ruvnet-brain 4.5.13 → 4.5.14

package/README.md

@@ -7,7 +7,7 @@ Created: 2026-06-29 22:36:38 EDT
 
 # 🧠 RuvNet Brain
 
-### 🧠 RuvNet Brain — [![RuvNet Brain version 4.5.13 — updated 2026-07-30 03:24 EDT](https://img.shields.io/badge/version_4.5.13-updated_2026--07--30_03:24_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](https://github.com/stuinfla/ruvnet-brain/blob/main/plugin/.claude-plugin/plugin.json)
+### 🧠 RuvNet Brain — [![RuvNet Brain version 4.5.14 — updated 2026-07-30 03:24 EDT](https://img.shields.io/badge/version_4.5.14-updated_2026--07--30_03:24_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](https://github.com/stuinfla/ruvnet-brain/blob/main/plugin/.claude-plugin/plugin.json)
 
 **A portable, source-grounded brain over Reuven Cohen's (rUv's) RuvNet stack — delivered as a Claude Code plugin that makes Claude _use_ the stack instead of fighting it.**
 

package/bin/install.mjs

@@ -2140,8 +2140,18 @@ export function codexSessionSafety(status) {
   };
 }
 
+function codexAdministrativeProbeBinary() {
+  if (process.env.CODEX_BIN) return process.env.CODEX_BIN;
+  try {
+    const brainHome = process.env.RUVNET_BRAIN_HOME || path.join(os.homedir(), '.cache', 'ruvnet-brain');
+    const configured = JSON.parse(fs.readFileSync(path.join(brainHome, 'model-routing', 'terminal-launcher-config.json'), 'utf8'));
+    if (typeof configured.realCodex === 'string' && path.isAbsolute(configured.realCodex)) return configured.realCodex;
+  } catch { /* absent or malformed configuration retains the ordinary bounded PATH probe */ }
+  return 'codex';
+}
+
 function codexHooksList({
-  codexBin = process.env.CODEX_BIN || 'codex',
+  codexBin = codexAdministrativeProbeBinary(),
   codexHome = codexHomeDir(),
   cwd = process.cwd(),
   timeoutMs = 8_000,
@@ -2997,13 +3007,7 @@ async function doctorRun({ json }) {
       hostConvergence = classifyHostConvergence(recorded);
       const codex = recorded.hosts?.codex;
       if (codex?.state === 'ready' && codex.restartRequired === true && codex.restartScope === 'unproven') {
-        let binary = process.env.CODEX_BIN || 'codex';
-        if (!process.env.CODEX_BIN) {
-          try {
-            const configured = JSON.parse(fs.readFileSync(path.join(path.dirname(convergencePath), 'model-routing', 'terminal-launcher-config.json'), 'utf8'));
-            if (typeof configured.realCodex === 'string' && path.isAbsolute(configured.realCodex)) binary = configured.realCodex;
-          } catch { /* native PATH resolution remains bounded and fail closed */ }
-        }
+        const binary = codexAdministrativeProbeBinary();
         const fresh = await probeFreshCodexDeclarations({ binary, codexHome: codexHomeDir(), cwd: process.cwd(),
           releasedPluginRoot: path.join(REPO_ROOT, 'plugin'), expectedVersion: PACKAGE_VERSION });
         hostConvergence = reconcileFreshCodexDeclarations(recorded, fresh);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.5.13",
+  "version": "4.5.14",
   "description": "One-command installer for RuvNet Brain — a portable, source-grounded brain over rUv's RuvNet building blocks, delivered as a Claude Code plugin so Claude uses the stack instead of fighting it.",
   "type": "module",
   "bin": {

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ruvnet-brain",
   "description": "RuvNet brain transplant for Claude Code — grounds every RuvNet decision in real source across 77 rUv repositories, prefers Ruflo / RuVector-RVF / AgentDB over training-prior defaults (pgvector, Pinecone, hand-rolled cosine), and can pull in any RuvNet repo on demand. Ships a UserPromptSubmit retrieve-and-inject grounding hook and a PreToolUse write gate that refuses ungrounded rUv-product code until search_ruvnet has been consulted (ADR-0012 / ADR-067).",
-  "version": "4.5.13",
+  "version": "4.5.14",
   "author": {
     "name": "Stuart Kerr"
   },

package/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.5.13",
+  "version": "4.5.14",
   "description": "Source-grounded RuvNet knowledge, lifecycle enforcement, and learning for Codex.",
   "author": {
     "name": "Stuart Kerr"

package/scripts/model-managed-prompt.mjs

@@ -30,19 +30,22 @@ function verifyRefs(refs) {
   }
 }
 
-/** Private immutable-by-digest copy of the actual parent transcript, never a generated summary. */
+/** Actual native bytes only; large histories use a source-bound native compaction projection. */
 export async function captureNativeParentContext({ harness, sessionId, env = process.env,
   evidenceRoot = path.join(env.HOME || os.homedir(), '.cache/ruvnet-brain/model-routing/parent-context'),
-  observeCodex } = {}) {
+  observeCodex, deadline = Infinity, signal } = {}) {
   requireValue(process.platform !== 'win32', 'private native parent transcript capture unsupported on Windows; ACL proof unavailable');
   if (!sessionId) return [];
   requireValue(/^[a-f0-9-]{36}$/i.test(sessionId) && ['codex', 'claude-code'].includes(harness), 'native parent identity required');
-  let source, expected;
+  let source, expected, sourceBound, observedTurns, observedBytes;
   if (harness === 'codex') {
     const observe = observeCodex ?? (await import('./model-routing-execution-adapters.mjs')).readCodexWorkerObservation;
-    const observed = observe(sessionId, { home: env.CODEX_HOME || path.join(env.HOME || os.homedir(), '.codex'), allowHistory: true });
+    const observed = observe(sessionId, { home: env.CODEX_HOME || path.join(env.HOME || os.homedir(), '.codex'), allowHistory: true, deadline, signal });
     requireValue(observed?.sessionId === sessionId && HASH.test(observed.evidence?.sha256 || ''), 'actual Codex parent evidence unproven');
-    source = observed.evidence.path; expected = observed.evidence.sha256;
+    source = observed.evidence.path; expected = observed.evidence.sha256; sourceBound = observed.evidence.sourceBound;
+    observedTurns = observed.turnCount; observedBytes = observed.evidence.byteLength;
+    const nativeHome = fs.realpathSync(env.CODEX_HOME || path.join(env.HOME || os.homedir(), '.codex'));
+    requireValue(source.startsWith(path.join(nativeHome, 'sessions') + path.sep), 'parent evidence escaped native session home');
   } else {
     const projects = path.join(env.CLAUDE_CONFIG_DIR || path.join(env.HOME || os.homedir(), '.claude'), 'projects');
     const matches = [];
@@ -57,14 +60,54 @@ export async function captureNativeParentContext({ harness, sessionId, env = pro
   requireValue(path.isAbsolute(source || '') && fs.realpathSync(source) === source, 'canonical native parent transcript required');
   const fd = fs.openSync(source, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW); let bytes;
   try {
-    const before = fs.fstatSync(fd);
-    requireValue(before.isFile() && before.uid === process.getuid?.() && before.size <= 16 * 1024 * 1024, 'owned bounded parent transcript required');
-    bytes = fs.readFileSync(fd); const after = fs.fstatSync(fd), current = fs.lstatSync(source);
-    requireValue(before.ino === after.ino && before.size === after.size && before.mtimeMs === after.mtimeMs &&
-      current.ino === after.ino && !current.isSymbolicLink(), 'parent transcript changed while captured');
+    const before = fs.fstatSync(fd, { bigint: true }), limit = 16 * 1024 * 1024;
+    requireValue(before.isFile() && before.uid === BigInt(process.getuid()), 'owned bounded parent transcript required');
+    const live = () => requireValue(!signal?.aborted && Date.now() < deadline, 'parent capture cancelled or expired'); live();
+    if (before.size <= BigInt(limit)) {
+      sourceBound = undefined; bytes = Buffer.alloc(Number(before.size)); let offset = 0;
+      while (offset < bytes.length) {
+        live(); const count = fs.readSync(fd, bytes, offset, Math.min(256 * 1024, bytes.length - offset), offset);
+        requireValue(count > 0, 'parent transcript truncated while captured'); offset += count;
+      }
+    }
+    else {
+      requireValue(harness === 'codex' && sourceBound?.kind === 'native-compaction-projection'
+        && sourceBound.nativeSessionId === sessionId && sourceBound.sourceSha256 === expected
+        && sourceBound.sourceBytes === Number(before.size) && sourceBound.sourceBytes === observedBytes
+        && sourceBound.fullTurnCount === observedTurns && sourceBound.omittedHistoryPrefix === true
+        && Number.isSafeInteger(sourceBound.fullTurnCount) && sourceBound.fullTurnCount > 0
+        && Array.isArray(sourceBound.ranges) && sourceBound.ranges.length >= 2 && sourceBound.ranges.length <= 3,
+      'bounded native compaction provenance required');
+      let total = 0, priorEnd = 0;
+      for (const range of sourceBound.ranges) {
+        requireValue(Number.isSafeInteger(range.offset) && range.offset >= priorEnd && Number.isSafeInteger(range.bytes)
+          && range.bytes > 0 && range.offset + range.bytes <= Number(before.size), 'unsafe native projection range');
+        priorEnd = range.offset + range.bytes; total += range.bytes;
+      }
+      requireValue(sourceBound.ranges[0].offset === 0 && priorEnd === Number(before.size) && total <= limit, 'native projection exceeded bound');
+      const hash = crypto.createHash('sha256'), buffer = Buffer.alloc(256 * 1024), parts = []; let offset = 0;
+      while (offset < Number(before.size)) {
+        live(); const count = fs.readSync(fd, buffer, 0, Math.min(buffer.length, Number(before.size) - offset), offset);
+        requireValue(count > 0, 'parent transcript truncated while captured'); hash.update(buffer.subarray(0, count));
+        for (const range of sourceBound.ranges) {
+          const start = Math.max(offset, range.offset), end = Math.min(offset + count, range.offset + range.bytes);
+          if (end > start) parts.push(Buffer.from(buffer.subarray(start - offset, end - offset)));
+        }
+        offset += count;
+      }
+      requireValue(hash.digest('hex') === expected, 'parent transcript evidence changed'); bytes = Buffer.concat(parts, total);
+      const rows = new TextDecoder('utf-8', { fatal: true }).decode(bytes).trim().split('\n').map(line => JSON.parse(line));
+      requireValue(rows[0]?.type === 'session_meta' && rows[0].payload?.id === sessionId && rows.filter(row => row.type === 'session_meta').length === 1
+        && rows.some(row => row.type === 'compacted' && Array.isArray(row.payload?.replacement_history)), 'native projection provenance mismatch');
+      sourceBound = { kind: sourceBound.kind, nativeSessionId: sessionId, sourceSha256: expected, sourceBytes: Number(before.size),
+        fullTurnCount: sourceBound.fullTurnCount, omittedHistoryPrefix: true, ranges: sourceBound.ranges, nativeHistoryMutated: false };
+    }
+    const after = fs.fstatSync(fd, { bigint: true }), current = fs.lstatSync(source, { bigint: true });
+    requireValue(['dev', 'ino', 'size', 'mtimeNs', 'ctimeNs'].every(key => before[key] === after[key] && after[key] === current[key])
+      && !current.isSymbolicLink(), 'parent transcript changed while captured'); live();
   } finally { fs.closeSync(fd); }
   const digest = sha(bytes);
-  requireValue(bytes.length > 0 && (!expected || digest === expected), 'parent transcript evidence changed');
+  requireValue(bytes.length > 0 && (!expected || sourceBound || digest === expected), 'parent transcript evidence changed');
   if (harness === 'claude-code') {
     const rows = bytes.toString('utf8').split('\n').filter(Boolean).map(line => JSON.parse(line));
     requireValue(rows.some(row => row.sessionId === sessionId), 'actual Claude transcript session identity missing');
@@ -77,7 +120,7 @@ export async function captureNativeParentContext({ harness, sessionId, env = pro
   const file = path.join(directory, `${sessionId}.jsonl`);
   const output = fs.openSync(file, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_NOFOLLOW, 0o600);
   try { fs.writeFileSync(output, bytes); fs.fsyncSync(output); } finally { fs.closeSync(output); }
-  return [{ path: file, digest }];
+  return [{ path: file, digest, ...(sourceBound ? { sourceBound } : {}) }];
 }
 
 async function service() {
@@ -264,7 +307,7 @@ export async function runManagedPrompt({ originalPrompt, prompt = originalPrompt
     }
     if (!contextRefs.length && (retainedContext.sessionId || retainedContext.threadId)) {
       contextRefs = await bounded(() => captureContext({ harness, sessionId: retainedContext.sessionId ?? retainedContext.threadId,
-        env: primaryOptions.env ?? process.env }));
+        env: primaryOptions.env ?? process.env, deadline, signal: combined }));
       requireValue(contextRefs.length > 0, 'existing parent transcript required');
     }
     requireValue(original.length <= 120000, 'substantive request exceeds bounded completion-frame input');

package/scripts/model-routing-execution-adapters.mjs

@@ -18,36 +18,93 @@ export function nativeWorkflowBinaries(home = os.homedir()) {
   return { claude: config.realClaude, codex: config.realCodex };
 }
 
-export function readCodexWorkerObservation(sessionId, { home = process.env.CODEX_HOME || path.join(os.homedir(), '.codex'), now = Date.now(), expectedPriorTurns, evidencePath, allowHistory = false } = {}) {
+export function readCodexWorkerObservation(sessionId, { home = process.env.CODEX_HOME || path.join(os.homedir(), '.codex'), now = Date.now(), expectedPriorTurns, evidencePath, expectedPrefix, allowHistory = false, deadline = Infinity, signal } = {}) {
   if (!/^[a-f0-9-]{36}$/.test(sessionId || '')) throw blocked('Native worker session identity missing');
   const matches = [];
   const directories = [];
-  const base = path.join(home, 'sessions');
-  if (evidencePath) directories.push(path.dirname(evidencePath));
+  const base = path.join(fs.existsSync(home) ? fs.realpathSync(home) : home, 'sessions');
+  if (evidencePath) {
+    const directory = fs.realpathSync(path.dirname(evidencePath));
+    if (!directory.startsWith(base + path.sep)) throw blocked('Native evidence escaped its session home');
+    evidencePath = path.join(directory, path.basename(evidencePath)); directories.push(directory);
+  }
   else if ((expectedPriorTurns !== undefined || allowHistory) && fs.existsSync(base)) {
     for (const year of fs.readdirSync(base)) if (/^\d{4}$/.test(year))
       for (const month of fs.readdirSync(path.join(base, year))) if (/^\d{2}$/.test(month))
         for (const day of fs.readdirSync(path.join(base, year, month))) if (/^\d{2}$/.test(day)) directories.push(path.join(base, year, month, day));
   } else for (const offset of [0, 86400000]) {
     const date = new Date(now - offset).toISOString().slice(0, 10).split('-');
-    directories.push(path.join(home, 'sessions', ...date));
+    directories.push(path.join(base, ...date));
   }
   for (const directory of new Set(directories)) {
     if (!fs.existsSync(directory)) continue;
     for (const name of fs.readdirSync(directory)) {
       if (!name.endsWith(`-${sessionId}.jsonl`)) continue;
       const file = path.join(directory, name), stat = fs.lstatSync(file);
-      if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 16 * 1024 * 1024) throw blocked('Unsafe native worker evidence file');
-      matches.push({ file, bytes: fs.readFileSync(file) });
+      if (!stat.isFile() || stat.isSymbolicLink() || fs.realpathSync(file) !== file || process.getuid && stat.uid !== process.getuid()) throw blocked('Unsafe native worker evidence file');
+      if (!evidencePath || evidencePath === file) matches.push({ file });
     }
   }
   if (matches.length !== 1) throw blocked('Exact native worker rollout unavailable or ambiguous');
-  const rows = matches[0].bytes.toString('utf8').trim().split('\n').map(line => JSON.parse(line));
-  const contexts = rows.filter(row => row.type === 'turn_context');
-  if (!contexts.length || !allowHistory && contexts.length !== (expectedPriorTurns === undefined ? 1 : expectedPriorTurns + 1)) throw blocked('Native worker has unexpected turn history');
-  const context = contexts.at(-1).payload;
+  const file = matches[0].file, fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+  const limit = 16 * 1024 * 1024, decoder = new TextDecoder('utf-8', { fatal: true }), hash = crypto.createHash('sha256');
+  const prefix = expectedPrefix && crypto.createHash('sha256'), buffer = Buffer.alloc(256 * 1024);
+  let before, offset = 0, rowOffset = 0, rowBytes = 0, parts = [], context, contextRange, meta, compact, turnCount = 0, metaCount = 0;
+  const live = () => { if (signal?.aborted || Date.now() >= deadline) throw blocked('Native evidence capture cancelled or expired'); };
+  const consume = () => {
+    let row;
+    try { row = JSON.parse(decoder.decode(Buffer.concat(parts, rowBytes))); } catch { throw blocked('Malformed native evidence record or UTF-8'); }
+    if (!row || typeof row !== 'object' || typeof row.type !== 'string') throw blocked('Malformed native evidence record');
+    const range = { offset: rowOffset, bytes: rowBytes };
+    if (row.type === 'session_meta') { metaCount++; meta = { ...range, id: row.payload?.id }; }
+    if (row.type === 'turn_context') { turnCount++; context = row.payload; contextRange = range; }
+    if (row.type === 'compacted') {
+      if (!Array.isArray(row.payload?.replacement_history) || !row.payload.replacement_history.length) throw blocked('Native compaction provenance unavailable');
+      compact = range;
+    }
+    rowOffset += rowBytes; rowBytes = 0; parts = [];
+  };
+  try {
+    before = fs.fstatSync(fd, { bigint: true });
+    if (!before.isFile() || process.getuid && before.uid !== BigInt(process.getuid()) || before.size > BigInt(Number.MAX_SAFE_INTEGER)
+      || !process.getuid && before.size > BigInt(limit)) throw blocked('Unsafe native worker evidence file');
+    if (expectedPrefix && (!Number.isSafeInteger(expectedPrefix.bytes) || expectedPrefix.bytes < 0 || expectedPrefix.bytes > Number(before.size)
+      || !/^[a-f0-9]{64}$/.test(expectedPrefix.sha256 || ''))) throw blocked('Native history prefix changed');
+    while (offset < Number(before.size)) {
+      live(); const count = fs.readSync(fd, buffer, 0, Math.min(buffer.length, Number(before.size) - offset), offset);
+      if (!count) throw blocked('Native evidence truncated during capture');
+      hash.update(buffer.subarray(0, count));
+      if (prefix && offset < expectedPrefix.bytes) prefix.update(buffer.subarray(0, Math.min(count, expectedPrefix.bytes - offset)));
+      let start = 0;
+      while (start < count) {
+        const newline = buffer.indexOf(10, start), end = newline >= start && newline < count ? newline + 1 : count;
+        const part = Buffer.from(buffer.subarray(start, end)); rowBytes += part.length;
+        if (rowBytes > limit) throw blocked('Native evidence record exceeded bound');
+        parts.push(part); if (end <= count && buffer[end - 1] === 10) consume(); start = end;
+      }
+      offset += count;
+    }
+    if (rowBytes) { if (Number(before.size) > limit) throw blocked('Partial native evidence terminal record'); consume(); }
+    const after = fs.fstatSync(fd, { bigint: true }), current = fs.lstatSync(file, { bigint: true });
+    if (['dev', 'ino', 'size', 'mtimeNs', 'ctimeNs'].some(key => before[key] !== after[key] || after[key] !== current[key]) || current.isSymbolicLink()) throw blocked('Native evidence changed during capture');
+    live();
+  } finally { fs.closeSync(fd); }
+  if (prefix && prefix.digest('hex') !== expectedPrefix.sha256) throw blocked('Native history prefix changed');
+  if (!turnCount || !context || !allowHistory && turnCount !== (expectedPriorTurns === undefined ? 1 : expectedPriorTurns + 1)) throw blocked('Native worker has unexpected turn history');
+  const sha256 = hash.digest('hex'), bytes = Number(before.size);
+  if (metaCount > 1 || meta && meta.id !== sessionId) throw blocked('Native history session provenance mismatch');
+  let sourceBound;
+  if (bytes > limit) {
+    if (metaCount !== 1 || meta?.id !== sessionId) throw blocked('Native history session provenance mismatch');
+    if (compact) {
+      const ranges = [{ offset: meta.offset, bytes: meta.bytes }, ...(contextRange.offset < compact.offset ? [contextRange] : []), { offset: compact.offset, bytes: bytes - compact.offset }];
+      if (ranges.some((range, index) => index && range.offset < ranges[index - 1].offset + ranges[index - 1].bytes)) throw blocked('Native projection provenance overlaps');
+      sourceBound = { kind: 'native-compaction-projection', nativeSessionId: sessionId, sourceSha256: sha256, sourceBytes: bytes,
+        fullTurnCount: turnCount, omittedHistoryPrefix: true, ranges };
+    }
+  }
   return { model: context.model, effort: context.effort, cwd: context.cwd, sandbox: context.sandbox_policy, sessionId,
-    turnCount: contexts.length, evidence: { path: matches[0].file, sha256: digest(matches[0].bytes), type: 'native-turn-context' } };
+    turnCount, evidence: { path: file, sha256, type: 'native-turn-context', byteLength: bytes, ...(sourceBound ? { sourceBound } : {}) } };
 }
 
 /** Only the installed user-owned Brain search server is projected into isolated native workers. */
@@ -96,7 +153,8 @@ export async function executeCodexWorkflowWorker({ binary, decision, prompt, cwd
   if (performance.now() >= limit || signal?.aborted) throw blocked('Native worker deadline expired during readiness');
   const spec = buildLaunch(decision, { cwd });
   const evidenceHome = clean.CODEX_HOME || path.join(os.homedir(), '.codex');
-  const prior = sessionId ? observe(sessionId, { home: evidenceHome, expectedPriorTurns: undefined, allowHistory: true }) : null;
+  const prior = sessionId ? observe(sessionId, { home: evidenceHome, expectedPriorTurns: undefined, allowHistory: true,
+    deadline: Date.now() + Math.max(0, limit - performance.now()), signal }) : null;
   const args = sessionId ? ['exec', 'resume', '--ignore-user-config', '--skip-git-repo-check', '--json', '--model', decision.model,
     '-c', `model_reasoning_effort=\"${decision.effort}\"`, '-c', 'model_provider=\"openai\"',
     '-c', 'service_tier=\"default\"', '-c', `sandbox_mode=\"${readOnly ? 'read-only' : 'workspace-write'}\"`,
@@ -104,6 +162,7 @@ export async function executeCodexWorkflowWorker({ binary, decision, prompt, cwd
     : [...spec.args.slice(0, -1), '--skip-git-repo-check', '--json', '--sandbox', readOnly ? 'read-only' : 'workspace-write',
       '-c', 'features.multi_agent=false', '-c', 'features.multi_agent_v2=false', '-'];
   args.splice(args.length - 1, 0, ...codexBrainSearchArguments(clean));
+  if (performance.now() >= limit || signal?.aborted) throw blocked('Native worker deadline expired before launch');
   const result = await new Promise((resolve, reject) => {
     const child = launch(binary, args, { cwd, env: clean, shell: false, stdio: ['pipe', 'pipe', 'pipe'] });
     let stdout = '', stderr = '', finished = false, timer, killTimer, cancelled = false, cancelReason;
@@ -140,7 +199,9 @@ export async function executeCodexWorkflowWorker({ binary, decision, prompt, cwd
     throw blocked('Native Codex turn did not complete successfully');
   }
   if (sessionId && thread?.thread_id !== sessionId) throw blocked('Native parent session changed');
-  const observation = observe(thread?.thread_id, sessionId ? { home: evidenceHome, expectedPriorTurns: prior.turnCount, evidencePath: prior.evidence.path } : { home: evidenceHome });
+  const observation = observe(thread?.thread_id, { home: evidenceHome, deadline: Date.now() + Math.max(0, limit - performance.now()), signal,
+    ...(sessionId ? { expectedPriorTurns: prior.turnCount, evidencePath: prior.evidence.path,
+      expectedPrefix: { bytes: prior.evidence.byteLength, sha256: prior.evidence.sha256 } } : {}) });
   if (observation.model !== decision.model || observation.effort !== decision.effort || observation.cwd !== cwd
     || (readOnly && observation.sandbox?.type !== 'read-only')) throw blocked('Native worker model, effort, directory or sandbox mismatch');
   const messages = events.filter(event => event.type === 'item.completed' && event.item?.type === 'agent_message');