sortie-dogs 0.14.2 → 0.14.3

package/README.md

@@ -19,8 +19,8 @@ evidence-backed result, not more agents for their own sake.
 [![Node.js](https://img.shields.io/node/v/sortie-dogs)](https://www.npmjs.com/package/sortie-dogs)
 [![MIT License](https://img.shields.io/npm/l/sortie-dogs)](LICENSE)
 
-**Current release: [v0.14.2](https://github.com/zufall-upon/Sortie-dogs/releases/tag/v0.14.2)**
-· [Release notes](docs/release-v0.14.2.md) · [Execution vision](docs/v0.14.0-execution-vision.md)
+**Current release: [v0.14.3](https://github.com/zufall-upon/Sortie-dogs/releases/tag/v0.14.3)**
+· [Release notes](docs/release-v0.14.3.md) · [Execution vision](docs/v0.14.0-execution-vision.md)
 
 [Quick start](#quick-start) · [Workflow](#mission-workflow) · [Models](#default-models) ·
 [Measured results](#measured-results) · [Configuration](#configuration) · [Documentation](#documentation)
@@ -57,7 +57,7 @@ Use an existing Codex CLI signed in with **ChatGPT**. On Windows, PowerShell **7
 available; POSIX uses bash. Sortie does not install Codex, start login or use a metered API fallback.
 
 ```sh
-npm install --save-dev sortie-dogs@0.14.2
+npm install --save-dev sortie-dogs@0.14.3
 npx --no-install sortie-dogs codex init .
 ```
 
@@ -86,7 +86,7 @@ bridge. [Codex guide: SDK, permissions, progress, resume and manifest route](doc
 Use **OpenCode V2**. In the target project:
 
 ```sh
-npm install --save-dev sortie-dogs@0.14.2
+npm install --save-dev sortie-dogs@0.14.3
 npx --no-install sortie-dogs init .
 ```
 
@@ -242,7 +242,7 @@ Install the desired package version and rerun **your host's** initializer:
 
 An OpenCode config-local bridge may resolve a separate package; npm-global update alone does not
 update it. [Global/update instructions](docs/configuration.md#global-availability).
-The current Mission asset marker is `0.14.2-cold-resume-v1`; the unchanged Codex skill marker is
+The current Mission asset marker is `0.14.3-workspace-proof-v1`; the unchanged Codex skill marker is
 `0.13.11-codex-skill-v2`. Installed markers alone do not prove a running host reloaded the new version.
 
 There is no supported uninstall command. Remove the dependency and only known Sortie-owned paths;
@@ -258,7 +258,7 @@ follow the [manual removal guide](docs/uninstall.md), never delete the entire `.
   [SWE-bench history](docs/benchmarks/swebench-lite-history.md) · [Historical local case study](docs/benchmark-reference.md).
 - **Development:** [Testing](docs/testing.md) · [CLI testing](docs/cli-testing.md) ·
   [Windows tests](docs/windows-tests.md) · [Release routine](docs/release-batch.md).
-- **Releases:** [v0.14.2](docs/release-v0.14.2.md) · [v0.14.1](docs/release-v0.14.1.md) · [v0.14.0](docs/release-v0.14.0.md) · [v0.13.22](docs/release-v0.13.22.md) · [v0.13.21](docs/release-v0.13.21.md) · [v0.13.20](docs/release-v0.13.20.md) · [v0.13.19](docs/release-v0.13.19.md) · [v0.13.18](docs/release-v0.13.18.md) · [v0.13.17](docs/release-v0.13.17.md) · [v0.13.16](docs/release-v0.13.16.md) · [v0.13.15](docs/release-v0.13.15.md) · [v0.13.14](docs/release-v0.13.14.md) · [v0.13.13](docs/release-v0.13.13.md) · [v0.13.12](docs/release-v0.13.12.md) · [v0.13.11](docs/release-v0.13.11.md) · [v0.13.10](docs/release-v0.13.10.md) ·
+- **Releases:** [v0.14.3](docs/release-v0.14.3.md) · [v0.14.2](docs/release-v0.14.2.md) · [v0.14.1](docs/release-v0.14.1.md) · [v0.14.0](docs/release-v0.14.0.md) · [v0.13.22](docs/release-v0.13.22.md) · [v0.13.21](docs/release-v0.13.21.md) · [v0.13.20](docs/release-v0.13.20.md) · [v0.13.19](docs/release-v0.13.19.md) · [v0.13.18](docs/release-v0.13.18.md) · [v0.13.17](docs/release-v0.13.17.md) · [v0.13.16](docs/release-v0.13.16.md) · [v0.13.15](docs/release-v0.13.15.md) · [v0.13.14](docs/release-v0.13.14.md) · [v0.13.13](docs/release-v0.13.13.md) · [v0.13.12](docs/release-v0.13.12.md) · [v0.13.11](docs/release-v0.13.11.md) · [v0.13.10](docs/release-v0.13.10.md) ·
   [v0.13.9](docs/release-v0.13.9.md) · [All GitHub releases](https://github.com/zufall-upon/Sortie-dogs/releases).
 
 ## Community

package/dist/asset-version.d.ts

@@ -3,6 +3,6 @@
  * installed project marker without importing every asset body.
  */
 export declare const RUNTIME_ASSET_VERSION = "0.3.89-completion-proof-v1";
-export declare const V010_RUNTIME_ASSET_VERSION = "0.14.2-cold-resume-v1";
+export declare const V010_RUNTIME_ASSET_VERSION = "0.14.3-workspace-proof-v1";
 export declare const CODEX_SKILL_ASSET_VERSION = "0.13.11-codex-skill-v2";
 export type RuntimeAssetVersion = typeof RUNTIME_ASSET_VERSION | typeof V010_RUNTIME_ASSET_VERSION | typeof CODEX_SKILL_ASSET_VERSION;

package/dist/asset-version.js

@@ -3,5 +3,5 @@
  * installed project marker without importing every asset body.
  */
 export const RUNTIME_ASSET_VERSION = "0.3.89-completion-proof-v1";
-export const V010_RUNTIME_ASSET_VERSION = "0.14.2-cold-resume-v1";
+export const V010_RUNTIME_ASSET_VERSION = "0.14.3-workspace-proof-v1";
 export const CODEX_SKILL_ASSET_VERSION = "0.13.11-codex-skill-v2";

package/dist/core/goal-bound.d.ts

@@ -45,6 +45,14 @@ export interface GoalEvidence {
         /** Non-generating native validation pins inputs/concrete outputs, not write-only directory bookkeeping.
          * Missing on old evidence: retain its full source/output recipe. */
         readonly validation_policy?: "inputs-and-concrete-outputs-v1";
+        /** Snapshot and recheck the exact Git workspace inside one validated Docker task container. */
+        readonly docker_workspace?: {
+            readonly container_id: string;
+            readonly cwd: string;
+            readonly repository_root: string;
+            readonly source: string;
+            readonly candidate: string;
+        };
         /** Fixed when validation starts. Full manifest_hash still identifies the historical execution contract. */
         readonly freshness?: {
             readonly contract_hash: string;

package/dist/core/goal-bound.js

@@ -59,6 +59,7 @@ export function validGoalEvidence(value, state) {
         return false;
     const criteria = state.acceptance_contract?.criteria.filter(({ criterion_id }) => value.measurement.criterion_ids.includes(criterion_id)) ?? [];
     const protectedBinding = value.protected_binding;
+    const dockerWorkspace = protectedBinding?.docker_workspace;
     const protectedBindingValid = protectedBinding !== undefined && HASH.test(protectedBinding.manifest_hash) &&
         text(protectedBinding.project_root) && text(protectedBinding.manifest_path) && Array.isArray(protectedBinding.source_paths) &&
         protectedBinding.source_paths.every(text) && Array.isArray(protectedBinding.candidate_paths) &&
@@ -67,6 +68,10 @@ export function validGoalEvidence(value, state) {
             protectedBinding.source_policy === "declared-paths-v1") &&
         (protectedBinding.candidate_policy === undefined || protectedBinding.candidate_policy === "project-root-artifacts-v1") &&
         (protectedBinding.validation_policy === undefined || protectedBinding.validation_policy === "inputs-and-concrete-outputs-v1") &&
+        (dockerWorkspace === undefined || (typeof dockerWorkspace.container_id === "string" && /^[a-f0-9]{12,64}$/u.test(dockerWorkspace.container_id) &&
+            typeof dockerWorkspace.cwd === "string" && dockerWorkspace.cwd.startsWith("/") &&
+            typeof dockerWorkspace.repository_root === "string" && dockerWorkspace.repository_root.startsWith("/") &&
+            HASH.test(dockerWorkspace.source) && HASH.test(dockerWorkspace.candidate))) &&
         (protectedBinding.freshness === undefined || (protectedBinding.freshness !== null && typeof protectedBinding.freshness === "object" &&
             HASH.test(protectedBinding.freshness.contract_hash) &&
             Array.isArray(protectedBinding.freshness.scratch_paths) && protectedBinding.freshness.scratch_paths.every(text) &&
@@ -89,10 +94,10 @@ export function validGoalEvidence(value, state) {
             sameStrings(criterion.oracle_coverage, value.measurement.oracle_coverage) &&
             criterion.build_boundary === value.measurement.build_boundary &&
             (criterion.source_binding === "current-protected"
-                ? protectedBindingValid && HASH.test(value.identity.source)
+                ? protectedBindingValid && HASH.test(value.identity.source) && (dockerWorkspace === undefined || dockerWorkspace.source === value.identity.source)
                 : criterion.source === value.identity.source) &&
             (criterion.candidate_binding === "current-protected"
-                ? protectedBindingValid && HASH.test(value.identity.candidate)
+                ? protectedBindingValid && HASH.test(value.identity.candidate) && (dockerWorkspace === undefined || dockerWorkspace.candidate === value.identity.candidate)
                 : criterion.candidate === value.identity.candidate) &&
             (criterion.validation_command === undefined ||
                 (value.execution.command.length === 1 && value.execution.command[0] === criterion.validation_command)) &&

package/dist/plugin/docker-validation.d.ts

@@ -0,0 +1,14 @@
+export interface DockerWorkspaceSnapshot {
+    readonly container_id: string;
+    readonly cwd: string;
+    readonly repository_root: string;
+    readonly source: string;
+    readonly candidate: string;
+}
+/** Hash the fixed container's actual workspace, including non-Git and ignored inputs. */
+export declare function captureDockerWorkspaceSnapshot(containerID: string, cwd: string): Promise<DockerWorkspaceSnapshot | undefined>;
+export declare function isDockerContainerID(value: unknown): value is string;
+export declare function isDockerWorkspacePath(value: unknown): value is string;
+/** Inspect bytes, never execute caller-supplied code. The Review envelope's
+ * immutable Docker candidate must match both before and after the read. */
+export declare function readDockerWorkspaceFile(containerID: string, cwd: string, candidate: string, path: string, offset?: number, limit?: number): Promise<Record<string, unknown>>;

package/dist/plugin/docker-validation.js

@@ -0,0 +1,153 @@
+import { createHash } from "node:crypto";
+import { execFile } from "node:child_process";
+import { posix } from "node:path";
+import { promisify } from "node:util";
+const exec = promisify(execFile);
+const CONTAINER_ID = /^[a-f0-9]{12,64}$/u;
+const SNAPSHOT_MARKER = "SORTIE_DOCKER_WORKSPACE_V1";
+// Terminal tasks need not contain Git at all. Capture actual bytes and file
+// identity, including ignored inputs; timestamps alone are not candidate edits.
+const FILE_SNAPSHOT = String.raw `
+import hashlib, json, os, stat, subprocess
+cwd = os.path.realpath(os.getcwd())
+try:
+    root = subprocess.check_output(["git", "rev-parse", "--show-toplevel"], stderr=subprocess.DEVNULL, text=True).strip()
+    head = subprocess.check_output(["git", "rev-parse", "--verify", "HEAD^{tree}"], stderr=subprocess.DEVNULL, text=True).strip()
+except (OSError, subprocess.CalledProcessError):
+    root, head = cwd, "no-git"
+root = os.path.realpath(root)
+rows = []
+def digest(path):
+    h = hashlib.sha256()
+    with open(path, "rb") as stream:
+        for block in iter(lambda: stream.read(1024 * 1024), b""):
+            h.update(block)
+    return h.hexdigest()
+for directory, dirs, files in os.walk(root, followlinks=False, onerror=lambda error: (_ for _ in ()).throw(error)):
+    if directory == root:
+        dirs[:] = [name for name in dirs if name != ".git"]
+        files = [name for name in files if name != ".git"]
+    for name in [".", *dirs, *files]:
+        path = directory if name == "." else os.path.join(directory, name)
+        relative = os.path.relpath(path, root)
+        info = os.lstat(path)
+        mode = stat.S_IMODE(info.st_mode)
+        if stat.S_ISREG(info.st_mode):
+            value = [relative, "file", mode, digest(path)]
+        elif stat.S_ISLNK(info.st_mode):
+            target = os.path.realpath(path)
+            # Internal directory targets are captured at their own lexical path.
+            # External directory trees are not silently omitted from a proof.
+            if os.path.isdir(path) and os.path.commonpath([root, target]) != root:
+                raise RuntimeError("external-directory-link-snapshot-unavailable")
+            value = [relative, "link", mode, os.readlink(path), digest(path) if os.path.isfile(path) else None]
+        elif stat.S_ISDIR(info.st_mode):
+            value = [relative, "directory", mode]
+        else:
+            raise RuntimeError("unsupported-workspace-file-type")
+        rows.append(value)
+tree = hashlib.sha256(json.dumps(sorted(rows), ensure_ascii=True, separators=(",", ":")).encode()).hexdigest()
+print("SORTIE_DOCKER_WORKSPACE_V1")
+print(cwd)
+print(root)
+print(tree)
+print(hashlib.sha256(head.encode()).hexdigest())
+print("0" * 64)
+`;
+const SNAPSHOT_COMMAND = [
+    "set -eu",
+    "if command -v python3 >/dev/null 2>&1; then",
+    "python3 -I -S - <<'SORTIE_WORKSPACE_PY'",
+    FILE_SNAPSHOT,
+    "SORTIE_WORKSPACE_PY",
+    "else",
+    "actual_cwd=$(pwd -P)",
+    "root=$(git rev-parse --show-toplevel)",
+    "cd \"$root\"",
+    "tree=$(git rev-parse --verify 'HEAD^{tree}')",
+    "tracked=$(git diff --binary HEAD -- | sha256sum | cut -d' ' -f1)",
+    "untracked=$(git ls-files -z --others | sort -z | xargs -0 -r sha256sum -- | sha256sum | cut -d' ' -f1)",
+    "printf '%s\\n%s\\n%s\\n%s\\n%s\\n%s\\n' 'SORTIE_DOCKER_WORKSPACE_V1' \"$actual_cwd\" \"$root\" \"$tree\" \"$tracked\" \"$untracked\"",
+    "fi",
+].join("\n");
+/** Hash the fixed container's actual workspace, including non-Git and ignored inputs. */
+export async function captureDockerWorkspaceSnapshot(containerID, cwd) {
+    if (!CONTAINER_ID.test(containerID) || !posix.isAbsolute(cwd) || posix.normalize(cwd) !== cwd || cwd.includes("\0"))
+        return undefined;
+    try {
+        const result = await exec("docker", ["exec", "--workdir", cwd, containerID, "sh", "-lc", SNAPSHOT_COMMAND], {
+            encoding: "buffer", timeout: 30_000, maxBuffer: 64 * 1024 * 1024,
+        });
+        const output = result.stdout;
+        let offset = 0;
+        const line = () => {
+            const end = output.indexOf(0x0a, offset);
+            if (end < 0)
+                return undefined;
+            const value = output.subarray(offset, end).toString("utf8");
+            offset = end + 1;
+            return value;
+        };
+        if (line() !== SNAPSHOT_MARKER)
+            return undefined;
+        const actualCwd = line(), repositoryRoot = line(), tree = line(), tracked = line(), untracked = line();
+        if (actualCwd !== cwd || !repositoryRoot || !posix.isAbsolute(repositoryRoot) || !tree || !/^[a-f0-9]{40,64}$/u.test(tree) ||
+            !tracked || !/^[a-f0-9]{64}$/u.test(tracked) || !untracked || !/^[a-f0-9]{64}$/u.test(untracked) || offset !== output.length)
+            return undefined;
+        const source = `sha256:${createHash("sha256").update(`git-tree\0${repositoryRoot}\0${tree}`).digest("hex")}`;
+        const candidate = `sha256:${createHash("sha256").update(JSON.stringify([containerID, cwd, repositoryRoot, tree, tracked, untracked])).digest("hex")}`;
+        return { container_id: containerID, cwd, repository_root: repositoryRoot, source, candidate };
+    }
+    catch {
+        return undefined;
+    }
+}
+export function isDockerContainerID(value) {
+    return typeof value === "string" && CONTAINER_ID.test(value);
+}
+export function isDockerWorkspacePath(value) {
+    return typeof value === "string" && value.length > 0 && posix.isAbsolute(value) &&
+        posix.normalize(value) === value && !value.includes("\0");
+}
+const READ_WORKSPACE = String.raw `
+import hashlib, json, os, stat, sys
+root, requested, offset, limit = sys.argv[1], sys.argv[2], int(sys.argv[3]), int(sys.argv[4])
+path = os.path.realpath(os.path.join(root, requested))
+if os.path.commonpath([root, path]) != root:
+    raise ValueError("file-outside-candidate-workspace")
+if os.path.isdir(path):
+    entries = sorted(os.listdir(path))
+    result = {"kind": "directory", "entries": entries[offset - 1:offset - 1 + limit], "total": len(entries)}
+elif stat.S_ISREG(os.stat(path).st_mode):
+    h = hashlib.sha256()
+    lines, total, size = [], 0, 0
+    with open(path, "rb") as stream:
+        for line in stream:
+            h.update(line)
+            total += 1
+            if offset <= total < offset + limit and size < 64000:
+                text = line[:64000-size].decode("utf-8", errors="replace")
+                lines.append([total, text])
+                size += len(line[:64000-size])
+    result = {"kind": "file", "lines": lines, "total_lines": total, "sha256": h.hexdigest()}
+else:
+    raise ValueError("candidate-file-not-readable")
+print(json.dumps({"path": path, **result}, ensure_ascii=True))
+`;
+/** Inspect bytes, never execute caller-supplied code. The Review envelope's
+ * immutable Docker candidate must match both before and after the read. */
+export async function readDockerWorkspaceFile(containerID, cwd, candidate, path, offset = 1, limit = 200) {
+    if (!/^sha256:[a-f0-9]{64}$/u.test(candidate) || typeof path !== "string" || path.includes("\0") ||
+        !Number.isSafeInteger(offset) || offset < 1 || !Number.isSafeInteger(limit) || limit < 1 || limit > 2000) {
+        throw new Error("docker-candidate-read-invalid");
+    }
+    const before = await captureDockerWorkspaceSnapshot(containerID, cwd);
+    if (!before || before.candidate !== candidate)
+        throw new Error("docker-review-candidate-stale-or-unavailable");
+    const { stdout } = await exec("docker", ["exec", "--workdir", cwd, containerID, "python3", "-I", "-S", "-c", READ_WORKSPACE,
+        before.repository_root, path, String(offset), String(limit)], { encoding: "utf8", timeout: 30_000, maxBuffer: 256 * 1024 });
+    const after = await captureDockerWorkspaceSnapshot(containerID, cwd);
+    if (!after || after.candidate !== candidate)
+        throw new Error("docker-review-candidate-changed-during-read");
+    return { workspace: before, ...JSON.parse(stdout) };
+}

package/dist/plugin/frontierharness-agent-tool-registry.json

@@ -0,0 +1,61 @@
+{
+    "schema_version": 1,
+    "tool_prefix": "sortie_v010_",
+    "core_tools": ["execute", "subagent", "read"],
+    "runtime_agents": {
+        "dog-coordinator": "dog-operator",
+        "dog-worker": "dog-worker-v010",
+        "dog-luna-worker": "dog-luna-worker-v010",
+        "dog-scout": "dog-scout-v010",
+        "dog-reviewer": "dog-reviewer-v010",
+        "dog-advisor": "dog-advisor-v010",
+        "dog-operator": "dogs-coordinator"
+    },
+    "roles": {
+        "dog-coordinator": {
+            "tool_families": {
+                "mission_lifecycle": ["start_mission", "operator_next", "operator_status", "extend_mission_budget", "complete_mission", "cancel_operator", "reflection"],
+                "unit_execution": ["plan_units", "start_direct_unit", "finish_direct_unit", "retry_mission_unit", "expand_unit"],
+                "review": ["review_mission", "repair_review"]
+            },
+            "children": ["dog-operator", "dog-worker", "dog-reviewer"]
+        },
+        "dog-worker": {
+            "tool_families": {
+                "workspace": ["bind_write_gate", "release_write_gate", "operator_status", "expand_unit"]
+            },
+            "native_tool_families": {
+                "docker_task": ["fh_docker_exec"]
+            },
+            "core_tools": ["execute", "read"],
+            "children": []
+        },
+        "dog-luna-worker": {
+            "tool_families": {
+                "workspace": ["bind_write_gate", "release_write_gate", "operator_status", "expand_unit"]
+            },
+            "core_tools": ["execute", "read"],
+            "children": []
+        },
+        "dog-scout": { "tool_families": {}, "children": [] },
+        "dog-reviewer": {
+            "tool_families": { "review": ["repair_review"] },
+            "native_tool_families": { "docker_review": ["fh_docker_read"] },
+            "correction_native_tool_families": { "docker_task": ["fh_docker_exec"] },
+            "correction_tool_families": {
+                "workspace": ["bind_write_gate", "release_write_gate", "operator_status", "expand_unit"],
+                "correction": ["repair_review", "finish_direct_unit"]
+            },
+            "children": []
+        },
+        "dog-advisor": { "tool_families": {}, "children": [] },
+        "dog-operator": {
+            "tool_families": {
+                "mission_lifecycle": ["operator_next", "operator_status", "submit_mission", "skip_mission_consultation"],
+                "unit_execution": ["plan_units", "start_direct_unit", "finish_direct_unit", "retry_mission_unit", "rescue_mission_unit", "expand_unit"],
+                "review": ["review_mission", "repair_review"]
+            },
+            "children": ["dog-worker", "dog-reviewer"]
+        }
+    }
+}

package/dist/plugin/index.js

@@ -53,7 +53,8 @@ import { STABLE_RUNTIME_PROFILE } from "../core/runtime-profile.js";
 import { reviewerCorrectionValidationFresh } from "./mission-review.js";
 import { evidenceFromObservedExecution } from "../core/observed-goal-evidence.js";
 import { receiptBoundTerminalText } from "./receipt-presentation.js";
-import { operationInputSnapshot, protectedSnapshot, refreshProtectedSnapshot, validatedSourceSnapshot, validationInputSnapshot } from "./protected-snapshot.js";
+import { operationInputSnapshot, protectedDockerSnapshot, protectedSnapshot, refreshProtectedSnapshot, validatedSourceSnapshot, validationInputSnapshot } from "./protected-snapshot.js";
+import { isDockerContainerID, isDockerWorkspacePath } from "./docker-validation.js";
 import { settledUnitUsage } from "./unit-usage.js";
 import { goalCompletionReadiness } from "./goal-completion.js";
 const INPUT_LIMITS = { config: 64 * 1024, manifest: 512 * 1024, handoff: 2 * 1024 * 1024, parallel: 512 * 1024 };
@@ -205,10 +206,34 @@ function observedHostGoalEvidence(execution, goal, unitID) {
 function isRecord(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function validationEnvironment(directory) {
+function validationEnvironment(directory, dockerWorkspace) {
+    if (dockerWorkspace)
+        return { platform: "docker-container", arch: "unknown", runtime: "docker",
+            toolchain: `container:${dockerWorkspace.container_id}`, directory: dockerWorkspace.cwd };
     return { platform: process.platform, arch: process.arch, runtime: process.version,
         ...(directory ? { directory } : {}) };
 }
+function dockerToolExitCode(output) {
+    const metadata = isRecord(output.metadata) ? output.metadata : undefined;
+    const status = output.status ?? metadata?.status;
+    if (status === "error" || status === "cancel" || status === "cancelled" || status === "canceled" || status === "interrupted")
+        return undefined;
+    const recorded = metadata?.exit;
+    const text = typeof output.output === "string" ? output.output
+        : typeof output.content === "string" ? output.content
+            : Array.isArray(output.content) ? output.content.flatMap(part => isRecord(part) && typeof part.text === "string" ? [part.text] : []).join("\n")
+                : "";
+    const match = text.match(/^exit_code=(0|[1-9]\d*|-[1-9]\d*|unknown)(?:\r?\n|$)/u);
+    const header = match?.[1] === "unknown" ? null : match ? Number(match[1]) : undefined;
+    const explicit = typeof recorded === "number" && Number.isSafeInteger(recorded) ? recorded : undefined;
+    if (explicit !== undefined && header !== undefined && explicit !== header)
+        return undefined;
+    if (explicit !== undefined)
+        return explicit;
+    if (header !== undefined && (header === null || Number.isSafeInteger(header)))
+        return header;
+    return null;
+}
 function validationCandidate(source, candidate) {
     return goalFingerprint({ source, candidate });
 }
@@ -1347,11 +1372,17 @@ export const SortieDogsPlugin = async (input, options) => {
         if (authorization === undefined || authorization.suspended || authorization.rootSessionID !== owner)
             return;
         const args = isRecord(output.args) ? output.args : undefined;
+        const dockerTool = toolInput.tool === "fh_docker_exec" || toolInput.tool === "fh.docker_exec";
+        const dockerRequest = dockerTool && args !== undefined && isDockerContainerID(args.container_id) &&
+            isDockerWorkspacePath(args.cwd) && typeof args.command === "string"
+            ? { containerID: args.container_id, cwd: args.cwd } : undefined;
+        if (dockerTool && dockerRequest === undefined)
+            return;
         const rawCommand = args !== undefined && typeof args.command === "string" ? normalizeCommand(args.command) : undefined;
         if (rawCommand === undefined || rawCommand.length === 0)
             return;
         const correcting = !!direct || await input.runtimeBridge?.ownsReviewerCorrection?.(toolInput.sessionID) === true;
-        const directory = resolve(input.directory, typeof args?.workdir === "string" ? args.workdir : ".");
+        const directory = dockerRequest?.cwd ?? resolve(input.directory, typeof args?.workdir === "string" ? args.workdir : ".");
         // A check is proof only in its registered cwd. Snapshot the same admitted source
         // recipe at actual native start; never retrofit it to older external-cwd history.
         const members = correcting ? await input.runtimeBridge?.reviewerCorrectionValidationMembers?.(toolInput.sessionID, rawCommand, directory)
@@ -1367,9 +1398,14 @@ export const SortieDogsPlugin = async (input, options) => {
             ? await input.runtimeBridge?.missionDispatchCall?.(authorization.rootSessionID, toolInput.sessionID, authorization.taskID) : undefined);
         const correction = correcting && dispatchCallID && members
             ? { taskID: authorization.taskID, dispatchCallID, commands: members } : undefined;
-        const admittedSnapshot = await protectedSnapshot(authorization, { directory, command: args.command }).catch(() => undefined);
+        const admittedSnapshot = dockerRequest
+            ? await protectedDockerSnapshot(authorization, dockerRequest.containerID, dockerRequest.cwd).catch(() => undefined)
+            : await protectedSnapshot(authorization, { directory, command: args.command }).catch(() => undefined);
         if (admittedSnapshot === undefined)
             return;
+        const dockerWorkspace = admittedSnapshot.binding.docker_workspace;
+        if (dockerRequest && (!dockerWorkspace || dockerWorkspace.container_id !== dockerRequest.containerID || dockerWorkspace.cwd !== dockerRequest.cwd))
+            return;
         const root = goalRoot(owner);
         const ledger = await goalLedger(root);
         const goalSnapshot = await ledger.readGoal(), goal = goalSnapshot.state;
@@ -1410,7 +1446,7 @@ export const SortieDogsPlugin = async (input, options) => {
             const owner = validationOwner(scope);
             const request = { run_id: goal.goal_id, operation_id: toolInput.callID,
                 source_snapshot: snapshot.source, candidate: validationCandidate(snapshot.source, snapshot.candidate),
-                command: [rawCommand], environment: validationEnvironment(directory), scope, owner,
+                command: [rawCommand], environment: validationEnvironment(directory, dockerWorkspace), scope, owner,
                 expected_evidence: [...new Set(criteria.flatMap((criterion) => [criterion.criterion_id, ...criterion.oracle_coverage,
                         `unit:${unitID}`, "source_snapshot", "candidate", "command", "scope", "exit_code"]))],
                 marginal_value: { unmet_criteria: criteria.map(criterion => criterion.criterion_id), risk_hypothesis: null },
@@ -1418,12 +1454,17 @@ export const SortieDogsPlugin = async (input, options) => {
                     ? { required_execution: { admission: dispatchCallID, call_id: toolInput.callID } } : {}) };
             const evidenceKey = validationEvidenceKey(request);
             const durable = goalSnapshot.records.flatMap(({ event }) => event.kind === "unit.settled" || event.kind === "unit.evidence-reconciled" ? event.evidence : [])
-                .filter(entry => directory === resolve(input.directory) && validGoalEvidence(entry, goal) && (entry.proof_scope !== "requested-full" || coordinatorOwned) &&
+                .filter(entry => (directory === resolve(input.directory) || dockerWorkspace !== undefined &&
+                entry.protected_binding?.docker_workspace?.container_id === dockerWorkspace.container_id &&
+                entry.protected_binding.docker_workspace.cwd === dockerWorkspace.cwd) && validGoalEvidence(entry, goal) &&
+                (entry.proof_scope !== "requested-full" || coordinatorOwned) &&
                 entry.identity.source === snapshot.source && entry.identity.candidate === snapshot.candidate &&
                 entry.execution.command.length === 1 && entry.execution.command[0] === rawCommand)
                 .map(entry => ({ ...entry, execution: { ...entry.execution, units: [unitID] } }));
             const live = [...hostGoalExecutions.values()].filter(execution => execution.root === root &&
-                execution.sessionID === toolInput.sessionID && execution.directory === directory && execution.endedAt !== undefined && execution.exitCode === 0 &&
+                execution.sessionID === toolInput.sessionID && (execution.directory === directory || dockerWorkspace !== undefined &&
+                execution.dockerWorkspace?.container_id === dockerWorkspace.container_id && execution.dockerWorkspace.cwd === dockerWorkspace.cwd) &&
+                execution.endedAt !== undefined && execution.exitCode === 0 &&
                 execution.outcome === "pass" && execution.immutableRef !== undefined && execution.fresh === true &&
                 execution.source === snapshot.source && execution.candidate === snapshot.candidate &&
                 execution.command.length === 1 && execution.command[0] === rawCommand)
@@ -1463,7 +1504,7 @@ export const SortieDogsPlugin = async (input, options) => {
                 }
                 if (reservation.decision === "SKIP") {
                     reusedEvidence = reconciliationEvidence;
-                    const notice = settledPassNoticeCommand();
+                    const notice = dockerRequest ? "true" : settledPassNoticeCommand();
                     args.command = notice;
                     settledPassNotices.set(toolInput.callID, { sessionID: toolInput.sessionID, command: notice });
                 }
@@ -1475,10 +1516,10 @@ export const SortieDogsPlugin = async (input, options) => {
             }
         }
         const mission = await new OperatorMissionRuntime(input.directory, runtimeProfile).read(root);
-        const operationInputs = mission?.kind === "operation" && mission.execution?.commands.includes(rawCommand) &&
+        const operationInputs = !dockerWorkspace && mission?.kind === "operation" && mission.execution?.commands.includes(rawCommand) &&
             resolve(input.directory, typeof args?.workdir === "string" ? args.workdir : ".") === mission.execution.directory
             ? await operationInputSnapshot(authorization.projectRoot, snapshot.binding).catch(() => undefined) : undefined;
-        const validationInputs = (validation !== undefined || correction !== undefined) && operationInputs === undefined
+        const validationInputs = !dockerWorkspace && (validation !== undefined || correction !== undefined) && operationInputs === undefined
             ? await validationInputSnapshot(authorization.projectRoot, snapshot.binding).catch(() => undefined) : undefined;
         const validationSource = correction && validationInputs !== undefined
             ? await validatedSourceSnapshot(authorization.projectRoot, snapshot.binding).catch(() => undefined) : undefined;
@@ -1486,6 +1527,7 @@ export const SortieDogsPlugin = async (input, options) => {
             sessionID: toolInput.sessionID,
             callID: toolInput.callID, tool: toolInput.tool, command: [rawCommand], directory, startedAt: new Date().toISOString(),
             binding: snapshot.binding, source: snapshot.source, candidate: snapshot.candidate,
+            ...(dockerWorkspace === undefined ? {} : { dockerWorkspace }),
             ...(operationInputs === undefined ? {} : { operationInputs }),
             ...(validationInputs === undefined ? {} : { validationInputs }),
             ...(validationSource === undefined ? {} : { validationSource }),
@@ -1499,7 +1541,8 @@ export const SortieDogsPlugin = async (input, options) => {
             return;
         const metadata = isRecord(output.metadata) ? output.metadata : undefined;
         const rawExit = metadata?.exit;
-        const exitCode = typeof rawExit === "number" && Number.isSafeInteger(rawExit) ? rawExit : undefined;
+        const exitCode = execution.dockerWorkspace ? dockerToolExitCode(output)
+            : typeof rawExit === "number" && Number.isSafeInteger(rawExit) ? rawExit : undefined;
         const rawStatus = metadata?.status ?? output.status;
         const outcome = exitCode === 0 ? execution.reusedEvidence === undefined ? "pass" : "skip" : exitCode !== undefined ? "fail"
             : rawStatus === "cancel" || rawStatus === "cancelled" ? "cancel" : undefined;
@@ -1519,11 +1562,13 @@ export const SortieDogsPlugin = async (input, options) => {
             ? new Date(timing.end).toISOString() : new Date().toISOString();
         // Declared outputs can change during a successful validation. Read inputs must not;
         // the evidence still binds to the complete post-command candidate and source.
-        const fresh = refreshed !== undefined && (execution.operationInputs !== undefined
-            ? await operationInputSnapshot(execution.projectRoot, execution.binding).catch(() => undefined) === execution.operationInputs
-            : execution.validationInputs !== undefined
-                ? await validationInputSnapshot(execution.projectRoot, execution.binding).catch(() => undefined) === execution.validationInputs
-                : refreshed.source === execution.source);
+        const fresh = refreshed !== undefined && (execution.dockerWorkspace !== undefined
+            ? refreshed.source === execution.source && refreshed.candidate === execution.candidate
+            : execution.operationInputs !== undefined
+                ? await operationInputSnapshot(execution.projectRoot, execution.binding).catch(() => undefined) === execution.operationInputs
+                : execution.validationInputs !== undefined
+                    ? await validationInputSnapshot(execution.projectRoot, execution.binding).catch(() => undefined) === execution.validationInputs
+                    : refreshed.source === execution.source);
         const immutableRef = outcome === undefined || execution.reusedEvidence !== undefined ? undefined : goalFingerprint({ root: execution.root,
             child_session_id: execution.sessionID, call_id: execution.callID, command: execution.command, directory: execution.directory,
             started_at: observedStartedAt, ended_at: endedAt, exit_code: exitCode ?? null, outcome,

package/dist/plugin/mission-review.d.ts

@@ -33,6 +33,13 @@ export declare function missionReviewValidation(run: OperatorState, statePath: s
     }[] | undefined;
     evidence: {
         protected_binding_ref?: {
+            docker_workspace?: {
+                readonly container_id: string;
+                readonly cwd: string;
+                readonly repository_root: string;
+                readonly source: string;
+                readonly candidate: string;
+            } | undefined;
             manifest_path: string;
             manifest_hash: string;
             source_policy: "project-files-v1" | "declared-paths-v1" | undefined;
@@ -75,6 +82,7 @@ export declare function observedMissionValidation(validation: readonly string[],
         command: string;
         native_command?: string;
         directory?: string;
+        directory_status?: "unobserved";
         observed_members?: readonly string[];
         exit_code: number | null;
         started_ms: number | null;

package/dist/plugin/mission-review.js

@@ -12,6 +12,7 @@ import { taskChildSessionID } from "./task-result-repair.js";
 import { normalizeManifestScope } from "../core/path.js";
 import { declaredArtifacts } from "./declared-artifacts.js";
 import { canonicalDeclaredValidationMembers, canonicalObservedValidationMembers, normalizeCommand } from "./gate.js";
+import { isDockerContainerID, isDockerWorkspacePath } from "./docker-validation.js";
 import { currentSnapshotProtection, isRuntimeControlPath, refreshProtectedSnapshot, snapshotControlExclusion, snapshotScratchExclusion, validationInputSnapshot } from "./protected-snapshot.js";
 const exec = promisify(execFile);
 const notRepository = (error) => /fatal: not a git repository \(or (?:any of the parent directories|any parent up to mount point [^\r\n)]+)\)(?:: \.git)?/u
@@ -48,6 +49,7 @@ export function missionReviewValidation(run, statePath) {
                     manifest_path: protected_binding.manifest_path,
                     manifest_hash: protected_binding.manifest_hash,
                     source_policy: protected_binding.source_policy,
+                    ...(protected_binding.docker_workspace ? { docker_workspace: protected_binding.docker_workspace } : {}),
                 } } : {}),
         })),
         ...(unit.reviewerCorrection ? { correction_checks: (unit.reviewerCorrection.checks ?? []).map(check => ({
@@ -60,6 +62,30 @@ export function missionReviewValidation(run, statePath) {
             field: "units[].evidence", omitted: "host snapshot recipe: source/candidate paths and freshness environment" },
     }));
 }
+function nativeToolText(value) {
+    if (typeof value === "string")
+        return value;
+    if (!Array.isArray(value))
+        return undefined;
+    const texts = value.flatMap(item => record(item) && item.type === "text" && typeof item.text === "string" ? [item.text] : []);
+    return texts.length ? texts.join("\n") : undefined;
+}
+function dockerExecExitCode(state) {
+    if (state.status !== "completed")
+        return null;
+    const metadataStatus = record(state.metadata) ? state.metadata.status : undefined;
+    if (metadataStatus === "error" || metadataStatus === "cancel" || metadataStatus === "cancelled" ||
+        metadataStatus === "canceled" || metadataStatus === "interrupted")
+        return null;
+    const metadataExit = record(state.metadata) ? state.metadata.exit : undefined;
+    const output = nativeToolText(state.output) ?? nativeToolText(state.content);
+    const match = output?.match(/^exit_code=(0|[1-9]\d*|-[1-9]\d*|unknown)(?:\r?\n|$)/u);
+    const outputExit = match && match[1] !== "unknown" ? Number(match[1]) : null;
+    const explicit = typeof metadataExit === "number" && Number.isSafeInteger(metadataExit) ? metadataExit : undefined;
+    if (explicit !== undefined && match && explicit !== outputExit)
+        return null;
+    return explicit ?? outputExit;
+}
 /** Show native command outcomes to the Reviewer without turning non-criterion checks into acceptance evidence. */
 export function observedMissionValidation(validation, childSessionID, history, notBefore, directory, directories) {
     const declared = validation.map(normalizeCommand);
@@ -69,27 +95,53 @@ export function observedMissionValidation(validation, childSessionID, history, n
             !Array.isArray(message.parts))
             return [];
         return message.parts.flatMap(part => {
-            if (!record(part) || part.type !== "tool" || !["bash", "shell", "powershell", "pwsh"].includes(String(part.tool)) ||
-                !record(part.state) || !["completed", "error"].includes(String(part.state.status)) || !record(part.state.input) ||
-                typeof part.state.input.command !== "string")
+            if (!record(part) || part.type !== "tool" || !record(part.state) || !["completed", "error"].includes(String(part.state.status)))
                 return [];
-            // Match raw input first: whitespace normalization destroys Python heredoc boundaries.
-            const command = part.state.input.command;
-            const exit = record(part.state.metadata) ? part.state.metadata.exit : undefined;
             const started = record(part.time) ? time(part.time.ran) : record(part.state.time) ? time(part.state.time.start) : null;
             const completed = record(part.time) ? time(part.time.completed) : record(part.state.time) ? time(part.state.time.end) : null;
             if (notBefore !== undefined && (started === null || completed === null || started < notBefore || completed < started))
                 return [];
-            return [{ command, directory: typeof part.state.input.workdir === "string" ? part.state.input.workdir : undefined,
-                    exit_code: typeof exit === "number" && Number.isSafeInteger(exit) ? exit : null,
-                    started_ms: started, completed_ms: completed }];
+            if (["bash", "shell", "powershell", "pwsh"].includes(String(part.tool))) {
+                if (!record(part.state.input) || typeof part.state.input.command !== "string")
+                    return [];
+                // Match raw input first: whitespace normalization destroys Python heredoc boundaries.
+                const exit = record(part.state.metadata) ? part.state.metadata.exit : undefined;
+                return [{ command: part.state.input.command,
+                        directory: typeof part.state.input.workdir === "string" ? part.state.input.workdir : undefined,
+                        exit_code: typeof exit === "number" && Number.isSafeInteger(exit) ? exit : null,
+                        started_ms: started, completed_ms: completed }];
+            }
+            if ((part.tool === "fh_docker_exec" || part.tool === "fh.docker_exec") && record(part.state.input) &&
+                typeof part.state.input.command === "string") {
+                const input = part.state.input;
+                return [{ command: part.state.input.command,
+                        ...(isDockerWorkspacePath(input.cwd) ? { directory: input.cwd } : { directory_status: "unobserved" }),
+                        docker: true, exit_code: dockerExecExitCode(part.state),
+                        started_ms: started, completed_ms: completed }];
+            }
+            // Codemode's outer `execute` record retains the real namespaced call in toolCalls,
+            // while its result carries the Docker plugin's explicit exit_code header. Only a
+            // single completed Docker call can be paired unambiguously with that result.
+            if (part.tool !== "execute" || part.state.status !== "completed" || !record(part.state.metadata) ||
+                !Array.isArray(part.state.metadata.toolCalls) || part.state.metadata.toolCalls.length !== 1)
+                return [];
+            const [call] = part.state.metadata.toolCalls;
+            if (!record(call) || call.tool !== "fh.docker_exec" || call.status !== "completed" ||
+                !record(call.input) || typeof call.input.command !== "string")
+                return [];
+            return [{ command: call.input.command,
+                    ...(isDockerWorkspacePath(call.input.cwd) ? { directory: call.input.cwd } : { directory_status: "unobserved" }),
+                    docker: true,
+                    exit_code: dockerExecExitCode(part.state), started_ms: started, completed_ms: completed }];
         });
     });
     let occurrence = 0;
     const attempts = rawAttempts.sort((a, b) => (a.started_ms ?? 0) - (b.started_ms ?? 0) || (a.completed_ms ?? 0) - (b.completed_ms ?? 0)).flatMap(attempt => {
         const exact = canonicalDeclaredValidationMembers(attempt.command, declared, occurrence);
         const members = exact ?? (attempt.exit_code === 0 ? canonicalObservedValidationMembers(attempt.command, declared, occurrence) : undefined);
-        if (!members || !validationDirectoryMatches(members, attempt.directory, directory, directories))
+        const directoryMatches = attempt.directory_status === "unobserved" ? directory === undefined
+            : validationDirectoryMatches(members ?? [], attempt.directory, directory, directories);
+        if (!members || !directoryMatches)
             return [];
         if (attempt.exit_code !== 0)
             occurrence = 0;
@@ -100,9 +152,10 @@ export function observedMissionValidation(validation, childSessionID, history, n
                 if (command === declared[occurrence])
                     occurrence = (occurrence + 1) % declared.length;
             }
-        const { directory: actual, ...visible } = attempt;
-        return [{ ...visible, command: members.join(" && "), ...(!exact ? { native_command: attempt.command } : {}), ...(directory && resolve(directory, actual ?? ".") !== resolve(directory)
-                    ? { directory: resolve(directory, actual ?? ".") } : {}), ...(members.length > 1 ? { observed_members: members } : {}) }];
+        const { directory: actual, docker, ...visible } = attempt;
+        return [{ ...visible, command: members.join(" && "), ...(!exact ? { native_command: attempt.command } : {}),
+                ...(actual && (docker || directory && resolve(directory, actual) !== resolve(directory))
+                    ? { directory: docker ? actual : resolve(directory, actual) } : {}), ...(members.length > 1 ? { observed_members: members } : {}) }];
     });
     // Retain early attempts and the latest checks if a Worker retried many times.
     const shown = attempts.length > 32 ? [...attempts.slice(0, 8), ...attempts.slice(-24)] : attempts;
@@ -131,6 +184,23 @@ export function reviewerCorrectionValidation(validation, child, history, notBefo
                     editedAt = Math.max(editedAt, end);
                 continue;
             }
+            if (record(part) && part.type === "tool" && (part.tool === "fh_docker_exec" || part.tool === "fh.docker_exec") &&
+                record(part.state) && record(part.state.input) && typeof part.state.input.command === "string" &&
+                isDockerContainerID(part.state.input.container_id) && isDockerWorkspacePath(part.state.input.cwd)) {
+                const input = part.state.input, command = input.command, containerID = input.container_id, cwd = input.cwd;
+                const callID = typeof part.callID === "string" ? part.callID
+                    : typeof part.id === "string" ? part.id : undefined;
+                const timing = record(part.time) ? { started: part.time.ran, completed: part.time.completed }
+                    : record(part.state.time) ? { started: part.state.time.start, completed: part.state.time.end } : undefined;
+                if (!callID || seen.has(callID) || !timing || typeof timing.started !== "number" || typeof timing.completed !== "number" ||
+                    !Number.isFinite(timing.started) || !Number.isFinite(timing.completed) || timing.started < notBefore || timing.completed < timing.started)
+                    continue;
+                seen.add(callID);
+                attempts.push({ callID, command: command, directory: cwd,
+                    dockerWorkspace: { container_id: containerID, cwd: cwd }, exit: dockerExecExitCode(part.state),
+                    started: timing.started, completed: timing.completed });
+                continue;
+            }
             if (!record(part) || part.type !== "tool" || !["bash", "shell", "powershell", "pwsh"].includes(String(part.tool)) ||
                 !record(part.state) || !["completed", "error"].includes(String(part.state.status)) ||
                 !record(part.state.input) || typeof part.state.input.command !== "string")
@@ -153,6 +223,28 @@ export function reviewerCorrectionValidation(validation, child, history, notBefo
         }
     }
     const matched = [];
+    const checkDirectoryMatches = (check, attempt, command) => {
+        if (attempt.dockerWorkspace) {
+            const workspace = check.binding.docker_workspace;
+            return workspace?.container_id === attempt.dockerWorkspace.container_id && workspace.cwd === attempt.dockerWorkspace.cwd &&
+                check.directory === attempt.dockerWorkspace.cwd && validationDirectoryMatches([command], check.directory, directory, directories);
+        }
+        return check.binding?.docker_workspace === undefined && validationDirectoryMatches([command], check.directory, directory, directories);
+    };
+    // Reuse the completed-sequence binding predicate before retaining an incomplete
+    // prefix too; an exit-zero call with an invalid saved check is not reusable proof.
+    const bindingUnavailable = (item) => {
+        if (!checks)
+            return false;
+        const command = declared[item.occurrence];
+        const check = checks.find(check => check.callID === item.callID && check.childSessionID === child);
+        const attempt = attempts.find(attempt => attempt.callID === item.callID);
+        return !check || !attempt || !check.fresh || check.exitCode !== 0 || check.command[item.member] !== command ||
+            !checkDirectoryMatches(check, attempt, command) ||
+            directory !== undefined && resolve(directory, check.directory ?? ".") !== resolve(directory, attempt.directory ?? ".") ||
+            !Number.isFinite(Date.parse(check.startedAt)) || !Number.isFinite(Date.parse(check.endedAt)) ||
+            Date.parse(check.startedAt) < notBefore || Date.parse(check.endedAt) < Date.parse(check.startedAt);
+    };
     // Registration repairs replace only affected recipes. Retain the ordered actual
     // occurrences of unchanged checks and join the changed checks after their own
     // registration, rather than making an inserted/corrected command rerun its neighbors.
@@ -185,7 +277,11 @@ export function reviewerCorrectionValidation(validation, child, history, notBefo
             if (!commands || registeredAt && recorded && JSON.stringify(commands) !== JSON.stringify(recorded.command))
                 continue;
             const members = commands.flatMap((command, member) => required.includes(command) &&
-                validationDirectoryMatches([command], attempt.directory, directory, directories) &&
+                (attempt.dockerWorkspace
+                    ? recorded?.binding?.docker_workspace?.container_id === attempt.dockerWorkspace.container_id &&
+                        recorded.binding?.docker_workspace?.cwd === attempt.dockerWorkspace.cwd && recorded.directory === attempt.dockerWorkspace.cwd &&
+                        validationDirectoryMatches([command], attempt.directory, directory, directories)
+                    : recorded?.binding?.docker_workspace === undefined && validationDirectoryMatches([command], attempt.directory, directory, directories)) &&
                 (registeredAt?.[command] === undefined || Number.isFinite(Date.parse(registeredAt[command])) &&
                     attempt.started >= Date.parse(registeredAt[command])) ? [{ command, member }] : []);
             if (!members.length || !registeredAt && members.length !== commands.length)
@@ -212,8 +308,16 @@ export function reviewerCorrectionValidation(validation, child, history, notBefo
             failed = undefined;
             // A failed && chain proves no member, even if earlier members could have passed.
             if (attempt.exit !== 0) {
+                // A standalone, unique final check can be retried after setup repair without
+                // replaying its passed prefix. It still fails until an actual successful retry;
+                // the retained prefix and replacement tail must pass the usual binding/freshness checks.
+                const retryableTail = commands.length === 1 && members.length === 1 &&
+                    partial.length === required.length - 1 && members[0].command === required.at(-1) &&
+                    required.indexOf(members[0].command) === required.length - 1 &&
+                    partial.every(item => !bindingUnavailable(item));
                 completed = undefined;
-                partial.length = 0;
+                if (!retryableTail)
+                    partial.length = 0;
                 failed = { command: commands, outcome: "fail", exitCode: attempt.exit };
                 continue;
             }
@@ -231,7 +335,8 @@ export function reviewerCorrectionValidation(validation, child, history, notBefo
             }
         }
         if (failed)
-            return { ready: false, reason: `mission-review-correction-validation-failed:${failed.command.join(" && ")}`, failure: failed, nextOccurrence: occurrences[0] };
+            return { ready: false, reason: `mission-review-correction-validation-failed:${failed.command.join(" && ")}`, failure: failed,
+                nextOccurrence: occurrences[partial.length] ?? occurrences[0] };
         if (!completed) {
             const next = occurrences[partial.length] ?? occurrences[0];
             if (!incomplete || next < incomplete.nextOccurrence)
@@ -248,13 +353,7 @@ export function reviewerCorrectionValidation(validation, child, history, notBefo
     complete.sort((a, b) => a.occurrence - b.occurrence);
     for (const item of complete) {
         const command = declared[item.occurrence];
-        const check = checks?.find(check => check.callID === item.callID && check.childSessionID === child);
-        const attempt = attempts.find(attempt => attempt.callID === item.callID);
-        if (checks && (!check || !check.fresh || check.exitCode !== 0 || check.command[item.member] !== command ||
-            !validationDirectoryMatches([command], check.directory, directory, directories) ||
-            directory !== undefined && resolve(directory, check.directory ?? ".") !== resolve(directory, attempt.directory ?? ".") ||
-            !Number.isFinite(Date.parse(check.startedAt)) || !Number.isFinite(Date.parse(check.endedAt)) ||
-            Date.parse(check.startedAt) < notBefore || Date.parse(check.endedAt) < Date.parse(check.startedAt))) {
+        if (bindingUnavailable(item)) {
             return { ready: false, reason: `mission-review-correction-validation-binding-unavailable:${command}` };
         }
     }
@@ -299,10 +398,11 @@ export async function observedMissionValidationSummary(validation, childSessionI
     const observed = observedMissionValidation(validation, childSessionID, data.filter(record), notBefore, directory, directories);
     const grouped = new Map();
     for (const attempt of observed.attempts) {
-        const key = JSON.stringify([attempt.command, attempt.native_command, attempt.directory, attempt.exit_code]);
+        const key = JSON.stringify([attempt.command, attempt.native_command, attempt.directory, attempt.directory_status, attempt.exit_code]);
         const previous = grouped.get(key);
         grouped.set(key, { command: attempt.command, ...(attempt.native_command ? { native_command: attempt.native_command } : {}),
-            ...(attempt.directory ? { directory: attempt.directory } : {}), exit_code: attempt.exit_code,
+            ...(attempt.directory ? { directory: attempt.directory } : {}),
+            ...(attempt.directory_status ? { directory_status: attempt.directory_status } : {}), exit_code: attempt.exit_code,
             observed_attempts: (previous?.observed_attempts ?? 0) + 1,
             latest_started_ms: attempt.started_ms, latest_completed_ms: attempt.completed_ms });
     }

package/dist/plugin/operator-status-output.d.ts

@@ -1,6 +1,5 @@
 /**
- * Native V2 truncates at whole-line boundaries. A large one-line full packet can
- * therefore hide every field. Put existing actionable facts before bulky proof
- * recipes, with one top-level field per line; keep the complete JSON unchanged.
+ * Native V2 truncates at whole-line boundaries. Put actionable facts and bounded
+ * model observations before bulky history/proof; preserve every original value.
  */
 export declare function serializeOperatorStatus(packet: Record<string, unknown>): string;

package/dist/plugin/operator-status-output.js

@@ -1,18 +1,53 @@
+const RECENT_ATTEMPTS = 8;
+const RECENT_MODEL_ATTEMPTS = 8;
+const ATTEMPT_FIELDS = ["attemptID", "runID", "unitID", "kind", "childSessionID", "status", "nativeOutcome",
+    "selectedModel", "observedModel", "observedVariant", "resultClass"];
+const record = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
+/** Display-only projection: never infer an observed model from a selection. */
+function recentModelObservations(attempts) {
+    const selected = new Set();
+    for (let index = Math.max(0, attempts.length - RECENT_ATTEMPTS); index < attempts.length; index++)
+        selected.add(index);
+    // Model-less direct work must not displace the most recent model observations.
+    let models = 0;
+    for (let index = attempts.length - 1; index >= 0 && models < RECENT_MODEL_ATTEMPTS; index--) {
+        const attempt = attempts[index];
+        if (record(attempt) && [attempt.selectedModel, attempt.observedModel].some(value => typeof value === "string" && value.length > 0)) {
+            selected.add(index);
+            models++;
+        }
+    }
+    const recent = [...selected].sort((left, right) => left - right).flatMap(index => {
+        const attempt = attempts[index];
+        if (!record(attempt))
+            return [];
+        const summary = Object.fromEntries(ATTEMPT_FIELDS.filter(key => Object.hasOwn(attempt, key)).map(key => [key, attempt[key]]));
+        if (record(attempt.failure)) {
+            const failure = attempt.failure;
+            summary.failure = Object.fromEntries(["category", "code"].filter(key => Object.hasOwn(failure, key)).map(key => [key, failure[key]]));
+        }
+        else if (attempt.failure === null)
+            summary.failure = null;
+        return [summary];
+    });
+    return { recent_attempts: recent, omitted_attempts: attempts.length - recent.length };
+}
 /**
- * Native V2 truncates at whole-line boundaries. A large one-line full packet can
- * therefore hide every field. Put existing actionable facts before bulky proof
- * recipes, with one top-level field per line; keep the complete JSON unchanged.
+ * Native V2 truncates at whole-line boundaries. Put actionable facts and bounded
+ * model observations before bulky history/proof; preserve every original value.
  */
 export function serializeOperatorStatus(packet) {
+    const display = !Object.hasOwn(packet, "model_observations") && Array.isArray(packet.attempts) && packet.attempts.length > 0
+        ? { ...packet, model_observations: recentModelObservations(packet.attempts) } : packet;
     const keys = new Set([
         "profile", "view", "mission_id", "run_id", "phase", "status", "decision", "coordinator_session_id",
-        "work_quantity", "budget", "accounting_scope", "attempts", "next_action", "execution_summary", "runtime", "completion",
-        ...Object.keys(packet),
+        "work_quantity", "budget", "accounting_scope", "next_action", "execution_summary", "runtime", "model_observations", "completion", "attempts",
+        ...Object.keys(display),
     ]);
     const lines = [...keys].flatMap(key => {
-        if (!Object.hasOwn(packet, key))
+        if (!Object.hasOwn(display, key))
             return [];
-        const value = JSON.stringify(packet[key]);
+        const value = JSON.stringify(display[key]);
         return value === undefined ? [] : [`  ${JSON.stringify(key)}: ${value}`];
     });
     return `{\n${lines.join(",\n")}\n}`;

package/dist/plugin/profiled.js

@@ -239,8 +239,10 @@ export function createProfiledPlugin(profile, assetVersion) {
             if (!child)
                 throw new Error("native-worker-history-session-unavailable");
             const direct = await directExecution(child) ?? await reviewerCorrection(child);
-            return observedMissionValidationSummary(validation, child, typeof nativeSession?.messages === "function"
-                ? () => session("messages", { path: { id: child }, query: { directory: input.directory } }) : undefined, notBefore, notBefore === undefined ? undefined : input.directory, direct?.unit.directExecution?.validationCwd ?? direct?.unit.unit.validation_cwd);
+            const method = typeof nativeSession?.reviewMessages === "function" ? "reviewMessages" : "messages";
+            return observedMissionValidationSummary(validation, child, typeof nativeSession?.[method] === "function"
+                ? () => session(method, { path: { id: child }, query: { directory: input.directory,
+                        ...(notBefore === undefined ? {} : { notBefore: new Date(notBefore).toISOString() }) } }) : undefined, notBefore, notBefore === undefined ? undefined : input.directory, direct?.unit.directExecution?.validationCwd ?? direct?.unit.unit.validation_cwd);
         }
         async function reviewMessages(id, notBefore, requireAvailable = false) {
             const method = typeof nativeSession?.reviewMessages === "function" ? "reviewMessages" : "messages";
@@ -679,7 +681,8 @@ export function createProfiledPlugin(profile, assetVersion) {
                     return undefined;
                 const unit = correction.unit;
                 const directories = unit.directExecution?.validationCwd ?? unit.unit.validation_cwd;
-                const progress = reviewerCorrectionValidation(unit.unit.validation, child, await messages(child), Date.parse(unit.reviewerCorrection?.admittedAt ?? unit.directExecution?.startedAt ?? correction.run.createdAt), unit.reviewerCorrection?.checks ?? unit.directExecution?.checks ?? [], input.directory, directories, unit.reviewerCorrection?.validationRegisteredAt ?? unit.directExecution?.validationRegisteredAt);
+                const admittedAt = unit.reviewerCorrection?.admittedAt ?? unit.directExecution?.startedAt ?? correction.run.createdAt;
+                const progress = reviewerCorrectionValidation(unit.unit.validation, child, await reviewMessages(child, admittedAt), Date.parse(admittedAt), unit.reviewerCorrection?.checks ?? unit.directExecution?.checks ?? [], input.directory, directories, unit.reviewerCorrection?.validationRegisteredAt ?? unit.directExecution?.validationRegisteredAt);
                 const members = canonicalObservedValidationMembers(command, unit.unit.validation, progress.nextOccurrence ?? 0);
                 return members && validationDirectoryMatches(members, directory, input.directory, directories) ? members : undefined;
             },
@@ -697,8 +700,10 @@ export function createProfiledPlugin(profile, assetVersion) {
                     (item.reviewerCorrection?.author === child || item.directExecution?.actor === child));
                 if (!unit)
                     return undefined;
+                // Compaction removes earlier tools from session.context, not from native history.
+                // Reuse the admission-window reader; saved checks still require their live input binding.
                 try {
-                    return await reviewerCorrectionValidationFresh(unit.unit.validation, child, await messages(child), startedAt, unit.reviewerCorrection?.checks ?? unit.directExecution?.checks ?? [], input.directory, unit.directExecution?.validationCwd ?? unit.unit.validation_cwd, unit.reviewerCorrection?.validationRegisteredAt ?? unit.directExecution?.validationRegisteredAt);
+                    return await reviewerCorrectionValidationFresh(unit.unit.validation, child, await reviewMessages(child, new Date(startedAt).toISOString()), startedAt, unit.reviewerCorrection?.checks ?? unit.directExecution?.checks ?? [], input.directory, unit.directExecution?.validationCwd ?? unit.unit.validation_cwd, unit.reviewerCorrection?.validationRegisteredAt ?? unit.directExecution?.validationRegisteredAt);
                 }
                 catch {
                     return { ready: false, reason: "mission-review-correction-validation-history-unavailable" };
@@ -3515,7 +3520,8 @@ export function createProfiledPlugin(profile, assetVersion) {
             for (const unit of run.units) {
                 if (!unit.reviewerCorrection || !unit.childSessionID)
                     continue;
-                const checked = await reviewerCorrectionValidationFresh(unit.unit.validation, unit.childSessionID, await messages(unit.childSessionID), Date.parse(unit.reviewerCorrection.admittedAt ?? run.createdAt), unit.reviewerCorrection.checks ?? [], input.directory, unit.directExecution?.validationCwd ?? unit.unit.validation_cwd, unit.reviewerCorrection.validationRegisteredAt);
+                const admittedAt = unit.reviewerCorrection.admittedAt ?? run.createdAt;
+                const checked = await reviewerCorrectionValidationFresh(unit.unit.validation, unit.childSessionID, await reviewMessages(unit.childSessionID, admittedAt), Date.parse(admittedAt), unit.reviewerCorrection.checks ?? [], input.directory, unit.directExecution?.validationCwd ?? unit.unit.validation_cwd, unit.reviewerCorrection.validationRegisteredAt);
                 if (!checked.ready)
                     return checked.reason;
             }
@@ -3529,7 +3535,7 @@ export function createProfiledPlugin(profile, assetVersion) {
         async function observeNativeSelfRecheck(root, mission, run, author, callID, promptID, admittedAt, expectedSource, suppliedHistory) {
             if (!promptID || !Number.isFinite(admittedAt) || mission.runID !== run.runID || run.phase !== "awaiting-acceptance")
                 return undefined;
-            const history = suppliedHistory ?? await messages(author);
+            const history = suppliedHistory ?? await reviewMessages(author, new Date(admittedAt).toISOString());
             const prompt = history.findIndex(message => record(message.info) && message.info.id === promptID && message.info.role === "user" && message.info.sessionID === author);
             if (prompt < 0)
                 return undefined;

package/dist/plugin/protected-snapshot.d.ts

@@ -53,6 +53,16 @@ export declare function protectedSnapshot(authorization: {
     readonly source: string;
     readonly candidate: string;
 } | undefined>;
+/** Capture a task workspace that exists only inside the fixed Docker task container. */
+export declare function protectedDockerSnapshot(authorization: {
+    manifestPath: string;
+    manifestHash: string;
+    projectRoot: string;
+}, containerID: string, cwd: string): Promise<{
+    readonly binding: Binding;
+    readonly source: string;
+    readonly candidate: string;
+} | undefined>;
 export declare function refreshProtectedSnapshot(projectRoot: string, binding: Binding): Promise<{
     readonly source: string;
     readonly candidate: string;

package/dist/plugin/protected-snapshot.js

@@ -7,6 +7,7 @@ import { normalizeManifestScope } from "../core/path.js";
 import { RUNTIME_PROFILES } from "../core/runtime-profile.js";
 import { declaredArtifacts } from "./declared-artifacts.js";
 import { validationScratchPaths } from "./validation-scratch.js";
+import { captureDockerWorkspaceSnapshot } from "./docker-validation.js";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 const controlRoots = new Set([".git", ...Object.values(RUNTIME_PROFILES).map(profile => profile.stateDirectory)]);
@@ -505,7 +506,34 @@ export async function protectedSnapshot(authorization, options = {}) {
             source_paths: sourcePaths.map(path => evidencePath(path).replaceAll("\\", "/")),
             candidate_paths: candidatePaths.map(path => evidencePath(path).replaceAll("\\", "/")) }, source, candidate };
 }
+/** Capture a task workspace that exists only inside the fixed Docker task container. */
+export async function protectedDockerSnapshot(authorization, containerID, cwd) {
+    const manifestSource = await readFile(authorization.manifestPath).catch(() => undefined);
+    if (manifestSource === undefined)
+        return undefined;
+    const manifestHash = createHash("sha256").update(manifestSource).digest("hex");
+    if (manifestHash !== authorization.manifestHash)
+        return undefined;
+    const relativePath = relative(authorization.projectRoot, authorization.manifestPath).replaceAll("\\", "/");
+    if (relativePath.startsWith("../") || isAbsolute(relativePath))
+        return undefined;
+    const workspace = await captureDockerWorkspaceSnapshot(containerID, cwd);
+    if (!workspace)
+        return undefined;
+    return { binding: { manifest_hash: `sha256:${manifestHash}`, project_root: authorization.projectRoot,
+            manifest_path: relativePath, source_policy: "declared-paths-v1", source_paths: [], candidate_paths: [],
+            docker_workspace: workspace }, source: workspace.source, candidate: workspace.candidate };
+}
 export async function refreshProtectedSnapshot(projectRoot, binding) {
+    if (binding.docker_workspace) {
+        if (resolve(projectRoot) !== resolve(binding.project_root) || !await snapshotManifest(projectRoot, binding))
+            return undefined;
+        const workspace = await captureDockerWorkspaceSnapshot(binding.docker_workspace.container_id, binding.docker_workspace.cwd);
+        if (!workspace || workspace.container_id !== binding.docker_workspace.container_id ||
+            workspace.cwd !== binding.docker_workspace.cwd || workspace.repository_root !== binding.docker_workspace.repository_root)
+            return undefined;
+        return { source: workspace.source, candidate: workspace.candidate };
+    }
     const current = await snapshotManifest(projectRoot, binding);
     if (!current)
         return undefined;

package/dist/plugin/v2.d.ts

@@ -1,4 +1,77 @@
 import type { OpenCodeHooks, OpenCodePlugin } from "./index.js";
+export declare const V010_AGENT_TOOL_REGISTRY: {
+    schema_version: number;
+    tool_prefix: string;
+    core_tools: string[];
+    runtime_agents: {
+        "dog-coordinator": string;
+        "dog-worker": string;
+        "dog-luna-worker": string;
+        "dog-scout": string;
+        "dog-reviewer": string;
+        "dog-advisor": string;
+        "dog-operator": string;
+    };
+    roles: {
+        "dog-coordinator": {
+            tool_families: {
+                mission_lifecycle: string[];
+                unit_execution: string[];
+                review: string[];
+            };
+            children: string[];
+        };
+        "dog-worker": {
+            tool_families: {
+                workspace: string[];
+            };
+            native_tool_families: {
+                docker_task: string[];
+            };
+            core_tools: string[];
+            children: never[];
+        };
+        "dog-luna-worker": {
+            tool_families: {
+                workspace: string[];
+            };
+            core_tools: string[];
+            children: never[];
+        };
+        "dog-scout": {
+            tool_families: {};
+            children: never[];
+        };
+        "dog-reviewer": {
+            tool_families: {
+                review: string[];
+            };
+            native_tool_families: {
+                docker_review: string[];
+            };
+            correction_native_tool_families: {
+                docker_task: string[];
+            };
+            correction_tool_families: {
+                workspace: string[];
+                correction: string[];
+            };
+            children: never[];
+        };
+        "dog-advisor": {
+            tool_families: {};
+            children: never[];
+        };
+        "dog-operator": {
+            tool_families: {
+                mission_lifecycle: string[];
+                unit_execution: string[];
+                review: string[];
+            };
+            children: string[];
+        };
+    };
+};
 type JsonObject = Record<string, unknown>;
 type NativePermissionRule = {
     action: string;

package/dist/plugin/v2.js

@@ -15,6 +15,9 @@ import { modelLiveState } from "./model-live-state.js";
 import { serializeOperatorStatus } from "./operator-status-output.js";
 import { runtimeAssets as reviewerAssets } from "../runtime-assets-v010.js";
 import { MISSION_RESULT_HOLD_POLICY, MISSION_REFLECTION_WORKFLOW, LEGACY_MISSION_REFLECTION_WORKFLOW } from "../runtime-mission-assets.js";
+import agentToolRegistry from "./frontierharness-agent-tool-registry.json" with { type: "json" };
+import { canonicalAgent, V010_RUNTIME_PROFILE } from "../core/runtime-profile.js";
+export const V010_AGENT_TOOL_REGISTRY = agentToolRegistry;
 // Capture once when this module evaluates. A later package replacement must not make an old
 // process report the replacement's bytes as its loaded adapter.
 const loadedAdapter = Object.freeze({ adapter_url: import.meta.url,
@@ -322,7 +325,7 @@ export function createV2ReturnReportFinalizer(context, hooks) {
 }
 const correctionAgent = (agent) => typeof agent === "string" && /^dog-reviewer-correction-v010-[a-f0-9]{16}$/u.test(agent);
 const reviewerCorrectionOnlyTools = new Set(["edit", "write", "patch", "sortie_v010_bind_write_gate",
-    "sortie_v010_release_write_gate", "sortie_v010_operator_status", "sortie_v010_expand_unit", "sortie_v010_finish_direct_unit"]);
+    "sortie_v010_release_write_gate", "sortie_v010_operator_status", "sortie_v010_expand_unit", "sortie_v010_finish_direct_unit", "fh_docker_exec"]);
 // Order only the genuine, already-filtered native definitions. Initial read-only
 // tools remain a deterministic prefix when correction admits additional tools;
 // object identities, schemas, executors and native authority are unchanged.
@@ -375,6 +378,29 @@ function shippedReviewerBlock(rules) {
     }
     return undefined;
 }
+function correctionGatewayReviewerRules(rules) {
+    const role = agentToolRegistry.roles["dog-reviewer"];
+    // Match product_agent_permissions()'s exact generated block, in place. A user's
+    // surrounding agent rules and later session rules retain native last-match order.
+    const generated = (correcting) => {
+        const actions = [...new Set([...Object.values(role.tool_families),
+                ...(correcting ? Object.values(role.correction_tool_families) : [])].flat())].sort();
+        const native = [...new Set([...Object.values(role.native_tool_families),
+                ...(correcting ? Object.values(role.correction_native_tool_families) : [])].flat())].sort();
+        return [{ action: "*", resource: "*", effect: "deny" },
+            ...actions.map(action => ({ action: agentToolRegistry.tool_prefix + action, resource: "*", effect: "allow" })),
+            ...native.map(action => ({ action, resource: "*", effect: "allow" }))];
+    };
+    const original = generated(false);
+    for (let start = rules.length - original.length; start >= 0; start--) {
+        if (original.every((rule, offset) => {
+            const actual = rules[start + offset];
+            return actual?.action === rule.action && actual.resource === rule.resource && actual.effect === rule.effect;
+        }))
+            return [...rules.slice(0, start), ...generated(true), ...rules.slice(start + original.length)];
+    }
+    return [...rules];
+}
 const correctionAgents = new WeakMap();
 /** Use 2.0.18's agent.transform/switchAgent BEFORE native tool snapshot selection; never mutate session rules. */
 export async function syncReviewerCorrectionPermissions(context, hooks, sessionID, activate = true) {
@@ -470,7 +496,7 @@ async function syncReviewerCorrectionPermissionsOnce(context, hooks, sessionID,
             const reviewer = editor.get?.("dog-reviewer-v010");
             if (!reviewer?.permissions)
                 throw new Error("native-reviewer-correction-role-permissions-unavailable");
-            const rules = reviewer.permissions;
+            const rules = correctionGatewayReviewerRules(reviewer.permissions);
             const shipped = shippedReviewerBlock(rules);
             if (!shipped)
                 throw new Error("native-reviewer-correction-readonly-role-block-unavailable");
@@ -479,8 +505,8 @@ async function syncReviewerCorrectionPermissionsOnce(context, hooks, sessionID,
                 ...rules.slice(shipped.start + shipped.rules.length)];
             editor.update(id, agent => Object.assign(agent, reviewer, { id, name: id, mode: "subagent", hidden: true,
                 model: { ...info.model },
-                // Remove ONLY the shipped read-only edit/shell role entries. Native implementation
-                // defaults and every real configured rule keep their original order/effective meaning.
+                // Project only the exact generated gateway block and shipped read-only edit/shell
+                // role entries. Other configured rules keep their native order/effective meaning.
                 // No edit/shell grants, copied historical denies, command scanner or session-rule replacement.
                 // The existing correction-control tools stay exposed beneath the shipped sortie_* deny.
                 // Common implementation gates own known output scope; the ordinary Reviewer is untouched.
@@ -792,21 +818,24 @@ async function registerV2Hooks(context, hooks, background, liveState) {
             await hooks["experimental.chat.system.transform"]({ sessionID: String(event.sessionID ?? "") }, output);
             await reconcileCorrectionPermissions(String(event.sessionID));
             if (record(event.tools)) {
-                const visible = {
-                    "dog-operator": ["start_mission", "plan_units", "start_direct_unit", "finish_direct_unit", "retry_mission_unit", "operator_next", "operator_status", "extend_mission_budget", "expand_unit", "review_mission", "repair_review", "complete_mission", "cancel_operator", "reflection"],
-                    "dogs-coordinator": ["plan_units", "start_direct_unit", "finish_direct_unit", "operator_next", "operator_status", "expand_unit", "review_mission", "repair_review", "submit_mission", "skip_mission_consultation", "retry_mission_unit", "rescue_mission_unit"],
-                    "dog-worker-v010": ["bind_write_gate", "release_write_gate", "operator_status", "expand_unit"],
-                    "dog-luna-worker-v010": ["bind_write_gate", "release_write_gate", "operator_status", "expand_unit"],
-                    "dog-reviewer-v010": await hooks.reviewerCorrectionScope?.(String(event.sessionID)) ? ["bind_write_gate", "release_write_gate", "operator_status", "expand_unit", "repair_review", "finish_direct_unit"] : ["repair_review"], "dog-scout-v010": [], "dog-advisor-v010": [],
-                };
                 const correcting = correctionAgent(event.agent) && !!await hooks.reviewerCorrectionScope?.(String(event.sessionID));
-                const allowed = correctionAgent(event.agent) ? (correcting ? ["bind_write_gate", "release_write_gate", "operator_status", "expand_unit", "repair_review", "finish_direct_unit"] : []) : visible[String(event.agent)];
+                const logicalRole = canonicalAgent(V010_RUNTIME_PROFILE, String(event.agent));
+                const role = logicalRole ? agentToolRegistry.roles[logicalRole] : undefined;
+                const families = role ? [...Object.values(role.tool_families), ...(correcting ? Object.values(role.correction_tool_families ?? {}) : [])] : [];
+                const allowed = role ? [...new Set(families.flat())] : undefined;
+                const nativeFamilies = role ? [...Object.values(role.native_tool_families ?? {}),
+                    ...(correcting ? Object.values(role.correction_native_tool_families ?? {}) : [])] : [];
+                const allowedNativeTools = new Set(nativeFamilies.flat());
                 for (const key of Object.keys(event.tools)) {
                     if ((event.agent === "dog-reviewer-v010" || correctionAgent(event.agent)) && !correcting &&
                         ["edit", "write", "patch"].includes(key)) {
                         delete event.tools[key];
                         continue;
                     }
+                    if (key.startsWith("fh_") && !allowedNativeTools.has(key)) {
+                        delete event.tools[key];
+                        continue;
+                    }
                     if (!key.startsWith("sortie_"))
                         continue;
                     if (!allowed || !key.startsWith("sortie_v010_") || !allowed.includes(key.slice("sortie_v010_".length)))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sortie-dogs",
-  "version": "0.14.2",
+  "version": "0.14.3",
   "description": "Bounded agent harness and validated orchestration loop plugin for OpenCode",
   "keywords": [
     "opencode",