pi-claude-supervisor 0.5.4 → 0.6.0

package/docs/engineering-plan.md

@@ -36,7 +36,7 @@ Claude Code Worker
 4. Supervisor 因误判导致无限循环、危险操作或不可审计的修改。
 5. 人工无法随时接管或恢复任务。
 
-**当前状态：`v0.5.3` 已正式发布，已完成固定 Claude Code `2.1.270` 稳定性验证、单 Worker recovery、真实只读 Review drill、隔离临时 worktree 的允许编辑 repair/reacceptance drill、exact-head 独立 Review 和受保护发布。当前工作树已落实 repairable/persistent 能力拆分、verifying stop、paused watchdog、baseline-relative repository evidence、可取消验收/Reviewer、启动 preflight、无人值守权限决策、local-commit enforcement、候选挂起和阶段进度通知。自动模式现在要求 direct Claude JSONL 或 Supervisor 自有 tmux bridge、完整 Git baseline、非保护分支，并请求不可用即失败的 Claude Code sandbox 和无出站域名；任意自定义可执行文件不会进入自动模式。Legacy human/takeover APIs 仅保留显式兼容控制；普通不确定性不再阻塞本地循环。协同多 Worker、手动/自定义集成的 host-level 低权限和网络隔离仍是独立后续里程碑。**
+**当前状态：`v0.5.3` 已正式发布，已完成以 Claude Code `2.1.270` 为兼容下限的稳定性验证、单 Worker recovery、真实只读 Review drill、隔离临时 worktree 的允许编辑 repair/reacceptance drill、exact-head 独立 Review 和受保护发布。当前工作树已落实 repairable/persistent 能力拆分、verifying stop、paused watchdog、baseline-relative repository evidence、可取消验收/Reviewer、启动 preflight、无人值守权限决策、local-commit enforcement、候选挂起和阶段进度通知。自动模式现在要求 direct Claude JSONL 或 Supervisor 自有 tmux bridge、完整 Git baseline、非保护分支和受信任的 Claude 可执行文件；它保留 Claude Code 的完整环境、网络、工具、Agent/Task、插件、MCP 和嵌套 Claude 能力，`CLAUDECODE` 仅为允许嵌套会话而移除。已知直接 remote push/main-integration 操作仍由策略拒绝，cgroup 负责所有后代清理；自定义/嵌套能力的绝对 remote/main 隔离仍由独立边界提供。Legacy human/takeover APIs 仅保留显式兼容控制；普通不确定性不再阻塞本地循环。协同多 Worker 仍是独立后续里程碑。**
 
 ---
 
@@ -563,8 +563,10 @@ Worker 声称完成
 - 故障恢复、候选挂起和可选通知。
 
 本阶段不阻塞当前 Supervisor 功能、Worker 生命周期、进程组清理、resume
-和独立验收工作。Worker 可在任务授权及宿主机策略允许的权限范围内运行，
-并可本地修改、测试、修复和提交；但不拥有远程 push 或 main/integration merge 权限。
+和独立验收工作。自动 Claude Worker 可在完整继承的环境、网络、工具、Agent/Task、
+插件、MCP 和嵌套会话能力下本地修改、测试、修复和提交；已知直接 remote push 或
+main/integration merge 请求仍由策略拒绝，但嵌套/自定义能力的绝对边界必须由独立
+host/repository 机制提供。
 
 ---
 
@@ -743,7 +745,7 @@ TASK_STOPPED
 | 无限 continue 循环 | P1 | 最大轮数、重复检测、冷却时间 |
 | Worker 输出 prompt injection | P1 | 输出不可信化、工具调用前策略拦截 |
 | Reviewer 不够独立 | P1 | 独立上下文、只读验收、证据重新采集 |
-| 误操作生产环境 | P0 | 任务授权、独立验收、远程/main 独立边界；sandbox/白名单作为后续独立加固 |
+| 误操作生产环境 | P0 | 任务授权、独立验收、已知直接 remote/main 策略门；完整能力的 host/repository 独立边界作为后续加固 |
 | Worker 崩溃后状态丢失 | P2 | Decision Worker session/task mapping 持久化，异常重启后显式 recovery；Claude Worker 本身不静默 resume |
 | 多会话互相覆盖 | P1 | 独立 cwd/worktree 检测、共享事件锁、会话级 watchdog |
 | Decision Worker/API 不可用 | P1 | 记录事件，按有限重试和候选挂起策略处理；通知是可选投递，不是同步控制依赖 |
@@ -917,7 +919,7 @@ PTY 和 headless JSONL 只能选择一个作为 MVP 的主 transport，禁止两
 
 ## 20. 近期落地与剩余门禁：稳定的自动验收闭环
 
-本轮已落地 TaskSpec 多命令验收和 autonomy 字段、独立只读 Reviewer、结构化 repair round、重复 finding/P0/P1 候选挂起、JSONL 去重、baseline-relative commit evidence 和确定性 replay fixture。剩余门禁是固定 CLI 的重复运行统计，而不是继续扩大本地同步安全边界。当前只验证固定的 Claude Code `2.1.270`，不把多版本兼容作为本阶段任务。自动 Claude 路径已请求 fail-closed sandbox 和无出站域名；OS 级低权限、host-level sandbox、手动/自定义集成的 network allowlist、SBOM 和更深的供应链加固后置，不作为本阶段门禁；远程 push/main merge、保护 CI 和发布仍保持独立边界。
+本轮已落地 TaskSpec 多命令验收和 autonomy 字段、独立只读 Reviewer、结构化 repair round、重复 finding/P0/P1 候选挂起、JSONL 去重、baseline-relative commit evidence 和确定性 replay fixture。剩余门禁是兼容下限以上 CLI 的重复运行统计，而不是继续扩大本地同步安全边界。Claude Code 以 `2.1.270` 为最低兼容版本；真实 Spike 默认从 `PATH` 解析当前安装（包括 `latest` 路径），接受该版本及更新版本，并记录实际版本和路径。自动模式不再注入 fail-closed sandbox、无出站域名、凭据过滤或 Claude 工具 allowlist；正常 Agent/Task、插件、MCP、网络和嵌套 Claude 均保持可用。OS 级低权限、host-level sandbox、手动/自定义集成的 network allowlist、SBOM 和更深的供应链加固后置，不作为本阶段门禁；已知 remote push/main merge、保护 CI 和发布仍保持独立边界。
 
 ### 20.1 Goal / Evidence / Sign-off 模型
 
@@ -962,7 +964,7 @@ Reviewer 必须使用独立 Pi session，只允许 `read`、`grep`、`find`、`l
 
 ### 20.2 JSONL 稳定性证据
 
-只对 Claude Code `2.1.270` 建立证据，覆盖：
+以 Claude Code `2.1.270` 为最低兼容版本建立以下证据；真实 Spike 可使用 `PATH` 中当前的更高版本：
 
 - JSONL 跨 chunk 拆分、单 chunk 多记录和 malformed 行；malformed 行不能触发完成事件；
 - 重复 result、重复 permission request、重复 Supervisor idempotency key 不产生重复动作；
@@ -973,7 +975,6 @@ Reviewer 必须使用独立 Pi session，只允许 `read`、`grep`、`find`、`l
 
 ### 20.3 明确不属于本阶段
 
-- Claude CLI 多版本兼容；
 - OS sandbox、低权限执行和网络隔离；
 - Worker 获得远程 push 或 main/integration merge 权限；
 - 多 Worker 在同一工作树协作。
@@ -988,7 +989,7 @@ Reviewer 必须使用独立 Pi session，只允许 `read`、`grep`、`find`、`l
 
 ### 21.1 短期：稳定性收尾
 
-- 完成真实 Claude Code `2.1.270` 重复 Spike：普通任务连续 10 次，权限和问题回退各至少 5 次；
+- 使用 PATH 中当前的 Claude Code（不得低于 `2.1.270`）完成重复 Spike：普通任务连续 10 次，权限和问题回退各至少 5 次，并记录实际版本/路径；
 - 补齐 replay：多轮修复、验收失败修复、repair budget 耗尽、takeover、recover 和 Pi shutdown；
 - 补齐边界测试：Reviewer 流式输出上限、`DecisionSessionStore.list()` 任务 ID 校验、跨进程恢复和超时/输出截断；
 - 继续观察 npm `0.5.2`、GitHub Release 资产、provenance 和回滚路径；
@@ -1025,7 +1026,7 @@ Reviewer 必须使用独立 Pi session，只允许 `read`、`grep`、`find`、`l
 
 ### 21.4 后置：安全加固
 
-- CLI 多版本兼容矩阵；
+- Claude CLI 破坏性变更检测和跨版本兼容矩阵（当前最低兼容版本为 `2.1.270`）；
 - OS sandbox、低权限执行、网络隔离/allowlist；
 - 更深的供应链、SBOM、密钥隔离和生产监控。
 
@@ -1047,6 +1048,8 @@ Worker → 验收 → 独立 Reviewer → fail-closed 候选挂起链路。验
 4. **验证门禁**：已补齐真实 capability 矩阵、隔离 worktree 的真实
    repair/reacceptance 演练、exact-head 独立 Reviewer 和受保护发布；本地候选仍不得绕过远程/main 独立边界。
 
-本轮不放宽以下边界，同时不增加本地同步人工门：Reviewer 仍只读，验收仍使用 argv/`execFile`，不伪造 Claude
-`--resume`，Worker 不得远程 push 或 main/integration merge，P0/P1、重复 finding、超时、API 错误和不完整
-证据继续 fail-closed 并生成不可发布候选。多 Worker 协作继续后置。
+本轮不增加本地同步人工门：Reviewer 仍只读，验收仍使用 argv/`execFile`，不伪造 Claude
+`--resume`；Supervisor 管理的已知 remote push 或 main/integration merge 仍拒绝，P0/P1、
+重复 finding、超时、API 错误和不完整证据继续 fail-closed 并生成不可发布候选。自动
+Claude 的 Agent/Task、插件、MCP、网络和嵌套 Claude 能力保持开放，cgroup 只负责后代
+清理；多 Worker 协作继续后置。

package/docs/implementation-review.md

@@ -1,21 +1,22 @@
 # Implementation Review
 
 An independent read-only reviewer examined the implementation before the final
-hardening pass. The review found release blockers in automatic startup validation,
-shell-policy lexical handling, malformed custom Reviewer results, credential
-filtering, and stale security documentation. Those findings are addressed by the
-current implementation and regression tests.
+hardening pass. The earlier review found release blockers in automatic startup
+validation, shell-policy lexical handling, malformed custom Reviewer results and
+stale security documentation; those findings remain covered by the current
+implementation and regression tests. Its previous credential-filtering and
+Claude-sandbox assumptions were deliberately superseded by the full-capability
+unattended operating model.
 
-Automatic mode is fail-closed at its supported Worker boundary: it requires a
-validated non-bare Git worktree, an existing full baseline commit, a non-protected
-branch, the Claude JSONL transport, and the bare `claude`/`claude.exe` command name.
-Startup resolves and pins an operator-owned, non-writable executable path (or an
-explicit `PI_CLAUDE_SUPERVISOR_TRUSTED_CLAUDE` path), and the final pre-spawn check
-compares the current repository HEAD with the exact startup HEAD. The built-in Claude
-path requests Claude Code's fail-closed Bash sandbox with no outbound domains.
-Arbitrary custom executables and explicit paths are not admitted to automatic mode;
-manual/custom integrations remain responsible for their own host sandbox and network
-boundary.
+Automatic mode still validates a non-bare Git worktree, an existing full baseline
+commit, a non-protected branch, the Claude JSONL/tmux transport and the bare
+`claude`/`claude.exe` command name. Startup resolves and pins an operator-owned,
+non-writable executable path (or an explicit `PI_CLAUDE_SUPERVISOR_TRUSTED_CLAUDE`
+path), and the final pre-spawn check compares the current repository HEAD with the
+exact startup HEAD. Automatic Claude workers retain their normal environment,
+network, tools, agents, plugins and MCP configuration; `CLAUDECODE` is removed only
+to permit nested Claude sessions. Cgroup/process cleanup owns all descendants, but
+custom/nested descendants are trusted rather than denied by a nested-process guard.
 
 ## Findings addressed in this pass
 
@@ -25,9 +26,10 @@ boundary.
 - Automatic startup pins a secure resolved Claude executable identity and rejects
   explicit paths, persists that identity for recovery, and rechecks the exact startup
   HEAD through the built-in adapter's final `preSpawnCheck` immediately before spawn.
-- Worker and verifier processes use a minimal environment; explicit worker
-  variables can be selected with `PI_CLAUDE_SUPERVISOR_WORKER_ENV` or an
-  embedding caller's `WorkerStartInput.env`.
+- Manual Worker and verifier processes retain the baseline environment behavior;
+  automatic Workers pass the full Supervisor environment, including credentials,
+  helpers, custom settings and proxy/network variables, with only `CLAUDECODE`
+  removed so nested Claude can start.
 - Startup failures clean up a worker and do not let event-log failures hide the
   original error.
 - Default wall-clock and no-output watchdogs stop stalled workers.
@@ -50,12 +52,13 @@ sandbox that prevents `.git` writes.
 These are verified limitations and follow-up work after the automatic boundary
 hardening:
 
-- The Claude Code sandbox is a requested runtime boundary and is fail-closed when
-  unavailable; it is not a substitute for a host-level sandbox, lower-privilege
-  account, or container policy for manual integrations.
+- Automatic mode intentionally does not provide a host-level network sandbox or
+  low-privilege account. Known direct remote push/main operations remain policy
+  denied, but nested agents, plugins and MCP servers are trusted capabilities and
+  need an independent repository/host boundary for absolute enforcement.
 - Event contents can contain worker output or user messages; common credential
-  patterns are now redacted and sequence recovery is persisted, but broader
-  structured-secret coverage remains follow-up work.
+  patterns are redacted and sequence recovery is persisted, but broader structured
+  secret coverage remains follow-up work.
 - PTY semantics, permission-event handling, and process-group behavior with the
   target Claude Code versions still require dedicated transport evidence. Basic
   Claude JSONL prompt, multi-turn and session-resume fixtures now pass in the

package/docs/independent-review.md

@@ -20,7 +20,7 @@
 - `pi-interactive-shell` 如果通过版本、API、许可证和故障测试，应优先复用其 PTY 和人工接管实现。
 - `pi-claude-code`、`pi-harness-delegate` 在完成供应链、API 和故障语义审计前，不作为核心依赖。
 
-**结论：架构方向 GO；先完成固定版本 Spike、生命周期和故障恢复主线。当前自动模式已把直接 Claude 的 fail-closed sandbox、无出站域名、JSONL transport、Git baseline 和分支校验作为启动边界，并拒绝任意自定义可执行文件；手动集成的 host-level 低权限和网络隔离仍是后续加固。另经产品确认，本地开发必须完全无人值守；远程 push 和 main/integration merge 是 Worker 不具备权限的独立边界。详见 [autonomy-target.md](autonomy-target.md)。**
+**结论：架构方向 GO；生命周期、故障恢复和独立验收主线已完成。产品目标是本地开发完全无人值守，因此当前自动模式保留 Claude Code 的完整环境、网络、工具、Agent/Task、插件、MCP 和嵌套 Claude 能力；只保留已知直接 remote push/main-integration 操作的策略拒绝、Git 元数据保护、cgroup 清理和独立验收。`CLAUDECODE` 仅为允许嵌套会话而移除；自定义/嵌套工具如需绝对 remote/main 隔离，必须由独立 host/repository 边界提供。详见 [autonomy-target.md](autonomy-target.md)。**
 
 ## 2. 外部参考源审查结果
 
@@ -222,7 +222,7 @@ MVP 必须满足：
 
 - 单仓库、单 worktree、单 Worker；
 - 本地开发动作按任务授权自动继续、修复或挂起；
-- 不授予 Worker 远程 push 或 main/integration merge 权限；
+- Supervisor 管理的直接 remote push 或 main/integration merge 请求必须拒绝，并由独立边界保护自定义/嵌套能力；
 - 事件可以完整回放；
 - 人工 takeover 后零自动发送；
 - 验收失败绝不进入 `COMPLETE`；
@@ -238,7 +238,7 @@ MVP 必须满足：
 - 依赖 lockfile 和 SBOM；
 - 包来源校验；
 - 手动/自定义集成的最小权限和 host-level sandbox；
-- 手动/自定义集成的网络白名单；自动 Claude 路径已请求无出站域名并在不可用时失败；
+- 手动/自定义集成的网络和 host 权限边界；自动 Claude 路径保留完整网络、工具和 MCP 能力；
 - 更广泛的密钥隔离；
 - 日志脱敏；
 - 成本和时间告警；
@@ -246,9 +246,10 @@ MVP 必须满足：
 - 可随时关闭自动化；
 - 故障回滚、候选挂起和可选通知。
 
-其中手动/自定义集成的 host-level 低权限、sandbox 和网络白名单不阻塞当前生命周期验证；
-自动模式不接受没有 Claude sandbox 边界的自定义 Worker。本地运行权限由任务和调用方授权策略
-控制，远程 push/main merge 仍由独立边界控制。
+其中手动/自定义集成的 host-level 低权限和网络边界不阻塞当前生命周期验证；自动模式
+允许 Agent/Task、插件、MCP 和嵌套 Claude，cgroup 只负责后代清理，已知直接
+remote push/main merge 仍由策略和独立边界控制。嵌套/自定义工具若需要绝对隔离，必须
+由 host/repository 边界提供。
 
 ### 5.4 建议 Go / No-Go 门槛
 

package/docs/testing.md

@@ -36,8 +36,11 @@ the published TypeScript source directly and there is no second runtime bundle.
   blank turn, idle adoption emits no synthetic completion, adopted pipe
   detachment permits re-adoption, and adopted stop preserves the user's
   session.
-- `worker/environment.test.ts`: unrelated host credentials are excluded unless
-  explicitly supplied.
+- `worker/environment.test.ts`: manual environment inheritance remains minimal, while
+  automatic mode merges explicit overrides onto the complete inherited environment,
+  removes only `CLAUDECODE` so nested Claude can run, adds a safe default permission
+  mode when omitted, resolves settings from effective `HOME`/`CLAUDE_CONFIG_DIR`, and
+  rejects Bash preauthorization in CLI/settings configuration.
 - `supervisor.test.ts`: the no-output watchdog stops a stalled worker, lifecycle event failures are retried, and output is restored when event persistence fails.
 - `scripts/check-package.mjs`: verifies the Pi manifest, peer dependency policy,
   required files and forbidden secret paths.
@@ -52,18 +55,22 @@ It must not be added to the normal CI gate because authentication is an owner
 controlled prerequisite.
 
 The transport fixtures validate one prompt, multiple turns, session resume,
-permission allow/deny and SIGTERM/SIGINT behavior. The current release validation
-uses Claude Code 2.1.270 at
-`/home/yancao/.local/share/mise/installs/claude/2.1.270/claude`, including real
-owned tmux turns, pause/resume, and restart re-adoption.
+permission allow/deny and SIGTERM/SIGINT behavior. The compatibility floor for the current release line is Claude Code `2.1.270`.
+The real-Claude spikes resolve the current `claude` executable from `PATH` by
+default, so installer-managed `latest` paths work without naming a versioned
+installation directory; `PI_CLAUDE_SUPERVISOR_REAL_CLAUDE_PATH` is an optional
+explicit override. Versions older than `2.1.270` are rejected, while newer
+versions are accepted and recorded in the spike output. The recorded baseline
+run used Claude Code `2.1.270` and covered real owned tmux turns, pause/resume,
+and restart re-adoption.
 The adapter regression suite also verifies event subscription, parsed
 `permission_request` events, the exact nested `control_response` envelope, and
-that an automatic tmux Worker cannot launch a second Claude executable from a
-Worker-created script.
+that an automatic Worker may launch a nested Claude executable while cgroup
+cleanup still reaps the child.
 The automation spike additionally exercises a real Pi SDK Decision Worker with
 Claude: ordinary completion, harmless Bash permission handling, and an
 `AskUserQuestion` denial-to-text fallback followed by automatic verification.
-A local pinned-CLI run completed all three scenarios with `state=completed`,
+A local baseline-CLI run completed all three scenarios with `state=completed`,
 `verified=true`, and zero human interventions. Provider/model latency can still
 cause a later run to fail closed as a parked/non-publishable candidate after the bounded Decision
 Worker or Reviewer timeout; this is evidence for the manual spike only, not a CI guarantee.
@@ -75,8 +82,21 @@ heartbeat. Recovery is explicit and safe: after an unclean Pi restart,
 `/supervise sessions` shows the task as `recoverable`, and `/supervise recover
 [--takeover] <task-id>` restores the Decision Worker history before starting a new
 Claude Worker. `--takeover` is accepted only when the old Pi owner is dead, the
-Worker process group is gone, and its cgroup is a real readable empty boundary;
-persistent tmux sessions use `adopt-tmux`.
+Worker process group is gone, and its cgroup is a real readable empty boundary.
+Automatic tmux takeover additionally verifies Supervisor ownership, persisted
+Worker/cgroup and tmux-server identities, and that the private tmux session is gone.
+It persists cleanup-pending state before reserving the gone private socket,
+reuses the old lease record for an atomic replacement, then removes the
+guardian-left-empty cgroup and clears the transaction only after cleanup is
+verified; a fresh lease reader reconciles an interrupted transaction while
+retaining a replacement lease during its replacement phase. Automatic lease acquisition records a no-spawn startup marker; the adapter
+persists its generated cgroup/socket plan before resource creation, then records
+cgroup and tmux-server identity in stages before spawn. Startup takeover verifies
+and cleans a planned empty cgroup/session when a crash interrupts that sequence;
+a stale marker can otherwise be reclaimed only after its owner is proven dead.
+Automatic normal-exit cleanup retains an empty cgroup until lease release.
+Persistent manual tmux sessions use `adopt-tmux`. The bridge has a regression test that mutates settings
+between Supervisor preflight and `respawn-pane` and confirms Claude is not spawned.
 Run the permission and signal probes explicitly when validating a CLI release:
 
 ```bash
@@ -86,10 +106,11 @@ npm run spike:signals
 npm run spike:automation
 SPIKE_AUTOMATION_PERMISSION=1 npm run spike:automation
 SPIKE_AUTOMATION_QUESTION=1 npm run spike:automation
-PI_CLAUDE_SUPERVISOR_REAL_CLAUDE_PATH=/home/yancao/.local/share/mise/installs/claude/2.1.270/claude \
 PI_CLAUDE_SUPERVISOR_REAL_CLAUDE=1 npm run spike:tmux
-PI_CLAUDE_SUPERVISOR_REAL_CLAUDE_PATH=/home/yancao/.local/share/mise/installs/claude/2.1.270/claude \
 PI_CLAUDE_SUPERVISOR_REAL_CLAUDE=1 npm run spike:tmux-interactive
+# Optional explicit override; PATH/latest is preferred:
+PI_CLAUDE_SUPERVISOR_REAL_CLAUDE_PATH="$HOME/.local/share/mise/installs/claude/latest/claude" \
+PI_CLAUDE_SUPERVISOR_REAL_CLAUDE=1 npm run spike:tmux
 ```
 
 The tmux spike is gated, authenticated, and excluded from normal CI. It uses
@@ -100,11 +121,12 @@ and identity-bound restart re-adoption. The interactive spike uses a fresh tempo
 cwd to verify Claude's trust prompt, a real Bash permission prompt, an allow-once
 response, and an exact result marker; it also records metadata only.
 
-For each release, pin and record the validated Claude Code version, resolved
-executable path, and model. The spikes reject an unpinned/mismatched executable
-version. For this release the validated version is `2.1.270` with model `opus`;
-the bounded matrix and its fail-closed outliers are recorded in
-[`docs/stability-matrix-2.1.270.md`](stability-matrix-2.1.270.md).
+For each release, record the validated Claude Code version, resolved executable
+path, and model. The spikes resolve `claude` from `PATH` by default and reject
+versions below the compatibility floor `2.1.270`; they do not require an exact
+versioned installation path. The recorded baseline for this release is `2.1.270`
+with model `opus`; the bounded matrix and its fail-closed outliers are recorded
+in [`docs/stability-matrix-2.1.270.md`](stability-matrix-2.1.270.md).
 Record:
 
 1. exact version and resolved executable path;
@@ -137,11 +159,17 @@ The tmux transport is selected with `PI_CLAUDE_SUPERVISOR_TRANSPORT=tmux`.
 Automatic mode rejects explicit `process-pipe`; use JSONL or the Supervisor-owned
 bridge for bounded decisions and repair. Automatic JSONL and tmux workers also
 require Linux cgroup v2 containment (and the tmux parent-death guardian); startup
-fails closed when it is unavailable. Built-in Claude workers also receive a fail-closed
-sandbox setting (`failIfUnavailable`, `allowUnsandboxedCommands=false`, no outbound
-network domains); verify that startup fails if the sandbox cannot be initialized.
-Automatic startup also requires a full existing Git baseline, non-bare non-protected
-worktree and the bare `claude`/`claude.exe` command name. It resolves and pins an
+fails closed when it is unavailable. Parent-death cleanup leaves an empty cgroup
+for verified takeover, while automatic normal worker cleanup retains an empty
+cgroup until cwd lease release (manual cleanup removes it). Automatic workers
+preserve Claude Code's normal
+arguments, environment, network access, tools, agents, plugins and MCP configuration;
+there is no injected sandbox or automatic tool allowlist. The only automatic CLI
+safety addition is a `default` permission mode when none was supplied; Bash
+preauthorization through `--allowedTools` or loaded settings is rejected so Bash
+requests remain visible to Supervisor policy. Automatic startup also requires
+a full existing Git baseline, non-bare non-protected worktree and the bare
+`claude`/`claude.exe` command name. It resolves and pins an
 operator-owned, non-writable executable path (or the path configured by
 `PI_CLAUDE_SUPERVISOR_TRUSTED_CLAUDE`), rejects explicit/custom executable paths, and
 compares the exact startup HEAD again immediately before spawn. Before release, verify:
@@ -163,13 +191,16 @@ response.
 The automated adapter matrix covers external `SIGTERM`, `SIGINT`, `SIGKILL`,
 `SIGSTOP`/`SIGCONT`, SIGTERM refusal/escalation, leader-early-exit descendant
 cleanup, required cgroup bootstrap containment of a pre-attachment detached
-and `setsid()` descendant, automatic nested-Claude detection across the worker
-cgroup, repeated stop, spawn failure, output truncation,
+and `setsid()` descendant, nested Claude/agent descendant allowance with cgroup cleanup,
+repeated stop, spawn failure, output truncation,
 blocked stdin write timeouts, and immediate JSONL results. The Supervisor
 matrix also covers retrying failed lifecycle events, preserving startup event
 order, stopping under persistent timeout-event failure, and restoring output
 after event-log failure. The Supervisor matrix covers startup rejection,
-externally terminated workers, lifecycle serialization and stop races.
+externally terminated workers, lifecycle serialization and stop races. Cwd lease
+coverage includes successful automatic process and tmux takeover, token-bound
+same-record replacement, provisional pre-spawn identity, retained-cgroup
+release, and reconciliation of a durable pending-cleanup transaction.
 
 Before release, manually test at least: immediate crash, hung process, malformed
 output, duplicate send, send/exit race, Pi `SIGTERM`/`SIGINT` shutdown,
@@ -187,7 +218,7 @@ the managed process group.
 The `v0.5.0` implementation of the acceptance—independent Review—repair—reacceptance
 loop is shipped. The `v0.5.1` real read-only drill reached acceptance and independent
 Review, then correctly produced a non-publishable candidate after two P1 and two P2 findings under the then-current human-gated compatibility path.
-A separate real edit-capable Claude Code `2.1.270` drill then exercised one bounded
+A separate real edit-capable Claude Code `2.1.270` baseline drill then exercised one bounded
 acceptance failure, repair turn, reacceptance and independent Reviewer `pass` in an
 isolated temporary worktree. The current hardening plan and evidence paths are recorded
 in [`docs/automation-hardening-plan.md`](automation-hardening-plan.md). Deterministic
@@ -235,10 +266,12 @@ The adapter/replay matrix must cover:
 - paused watchdog behavior and resume-time no-output rebasing;
 - assistant-message-bounded Reviewer and Decision Worker output parsing.
 
-Real Claude tests remain authenticated manual Spikes and are pinned to
-`2.1.270`; they are not part of normal CI. Normal CI runs deterministic fake
-Worker and replay fixtures. The pinned stability matrix is the compatibility evidence
-for this release line; any future CLI change must rerun ten consecutive ordinary
+Real Claude tests remain authenticated manual Spikes and are not part of normal
+CI. The spikes accept Claude Code `2.1.270` and newer, resolve the current
+executable from `PATH`, and report the actual version/path. Normal CI runs
+deterministic fake Worker and replay fixtures. The `2.1.270` stability matrix is
+the baseline compatibility evidence for this release line; any future CLI change
+must rerun ten consecutive ordinary
 automatic runs and at least five runs each for permission and question handling, with
 no duplicate action, false completion or unreaped Worker.
 
@@ -258,12 +291,15 @@ Required deterministic and integration coverage:
 - conflicting diffs detected before integration, with no same-worktree writes;
 - independent child acceptance followed by root-task aggregate acceptance and Review;
 - single-child recovery, whole-graph recovery and Pi shutdown during scheduling;
-- no child can grant permissions, send control input to another child or bypass Policy Gate;
-- independent integration in a separate worktree; the Worker has no remote push or main/integration merge authority, and no candidate bypasses that boundary.
-
-The multi-worker gate should be added only after the pinned single-worker stability
-and recovery gates pass. CI should use fake Workers and replay fixtures; authenticated
-Claude multi-worker Spikes remain manual and version-pinned.
+- scheduler-owned children cannot grant permissions or send control input to another scheduled child;
+  Claude-native Agent/Task/MCP descendants remain trusted inside their Worker's cleanup cgroup;
+- independent integration in a separate worktree; known direct remote push/main operations remain
+  policy-denied, while absolute enforcement for trusted nested/custom capabilities belongs to that boundary.
+
+The multi-worker gate should be added only after the minimum-version single-worker
+stability and recovery gates pass. CI should use fake Workers and replay fixtures;
+authenticated Claude multi-worker Spikes remain manual and must meet the same
+`2.1.270` minimum.
 
 ## Live drill and hardening gate
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-claude-supervisor",
-  "version": "0.5.4",
+  "version": "0.6.0",
   "description": "A policy-gated Pi supervisor for observing and verifying Claude Code workers.",
   "license": "MIT",
   "publishConfig": {