmentVersion,
+        assessment_fingerprint_version: assessmentVersion,
+        current_fingerprint_version: ASSESSMENT_SECURITY_SNAPSHOT_VERSION,
+        assessment_schema_epoch: safeText(result.assessment?.assessment_schema_epoch, 80),
+        current_schema_epoch: TOOL_SCHEMA_EPOCH,
+        assessment_created_at: safeTimestamp(result.assessment?.created_at),
+        assessment_expires_at: safeTimestamp(result.assessment?.expires_at),
+        config_changed: result.failure_reason === "assessment_stale_config",
+        changed_field_names: changedSections,
+        changed_config_sections: changedSections,
+        validator_module_path: VALIDATOR_MODULE_PATH,
+        validator_build_id: VALIDATOR_BUILD_ID,
+        watcher_instance_id: safeInstanceId(process.env.PATCHWARDEN_WATCHER_INSTANCE_ID),
+        observed_at: new Date().toISOString(),
+    };
+}
+/** Persist a bounded value-free failure summary without changing validation behavior. */
+export function recordAssessmentValidationFailure(result) {
+    const diagnostic = buildAssessmentValidationFailureDiagnostic(result);
+    if (!diagnostic)
+        return false;
+    try {
+        const config = getConfig();
+        const assessmentsDir = getAssessmentsDir(config);
+        const file = guardPath(join(assessmentsDir, DIAGNOSTIC_FILE), config.workspaceRoot, config.assessmentsDir);
+        mkdirSync(dirname(file), { recursive: true });
+        atomicWriteJsonFileSync(file, diagnostic);
+        return true;
+    }
+    catch {
+        // Diagnostics must never replace the original fail-closed validation error.
+        return false;
+    }
+}
+export function readLastAssessmentValidationFailure() {
+    try {
+        const config = getConfig();
+        const file = guardPath(join(getAssessmentsDir(config), DIAGNOSTIC_FILE), config.workspaceRoot, config.assessmentsDir);
+        if (!existsSync(file))
+            return null;
+        const raw = readJsonObjectFileSync(file);
+        if (raw.diagnostic_version !== DIAGNOSTIC_VERSION)
+            return null;
+        const changedSections = Array.isArray(raw.changed_config_sections)
+            ? [...new Set(raw.changed_config_sections.map(safeCode).filter(Boolean))].sort().slice(0, 32)
+            : [];
+        return {
+            diagnostic_version: DIAGNOSTIC_VERSION,
+            error_code: safeCode(raw.error_code),
+            reason_code: safeCode(raw.reason_code),
+            assessment_id: safeAssessmentId(raw.assessment_id),
+            assessment_config_sha256: safeHash(raw.assessment_config_sha256),
+            current_config_sha256: safeHash(raw.current_config_sha256),
+            assessment_config_hash: safeHash(raw.assessment_config_hash),
+            current_config_hash: safeHash(raw.current_config_hash),
+            snapshot_version: safeText(raw.snapshot_version, 80),
+            assessment_fingerprint_version: safeText(raw.assessment_fingerprint_version, 80),
+            current_fingerprint_version: safeText(raw.current_fingerprint_version, 80) || ASSESSMENT_SECURITY_SNAPSHOT_VERSION,
+            assessment_schema_epoch: safeText(raw.assessment_schema_epoch, 80),
+            current_schema_epoch: safeText(raw.current_schema_epoch, 80) || TOOL_SCHEMA_EPOCH,
+            assessment_created_at: safeTimestamp(raw.assessment_created_at),
+            assessment_expires_at: safeTimestamp(raw.assessment_expires_at),
+            config_changed: raw.config_changed === true,
+            changed_field_names: Array.isArray(raw.changed_field_names)
+                ? [...new Set(raw.changed_field_names.map(safeCode).filter(Boolean))].sort().slice(0, 32)
+                : [],
+            changed_config_sections: changedSections,
+            validator_module_path: safeText(raw.validator_module_path, 120) || VALIDATOR_MODULE_PATH,
+            validator_build_id: safeText(raw.validator_build_id, 160) || VALIDATOR_BUILD_ID,
+            watcher_instance_id: safeInstanceId(raw.watcher_instance_id),
+            observed_at: safeTimestamp(raw.observed_at) || new Date(0).toISOString(),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function safeAssessmentId(value) {
+    return typeof value === "string" && /^assessment_\d{8}_\d{6}_[0-9a-f]{32}$/.test(value) ? value : null;
+}
+function safeInstanceId(value) {
+    return typeof value === "string" && /^[a-zA-Z0-9_-]{1,100}$/.test(value) ? value : null;
+}
+function safeCode(value) {
+    return typeof value === "string" && /^[a-z0-9_]{1,80}$/.test(value) ? value : "";
+}
+function safeHash(value) {
+    return typeof value === "string" && /^[0-9a-f]{64}$/.test(value) ? value : null;
+}
+function safeText(value, maxLength) {
+    return typeof value === "string" && value.length > 0
+        ? value.replace(/[\r\n]+/g, " ").slice(0, maxLength)
+        : null;
+}
+function safeTimestamp(value) {
+    return typeof value === "string" && Number.isFinite(Date.parse(value))
+        ? new Date(value).toISOString()
+        : null;
+}

package/dist/assessments/assessmentStore.d.ts

@@ -1,6 +1,8 @@
+import { PatchWardenConfig } from "../config.js";
 import { type RepoSnapshot } from "../runner/changeCapture.js";
 import type { RiskAssessmentResult } from "../security/riskEngine.js";
 import type { TaskTemplateName, ChangePolicy } from "../tools/taskTemplates.js";
+import { type SecuritySnapshotCategory } from "./securitySnapshot.js";
 export interface AgentAssessmentSummary {
     attempted: boolean;
     status: "completed" | "timed_out" | "non_zero_exit" | "parse_failed" | "read_only_violation" | "spawn_failed" | "not_run";
@@ -44,6 +46,12 @@ export interface AssessmentRecord {
     plan_id: string | null;
     policy_hash: string;
     tool_manifest_sha256: string;
+    execution_config_hash?: string;
+    execution_config_component_hashes?: Partial<Record<ExecutionConfigChangeCategory, string>>;
+    assessment_security_snapshot_version?: string;
+    assessment_security_snapshot_sha256?: string;
+    assessment_security_snapshot_component_hashes?: Partial<Record<ExecutionConfigChangeCategory, string>>;
+    assessment_schema_epoch?: string;
     workspace_fingerprint: string;
     workspace_snapshot_summary: {
         head: string | null;
@@ -62,10 +70,15 @@ export interface AssessmentRecord {
     agent: string;
     timeout_seconds?: number;
     change_policy?: ChangePolicy;
+    scope?: string[];
+    forbidden?: string[];
+    verification?: string[];
+    done_evidence?: string[];
     requires_confirm: boolean;
     confirmed: boolean;
     confirmed_at: string | null;
     confirm_code: string | null;
+    used_at?: string | null;
     agent_assessment_summary?: AgentAssessmentSummary | null;
 }
 export interface AssessmentCreateInput {
@@ -85,6 +98,10 @@ export interface AssessmentCreateInput {
     agent: string;
     timeout_seconds?: number;
     change_policy?: ChangePolicy;
+    scope?: string[];
+    forbidden?: string[];
+    verification?: string[];
+    done_evidence?: string[];
     snapshot: RepoSnapshot;
     assessment_id?: string;
     assessment_dir?: string;
@@ -94,7 +111,11 @@ export interface AssessmentValidationResult {
     valid: boolean;
     failure_reason: string | null;
     assessment: AssessmentRecord | null;
+    expected_hash?: string;
+    actual_hash?: string;
+    config_change_categories?: ExecutionConfigChangeCategory[];
 }
+export type ExecutionConfigChangeCategory = SecuritySnapshotCategory | "allowed_test_commands" | "execution_config";
 export interface AssessmentConfirmationResult {
     assessment_id: string;
     decision: "needs_confirm";
@@ -111,6 +132,8 @@ export declare function generateAssessmentId(): string;
 export declare function createAssessmentDir(assessmentId: string): string;
 export declare function createAssessment(input: AssessmentCreateInput): AssessmentRecord;
 export declare function readAssessment(assessmentId: string): AssessmentRecord;
+/** Atomically consume an Assessment before creating its one allowed task. */
+export declare function markAssessmentUsed(assessmentId: string): AssessmentRecord;
 export declare function validateAssessmentFreshness(assessmentId: string, currentSnapshot: RepoSnapshot, options?: AssessmentValidationOptions): AssessmentValidationResult;
 /**
  * Records an explicit confirmation performed from the local PatchWarden CLI.
@@ -130,4 +153,20 @@ interface PolicyHashInput {
     schema_epoch: string;
 }
 export declare function computePolicyHash(input: PolicyHashInput): string;
+interface ExecutionConfigHashInput {
+    agent: string;
+    tool_manifest_sha256: string;
+    tool_profile: string;
+    repo_path: string;
+    change_policy?: string | null;
+    template?: string | null;
+    verify_commands?: string[];
+    test_command?: string | null;
+    task_timeout_seconds?: number | null;
+    scope?: string[];
+    forbidden?: string[];
+    verification?: string[];
+    done_evidence?: string[];
+}
+export declare function computeExecutionConfigHash(config: PatchWardenConfig, input: ExecutionConfigHashInput): string;
 export {};

package/dist/assessments/assessmentStore.js

@@ -8,8 +8,11 @@ import { redactSensitiveContent } from "../security/contentRedaction.js";
 import { atomicWriteJsonFileSync } from "../utils/atomicFile.js";
 import { withFileLockSync } from "../utils/lockedJsonFile.js";
 import { TOOL_SCHEMA_EPOCH } from "../version.js";
-import { getLastToolCatalogSnapshot } from "../tools/catalog/toolCatalog.js";
+import { buildToolCatalogSnapshot, resolveToolProfile, } from "../tools/catalog/toolCatalog.js";
+import { getToolDefs } from "../tools/definitions/toolDefs.js";
 import { captureRepoSnapshot } from "../runner/changeCapture.js";
+import { getProjectPolicySummary } from "../policy/projectPolicy.js";
+import { ASSESSMENT_SECURITY_SNAPSHOT_VERSION, buildAssessmentSecuritySnapshot, getAssessmentSecuritySnapshotComponentHashes, hashAssessmentSecuritySnapshot, } from "./securitySnapshot.js";
 const SENSITIVE_PATH_RULES_SIGNATURE = "v1";
 const ARTIFACT_RULES_SIGNATURE = "v1";
 export function generateAssessmentId() {
@@ -35,7 +38,7 @@ export function createAssessment(input) {
     const planHash = input.plan_content
         ? createHash("sha256").update(input.plan_content).digest("hex")
         : null;
-    const toolManifest = getLastToolCatalogSnapshot()?.tool_manifest_sha256 || computeFallbackManifestHash(config);
+    const toolManifest = getCurrentToolManifest(config);
     const workspaceFingerprint = computeWorkspaceFingerprint(input.snapshot);
     const snapshotTruncated = input.snapshot.warnings.some((w) => w.includes("snapshot limited"));
     const policyHash = computePolicyHash({
@@ -48,6 +51,21 @@ export function createAssessment(input) {
         artifact_rules: ARTIFACT_RULES_SIGNATURE,
         schema_epoch: TOOL_SCHEMA_EPOCH,
     });
+    const executionConfig = computeExecutionConfigFingerprint(config, {
+        agent: input.agent,
+        tool_manifest_sha256: toolManifest,
+        tool_profile: resolveToolProfile(config.toolProfile),
+        repo_path: input.resolved_repo_path,
+        change_policy: input.change_policy || "repo_scoped_changes",
+        template: input.template || null,
+        verify_commands: input.verify_commands || [],
+        test_command: input.test_command || null,
+        task_timeout_seconds: input.timeout_seconds,
+        scope: input.scope,
+        forbidden: input.forbidden,
+        verification: input.verification,
+        done_evidence: input.done_evidence,
+    });
     const now = new Date();
     const expiresAt = new Date(now.getTime() + config.assessmentTtlSeconds * 1000).toISOString();
     const record = {
@@ -62,6 +80,12 @@ export function createAssessment(input) {
         plan_id: input.plan_id,
         policy_hash: policyHash,
         tool_manifest_sha256: toolManifest,
+        execution_config_hash: executionConfig.hash,
+        execution_config_component_hashes: executionConfig.components,
+        assessment_security_snapshot_version: ASSESSMENT_SECURITY_SNAPSHOT_VERSION,
+        assessment_security_snapshot_sha256: executionConfig.hash,
+        assessment_security_snapshot_component_hashes: executionConfig.components,
+        assessment_schema_epoch: TOOL_SCHEMA_EPOCH,
         workspace_fingerprint: workspaceFingerprint,
         workspace_snapshot_summary: {
             head: input.snapshot.head,
@@ -80,16 +104,24 @@ export function createAssessment(input) {
         agent: input.agent,
         timeout_seconds: input.timeout_seconds,
         change_policy: input.change_policy || "repo_scoped_changes",
+        scope: input.scope || [],
+        forbidden: input.forbidden || [],
+        verification: input.verification || [],
+        done_evidence: input.done_evidence || [],
         requires_confirm: input.decision === "needs_confirm",
         confirmed: false,
         confirmed_at: null,
         confirm_code: null,
+        used_at: null,
         agent_assessment_summary: input.agent_assessment_summary || null,
     };
     atomicWriteJsonFileSync(join(dir, "assessment.json"), record);
     return record;
 }
 export function readAssessment(assessmentId) {
+    if (!/^assessment_\d{8}_\d{6}_[0-9a-f]{32}$/.test(assessmentId)) {
+        throw new PatchWardenError("assessment_id_invalid", "A full assessment_id with 32 hexadecimal random characters is required.", "Copy the complete assessment_id from the assess_only response; assessment_short_id is display-only.");
+    }
     const config = getConfig();
     const assessmentsDir = getAssessmentsDir(config);
     const dir = resolve(assessmentsDir, assessmentId);
@@ -98,9 +130,36 @@ export function readAssessment(assessmentId) {
     if (!existsSync(file)) {
         throw new PatchWardenError("assessment_not_found", `Assessment "${assessmentId}" not found.`, "Call create_task with execution_mode=assess_only first to get a valid assessment_id.", true, { assessment_id: assessmentId });
     }
-    return JSON.parse(readFileSync(file, "utf-8"));
+    try {
+        const parsed = JSON.parse(readFileSync(file, "utf-8"));
+        if (!parsed || typeof parsed !== "object" || parsed.assessment_id !== assessmentId) {
+            throw new Error("record identity mismatch");
+        }
+        return parsed;
+    }
+    catch (error) {
+        throw new PatchWardenError("assessment_corrupted", `Assessment "${assessmentId}" cannot be read as a valid record.`, "Run create_task with execution_mode=assess_only again.", true, { assessment_id: assessmentId, failure_category: "invalid_assessment_record" });
+    }
+}
+/** Atomically consume an Assessment before creating its one allowed task. */
+export function markAssessmentUsed(assessmentId) {
+    const config = getConfig();
+    const assessmentFile = resolve(getAssessmentsDir(config), assessmentId, "assessment.json");
+    guardPath(assessmentFile, config.workspaceRoot, config.assessmentsDir);
+    return withFileLockSync(assessmentFile, () => {
+        const assessment = readAssessment(assessmentId);
+        if (assessment.used_at) {
+            throw new PatchWardenError("assessment_used", `Assessment "${assessmentId}" has already been used.`, "Run create_task with execution_mode=assess_only again to obtain a new assessment_id.", true, { assessment_id: assessmentId, used_at: assessment.used_at });
+        }
+        const consumed = { ...assessment, used_at: new Date().toISOString() };
+        atomicWriteJsonFileSync(assessmentFile, consumed);
+        return consumed;
+    });
 }
 export function validateAssessmentFreshness(assessmentId, currentSnapshot, options = {}) {
+    if (!/^assessment_\d{8}_\d{6}_[0-9a-f]{32}$/.test(assessmentId)) {
+        return { valid: false, failure_reason: "assessment_id_invalid", assessment: null };
+    }
     let assessment;
     try {
         assessment = readAssessment(assessmentId);
@@ -124,18 +183,70 @@ export function validateAssessmentFreshness(assessmentId, currentSnapshot, optio
             return { valid: false, failure_reason: "assessment_stale_plan", assessment };
         }
     }
+    const config = getConfig();
+    const currentManifest = getCurrentToolManifest(config);
     if (!options.skip_tool_manifest) {
-        const currentManifest = getLastToolCatalogSnapshot()?.tool_manifest_sha256 ||
-            computeFallbackManifestHash(getConfig());
-        if (currentManifest !== assessment.tool_manifest_sha256) {
-            return { valid: false, failure_reason: "assessment_stale_config", assessment };
+        // Legacy records need the standalone manifest check. Versioned security
+        // snapshots compare the manifest together with the source config, so the
+        // diagnostic can report both "tool_manifest" and e.g. "allowed_commands".
+        if (currentManifest !== assessment.tool_manifest_sha256 && !assessment.assessment_security_snapshot_sha256) {
+            return {
+                valid: false,
+                failure_reason: "assessment_stale_config",
+                assessment,
+                expected_hash: assessment.tool_manifest_sha256,
+                actual_hash: currentManifest,
+                config_change_categories: ["tool_manifest"],
+            };
         }
     }
     const currentFingerprint = computeWorkspaceFingerprint(currentSnapshot);
     if (currentFingerprint !== assessment.workspace_fingerprint) {
         return { valid: false, failure_reason: "assessment_workspace_changed", assessment };
     }
-    const config = getConfig();
+    if (assessment.execution_config_hash) {
+        const currentExecutionConfig = computeExecutionConfigFingerprint(config, {
+            agent: assessment.agent,
+            tool_manifest_sha256: currentManifest,
+            tool_profile: resolveToolProfile(config.toolProfile),
+            repo_path: assessment.resolved_repo_path,
+            change_policy: assessment.change_policy || "repo_scoped_changes",
+            template: assessment.template || null,
+            verify_commands: assessment.verify_commands || [],
+            test_command: assessment.test_command || null,
+            task_timeout_seconds: assessment.timeout_seconds,
+            scope: assessment.scope,
+            forbidden: assessment.forbidden,
+            verification: assessment.verification,
+            done_evidence: assessment.done_evidence,
+        });
+        if (assessment.assessment_security_snapshot_version
+            && assessment.assessment_security_snapshot_version !== ASSESSMENT_SECURITY_SNAPSHOT_VERSION) {
+            return {
+                valid: false,
+                failure_reason: "assessment_snapshot_version_incompatible",
+                assessment,
+                expected_hash: assessment.execution_config_hash,
+                actual_hash: currentExecutionConfig.hash,
+                config_change_categories: ["schema_epoch"],
+            };
+        }
+        if (currentExecutionConfig.hash !== assessment.execution_config_hash) {
+            const previousComponents = assessment.execution_config_component_hashes;
+            const changedCategories = previousComponents
+                ? Object.keys(currentExecutionConfig.components)
+                    .filter((category) => previousComponents[category] !== currentExecutionConfig.components[category])
+                : ["execution_config"];
+            return {
+                valid: false,
+                failure_reason: "assessment_stale_config",
+                assessment,
+                expected_hash: assessment.execution_config_hash,
+                actual_hash: currentExecutionConfig.hash,
+                config_change_categories: changedCategories.length > 0 ? changedCategories : ["execution_config"],
+            };
+        }
+    }
     const currentPolicyHash = computePolicyHash({
         change_policy: assessment.change_policy || "repo_scoped_changes",
         template: assessment.template || null,
@@ -232,10 +343,53 @@ export function computePolicyHash(input) {
 function getRepoAllowedCommands(config, repoPath) {
     return getRepoAllowedTestCommands(config, repoPath);
 }
-function computeFallbackManifestHash(config) {
-    return createHash("sha256")
-        .update(`${TOOL_SCHEMA_EPOCH}:${config.toolProfile || "full"}`)
-        .digest("hex");
+function getCurrentToolManifest(config) {
+    // The catalog cache is process-local. Rebuild the canonical catalog here so
+    // MCP and the independent Watcher derive the same manifest across processes.
+    const profile = resolveToolProfile(config.toolProfile);
+    return buildToolCatalogSnapshot(getToolDefs(), profile).tool_manifest_sha256;
+}
+export function computeExecutionConfigHash(config, input) {
+    return computeExecutionConfigFingerprint(config, input).hash;
+}
+function computeExecutionConfigFingerprint(config, input) {
+    let projectPolicy = null;
+    let projectPolicyValid = null;
+    let projectPolicyIssues = [];
+    try {
+        const summary = getProjectPolicySummary(input.repo_path);
+        projectPolicy = summary.effective_policy;
+        projectPolicyValid = summary.valid;
+        projectPolicyIssues = summary.issues.map(({ code, severity, field }) => ({ code, severity, field }));
+    }
+    catch {
+        // A workspace-root change can make the old repository inaccessible. The
+        // workspace_root component still fails closed without exposing the path.
+    }
+    const snapshot = buildAssessmentSecuritySnapshot({
+        config,
+        schemaEpoch: TOOL_SCHEMA_EPOCH,
+        toolProfile: input.tool_profile,
+        toolManifestSha256: input.tool_manifest_sha256,
+        agent: input.agent,
+        repoPath: input.repo_path,
+        changePolicy: input.change_policy,
+        template: input.template,
+        verifyCommands: input.verify_commands,
+        testCommand: input.test_command,
+        taskTimeoutSeconds: input.task_timeout_seconds,
+        scope: input.scope,
+        forbidden: input.forbidden,
+        verification: input.verification,
+        doneEvidence: input.done_evidence,
+        projectPolicy,
+        projectPolicyValid,
+        projectPolicyIssues,
+    });
+    return {
+        hash: hashAssessmentSecuritySnapshot(snapshot),
+        components: getAssessmentSecuritySnapshotComponentHashes(snapshot),
+    };
 }
 function extractReason(error) {
     if (error instanceof PatchWardenError)