sibyl-system 1.3.0 → 1.3.2

package/README.md

@@ -5,7 +5,8 @@
 A standalone [opencode](https://opencode.ai) plugin:
 
 - **`sibyl_consult`** — a three-voter review council (MELCHIOR / BALTHASAR / CASPER)
-  that audits an artifact against a goal and returns a **fail-closed 2/3 verdict**.
+  that audits an artifact against a goal and returns a **fail-closed verdict**
+  (`APPROVE` / `REJECT` / `CANNOT_ANSWER`).
 - **`sibyl_swarm`** — a lightweight workflow swarm: an ARCHITECT persona plans a
   dependency-ordered task graph, deterministic workers execute it in waves, and
   the result is aggregated into a verdict.
@@ -24,8 +25,10 @@ Council voters, swarm workers and the swarm judge run as **child sessions of the
 calling session** (`parentID` from the tool context): the TUI session picker
 lists root sessions only, so no sibyl ballot ever clutters your top-level
 session list. Transcripts stay in the DB, reachable from the parent session and
-mirrored into the run's sealed reply files. An empty caller session falls back
-to top-level creation. `sibyl_review` roles run fully isolated under /tmp with
+mirrored into the run's sealed reply files. A seatless (CLI/headless) caller
+falls back to top-level creation, and its voter rows are **garbage-collected
+on success** (the reply files are the durable record; failed votes keep their
+DB rows for salvage). `sibyl_review` roles run fully isolated under /tmp with
 their own HOME/DB (`src/lane/isolated.ts`), never touching yours.
 
 ## v1.1 — the review chamber (民主集中制)
@@ -44,6 +47,7 @@ Laws: docs/isolation-laws.md. Mechanism: docs/democratic-centralism.md.
 node dist/cli.js run --target doc.md --goal "Is this sound?" --model your-provider/your-model
 node dist/cli.js status --tail 5
 node dist/cli.js spotcheck <runId>
+node dist/cli.js run --target - --profile exam --scenario scenarios/<id>.json ...  # behavioral exam venue (bell preflight mandatory)
 ```
 
 ## Install
@@ -94,7 +98,7 @@ stderr, registers nothing, and returns empty hooks.
 | Tool | Arguments | Behavior |
 |------|-----------|----------|
 | `sibyl_consult` | `{ artifact, goal }` | `artifact` is a file path or inline multi-line text (≤ 256 KiB). The three councilors audit it in parallel; each reply is parsed into a verdict (one in-session JSON-only repair shot per voter). Returns the tally, merged reasons/must-fix, run id, and per-voter reply file paths. |
-| `sibyl_swarm` | `{ artifact, goal, judge? }` | ARCHITECT decomposes goal + artifact into a strict-JSON workflow schema; workers are minted deterministically and dispatched in dependency waves; drafts land in the run's space dir. Verdict: `APPROVE` / `REJECT` / `EXHAUSTED`. With `judge: true`, one extra judge pass may replace the derived verdict — an unrecognized or failed judge reply keeps the derived one. |
+| `sibyl_swarm` | `{ artifact, goal, judge? }` | ARCHITECT decomposes goal + artifact into a strict-JSON workflow schema; workers are minted deterministically and dispatched in dependency waves; drafts land in the run's space dir. Verdict: `APPROVE` / `REJECT` / `EXHAUSTED`, forced to `CANNOT_ANSWER` when a declared worker left no terminal row (W2) or zero drafts were produced. With `judge: true`, one extra judge pass may replace the derived verdict — an unrecognized or failed judge reply keeps the derived one. |
 | `sibyl_status` | `{ runId? }` | Read-only. Lists all recorded runs (newest last) + the last chamber-ledger rows, or shows one run's full record and space dir. |
 | `sibyl_review` | `{ target, goal, seed?, maxRounds? }` | v1.1 general democratic-centralism chamber: launches the isolated evidence→clash→judge pipeline detached and returns a receipt (explicitly NOT a verdict); the single voice lands in the run record at terminal state. CLI twin: `sibyl-chamber`. |
 | `sibyl_anchor_check` | `{ sessionId, index?, body?, expectSha256?, label? }` | Read-only verifier for "human anchor" claims (an order/approval message the owner says they sent): re-checks the claim against the engine's own session store instead of trusting a transcribed string. Closed 4-state verdict `MATCH` / `MISMATCH` / `ABSENT` / `ERROR`; the receipt carries a hash of the canonical view read, so later store mutation shows up as a view-hash difference. No `expectSha256` claim → non-verdict. |
@@ -119,7 +123,7 @@ defaults.
 | `timeoutMs` | `240000` | Per-child-session timeout (create + prompt share the budget). Integer ≥ 1. |
 | `concurrencyK` | `4` | Cap on parallel workers per wave (also capped by the schema's own `concurrency`). Integer 1–8. |
 | `staggerMs` | `2000` | Delay between worker launches within a wave, to avoid rate-limit bursts. Integer ≥ 0. |
-| `lane` | see below | v1.1 isolated-lane mechanics for `sibyl_review` / `sibyl-chamber` (`src/lane/isolated.ts`). Sub-keys: `runRoot` (string, default `"/tmp"`) — parent dir for run dirs; `opencodeBin` (non-empty string; discovery order: `$OPENCODE_BIN` → `~/.local/bin/opencode` → `/usr/local/bin/opencode` → `/usr/bin/opencode` → bare PATH name `"opencode"`; never empty, a wrong guess fails loud at spawn naming the bin) — the binary launched for each isolated role; `configSource` (default `~/.config/opencode/opencode.jsonc`) — **read-copied** into each role home, never written back; `roleTimeoutMs` (integer ≥ 5000, default `600000`) — per-role wall-clock budget. |
+| `lane` | see below | v1.1 isolated-lane mechanics for `sibyl_review` / `sibyl-chamber` (`src/lane/isolated.ts`). Sub-keys: `runRoot` (string, default `"/tmp"`) — parent dir for run dirs; `opencodeBin` (non-empty string; discovery order: `$OPENCODE_BIN` → `~/.local/bin/opencode` → `/usr/local/bin/opencode` → `/usr/bin/opencode` → bare PATH name `"opencode"`; never empty, a wrong guess fails loud at spawn naming the bin) — the binary launched for each isolated role; `configSource` (default `~/.config/opencode/opencode.jsonc`) — **read-copied** into each role home, never written back; `roleTimeoutMs` (integer ≥ 5000, default `600000`) — per-role wall-clock budget; `examMaskDirs` (array of absolute paths, default `[]`) — dirs tmpfs-masked from exam candidates (grader files, other runs); empty = an unsandboxed venue that says so plainly on the voice face. |
 | `modelPolicy` | `{ allowedPrefixes: ["local-"] }` | v1.1 E4/F1 seating allow-list: only pool models whose `providerID/modelID` starts with one of these prefixes may take a seat; everything else is denied at launch. Array of non-empty strings, **at least 1 entry** (an empty list is rejected as a deny-everything typo). Set this to your own machine's providers — the shipped default is a prefix pattern, not a specific model. |
 | `chamber` | see below | v1.1 review-chamber seats and rounds. Sub-keys: `maxRounds` (integer 1–8, default `3`) — clash/cross-critique round cap; `roles` (`{ evidence, pro, con, judge }` → pool slot names, each default `"default"`); `judgePool` (non-empty array of slot names, default `["default"]`) — the slots the independent judge may be drawn from (E2 pool+seed committed before launch). |
 
@@ -140,6 +144,8 @@ fails the release if any vendor model id reappears on a shipped surface.
 
 ## State layout
 
+- **Chamber ledger**: `~/.sibyl/chamber-ledger.jsonl` — append-only, one JSON
+  record per line, serial-stamped at append (A5); `sibyl_status` reads its tail.
 - **Runs file**: `~/.sibyl/runs.json` (Windows: `%USERPROFILE%\.sibyl\runs.json`) —
   one record per run (id, kind, status, verdict tally, operator notes), co-located
   with `spaces/` under the one `~/.sibyl` state root, so npm upgrades (which ship a
@@ -158,13 +164,18 @@ fails the release if any vendor model id reappears on a shipped surface.
 Plainly stated:
 
 - Approval needs **≥ 2 of 3 approvals and zero error/missing votes**.
-  Anything else — including 2A + 1 error or 2A + 1 missing — is **REJECT**.
+- When the council genuinely spoke (all three ballots substantive, or ≥ 2
+  substantive rejects) and approval was not reached, the verdict is **REJECT**.
+- When error/missing seats leave no decision (2A + 1 error, 2A + 1 missing,
+  a tie with an error seat), the verdict is **CANNOT_ANSWER** — a wounded
+  instrument, NOT a substantive reject, and it can never approve. Repair the
+  infra and re-run (since v1.2; pinned by `test/council.test.ts`).
 - Error votes, missing votes, and malformed verdicts all count against approval.
 - A reply that still doesn't parse after its single repair shot becomes a
   0-confidence REJECT ballot with reason `verdict-unparseable: …`.
 - There is no lenient mode, by design.
 
-## Ballot-integrity laws (W1–W3, added 2026-10-05 after the campaign postmortems)
+## Ballot-integrity laws (W1–W4, drafted 2026-10-04/05 after the campaign postmortems; shipped in v1.3.0)
 
 - **Convener recusal (W1).** Every consult/swarm/review run resolves the
   convening execution chain through the engine's own session store
@@ -189,7 +200,9 @@ Plainly stated:
 ## Security notes
 
 - Consult/swarm send the artifact text to your configured model pool providers.
-- The plugin writes only under its state paths: the runs file and the per-run space.
+- The plugin writes under its state paths (the runs file and the per-run space) and,
+  for chamber/exam lanes, sealed run directories under `lane.runRoot`
+  (default `/tmp`) — role homes, transcripts, pidfiles, CHECKSUMS.
 - Voter/worker turns run with `bash`, `edit`, and `write` disabled per prompt.
 
 ## Architecture (`src/`)
@@ -206,7 +219,9 @@ index.ts            plugin entry: parse options → share one RunStore + client
 │                   validation → exactly one repair → fail-closed REJECT
 ├── council/        councilor personas + tallyVotes (majority2of3 default,
 │                   unanimous exported); pure aggregation, zero IO
-├── state/          RunStore: atomic RMW runs.json, per-run space dirs
+├── state/          RunStore: atomic RMW runs.json, per-run space dirs;
+│                   v1.1 chamber records: EOF-append ledger (A5), face-last
+│                   regeneration, CHECKSUMS + spotcheck (A4)
 ├── swarm/          planner (ARCHITECT schema) → minter (deterministic worker
 │                   roster) → dispatcher (dependency waves, stagger,
 │                   suspend-on-rate-limit, resume) → aggregate (report +
@@ -218,8 +233,6 @@ index.ts            plugin entry: parse options → share one RunStore + client
 │                   fail-closed, dissent sealed by path+hash)
 ├── exam/           v1.1 E3: scenario-as-data behavioral exams, mechanical
 │                   transcript/disk signal grading, canary veto
-├── state/          RunStore + v1.1 chamber records: EOF-append ledger (A5),
-│                   face-last regeneration, CHECKSUMS + spotcheck (A4)
 ├── personas.ts     registry: 3 councilors + ARCHITECT + judge/repair texts,
 │                   model slots — the single source the W3 face hashes
 ├── terminal.ts     W2 terminal-row grammar (ok|error|timeout), parse + the
@@ -240,7 +253,7 @@ index.ts            plugin entry: parse options → share one RunStore + client
 
 This is **not** the oh-my-openagent swarm. It has no `team_*` tools, no
 cross-agent message bus, and no fleet-orchestration dependency of any kind —
-it is a clean-room implementation (~3.5K lines of product code, comments excluded) that happens to
+it is a clean-room implementation (~5K lines of product code, comments excluded) that happens to
 share the problem space. `sibyl_swarm` is a single tool call driving a
 PLAN→MINT→DISPATCH→AGGREGATE pipeline over ordinary child sessions.
 
@@ -248,7 +261,7 @@ PLAN→MINT→DISPATCH→AGGREGATE pipeline over ordinary child sessions.
 
 ```bash
 npm run typecheck   # tsc --noEmit, strict + noUncheckedIndexedAccess + exactOptionalPropertyTypes
-npm test            # 346 unit tests, fully offline (no network, no LLM)
+npm test            # full unit suite, fully offline (no network, no LLM; ~420 at v1.3.0 — the run prints the exact count)
 npm run build       # esbuild bundle → dist/index.js + dist/cli.js (ESM)
 node smoke/run-smoke.mjs   # offline smoke of the shipped surface (see smoke/README.md)
 ./ship.sh           # the full release gate: all of the above + portability scan of the packed tarball

package/dist/cli.js

@@ -8,6 +8,7 @@ var __export = (target, all) => {
 // src/cli.ts
 import { randomBytes } from "node:crypto";
 import { spawn as spawn2 } from "node:child_process";
+import { existsSync as existsSync3 } from "node:fs";
 import { copyFile as copyFile2, mkdir as mkdir6, readFile as readFile6 } from "node:fs/promises";
 import { basename, dirname as dirname4, isAbsolute as isAbsolute2, join as join7, resolve as resolve2 } from "node:path";
 
@@ -847,6 +848,17 @@ import { createWriteStream, existsSync } from "node:fs";
 import { copyFile, mkdir as mkdir3, readFile as readFile3, writeFile as writeFile3 } from "node:fs/promises";
 import { dirname as dirname2, join as join3 } from "node:path";
 var DEFAULT_PINNED_PATH = "/usr/bin:/bin";
+function composeSandboxArgs(opts) {
+  const argv = [opts.bwrapBin, "--ro-bind", "/", "/", "--dev", "/dev", "--die-with-parent"];
+  for (const m of opts.maskDirs) argv.push("--tmpfs", m);
+  for (const k of opts.keepDirs) argv.push("--dir", posixDirname(k), "--bind", k, k);
+  argv.push("--", opts.bin, ...opts.args);
+  return argv;
+}
+function posixDirname(p) {
+  const i = p.lastIndexOf("/");
+  return i <= 0 ? "/" : p.slice(0, i);
+}
 function rolePaths(cfg, role) {
   const roleDir = join3(cfg.runDir, role);
   const home = join3(roleDir, "home");
@@ -911,8 +923,12 @@ async function launchRole(cfg, role, spec) {
   await writeFile3(transcriptPath, "", "utf8");
   await writeFile3(stderrPath, "", "utf8");
   const args = composeRunArgs(spec);
+  const bwrap = cfg.bwrapBin ?? "/usr/bin/bwrap";
+  const mask = cfg.sandboxMaskDirs ?? [];
+  const sandboxed = mask.length > 0 && existsSync(bwrap);
+  const spawnArgv = sandboxed ? composeSandboxArgs({ bwrapBin: bwrap, maskDirs: mask, keepDirs: [cfg.runDir], bin: cfg.opencodeBin, args }) : [cfg.opencodeBin, ...args];
   return new Promise((resolvePromise) => {
-    const child = spawn(cfg.opencodeBin, args, {
+    const child = spawn(spawnArgv[0], spawnArgv.slice(1), {
       cwd: paths.workspace,
       env,
       detached: true,
@@ -934,7 +950,8 @@ async function launchRole(cfg, role, spec) {
           transcriptPath,
           sessionId: extractSessionId(transcript),
           startedAt,
-          endedAt: (/* @__PURE__ */ new Date()).toISOString()
+          endedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          sandboxed
         };
         if (spawnError2 !== void 0) result.error = spawnError2;
         resolvePromise(result);
@@ -20222,7 +20239,10 @@ var pluginOptionsSchema = external_exports.object({
     runRoot: external_exports.string().min(1).default("/tmp"),
     opencodeBin: external_exports.string().min(1).prefault(discoverOpencodeBin),
     configSource: external_exports.string().prefault(() => join6(homedir2(), ".config", "opencode", "opencode.jsonc")),
-    roleTimeoutMs: external_exports.number().int().min(5e3).default(6e5)
+    roleTimeoutMs: external_exports.number().int().min(5e3).default(6e5),
+    /** Exam venue: absolute dirs tmpfs-masked from the candidate (grader files,
+     * other runs). Empty = venue runs unsandboxed and SAYS SO on the voice face. */
+    examMaskDirs: external_exports.array(external_exports.string().min(2)).default([])
   }).prefault({}),
   /** v1.1 E4/F1: seats only from allowed model-id prefixes; deny at launch. */
   modelPolicy: external_exports.object({
@@ -20394,7 +20414,7 @@ async function resolveRun(flags) {
     if (scenarios.length === 0) return { ok: false, error: "--profile exam needs at least one --scenario" };
     const only = splitModelId(modelFlag ?? "") ?? null;
     if (only === null) return { ok: false, error: "--profile exam requires --model provider/model" };
-    return { ok: true, run: { runId, runDir, laneCfg, timeoutMs, chamber: null, exam: { scenarios, modelId: modelFlag }, killInjection } };
+    return { ok: true, run: { runId, runDir, laneCfg, timeoutMs, chamber: null, exam: { scenarios, modelId: modelFlag }, killInjection, examMaskDirs: opts?.lane.examMaskDirs ?? [] } };
   }
   if (profile !== "review") return { ok: false, error: `unknown --profile ${profile}` };
   const slots = {
@@ -20427,7 +20447,7 @@ async function resolveRun(flags) {
     // wired below (type seam: lane needs cfg, cfg needs lane)
   };
   chamber.lane = makeIsolatedLane(chamber, laneCfg, timeoutMs);
-  return { ok: true, run: { runId, runDir, laneCfg, timeoutMs, chamber, exam: null, killInjection } };
+  return { ok: true, run: { runId, runDir, laneCfg, timeoutMs, chamber, exam: null, killInjection, examMaskDirs: opts?.lane.examMaskDirs ?? [] } };
 }
 function slotToId(slot, pool) {
   const m = pool[slot] ?? pool["default"];
@@ -20451,8 +20471,8 @@ function makeIsolatedLane(cfg, laneCfg, timeoutMs) {
     }
   };
 }
-function makeExamDriver(laneCfgBase, runDir, modelId, timeoutMs) {
-  const lc = { runDir, opencodeBin: laneCfgBase.opencodeBin, configSource: laneCfgBase.configSource };
+function makeExamDriver(laneCfgBase, runDir, modelId, timeoutMs, maskDirs, bwrapProbe) {
+  const lc = { runDir, opencodeBin: laneCfgBase.opencodeBin, configSource: laneCfgBase.configSource, sandboxMaskDirs: maskDirs, bwrapBin: bwrapProbe };
   let turnNo = 0;
   const run = async (message, resume) => {
     turnNo += 1;
@@ -20469,11 +20489,14 @@ function makeExamDriver(laneCfgBase, runDir, modelId, timeoutMs) {
     return { facts: { ok: o.ok, rc: o.rc, signal: o.signal, timedOut: o.timedOut }, transcript, sessionId: o.sessionId };
   };
   return {
-    start: async (prompt) => await run(prompt),
-    continueTurn: async (sid, message) => await run(message, sid)
+    sandboxed: maskDirs.length > 0 && existsSync3(bwrapProbe),
+    driver: {
+      start: async (prompt) => await run(prompt),
+      continueTurn: async (sid, message) => await run(message, sid)
+    }
   };
 }
-function examVoice(results, runId, runDir) {
+function examVoice(results, runId, runDir, venueSandbox) {
   const lines = ["SIBYL \u2014 ONE CONCLUSION, ONE VOICE  [SIBYL-ONE-VOICE]"];
   let anyFail = false;
   let anyHuman = false;
@@ -20487,6 +20510,7 @@ function examVoice(results, runId, runDir) {
   const conclusion = anyFail ? "REJECT" : anyHuman ? "NEEDS_HUMAN" : "APPROVE";
   lines.splice(1, 0, `conclusion: ${conclusion}  terminal: CONVERGED  run: ${runId}`);
   lines.push(`honesty: PERFORMANCE-ONLY-IN-LOOP (single-uid box until C-09/C-14 rulings)`);
+  lines.push(`venue sandbox: ${venueSandbox}`);
   lines.push(`verify every recorded byte: ${spotcheckCommand(runDir)}`);
   return lines.join("\n");
 }
@@ -20550,7 +20574,7 @@ async function main(argv) {
       return 0;
     }
     if (run.exam !== null) {
-      const driver = makeExamDriver(run.laneCfg, run.runDir, run.exam.modelId, run.timeoutMs);
+      const { driver, sandboxed } = makeExamDriver(run.laneCfg, run.runDir, run.exam.modelId, run.timeoutMs, run.examMaskDirs, "/usr/bin/bwrap");
       const results = [];
       const scPaths = typeof flags["scenario"] === "string" ? [flags["scenario"]] : [];
       if (flags["allow-unbellied"] !== true) {
@@ -20564,7 +20588,8 @@ async function main(argv) {
         }
       }
       for (const sc of run.exam.scenarios) results.push(await runExamScenario(sc, run.runDir, driver));
-      console.log(examVoice(results, run.runId, run.runDir));
+      await writeChecksums(run.runDir, await listChecksumTargets(run.runDir));
+      console.log(examVoice(results, run.runId, run.runDir, sandboxed ? `ON (masked ${String(run.examMaskDirs.length)} dir(s))` : run.examMaskDirs.length === 0 ? "OFF (lane.examMaskDirs empty \u2014 grader files are candidate-readable)" : "OFF (bwrap missing at /usr/bin/bwrap)"));
       return 0;
     }
     return 2;

package/dist/index.js

@@ -18919,7 +18919,10 @@ var pluginOptionsSchema = external_exports.object({
     runRoot: external_exports.string().min(1).default("/tmp"),
     opencodeBin: external_exports.string().min(1).prefault(discoverOpencodeBin),
     configSource: external_exports.string().prefault(() => join(homedir(), ".config", "opencode", "opencode.jsonc")),
-    roleTimeoutMs: external_exports.number().int().min(5e3).default(6e5)
+    roleTimeoutMs: external_exports.number().int().min(5e3).default(6e5),
+    /** Exam venue: absolute dirs tmpfs-masked from the candidate (grader files,
+     * other runs). Empty = venue runs unsandboxed and SAYS SO on the voice face. */
+    examMaskDirs: external_exports.array(external_exports.string().min(2)).default([])
   }).prefault({}),
   /** v1.1 E4/F1: seats only from allowed model-id prefixes; deny at launch. */
   modelPolicy: external_exports.object({
@@ -31968,7 +31971,53 @@ function contentMatches(input2, needle) {
   }
   return false;
 }
-function scanMessages(rows, convenerIndex, sid, artifact) {
+var SHELL_TOOLS = ["bash"];
+var SHELL_KEYS = ["command"];
+var LINEAGE_CHUNK = 256;
+var LINEAGE_SAMPLES = 32;
+var LINEAGE_UNION_RATIO = 0.6;
+var LINEAGE_MIN_WINDOWS = 3;
+function sampleWindows(text) {
+  const total = Math.floor(text.length / LINEAGE_CHUNK);
+  if (total < LINEAGE_MIN_WINDOWS) return [];
+  const step = Math.max(1, Math.floor(total / LINEAGE_SAMPLES));
+  const out = [];
+  for (let i = 0; i < total; i += step) out.push(text.slice(i * LINEAGE_CHUNK, (i + 1) * LINEAGE_CHUNK));
+  return out.slice(0, LINEAGE_SAMPLES);
+}
+function beginLineage(artifact) {
+  if (artifact.kind !== "path" || artifact.mtimeMs === void 0) return null;
+  const chunks = sampleWindows(artifact.text);
+  if (chunks.length < LINEAGE_MIN_WINDOWS) return null;
+  return {
+    chunks,
+    need: Math.max(2, Math.ceil(chunks.length * LINEAGE_UNION_RATIO)),
+    mtimeMs: artifact.mtimeMs,
+    matched: /* @__PURE__ */ new Map(),
+    copiedAfterMtime: 0,
+    timeless: 0
+  };
+}
+function messageTime(m) {
+  const t = m.info?.time?.created;
+  return typeof t === "number" ? t : void 0;
+}
+function partCandidates(p) {
+  const shell = p.tool !== void 0 && SHELL_TOOLS.includes(p.tool);
+  if (!shell && !isDraftingTool(p.tool)) return [];
+  const keys = shell ? SHELL_KEYS : CONTENT_KEYS;
+  const out = [];
+  for (const key of keys) {
+    const v = p.input?.[key];
+    if (typeof v === "string" && v.length >= LINEAGE_CHUNK) out.push(v);
+  }
+  return out;
+}
+function lineageVerdict(lg, artifact) {
+  const sources = [.../* @__PURE__ */ new Set([...lg.matched.values()])].slice(0, 3).join("; ");
+  return `content-lineage evidence: ${String(lg.matched.size)} of ${String(lg.chunks.length)} verbatim ${String(LINEAGE_CHUNK)}-byte windows of ${artifact.source} appear in convener-chain tool inputs that predate its mtime (${sources}) \u2014 the chain authored this artifact's bytes before/independently of this path`;
+}
+function scanMessages(rows, convenerIndex, sid, artifact, lg) {
   for (const [mi, m] of rows.entries()) {
     for (const p of m.parts ?? []) {
       if (p.type === "tool" && isDraftingTool(p.tool)) {
@@ -31982,6 +32031,26 @@ function scanMessages(rows, convenerIndex, sid, artifact) {
       if (artifact.kind === "inline" && m.info?.role === "assistant" && p.type === "text" && typeof p.text === "string" && artifact.text.trim().length >= MIN_INLINE_MATCH && p.text.includes(artifact.text.trim())) {
         return `drafting evidence: assistant text in convener-chain session ${sid} (chain position ${String(convenerIndex)}, message ${String(mi)}) contains the inline artifact`;
       }
+      if (p.type === "tool" && lg !== null) {
+        const t = messageTime(m);
+        if (t === void 0) {
+          lg.timeless += 1;
+          continue;
+        }
+        if (t > lg.mtimeMs) {
+          lg.copiedAfterMtime += 1;
+          continue;
+        }
+        const label = `${p.tool ?? "tool"}@${sid}:${String(mi)}`;
+        for (const cand of partCandidates(p)) {
+          if (artifact.kind === "path" && cand.includes(artifact.text.trim())) {
+            return `${lineageVerdict({ ...lg, matched: /* @__PURE__ */ new Map([[0, label]]) }, artifact)}; full-text containment in ${label}`;
+          }
+          for (const [wi, chunk] of lg.chunks.entries()) {
+            if (!lg.matched.has(wi) && cand.includes(chunk)) lg.matched.set(wi, label);
+          }
+        }
+      }
     }
   }
   return null;
@@ -32022,6 +32091,7 @@ async function assessIndependence(client, directory, convenerSessionID, artifact
     seen.add(parent);
     current = parent;
   }
+  const lg = beginLineage(artifact);
   let scanFailed = "";
   for (const [i, sid] of chain.entries()) {
     const res = await client.session.messages({ path: { id: sid }, query: { directory } });
@@ -32029,22 +32099,33 @@ async function assessIndependence(client, directory, convenerSessionID, artifact
       scanFailed = scanFailed.length > 0 ? scanFailed : `messages(${sid}) refused`;
       continue;
     }
-    const hit = scanMessages(res.data, i, sid, artifact);
+    const hit = scanMessages(res.data, i, sid, artifact, lg);
     if (hit !== null) {
       return { status: "NOT-INDEPENDENT", convenerChain: chain, evidence: hit };
     }
   }
+  if (lg !== null && lg.matched.size >= lg.need) {
+    return { status: "NOT-INDEPENDENT", convenerChain: chain, evidence: lineageVerdict(lg, artifact) };
+  }
   if (scanFailed.length > 0 || walkIncomplete) {
     const why = [walkIncomplete ? walkReason : "", scanFailed].filter((s) => s.length > 0).join("; ");
     return { status: "UNVERIFIABLE", convenerChain: chain, evidence: `partial read: ${why} \u2014 independence was NOT established` };
   }
   const note = walkReason.length > 0 ? `; walk note: ${walkReason}` : "";
+  const lineageNote = lineageFaceNote(lg);
   return {
     status: "INDEPENDENT",
     convenerChain: chain,
-    evidence: `scanned ${String(chain.length)} session(s) of the convener chain to root; no drafting evidence within read scope${note}`
+    evidence: `scanned ${String(chain.length)} session(s) of the convener chain to root; no drafting evidence within read scope${lineageNote}${note}`
   };
 }
+function lineageFaceNote(lg) {
+  if (lg === null) return "";
+  const parts = [`${String(lg.matched.size)}/${String(lg.chunks.length)} lineage windows matched (need ${String(lg.need)})`];
+  if (lg.copiedAfterMtime > 0) parts.push(`${String(lg.copiedAfterMtime)} part(s) excluded as post-mtime copies`);
+  if (lg.timeless > 0) parts.push(`${String(lg.timeless)} part(s) lacked timestamps`);
+  return `; content-lineage: ${parts.join(", ")}`;
+}
 function independenceLabel(v) {
   return v.status === "INDEPENDENT" ? "independence=INDEPENDENT" : `independence=${v.status} \u2014 ${v.evidence}`;
 }
@@ -32523,7 +32604,7 @@ async function readArtifact(raw, cwd) {
   } catch (err) {
     return { ok: false, error: `artifact "${path}": ${errMessage(err)}` };
   }
-  return { ok: true, kind: "path", source: path, text };
+  return { ok: true, kind: "path", source: path, text, mtimeMs: info.mtimeMs };
 }
 function errMessage(err) {
   if (err instanceof Error) return err.message;
@@ -33855,7 +33936,11 @@ function toEngineClient(sdk) {
                   ...m.info.providerID !== void 0 && { providerID: m.info.providerID },
                   ...m.info.modelID !== void 0 && { modelID: m.info.modelID },
                   ...m.info.time !== void 0 && {
-                    time: { ...m.info.time.completed !== void 0 && { completed: m.info.time.completed } }
+                    time: {
+                      ...m.info.time.completed !== void 0 && { completed: m.info.time.completed },
+                      // W1-v2 lineage time gate needs creation stamps too
+                      ..."created" in m.info.time && m.info.time.created !== void 0 && { created: m.info.time.created }
+                    }
                   },
                   ...m.info.error !== void 0 && { error: m.info.error }
                 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sibyl-system",
-  "version": "1.3.0",
+  "version": "1.3.2",
   "license": "MIT",
   "type": "module",
   "description": "Sibyl-System: democratic-centralism review chamber (one conclusion, one voice) + fail-closed council voting + dynamic swarm plugin for OpenCode",