sortie-dogs 0.14.1 → 0.14.3

package/README.md

@@ -19,8 +19,8 @@ evidence-backed result, not more agents for their own sake.
 [![Node.js](https://img.shields.io/node/v/sortie-dogs)](https://www.npmjs.com/package/sortie-dogs)
 [![MIT License](https://img.shields.io/npm/l/sortie-dogs)](LICENSE)
 
-**Current release: [v0.14.1](https://github.com/zufall-upon/Sortie-dogs/releases/tag/v0.14.1)**
-· [Release notes](docs/release-v0.14.1.md) · [Execution vision](docs/v0.14.0-execution-vision.md)
+**Current release: [v0.14.3](https://github.com/zufall-upon/Sortie-dogs/releases/tag/v0.14.3)**
+· [Release notes](docs/release-v0.14.3.md) · [Execution vision](docs/v0.14.0-execution-vision.md)
 
 [Quick start](#quick-start) · [Workflow](#mission-workflow) · [Models](#default-models) ·
 [Measured results](#measured-results) · [Configuration](#configuration) · [Documentation](#documentation)
@@ -57,7 +57,7 @@ Use an existing Codex CLI signed in with **ChatGPT**. On Windows, PowerShell **7
 available; POSIX uses bash. Sortie does not install Codex, start login or use a metered API fallback.
 
 ```sh
-npm install --save-dev sortie-dogs@0.14.1
+npm install --save-dev sortie-dogs@0.14.3
 npx --no-install sortie-dogs codex init .
 ```
 
@@ -86,7 +86,7 @@ bridge. [Codex guide: SDK, permissions, progress, resume and manifest route](doc
 Use **OpenCode V2**. In the target project:
 
 ```sh
-npm install --save-dev sortie-dogs@0.14.1
+npm install --save-dev sortie-dogs@0.14.3
 npx --no-install sortie-dogs init .
 ```
 
@@ -242,7 +242,7 @@ Install the desired package version and rerun **your host's** initializer:
 
 An OpenCode config-local bridge may resolve a separate package; npm-global update alone does not
 update it. [Global/update instructions](docs/configuration.md#global-availability).
-The current Mission asset marker is `0.14.1-review-continuation-v1`; the unchanged Codex skill marker is
+The current Mission asset marker is `0.14.3-workspace-proof-v1`; the unchanged Codex skill marker is
 `0.13.11-codex-skill-v2`. Installed markers alone do not prove a running host reloaded the new version.
 
 There is no supported uninstall command. Remove the dependency and only known Sortie-owned paths;
@@ -258,7 +258,7 @@ follow the [manual removal guide](docs/uninstall.md), never delete the entire `.
   [SWE-bench history](docs/benchmarks/swebench-lite-history.md) · [Historical local case study](docs/benchmark-reference.md).
 - **Development:** [Testing](docs/testing.md) · [CLI testing](docs/cli-testing.md) ·
   [Windows tests](docs/windows-tests.md) · [Release routine](docs/release-batch.md).
-- **Releases:** [v0.14.1](docs/release-v0.14.1.md) · [v0.14.0](docs/release-v0.14.0.md) · [v0.13.22](docs/release-v0.13.22.md) · [v0.13.21](docs/release-v0.13.21.md) · [v0.13.20](docs/release-v0.13.20.md) · [v0.13.19](docs/release-v0.13.19.md) · [v0.13.18](docs/release-v0.13.18.md) · [v0.13.17](docs/release-v0.13.17.md) · [v0.13.16](docs/release-v0.13.16.md) · [v0.13.15](docs/release-v0.13.15.md) · [v0.13.14](docs/release-v0.13.14.md) · [v0.13.13](docs/release-v0.13.13.md) · [v0.13.12](docs/release-v0.13.12.md) · [v0.13.11](docs/release-v0.13.11.md) · [v0.13.10](docs/release-v0.13.10.md) ·
+- **Releases:** [v0.14.3](docs/release-v0.14.3.md) · [v0.14.2](docs/release-v0.14.2.md) · [v0.14.1](docs/release-v0.14.1.md) · [v0.14.0](docs/release-v0.14.0.md) · [v0.13.22](docs/release-v0.13.22.md) · [v0.13.21](docs/release-v0.13.21.md) · [v0.13.20](docs/release-v0.13.20.md) · [v0.13.19](docs/release-v0.13.19.md) · [v0.13.18](docs/release-v0.13.18.md) · [v0.13.17](docs/release-v0.13.17.md) · [v0.13.16](docs/release-v0.13.16.md) · [v0.13.15](docs/release-v0.13.15.md) · [v0.13.14](docs/release-v0.13.14.md) · [v0.13.13](docs/release-v0.13.13.md) · [v0.13.12](docs/release-v0.13.12.md) · [v0.13.11](docs/release-v0.13.11.md) · [v0.13.10](docs/release-v0.13.10.md) ·
   [v0.13.9](docs/release-v0.13.9.md) · [All GitHub releases](https://github.com/zufall-upon/Sortie-dogs/releases).
 
 ## Community

package/dist/asset-version.d.ts

@@ -3,6 +3,6 @@
  * installed project marker without importing every asset body.
  */
 export declare const RUNTIME_ASSET_VERSION = "0.3.89-completion-proof-v1";
-export declare const V010_RUNTIME_ASSET_VERSION = "0.14.1-review-continuation-v1";
+export declare const V010_RUNTIME_ASSET_VERSION = "0.14.3-workspace-proof-v1";
 export declare const CODEX_SKILL_ASSET_VERSION = "0.13.11-codex-skill-v2";
 export type RuntimeAssetVersion = typeof RUNTIME_ASSET_VERSION | typeof V010_RUNTIME_ASSET_VERSION | typeof CODEX_SKILL_ASSET_VERSION;

package/dist/asset-version.js

@@ -3,5 +3,5 @@
  * installed project marker without importing every asset body.
  */
 export const RUNTIME_ASSET_VERSION = "0.3.89-completion-proof-v1";
-export const V010_RUNTIME_ASSET_VERSION = "0.14.1-review-continuation-v1";
+export const V010_RUNTIME_ASSET_VERSION = "0.14.3-workspace-proof-v1";
 export const CODEX_SKILL_ASSET_VERSION = "0.13.11-codex-skill-v2";

package/dist/cli/codex-mission.js

@@ -71,6 +71,9 @@ export function codexMissionProgress(event) {
             native_status: event.params.turn?.status };
     if (event.method === "sortie/continuation")
         return { thread_id: event.threadId, turn_id: event.params.turnId, phase: event.params.phase, calls: event.params.calls };
+    if (event.method === "sortie/coordinatorRestored")
+        return { thread_id: event.threadId, phase: "coordinator-restored", mission_id: event.params.missionId,
+            coordinator_id: event.params.coordinatorId, call_id: event.params.callId, native_outcome: event.params.outcome, next_action: event.params.action };
     if (event.method === "sortie/modelRoute")
         return { thread_id: event.threadId, phase: "model-route", agent: event.params.agent, model: event.params.model,
             effort: event.params.effort, service_tier: event.params.serviceTier };

package/dist/codex/mission-session.d.ts

@@ -79,8 +79,9 @@ export declare class CodexMissionSession {
     close(): Promise<void>;
     private claimOwner;
     private rootOf;
+    private restoreCoordinator;
     private recoverNotStarted;
-    private bindWorkerDispatch;
+    private bindTaskDispatch;
     private recoverCompletedWorker;
     private required;
     private executeHostCommand;

package/dist/codex/mission-session.js

@@ -62,6 +62,7 @@ export class CodexMissionSession {
                 this.observations = missions.find(item => item.root === resume)?.codexUsage ?? [];
                 await this.restoreSession(resume, "dog-operator");
                 this.root = resume;
+                await this.restoreCoordinator(resume);
                 await this.claimOwner(resume);
                 await this.hooks.tool?.sortie_v010_operator_status?.execute({ view: "full" }, { sessionID: resume, agent: "dog-operator" });
             }
@@ -118,6 +119,45 @@ export class CodexMissionSession {
             current = this.required(current.parentID);
         return current.id;
     }
+    async restoreCoordinator(root) {
+        const missions = new OperatorMissionRuntime(this.directory, profile);
+        const mission = await missions.required(root);
+        if (!mission.coordinator || ["completed", "cancelled"].includes(mission.phase))
+            return;
+        if (!await codexOwnerGone(mission.codexOwner))
+            throw new Error("codex-mission-owner-active:no-resend");
+        // Codex can persist claim() and the child turn but omit the interrupted parent
+        // Task item. The existing Mission binding still owns this same Coordinator.
+        const coordinator = await this.restoreSession(mission.coordinator, "dogs-coordinator", root);
+        if (coordinator.parentID !== root || coordinator.agent !== "dogs-coordinator")
+            throw new Error("Retained Coordinator lineage mismatch.");
+        if (mission.dispatchOpen && mission.callID) {
+            // A retained terminal parent receipt already has the shared reconciliation path.
+            // The new binding is required only when that exact receipt is missing.
+            const parentReceipts = this.required(root).history.flatMap(message => Array.isArray(message.parts) ? message.parts.filter(object) : [])
+                .filter(part => part.type === "tool" && part.tool === "task" && part.callID === mission.callID && object(part.state) &&
+                ["completed", "error"].includes(String(part.state.status)) && object(part.state.input) &&
+                part.state.input.subagent_type === coordinator.agent &&
+                (part.state.input.task_id === undefined || part.state.input.task_id === coordinator.id));
+            if (parentReceipts.length === 1)
+                return;
+            const binding = mission.codexCoordinatorDispatch;
+            if (!binding || binding.missionID !== mission.id || binding.threadID !== root || binding.callID !== mission.callID ||
+                binding.childThreadID !== coordinator.id || binding.ownerGeneration !== mission.codexOwner?.generation ||
+                coordinator.history.filter(message => object(message.info) && message.info.role === "user" &&
+                    message.info.id === binding.clientUserMessageID).length !== 1)
+                throw new Error("Retained Coordinator has unproven execution for the current dispatch; no resend. Reconcile its exact native turn before resuming.");
+            await missions.codexRecovery(root, async (current) => {
+                if (current.codexOwner?.generation !== binding.ownerGeneration || !await codexOwnerGone(current.codexOwner) ||
+                    JSON.stringify(current.codexCoordinatorDispatch) !== JSON.stringify(binding))
+                    throw new Error("codex-mission-recovery-generation-stale");
+                await missions.reconcileFinishedDispatch(root, mission.id, mission.callID);
+            });
+            await this.options.onEvent?.({ method: "sortie/coordinatorRestored", threadId: root,
+                params: { missionId: mission.id, coordinatorId: coordinator.id, callId: mission.callID,
+                    outcome: coordinator.outcome, action: "resume-existing-task" } });
+        }
+    }
     async recoverNotStarted(threadID, turn, item) {
         if (item.tool !== "task" || !object(item.arguments) || item.arguments.task_id || typeof item.id !== "string" || typeof turn.id !== "string" ||
             !["completed", "interrupted", "failed"].includes(String(turn.status)))
@@ -156,7 +196,18 @@ export class CodexMissionSession {
         }
         return false;
     }
-    async bindWorkerDispatch(parent, child, call, messageID) {
+    async bindTaskDispatch(parent, child, call, messageID) {
+        if (child.agent === "dogs-coordinator") {
+            await new OperatorMissionRuntime(this.directory, profile).update(this.rootOf(parent), state => {
+                if (state.root !== call.threadId || state.coordinator !== child.id || state.callID !== call.callId || !state.dispatchOpen ||
+                    state.codexOwner?.generation !== this.owner.generation || state.codexOwner.closed)
+                    throw new Error("codex-mission-dispatch-owner-stale");
+                state.codexCoordinatorDispatch = { missionID: state.id, threadID: call.threadId, turnID: call.turnId, callID: call.callId,
+                    inputHash: createHash("sha256").update(JSON.stringify(call.arguments)).digest("hex"),
+                    childThreadID: child.id, clientUserMessageID: messageID, ownerGeneration: this.owner.generation };
+            });
+            return;
+        }
         if (child.agent !== "dog-worker-v010" || !object(call.arguments) || call.arguments.task_id)
             return;
         const root = this.rootOf(parent), missions = new OperatorMissionRuntime(this.directory, profile);
@@ -365,7 +416,7 @@ export class CodexMissionSession {
                 throw new Error(`Codex thread ${id} has no matching repository history.`);
             const turns = thread.turns.filter(object);
             for (const turn of turns) {
-                if (!Array.isArray(turn.items) || turn.status === "inProgress" || turn.itemsView !== "full")
+                if (!Array.isArray(turn.items) || !["completed", "failed", "interrupted", "cancelled"].includes(String(turn.status)) || turn.itemsView !== "full")
                     throw new Error(`Codex thread ${id} still has unproven execution; no resend. Reconcile its native execution before resuming.`);
                 for (const item of turn.items.filter(object)) {
                     // A terminal parent turn does not prove that its native executions or children stopped.
@@ -373,7 +424,8 @@ export class CodexMissionSession {
                         ["commandExecution", "fileChange", "mcpToolCall"].includes(String(item.type)) &&
                             !["completed", "failed", ...(item.type === "mcpToolCall" ? [] : ["declined"])].includes(String(item.status)))
                         throw new Error(`Codex thread ${id} has an unresolved native execution; no resend. Reconcile its native execution before resuming.`);
-                    if (item.type !== "dynamicToolCall" || item.status === "completed" && (turn.status === "completed" || item.success === true))
+                    if (item.type !== "dynamicToolCall" || ["completed", "failed"].includes(String(item.status)) &&
+                        (turn.status === "completed" || item.success === true))
                         continue;
                     const unique = turns.flatMap(entry => Array.isArray(entry.items) ? entry.items.filter(object) : []).filter(entry => entry.id === item.id).length === 1;
                     if (!unique)
@@ -475,7 +527,7 @@ export class CodexMissionSession {
             result = await this.promptTurn(session, "The previous native response ended while existing host tools were still running. Those exact calls have now returned:\n" +
                 JSON.stringify(result.deferredToolResults) +
                 "\nContinue this same Mission from these results through the remaining validation, delivery, review and root acceptance. " +
-                "Do not resend the original request or redispatch the completed Tasks. Preserve failures, ownership and cumulative budget; use existing Mission status for the next action.", undefined, true);
+                "Do not resend the original request or redispatch the completed Tasks. Preserve failures, ownership and cumulative budget; use existing Mission status for the next action.", session.agent === "dogs-coordinator" ? onDispatch : undefined, true);
         }
         return result;
     }
@@ -577,7 +629,7 @@ export class CodexMissionSession {
                 });
                 await this.hooks["tool.execute.after"]?.({ tool: call.tool, sessionID: session.id, callID: call.callId, args }, { output: "", metadata: { sessionId: child.id, status: "running" } });
                 const result = await this.prompt(child, String(args.prompt), async (messageID) => {
-                    await this.bindWorkerDispatch(session, child, call, messageID);
+                    await this.bindTaskDispatch(session, child, call, messageID);
                     dispatched = true;
                 });
                 text = result.finalResponse ?? "";

package/dist/core/goal-bound.d.ts

@@ -45,6 +45,14 @@ export interface GoalEvidence {
         /** Non-generating native validation pins inputs/concrete outputs, not write-only directory bookkeeping.
          * Missing on old evidence: retain its full source/output recipe. */
         readonly validation_policy?: "inputs-and-concrete-outputs-v1";
+        /** Snapshot and recheck the exact Git workspace inside one validated Docker task container. */
+        readonly docker_workspace?: {
+            readonly container_id: string;
+            readonly cwd: string;
+            readonly repository_root: string;
+            readonly source: string;
+            readonly candidate: string;
+        };
         /** Fixed when validation starts. Full manifest_hash still identifies the historical execution contract. */
         readonly freshness?: {
             readonly contract_hash: string;

package/dist/core/goal-bound.js

@@ -59,6 +59,7 @@ export function validGoalEvidence(value, state) {
         return false;
     const criteria = state.acceptance_contract?.criteria.filter(({ criterion_id }) => value.measurement.criterion_ids.includes(criterion_id)) ?? [];
     const protectedBinding = value.protected_binding;
+    const dockerWorkspace = protectedBinding?.docker_workspace;
     const protectedBindingValid = protectedBinding !== undefined && HASH.test(protectedBinding.manifest_hash) &&
         text(protectedBinding.project_root) && text(protectedBinding.manifest_path) && Array.isArray(protectedBinding.source_paths) &&
         protectedBinding.source_paths.every(text) && Array.isArray(protectedBinding.candidate_paths) &&
@@ -67,6 +68,10 @@ export function validGoalEvidence(value, state) {
             protectedBinding.source_policy === "declared-paths-v1") &&
         (protectedBinding.candidate_policy === undefined || protectedBinding.candidate_policy === "project-root-artifacts-v1") &&
         (protectedBinding.validation_policy === undefined || protectedBinding.validation_policy === "inputs-and-concrete-outputs-v1") &&
+        (dockerWorkspace === undefined || (typeof dockerWorkspace.container_id === "string" && /^[a-f0-9]{12,64}$/u.test(dockerWorkspace.container_id) &&
+            typeof dockerWorkspace.cwd === "string" && dockerWorkspace.cwd.startsWith("/") &&
+            typeof dockerWorkspace.repository_root === "string" && dockerWorkspace.repository_root.startsWith("/") &&
+            HASH.test(dockerWorkspace.source) && HASH.test(dockerWorkspace.candidate))) &&
         (protectedBinding.freshness === undefined || (protectedBinding.freshness !== null && typeof protectedBinding.freshness === "object" &&
             HASH.test(protectedBinding.freshness.contract_hash) &&
             Array.isArray(protectedBinding.freshness.scratch_paths) && protectedBinding.freshness.scratch_paths.every(text) &&
@@ -89,10 +94,10 @@ export function validGoalEvidence(value, state) {
             sameStrings(criterion.oracle_coverage, value.measurement.oracle_coverage) &&
             criterion.build_boundary === value.measurement.build_boundary &&
             (criterion.source_binding === "current-protected"
-                ? protectedBindingValid && HASH.test(value.identity.source)
+                ? protectedBindingValid && HASH.test(value.identity.source) && (dockerWorkspace === undefined || dockerWorkspace.source === value.identity.source)
                 : criterion.source === value.identity.source) &&
             (criterion.candidate_binding === "current-protected"
-                ? protectedBindingValid && HASH.test(value.identity.candidate)
+                ? protectedBindingValid && HASH.test(value.identity.candidate) && (dockerWorkspace === undefined || dockerWorkspace.candidate === value.identity.candidate)
                 : criterion.candidate === value.identity.candidate) &&
             (criterion.validation_command === undefined ||
                 (value.execution.command.length === 1 && value.execution.command[0] === criterion.validation_command)) &&

package/dist/core/operator-mission.d.ts

@@ -49,6 +49,7 @@ export interface CodexWorkerDispatch {
     clientUserMessageID: string;
     ownerGeneration: string;
 }
+export type CodexCoordinatorDispatch = Omit<CodexWorkerDispatch, "runID" | "unitID">;
 export interface CodexCompletedTaskProof {
     dispatch: CodexWorkerDispatch;
     childTurnID: string;
@@ -209,6 +210,8 @@ export interface OperatorMission {
     codexNotStarted?: CodexNotStartedProof[];
     /** Missing parent receipts reconciled from exact completed native Worker turns. */
     codexCompletedTasks?: CodexCompletedTaskProof[];
+    /** Current Coordinator dispatch bound before its exact native turn is sent. */
+    codexCoordinatorDispatch?: CodexCoordinatorDispatch;
     version: "0.12";
     id: string;
     root: string;

package/dist/plugin/docker-validation.d.ts

@@ -0,0 +1,14 @@
+export interface DockerWorkspaceSnapshot {
+    readonly container_id: string;
+    readonly cwd: string;
+    readonly repository_root: string;
+    readonly source: string;
+    readonly candidate: string;
+}
+/** Hash the fixed container's actual workspace, including non-Git and ignored inputs. */
+export declare function captureDockerWorkspaceSnapshot(containerID: string, cwd: string): Promise<DockerWorkspaceSnapshot | undefined>;
+export declare function isDockerContainerID(value: unknown): value is string;
+export declare function isDockerWorkspacePath(value: unknown): value is string;
+/** Inspect bytes, never execute caller-supplied code. The Review envelope's
+ * immutable Docker candidate must match both before and after the read. */
+export declare function readDockerWorkspaceFile(containerID: string, cwd: string, candidate: string, path: string, offset?: number, limit?: number): Promise<Record<string, unknown>>;

package/dist/plugin/docker-validation.js

@@ -0,0 +1,153 @@
+import { createHash } from "node:crypto";
+import { execFile } from "node:child_process";
+import { posix } from "node:path";
+import { promisify } from "node:util";
+const exec = promisify(execFile);
+const CONTAINER_ID = /^[a-f0-9]{12,64}$/u;
+const SNAPSHOT_MARKER = "SORTIE_DOCKER_WORKSPACE_V1";
+// Terminal tasks need not contain Git at all. Capture actual bytes and file
+// identity, including ignored inputs; timestamps alone are not candidate edits.
+const FILE_SNAPSHOT = String.raw `
+import hashlib, json, os, stat, subprocess
+cwd = os.path.realpath(os.getcwd())
+try:
+    root = subprocess.check_output(["git", "rev-parse", "--show-toplevel"], stderr=subprocess.DEVNULL, text=True).strip()
+    head = subprocess.check_output(["git", "rev-parse", "--verify", "HEAD^{tree}"], stderr=subprocess.DEVNULL, text=True).strip()
+except (OSError, subprocess.CalledProcessError):
+    root, head = cwd, "no-git"
+root = os.path.realpath(root)
+rows = []
+def digest(path):
+    h = hashlib.sha256()
+    with open(path, "rb") as stream:
+        for block in iter(lambda: stream.read(1024 * 1024), b""):
+            h.update(block)
+    return h.hexdigest()
+for directory, dirs, files in os.walk(root, followlinks=False, onerror=lambda error: (_ for _ in ()).throw(error)):
+    if directory == root:
+        dirs[:] = [name for name in dirs if name != ".git"]
+        files = [name for name in files if name != ".git"]
+    for name in [".", *dirs, *files]:
+        path = directory if name == "." else os.path.join(directory, name)
+        relative = os.path.relpath(path, root)
+        info = os.lstat(path)
+        mode = stat.S_IMODE(info.st_mode)
+        if stat.S_ISREG(info.st_mode):
+            value = [relative, "file", mode, digest(path)]
+        elif stat.S_ISLNK(info.st_mode):
+            target = os.path.realpath(path)
+            # Internal directory targets are captured at their own lexical path.
+            # External directory trees are not silently omitted from a proof.
+            if os.path.isdir(path) and os.path.commonpath([root, target]) != root:
+                raise RuntimeError("external-directory-link-snapshot-unavailable")
+            value = [relative, "link", mode, os.readlink(path), digest(path) if os.path.isfile(path) else None]
+        elif stat.S_ISDIR(info.st_mode):
+            value = [relative, "directory", mode]
+        else:
+            raise RuntimeError("unsupported-workspace-file-type")
+        rows.append(value)
+tree = hashlib.sha256(json.dumps(sorted(rows), ensure_ascii=True, separators=(",", ":")).encode()).hexdigest()
+print("SORTIE_DOCKER_WORKSPACE_V1")
+print(cwd)
+print(root)
+print(tree)
+print(hashlib.sha256(head.encode()).hexdigest())
+print("0" * 64)
+`;
+const SNAPSHOT_COMMAND = [
+    "set -eu",
+    "if command -v python3 >/dev/null 2>&1; then",
+    "python3 -I -S - <<'SORTIE_WORKSPACE_PY'",
+    FILE_SNAPSHOT,
+    "SORTIE_WORKSPACE_PY",
+    "else",
+    "actual_cwd=$(pwd -P)",
+    "root=$(git rev-parse --show-toplevel)",
+    "cd \"$root\"",
+    "tree=$(git rev-parse --verify 'HEAD^{tree}')",
+    "tracked=$(git diff --binary HEAD -- | sha256sum | cut -d' ' -f1)",
+    "untracked=$(git ls-files -z --others | sort -z | xargs -0 -r sha256sum -- | sha256sum | cut -d' ' -f1)",
+    "printf '%s\\n%s\\n%s\\n%s\\n%s\\n%s\\n' 'SORTIE_DOCKER_WORKSPACE_V1' \"$actual_cwd\" \"$root\" \"$tree\" \"$tracked\" \"$untracked\"",
+    "fi",
+].join("\n");
+/** Hash the fixed container's actual workspace, including non-Git and ignored inputs. */
+export async function captureDockerWorkspaceSnapshot(containerID, cwd) {
+    if (!CONTAINER_ID.test(containerID) || !posix.isAbsolute(cwd) || posix.normalize(cwd) !== cwd || cwd.includes("\0"))
+        return undefined;
+    try {
+        const result = await exec("docker", ["exec", "--workdir", cwd, containerID, "sh", "-lc", SNAPSHOT_COMMAND], {
+            encoding: "buffer", timeout: 30_000, maxBuffer: 64 * 1024 * 1024,
+        });
+        const output = result.stdout;
+        let offset = 0;
+        const line = () => {
+            const end = output.indexOf(0x0a, offset);
+            if (end < 0)
+                return undefined;
+            const value = output.subarray(offset, end).toString("utf8");
+            offset = end + 1;
+            return value;
+        };
+        if (line() !== SNAPSHOT_MARKER)
+            return undefined;
+        const actualCwd = line(), repositoryRoot = line(), tree = line(), tracked = line(), untracked = line();
+        if (actualCwd !== cwd || !repositoryRoot || !posix.isAbsolute(repositoryRoot) || !tree || !/^[a-f0-9]{40,64}$/u.test(tree) ||
+            !tracked || !/^[a-f0-9]{64}$/u.test(tracked) || !untracked || !/^[a-f0-9]{64}$/u.test(untracked) || offset !== output.length)
+            return undefined;
+        const source = `sha256:${createHash("sha256").update(`git-tree\0${repositoryRoot}\0${tree}`).digest("hex")}`;
+        const candidate = `sha256:${createHash("sha256").update(JSON.stringify([containerID, cwd, repositoryRoot, tree, tracked, untracked])).digest("hex")}`;
+        return { container_id: containerID, cwd, repository_root: repositoryRoot, source, candidate };
+    }
+    catch {
+        return undefined;
+    }
+}
+export function isDockerContainerID(value) {
+    return typeof value === "string" && CONTAINER_ID.test(value);
+}
+export function isDockerWorkspacePath(value) {
+    return typeof value === "string" && value.length > 0 && posix.isAbsolute(value) &&
+        posix.normalize(value) === value && !value.includes("\0");
+}
+const READ_WORKSPACE = String.raw `
+import hashlib, json, os, stat, sys
+root, requested, offset, limit = sys.argv[1], sys.argv[2], int(sys.argv[3]), int(sys.argv[4])
+path = os.path.realpath(os.path.join(root, requested))
+if os.path.commonpath([root, path]) != root:
+    raise ValueError("file-outside-candidate-workspace")
+if os.path.isdir(path):
+    entries = sorted(os.listdir(path))
+    result = {"kind": "directory", "entries": entries[offset - 1:offset - 1 + limit], "total": len(entries)}
+elif stat.S_ISREG(os.stat(path).st_mode):
+    h = hashlib.sha256()
+    lines, total, size = [], 0, 0
+    with open(path, "rb") as stream:
+        for line in stream:
+            h.update(line)
+            total += 1
+            if offset <= total < offset + limit and size < 64000:
+                text = line[:64000-size].decode("utf-8", errors="replace")
+                lines.append([total, text])
+                size += len(line[:64000-size])
+    result = {"kind": "file", "lines": lines, "total_lines": total, "sha256": h.hexdigest()}
+else:
+    raise ValueError("candidate-file-not-readable")
+print(json.dumps({"path": path, **result}, ensure_ascii=True))
+`;
+/** Inspect bytes, never execute caller-supplied code. The Review envelope's
+ * immutable Docker candidate must match both before and after the read. */
+export async function readDockerWorkspaceFile(containerID, cwd, candidate, path, offset = 1, limit = 200) {
+    if (!/^sha256:[a-f0-9]{64}$/u.test(candidate) || typeof path !== "string" || path.includes("\0") ||
+        !Number.isSafeInteger(offset) || offset < 1 || !Number.isSafeInteger(limit) || limit < 1 || limit > 2000) {
+        throw new Error("docker-candidate-read-invalid");
+    }
+    const before = await captureDockerWorkspaceSnapshot(containerID, cwd);
+    if (!before || before.candidate !== candidate)
+        throw new Error("docker-review-candidate-stale-or-unavailable");
+    const { stdout } = await exec("docker", ["exec", "--workdir", cwd, containerID, "python3", "-I", "-S", "-c", READ_WORKSPACE,
+        before.repository_root, path, String(offset), String(limit)], { encoding: "utf8", timeout: 30_000, maxBuffer: 256 * 1024 });
+    const after = await captureDockerWorkspaceSnapshot(containerID, cwd);
+    if (!after || after.candidate !== candidate)
+        throw new Error("docker-review-candidate-changed-during-read");
+    return { workspace: before, ...JSON.parse(stdout) };
+}

package/dist/plugin/frontierharness-agent-tool-registry.json

@@ -0,0 +1,61 @@
+{
+    "schema_version": 1,
+    "tool_prefix": "sortie_v010_",
+    "core_tools": ["execute", "subagent", "read"],
+    "runtime_agents": {
+        "dog-coordinator": "dog-operator",
+        "dog-worker": "dog-worker-v010",
+        "dog-luna-worker": "dog-luna-worker-v010",
+        "dog-scout": "dog-scout-v010",
+        "dog-reviewer": "dog-reviewer-v010",
+        "dog-advisor": "dog-advisor-v010",
+        "dog-operator": "dogs-coordinator"
+    },
+    "roles": {
+        "dog-coordinator": {
+            "tool_families": {
+                "mission_lifecycle": ["start_mission", "operator_next", "operator_status", "extend_mission_budget", "complete_mission", "cancel_operator", "reflection"],
+                "unit_execution": ["plan_units", "start_direct_unit", "finish_direct_unit", "retry_mission_unit", "expand_unit"],
+                "review": ["review_mission", "repair_review"]
+            },
+            "children": ["dog-operator", "dog-worker", "dog-reviewer"]
+        },
+        "dog-worker": {
+            "tool_families": {
+                "workspace": ["bind_write_gate", "release_write_gate", "operator_status", "expand_unit"]
+            },
+            "native_tool_families": {
+                "docker_task": ["fh_docker_exec"]
+            },
+            "core_tools": ["execute", "read"],
+            "children": []
+        },
+        "dog-luna-worker": {
+            "tool_families": {
+                "workspace": ["bind_write_gate", "release_write_gate", "operator_status", "expand_unit"]
+            },
+            "core_tools": ["execute", "read"],
+            "children": []
+        },
+        "dog-scout": { "tool_families": {}, "children": [] },
+        "dog-reviewer": {
+            "tool_families": { "review": ["repair_review"] },
+            "native_tool_families": { "docker_review": ["fh_docker_read"] },
+            "correction_native_tool_families": { "docker_task": ["fh_docker_exec"] },
+            "correction_tool_families": {
+                "workspace": ["bind_write_gate", "release_write_gate", "operator_status", "expand_unit"],
+                "correction": ["repair_review", "finish_direct_unit"]
+            },
+            "children": []
+        },
+        "dog-advisor": { "tool_families": {}, "children": [] },
+        "dog-operator": {
+            "tool_families": {
+                "mission_lifecycle": ["operator_next", "operator_status", "submit_mission", "skip_mission_consultation"],
+                "unit_execution": ["plan_units", "start_direct_unit", "finish_direct_unit", "retry_mission_unit", "rescue_mission_unit", "expand_unit"],
+                "review": ["review_mission", "repair_review"]
+            },
+            "children": ["dog-worker", "dog-reviewer"]
+        }
+    }
+}