thumbgate 1.34.3 → 1.37.1

package/scripts/gates-engine.js

@@ -19,6 +19,9 @@ const {
 const {
   evaluateFinancialControl,
 } = require('./financial-control-plane');
+const {
+  evaluateBrokerReceiptGate,
+} = require('./broker-execution-receipts');
 const {
   buildCostControl,
   normalizeProviderAction,
@@ -72,12 +75,14 @@ const {
   evaluateSecurityScan,
 } = require('./security-scanner');
 const { evaluatePlanGate } = require('./plan-gate');
+const { evaluateStealthMemoryInjection } = require('./stealth-memory-injection-gate');
 const { getTrajectoryScore } = require('./trajectory-scorer');
 const { evaluateSequenceState } = loadOptionalModule('./sequence-guard', () => ({
   evaluateSequenceState: () => null,
 }));
 const { getAutoGatesPath } = require('./auto-promote-gates');
 const { recordAuditEvent, auditToFeedback } = require('./audit-trail');
+const { consumeVerifiedApproval, listEscalations, requestEscalation } = require('./human-escalation');
 
 const DEFAULT_CONFIG_PATH = path.join(__dirname, '..', 'config', 'gates', 'default.json');
 const DEFAULT_CLAIM_GATES_PATH = path.join(__dirname, '..', 'config', 'gates', 'claim-verification.json');
@@ -103,9 +108,22 @@ const STATS_PATH = path.join(STATE_DIR, 'gate-stats.json');
 const SESSION_ACTIONS_PATH = path.join(STATE_DIR, 'session-actions.json');
 const CUSTOM_CLAIM_GATES_PATH = path.join(STATE_DIR, 'claim-verification.json');
 const GOVERNANCE_STATE_PATH = path.join(STATE_DIR, 'governance-state.json');
+const REMEDY_TOOL_NAMES = new Set([
+  'satisfy_gate',
+  'capture_feedback',
+  'capture_memory_feedback',
+  'record_task_outcome',
+  'diagnose_failure',
+  'set_task_scope',
+  'approve_protected_action',
+  'track_action',
+  'verify_claim',
+  'break_glass_emergency',
+]);
 const TTL_MS = 5 * 60 * 1000; // 5 minutes
 const SESSION_ACTION_TTL_MS = 60 * 60 * 1000; // 1 hour
 const PROTECTED_APPROVAL_TTL_MS = 60 * 60 * 1000; // 1 hour
+const DEFAULT_ADMIN_OVERRIDE_TTL_MS = 15 * 60 * 1000; // 15 minutes
 const DEFAULT_PROTECTED_FILE_GLOBS = [
   'AGENTS.md',
   'CLAUDE.md',
@@ -168,6 +186,10 @@ const UNCONDITIONAL_HARD_FLOOR_GATE_IDS = new Set([
   // applyEnforcementPosture, never demote spend blocks to warn-by-default.
   // Apollo $588 incident class (2026-08).
   'financial-control',
+  // Outbound email: irreversible delivery. Keep the hard gate intact until a
+  // separately authenticated admin override bound to the exact action digest
+  // authorizes one retry (AGENT-259 / District Cyber 2026-08-04).
+  'outbound-email-send',
   TASK_SCOPE_LEASE_EXPIRED_GATE_ID,
   ...SELF_PROTECT_HARD_FLOOR_GATE_IDS,
 ]);
@@ -188,6 +210,8 @@ const CATASTROPHIC_DECLARATIVE_GATE_IDS = new Set([
   'git-clean-force',
   'rm-rf-home-or-root',
   'financial-control',
+  // Never daily-cap discount a denied autonomous email send (same class as force-push).
+  'outbound-email-send',
 ]);
 const SELF_PROTECT_CONFIG_TARGET_PATTERN = /(?:^|\/)(?:config\/gates\/|config\/(?:budget|enforcement|mcp-allowlists)\.json$|\.thumbgate\/config\.json$|thumbgate\.json$)/i;
 const SELF_PROTECT_HOOK_TARGET_PATTERN = /(?:^|\/)(?:\.claude\/settings(?:\.local)?\.json|\.codex\/config\.toml|scripts\/hook-[^/]+\.(?:js|sh))$/i;
@@ -199,21 +223,76 @@ function isSelfProtectGate(gateId) {
   return SELF_PROTECT_HARD_FLOOR_GATE_IDS.has(gateId);
 }
 
+/**
+ * Name the existing warn-by-default vs strict postures in Trustwise Control Tower
+ * vocabulary (live / sidecar / simulation / batch) without cloning their product.
+ * Default remains sidecar (= warn-by-default). Hard floors never demote.
+ */
+function resolveGovernanceMode(env = process.env) {
+  // Strict opt-in wins over inherited simulation/batch. Hermes CLI sets
+  // THUMBGATE_STRICT_ENFORCEMENT=1 internally; a leftover shadow mode in the
+  // process env must not demote those denials.
+  if (env.THUMBGATE_STRICT_ENFORCEMENT === '1') return 'live';
+  const raw = String(env.THUMBGATE_GOVERNANCE_MODE || '').trim().toLowerCase();
+  if (raw === 'simulation' || raw === 'batch') return raw;
+  if (raw === 'live') return 'live';
+  return 'sidecar';
+}
+
+function alignmentLayerForResult(result) {
+  const gate = String(result && result.gate || '');
+  if (
+    UNCONDITIONAL_HARD_FLOOR_GATE_IDS.has(gate)
+    || CATASTROPHIC_DECLARATIVE_GATE_IDS.has(gate)
+    || /secret|self-protect|exfil/i.test(gate)
+  ) {
+    return 'safety';
+  }
+  if (/task-scope|local-only|pr_thread|sla/i.test(gate)) return 'sla';
+  return 'business';
+}
+
 function applyEnforcementPosture(result) {
   if (!result || (result.decision !== 'deny' && result.decision !== 'approve')) return result;
+  const mode = resolveGovernanceMode();
+  const alignmentLayer = alignmentLayerForResult(result);
   // Defensive backstop: hard-floor results must never be posture-downgraded.
-  if (UNCONDITIONAL_HARD_FLOOR_GATE_IDS.has(result.gate)) return result;
+  if (UNCONDITIONAL_HARD_FLOOR_GATE_IDS.has(result.gate)) {
+    return { ...result, governanceMode: mode, alignmentLayer };
+  }
+  // Simulation/batch shadow live traffic: record, do not block (except floors).
+  // Only denials are shadowed — allow/approve stay as-is.
+  if (mode === 'simulation' || mode === 'batch') {
+    if (result.decision === 'deny') {
+      return {
+        ...result,
+        decision: 'warn',
+        warnByDefault: true,
+        governanceMode: mode,
+        alignmentLayer,
+        simulated: true,
+        message: `${result.message}\n\n⚠️ ThumbGate governance mode=${mode} — flagged and logged, not blocked.`,
+      };
+    }
+    return { ...result, governanceMode: mode, alignmentLayer, simulated: true };
+  }
   // Full hard enforcement opt-in: keep every deny.
-  if (process.env.THUMBGATE_STRICT_ENFORCEMENT === '1') return result;
+  if (mode === 'live' || process.env.THUMBGATE_STRICT_ENFORCEMENT === '1') {
+    return { ...result, governanceMode: 'live', alignmentLayer };
+  }
   // Honor the explicit strict-knowledge-conflict opt-in for that gate.
-  if (process.env.THUMBGATE_STRICT_KNOWLEDGE_CONFLICT === '1' && result.gate === 'knowledge-conflict-gate') return result;
-  // Warn-by-default: the gate still fired and is recorded; the action is allowed through
+  if (process.env.THUMBGATE_STRICT_KNOWLEDGE_CONFLICT === '1' && result.gate === 'knowledge-conflict-gate') {
+    return { ...result, governanceMode: mode, alignmentLayer };
+  }
+  // Sidecar / warn-by-default: the gate still fired and is recorded; the action is allowed through
   // with the warning surfaced instead of hard-blocked, so legitimate work is never blocked.
   return {
     ...result,
     decision: 'warn',
     warnByDefault: true,
-    message: `${result.message}\n\n⚠️ ThumbGate is in warn-by-default mode — this was flagged and logged, not blocked. Set THUMBGATE_STRICT_ENFORCEMENT=1 to hard-block other flagged actions.`,
+    governanceMode: 'sidecar',
+    alignmentLayer,
+    message: `${result.message}\n\n⚠️ ThumbGate is in warn-by-default mode (sidecar) — this was flagged and logged, not blocked. Set THUMBGATE_STRICT_ENFORCEMENT=1 or THUMBGATE_GOVERNANCE_MODE=live to hard-block other flagged actions.`,
   };
 }
 const BREAK_GLASS_CONDITION = 'thumbgate_break_glass';
@@ -256,19 +335,51 @@ function commandContainsSequence(words, sequence) {
 }
 
 function commandHasPostMethod(words) {
-  for (let i = 0; i < words.length; i += 1) {
-    const word = words[i];
-    if ((word === '-x' || word === '--method') && words[i + 1] === 'post') return true;
-    if (word === '--method=post' || word === '-xpost') return true;
+  return ghApiHttpMethod(words) === 'post';
+}
+
+function ghApiHttpMethod(words) {
+  const list = Array.isArray(words) ? words : [];
+  for (let i = 0; i < list.length; i += 1) {
+    const word = list[i];
+    if ((word === '-x' || word === '--method') && list[i + 1]) return String(list[i + 1]).toLowerCase();
+    if (word.startsWith('--method=')) return word.slice('--method='.length).toLowerCase();
+    if (word.startsWith('-x') && word.length > 2 && !word.startsWith('-x=')) {
+      return word.slice(2).toLowerCase();
+    }
   }
-  return false;
+  return null;
+}
+
+function ghApiEndpoint(words) {
+  const list = Array.isArray(words) ? words : [];
+  const apiIndex = list.findIndex((word, i) => word === 'api' && list[i - 1] === 'gh');
+  if (apiIndex < 0) return null;
+  const flagsWithValue = new Set([
+    '-x', '--method', '-f', '--field', '-F', '--raw-field',
+    '-h', '--header', '--hostname', '--jq', '--input', '--cache',
+  ]);
+  for (let i = apiIndex + 1; i < list.length; i += 1) {
+    const word = list[i];
+    if (word.startsWith('-')) {
+      if (word.includes('=')) continue;
+      if (flagsWithValue.has(word)) i += 1;
+      continue;
+    }
+    return word;
+  }
+  return null;
 }
 
 function isGhApiPrCreateCommand(command) {
   const words = commandWords(command);
   if (!commandContainsSequence(words, ['gh', 'api'])) return false;
-  const hasPullsEndpoint = words.some((word) => word === '/pulls' || word.endsWith('/pulls'));
-  if (!hasPullsEndpoint) return false;
+  const method = ghApiHttpMethod(words);
+  if (method && method !== 'post') return false;
+  const endpoint = ghApiEndpoint(words);
+  if (!endpoint) return false;
+  if (/\/pulls\/\d+/.test(endpoint)) return false;
+  if (!(endpoint === '/pulls' || /\/pulls$/.test(endpoint))) return false;
   const fieldFlags = new Set(['-f', '--field', '--raw-field']);
   const hasFieldWrite = words.some((word) => (
     fieldFlags.has(word) ||
@@ -467,8 +578,39 @@ function isTaskScopeExpired(taskScope, nowMs = Date.now()) {
   return nowMs >= deadline;
 }
 
-function loadGovernanceState() {
-  const raw = loadJSON(module.exports.GOVERNANCE_STATE_PATH);
+function currentScopeSessionId(explicitSessionId = null) {
+  if (explicitSessionId) return String(explicitSessionId).trim();
+  const raw = String(
+    process.env.THUMBGATE_SESSION_AGENT
+    || process.env.THUMBGATE_SESSION_ID
+    || process.env.CLAUDE_SESSION_ID
+    || ''
+  ).trim();
+  return raw || null;
+}
+
+function sanitizeScopeSessionId(sessionId) {
+  if (!sessionId) return '';
+  const hash = crypto.createHash('sha256').update(String(sessionId)).digest('hex').slice(0, 16);
+  const prefix = String(sessionId).replace(/[^A-Za-z0-9._-]/g, '_').slice(0, 32);
+  return prefix ? `${prefix}-${hash}` : hash;
+}
+
+// Sibling agents share ~/.thumbgate/governance-state.json today, so one
+// set_task_scope rebinds every other live session (#3522). When a session id
+// is present, persist a per-session file next to the legacy slot.
+function governanceStatePath(explicitSessionId = null) {
+  const base = module.exports.GOVERNANCE_STATE_PATH;
+  const sessionId = currentScopeSessionId(explicitSessionId);
+  if (!sessionId) return base;
+  const safe = sanitizeScopeSessionId(sessionId);
+  if (!safe) return base;
+  const parsed = path.parse(base);
+  return path.join(parsed.dir, `${parsed.name}.${safe}${parsed.ext}`);
+}
+
+function loadGovernanceState(explicitSessionId = null) {
+  const raw = loadJSON(governanceStatePath(explicitSessionId));
   const state = {
     taskScope: raw && raw.taskScope && typeof raw.taskScope === 'object' ? raw.taskScope : null,
     protectedApprovals: Array.isArray(raw && raw.protectedApprovals) ? raw.protectedApprovals : [],
@@ -489,35 +631,142 @@ function loadGovernanceState() {
   const activeApprovals = state.protectedApprovals.filter((entry) => {
     if (!entry || typeof entry !== 'object') return false;
     if (!entry.timestamp || !entry.expiresAt) return false;
-    return now < entry.expiresAt;
+    return entry.expiresAt > now;
   });
-  if (activeApprovals.length !== state.protectedApprovals.length) {
-    state.protectedApprovals = activeApprovals;
-    saveGovernanceState(state);
-  }
+  state.protectedApprovals = activeApprovals;
   return state;
 }
 
-function saveGovernanceState(state) {
+function saveGovernanceState(state, explicitSessionId = null) {
   const next = {
     taskScope: state && state.taskScope ? state.taskScope : null,
     protectedApprovals: Array.isArray(state && state.protectedApprovals) ? state.protectedApprovals : [],
     branchGovernance: state && state.branchGovernance ? state.branchGovernance : null,
     workflowContract: state && state.workflowContract ? state.workflowContract : null,
   };
-  saveJSON(module.exports.GOVERNANCE_STATE_PATH, next);
+  saveJSON(governanceStatePath(explicitSessionId), next);
+}
+
+function stableCanonicalStringify(value) {
+  if (value === null || typeof value !== 'object') return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(stableCanonicalStringify).join(',')}]`;
+  return `{${Object.keys(value).sort().map((key) => (
+    `${JSON.stringify(key)}:${stableCanonicalStringify(value[key])}`
+  )).join(',')}}`;
+}
+
+function actionApprovalDigest(toolName, toolInput) {
+  return crypto.createHash('sha256').update(stableCanonicalStringify({
+    toolInput: toolInput && typeof toolInput === 'object' ? toolInput : {},
+    toolName: String(toolName || ''),
+  })).digest('hex');
+}
+
+function adminOverrideTaskId(gateId, digest) {
+  return `admin-override:${gateId}:${digest}`;
+}
+
+function selectAdminOverrideAttempt(baseTaskId) {
+  const attempts = listEscalations().filter((entry) => (
+    entry.taskId === baseTaskId || String(entry.taskId || '').startsWith(`${baseTaskId}:attempt:`)
+  ));
+  const latest = attempts[0] || null;
+  if (!latest) return baseTaskId;
+  const terminal = ['rejected', 'cancelled', 'expired'].includes(latest.status)
+    || latest.eventType === 'consumed'
+    || Date.parse(latest.expiresAt) <= Date.now();
+  if (!terminal) return latest.taskId;
+  const highestAttempt = attempts.reduce((highest, entry) => {
+    const match = String(entry.taskId || '').match(/:attempt:(\d+)$/);
+    return Math.max(highest, match ? Number(match[1]) : 1);
+  }, 1);
+  return `${baseTaskId}:attempt:${highestAttempt + 1}`;
+}
+
+function evaluateAdminOverride(gate, toolName, toolInput) {
+  const policy = gate && gate.adminOverride;
+  if (!policy || policy.required !== true) return null;
+
+  const approvalContextDigest = actionApprovalDigest(toolName, toolInput);
+  const baseTaskId = adminOverrideTaskId(gate.id, approvalContextDigest);
+  let taskId;
+  try {
+    taskId = selectAdminOverrideAttempt(baseTaskId);
+  } catch {
+    return {
+      authorized: false,
+      approvalContextDigest,
+      escalationId: null,
+      taskId: baseTaskId,
+      approvalUnavailable: true,
+    };
+  }
+  const ttlMs = Math.min(
+    60 * 60 * 1000,
+    Math.max(60 * 1000, Number(policy.ttlMs) || DEFAULT_ADMIN_OVERRIDE_TTL_MS),
+  );
+  let escalation;
+  try {
+    escalation = requestEscalation({
+      taskId,
+      reason: `Admin override required for hard gate '${gate.id}'.`,
+      severity: gate.severity || 'critical',
+      requester: { id: 'thumbgate-gates-engine', kind: 'service' },
+      evidence: [`sha256:${approvalContextDigest}`],
+      ttlMs,
+      idempotencyKey: taskId,
+      approvalContextDigest,
+      requiredReviewerRole: 'admin',
+    });
+  } catch {
+    return {
+      authorized: false,
+      approvalContextDigest,
+      escalationId: null,
+      taskId,
+      approvalUnavailable: true,
+    };
+  }
+  const escalationId = escalation.escalation.escalationId;
+  let consumption = null;
+  try {
+    consumption = consumeVerifiedApproval(escalationId, {
+      consumer: { id: 'thumbgate-gates-engine', kind: 'service' },
+    });
+  } catch {
+    consumption = null;
+  }
+
+  if (!consumption || !consumption.consumed) {
+    return {
+      authorized: false,
+      approvalContextDigest,
+      escalationId,
+      taskId,
+      replayed: consumption?.replayed === true,
+    };
+  }
+  return {
+    authorized: true,
+    approvalContextDigest,
+    escalationId,
+    taskId,
+    approver: consumption.approval.actor,
+    consumptionReceipt: consumption.consumption.eventHash,
+  };
 }
 
 function setTaskScope(scopeInput = {}) {
+  const explicitSessionId = scopeInput && scopeInput.sessionId ? String(scopeInput.sessionId).trim() : null;
   if (scopeInput && scopeInput.clear === true) {
-    const currentState = loadGovernanceState();
+    const currentState = loadGovernanceState(explicitSessionId);
     const cleared = {
       taskScope: null,
       protectedApprovals: currentState.protectedApprovals,
       branchGovernance: currentState.branchGovernance,
       workflowContract: null,
     };
-    saveGovernanceState(cleared);
+    saveGovernanceState(cleared, explicitSessionId);
     refreshLocalOnlyConstraint(cleared);
     return null;
   }
@@ -540,6 +789,7 @@ function setTaskScope(scopeInput = {}) {
   const leaseMs = scopeInput.ttlMs == null ? null : clampTtlMs(scopeInput.ttlMs, TASK_SCOPE_LEASE_MS);
   const taskScope = {
     taskId: String(scopeInput.taskId || '').trim() || null,
+    sessionId: currentScopeSessionId(explicitSessionId),
     summary: String(scopeInput.summary || '').trim() || null,
     allowedPaths,
     protectedPaths,
@@ -550,12 +800,12 @@ function setTaskScope(scopeInput = {}) {
     leaseMs,
     expiresAt: leaseMs == null ? null : scopeNow + leaseMs,
   };
-  const state = loadGovernanceState();
+  const state = loadGovernanceState(explicitSessionId);
   state.taskScope = taskScope;
   state.workflowContract = scopeInput.workflowContract && typeof scopeInput.workflowContract === 'object'
     ? scopeInput.workflowContract
     : null;
-  saveGovernanceState(state);
+  saveGovernanceState(state, explicitSessionId);
   if (taskScope.localOnly) {
     setConstraint('local_only', true);
   }
@@ -601,7 +851,14 @@ function breakGlassEmergency(input = {}) {
   const gates = ['pr_create_allowed', 'pr_threads_checked', BREAK_GLASS_CONDITION];
   const satisfied = {};
   for (const gateId of gates) {
-    satisfied[gateId] = satisfyCondition(gateId, evidence);
+    // Break glass is the highest-scrutiny unlock there is. Without an explicit
+    // source these records defaulted to 'cli', hiding emergency overrides among
+    // ordinary ones — the exact case an auditor looks for first.
+    satisfied[gateId] = satisfyCondition(gateId, evidence, null, {
+      source: 'break-glass',
+      actor: input.actor || 'operator',
+      reason,
+    });
   }
 
   const approval = approveProtectedAction({
@@ -660,8 +917,9 @@ function setBranchGovernance(input = {}) {
   return governance;
 }
 
-function getScopeState() {
-  return loadGovernanceState();
+function getScopeState(options = {}) {
+  const sessionId = typeof options === 'string' ? options : (options?.sessionId || process.env.THUMBGATE_SESSION_AGENT || null);
+  return loadGovernanceState(sessionId);
 }
 
 function getBranchGovernanceState() {
@@ -704,7 +962,7 @@ function isConditionSatisfied(conditionId) {
   return age < TTL_MS;
 }
 
-function satisfyCondition(conditionId, evidence, structuredReasoning) {
+function satisfyCondition(conditionId, evidence, structuredReasoning, options = {}) {
   const state = loadState();
   const entry = {
     timestamp: Date.now(),
@@ -720,6 +978,28 @@ function satisfyCondition(conditionId, evidence, structuredReasoning) {
   }
   state[conditionId] = entry;
   saveState(state);
+
+  // Satisfying a gate condition IS an override: it unlocks an action the gate
+  // had blocked. Previously this wrote only to the state store, so an override
+  // performed through the CLI left no trace in the audit trail at all — the
+  // least-supervised path was also the least-recorded. Record it explicitly.
+  // Never let an audit failure break the unlock the caller is relying on.
+  try {
+    // Lazy require: override-audit depends on audit-trail, which this module
+    // already loads; requiring at call time avoids any circular-init surprise.
+    const { recordOverride } = require('./override-audit');
+    recordOverride({
+      gateId: conditionId,
+      source: options.source || 'cli',
+      actor: options.actor,
+      reason: options.reason,
+      evidence: entry.evidence,
+      structuredReasoning: entry.structuredReasoning,
+    });
+  } catch {
+    /* audit is best-effort; the gate state is authoritative */
+  }
+
   return entry;
 }
 
@@ -900,14 +1180,111 @@ function safeExecFileLines(binary, args, cwd) {
   }
 }
 
+function extractGitMinusCPaths(command) {
+  const found = [];
+  const segments = String(command || '').split(/\r?\n|&&|\|\||[;|&]/);
+  for (const segment of segments) {
+    const tokens = tokenizeShellWords(segment);
+    const gitIdx = tokens.findIndex((token) => token === 'git' || /(?:^|\/)git$/.test(token));
+    if (gitIdx === -1) continue;
+    for (let i = gitIdx + 1; i < tokens.length; i += 1) {
+      const token = tokens[i];
+      if (token === '-C' && tokens[i + 1]) {
+        found.push(tokens[i + 1]);
+        i += 1;
+        continue;
+      }
+      if (token === '--work-tree' && tokens[i + 1]) {
+        found.push(tokens[i + 1]);
+        i += 1;
+        continue;
+      }
+      if (token.startsWith('--work-tree=')) {
+        found.push(token.slice('--work-tree='.length));
+        continue;
+      }
+      if (!token.startsWith('-')) break;
+    }
+  }
+  return found;
+}
+
+function extractGitContextPair(command) {
+  const segments = String(command || '').split(/\r?\n|&&|\|\||[;|&]/);
+  for (const segment of segments) {
+    const tokens = tokenizeShellWords(segment);
+    const gitIdx = tokens.findIndex((token) => token === 'git' || /(?:^|\/)git$/.test(token));
+    if (gitIdx === -1) continue;
+    let gitDir = null;
+    let workTree = null;
+    for (let i = gitIdx + 1; i < tokens.length; i += 1) {
+      const token = tokens[i];
+      if (token === '--git-dir' && tokens[i + 1]) {
+        gitDir = tokens[i + 1];
+        i += 1;
+        continue;
+      }
+      if (token.startsWith('--git-dir=')) {
+        gitDir = token.slice('--git-dir='.length);
+        continue;
+      }
+      if (token === '--work-tree' && tokens[i + 1]) {
+        workTree = tokens[i + 1];
+        i += 1;
+        continue;
+      }
+      if (token.startsWith('--work-tree=')) {
+        workTree = token.slice('--work-tree='.length);
+        continue;
+      }
+      if (token === '-C' && tokens[i + 1]) {
+        workTree = tokens[i + 1];
+        i += 1;
+        continue;
+      }
+      if (!token.startsWith('-')) break;
+    }
+    if (gitDir || workTree) return { gitDir, workTree };
+  }
+  return null;
+}
+
 function resolveRepoRoot(toolInput = {}) {
-  const candidates = [
+  const command = String(toolInput.command || '');
+  const baseCwd = toolInput.cwd ? path.resolve(String(toolInput.cwd)) : process.cwd();
+  const paired = extractGitContextPair(command);
+  if (paired && paired.gitDir && paired.workTree) {
+    try {
+      const resolvedGitDir = path.resolve(baseCwd, paired.gitDir);
+      const resolvedWorkTree = path.resolve(baseCwd, paired.workTree);
+      const root = execFileSync('git', ['--git-dir', resolvedGitDir, '--work-tree', resolvedWorkTree, 'rev-parse', '--show-toplevel'], {
+        cwd: resolvedWorkTree,
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'ignore'],
+      }).trim();
+      if (root) return root;
+    } catch {
+      // Fall through to standard candidate probing
+    }
+  }
+
+  const minusC = extractGitMinusCPaths(command).map((entry) => path.resolve(baseCwd, entry));
+  const commandCwd = effectiveCommandCwd(command, toolInput);
+  const candidates = [];
+  const seen = new Set();
+  for (const value of [
+    ...minusC,
+    commandCwd,
     toolInput.repoPath,
     toolInput.cwd,
     process.cwd(),
-  ]
-    .filter(Boolean)
-    .map((value) => path.resolve(String(value)));
+  ]) {
+    if (!value) continue;
+    const resolved = path.resolve(String(value));
+    if (seen.has(resolved)) continue;
+    seen.add(resolved);
+    candidates.push(resolved);
+  }
 
   for (const cwd of candidates) {
     try {
@@ -1130,7 +1507,17 @@ function parseGitPathspec(command, subcommand, options = {}) {
 // null as "unknown" and fall back to broad.
 function effectiveCommandCwd(command, toolInput) {
   let cwd = String(toolInput?.cwd || toolInput?.repoPath || process.cwd());
-  const segments = String(command || '').split(/\r?\n|&&|\|\||[;|&]/);
+  const commandStr = String(command || '');
+  const gitCMatch = commandStr.match(/(?:^|\s)git(?:\s+-[^\s]+)*\s+-C(?:\s+|=)(?:'([^']+)'|"([^"]+)"|([^\s'"]+))/i);
+  const gitCDir = gitCMatch ? (gitCMatch[1] || gitCMatch[2] || gitCMatch[3] || '').trim() : '';
+  if (gitCDir) {
+    let target = gitCDir;
+    if (target.startsWith('~/')) {
+      target = path.join(os.homedir(), target.slice(2));
+    }
+    return path.resolve(cwd, target);
+  }
+  const segments = commandStr.split(/\r?\n|&&|\|\||[;|&]/);
   for (const segment of segments) {
     // Parsed without a regex: /^cd\s+(?:--\s+)?(.+)$/ has adjacent \s+ groups that backtrack
     // polynomially on input like `cd\t\t\t…` (js/polynomial-redos). The command comes
@@ -1144,8 +1531,12 @@ function effectiveCommandCwd(command, toolInput) {
     else if (argText.startsWith('--') && /^[ \t]/.test(argText.slice(2))) argText = argText.slice(2).trim();
     const target = tokenizeShellWords(argText)[0];
     if (!target) break;                      // bare `cd` -> home; leave scope resolution alone
-    if (/[*?$`]|^~/.test(target)) return null;
-    cwd = path.resolve(cwd, target);
+    if (/[*?$`]/.test(target)) return null;
+    let targetResolved = target;
+    if (targetResolved.startsWith('~/')) {
+      targetResolved = path.join(os.homedir(), targetResolved.slice(2));
+    }
+    cwd = path.resolve(cwd, targetResolved);
   }
   return cwd;
 }
@@ -1371,8 +1762,10 @@ function extractAffectedFiles(toolName, toolInput = {}) {
     }
 
     if (/\bgit\s+push\b/i.test(command) || /\bgh\s+pr\s+(?:create|merge)\b/i.test(command) || isGhApiPrCreateCommand(command)) {
-      for (const filePath of getBranchDiffFiles(repoRoot)) {
-        files.add(normalizePosix(filePath));
+      if (files.size === 0) {
+        for (const filePath of getBranchDiffFiles(repoRoot)) {
+          files.add(normalizePosix(filePath));
+        }
       }
     }
   }
@@ -1686,9 +2079,51 @@ function isThreadResolutionSatisfied() {
   ));
 }
 
+// Hook payloads name MCP tools `mcp__<server>__<tool>` while exemption lists
+// hold bare tool names. Exemptions must compare on the stripped name or they
+// never fire for real hook traffic — 2026-08-05: the pending-thread gate
+// blocked `mcp__thumbgate__satisfy_gate` itself, deadlocking its own
+// documented escape hatch until the session-actions TTL expired.
+function bareToolName(toolName) {
+  return String(toolName || '').replace(/^mcp__.+?__/, '');
+}
+
+function isRemedyToolName(toolName) {
+  return REMEDY_TOOL_NAMES.has(bareToolName(toolName));
+}
+
+// permission-change-approval used to regex the entire command string, so
+// quoting `chmod 755` inside `gh issue create --body` was itself a deny (#3523).
+function isCommandPositionPermissionChange(toolName, toolInput = {}) {
+  if (toolName !== 'Bash') return false;
+  const command = String(toolInput.command || '');
+  if (!command) return false;
+  const segments = canonicalizeCommandForGates(command).split('; ');
+  for (const segment of segments) {
+    const tokens = tokenizeShellWords(segment);
+    if (tokens.length === 0) continue;
+    const bin = tokens[0].toLowerCase();
+    if (bin === 'chmod' || bin === 'chown' || bin === 'setfacl') return tokens.length >= 2;
+    if (bin === 'busybox' && tokens[1] && ['chmod', 'chown', 'setfacl'].includes(tokens[1].toLowerCase())) {
+      return tokens.length >= 3;
+    }
+    if (bin === 'grant' || bin === 'revoke') return tokens.length >= 2;
+    const nextFew = tokens.slice(1, 6).map((token) => token.toLowerCase());
+    if ((bin === 'pm' || bin === 'adb') && nextFew.includes('grant')) return true;
+    if (
+      (bin === 'aws' || bin === 'gcloud' || bin === 'az')
+      && nextFew.some((token) => token === 'iam' || token === 'policy' || token === 'role'
+        || token === 'grant' || token === 'revoke')
+    ) {
+      return true;
+    }
+  }
+  return false;
+}
+
 function isThreadResolutionEvidenceAction(toolName, toolInput = {}) {
   if (isGitCommitCommand(toolName, toolInput)) return true;
-  if (['recall', 'search_lessons', 'verify_claim', 'satisfy_gate', 'track_action'].includes(toolName)) return true;
+  if (['recall', 'search_lessons', 'verify_claim', 'satisfy_gate', 'track_action'].includes(bareToolName(toolName))) return true;
   if (toolName !== 'Bash') return false;
   const command = String(toolInput.command || '');
   return /\b(?:gate-satisfy|satisfy_gate|track_action|gh\s+pr\s+(?:view|checks|status)|gh\s+api\b.*(?:reviewThreads|reviews|comments|threads)|git\s+(?:status|diff|show))\b/i.test(command);
@@ -1728,7 +2163,9 @@ function getReadOnlyToolNames() {
   return names;
 }
 function isReadOnlyObservabilityTool(toolName) {
-  return Boolean(toolName) && getReadOnlyToolNames().has(toolName);
+  if (!toolName) return false;
+  const names = getReadOnlyToolNames();
+  return names.has(toolName) || names.has(bareToolName(toolName));
 }
 
 function evaluatePendingPrThreadResolutionGate(toolName, toolInput = {}) {
@@ -1772,7 +2209,7 @@ function evaluatePendingPrThreadResolutionGate(toolName, toolInput = {}) {
     severity: 'critical',
     reasoning: [
       `Tracked action ${PR_THREAD_RESOLUTION_ACTION} is pending`,
-      'Check review threads (e.g. gh pr view --json reviewThreads), then call the satisfy_gate tool with gateId="pr_threads_checked" and the evidence — running a check command alone does not clear this gate',
+      'Check review threads (e.g. gh pr view --json reviewThreads), then call the satisfy_gate tool with gate="pr_threads_checked" (param name is gate, not gateId) and evidence — running a check command alone does not clear this gate',
     ],
   };
 }
@@ -1867,10 +2304,15 @@ function recordHelperScriptWrite(toolName, toolInput = {}) {
     packageScriptTouched,
     reasons,
   };
-  trackAction(HELPER_BYPASS_ACTION, metadata);
+  trackAction(helperBypassActionKey(), metadata);
   return metadata;
 }
 
+function helperBypassActionKey() {
+  const sessionId = currentScopeSessionId();
+  return sessionId ? `${HELPER_BYPASS_ACTION}:${sessionId}` : HELPER_BYPASS_ACTION;
+}
+
 function evaluateStatefulHelperBypassGate(toolName, toolInput = {}) {
   if (process.env.THUMBGATE_HELPER_BYPASS_GUARD === '0') return null;
   if (toolName !== 'Bash') {
@@ -1896,7 +2338,7 @@ function evaluateStatefulHelperBypassGate(toolName, toolInput = {}) {
 
   const writeMetadata = recordHelperScriptWrite(toolName, toolInput);
   const actions = listSessionActions();
-  const recentWrite = actions[HELPER_BYPASS_ACTION];
+  const recentWrite = actions[helperBypassActionKey()];
   const recentMetadata = recentWrite && recentWrite.metadata && typeof recentWrite.metadata === 'object'
     ? recentWrite.metadata
     : null;
@@ -1969,6 +2411,10 @@ function evaluateCatastrophicDeclarativeGate(config, constraints, toolName, tool
   for (const gate of config.gates) {
     if (!CATASTROPHIC_DECLARATIVE_GATE_IDS.has(gate.id)) continue;
     if (gate.action !== 'block' || gate.metrics) continue;
+    // Override-capable hard gates must reach the ordinary loop so it can
+    // authenticate and consume the exact-action admin authorization. They are
+    // still unconditional hard floors and cannot be posture/cap downgraded.
+    if (gate.adminOverride && gate.adminOverride.required === true) continue;
 
     const matchDetails = matchGate(gate, toolName, toolInput);
     if (!matchDetails.matched) continue;
@@ -2274,8 +2720,52 @@ function checkWhenClause(when, constraints) {
   return true;
 }
 
+
+/**
+ * Surfaces a gate pattern can match against.
+ *
+ * Historically only `toolInput.command|file_path|path` was considered. That
+ * made every MCP / non-Bash tool call invisible to pattern gates — including
+ * Gmail `send_message`, Apollo emailer send, and any auto-promoted rule that
+ * mentioned a tool by name. Those gates rendered as "active" with
+ * lastFiredAt:null forever (AGENT-259).
+ *
+ * Surfaces, in order:
+ *   1. Bash/command text (preserves existing `^` anchor behavior)
+ *   2. bare tool name (MCP tools)
+ *   3. tool name + command
+ *   4. common URL/endpoint/action fields (HTTP-shaped tool inputs)
+ *
+ * Body/content is intentionally excluded to avoid false blocks when an agent
+ * *edits code that mentions* a send endpoint.
+ */
+function buildMatchSurfaces(toolName, toolInput = {}) {
+  const name = String(toolName || '').trim();
+  const command = String(toolInput.command || '').trim();
+  const filePath = String(toolInput.file_path || toolInput.path || '').trim();
+  const surfaces = [];
+  const push = (s) => {
+    const v = String(s || '').trim();
+    if (v && !surfaces.includes(v)) surfaces.push(v);
+  };
+  push(command);
+  push(filePath);
+  push(name);
+  if (name && command) push(`${name} ${command}`);
+  if (name && filePath) push(`${name} ${filePath}`);
+  for (const key of ['url', 'endpoint', 'method', 'action', 'path']) {
+    if (toolInput[key] == null) continue;
+    const v = String(toolInput[key]).slice(0, 400);
+    push(v);
+    if (name) push(`${name} ${v}`);
+  }
+  return surfaces;
+}
+
 function matchGate(gate, toolName, toolInput = {}) {
-  let matchText = toolInput.command || toolInput.file_path || toolInput.path || '';
+  // Primary text for audit/reasoning: prefer command, then tool name (MCP).
+  const matchSurfaces = buildMatchSurfaces(toolName, toolInput);
+  let matchText = matchSurfaces[0] || String(toolName || '');
 
   // Claw/hybrid support: enrich matchText with claw metadata (for EnterpriseClaw/OpenShell/Perplexity hybrid agents)
   const clawCtx = toolInput.clawContext || toolInput._claw || (toolInput.agentId ? {
@@ -2309,6 +2799,7 @@ function matchGate(gate, toolName, toolInput = {}) {
     }
 
     matchText = parts.filter(Boolean).join(' | ');
+    if (!matchSurfaces.includes(matchText)) matchSurfaces.push(matchText);
   }
 
   const affected = extractAffectedFiles(toolName, toolInput);
@@ -2349,14 +2840,27 @@ function matchGate(gate, toolName, toolInput = {}) {
 
   if (gate.pattern) {
     try {
-      const regex = new RegExp(gate.pattern);
-      // Match the original text or its git-canonical form, so `git -C <dir> push --force`
-      // is caught by the same pattern as `git push --force`.
-      if (!patternMatchesCommand(regex, matchText)) {
-        return { matched: false, matchText, affectedFiles };
-      }
-      if (gate.id === 'permission-change-approval' && isSafeLocalCredentialHardeningCommand(toolName, toolInput)) {
-        return { matched: false, matchText, affectedFiles };
+      if (gate.id === 'permission-change-approval') {
+        if (isRemedyToolName(toolName) || !isCommandPositionPermissionChange(toolName, toolInput)) {
+          return { matched: false, matchText, affectedFiles };
+        }
+        if (isSafeLocalCredentialHardeningCommand(toolName, toolInput)) {
+          return { matched: false, matchText, affectedFiles };
+        }
+      } else if (gate.id === 'gh-api-pr-create-restricted') {
+        if (!isGhApiPrCreateCommand(String(toolInput.command || ''))) {
+          return { matched: false, matchText, affectedFiles };
+        }
+      } else {
+        const regex = new RegExp(gate.pattern);
+        // Match command text, tool name, and light payload surfaces. MCP tools
+        // (e.g. Gmail send_message) have no `command` field — without multi-surface
+        // matching, every pattern gate against them is permanently inert.
+        const surfaces = matchSurfaces.length > 0 ? matchSurfaces : [matchText];
+        const anySurfaceMatch = surfaces.some((surface) => patternMatchesCommand(regex, surface));
+        if (!anySurfaceMatch) {
+          return { matched: false, matchText, affectedFiles };
+        }
       }
       if (isBreakGlassSettingsBypass(gate, affectedFiles)) {
         return { matched: false, matchText, affectedFiles };
@@ -2423,7 +2927,6 @@ function matchGate(gate, toolName, toolInput = {}) {
     matchText,
     affectedFiles,
     taskScopeViolation,
-    protectedApprovalViolation,
     branchGovernanceViolation,
   };
 }
@@ -2449,6 +2952,7 @@ function matchSelfProtectHardFloor(gate, toolName, toolInput = {}) {
 
   const command = String(toolInput.command || '');
   let matchText = command;
+
   if (gate.id === 'self-protect-config' || gate.id === 'self-protect-hooks-disable') {
     const targetPattern = gate.id === 'self-protect-config'
       ? SELF_PROTECT_CONFIG_TARGET_PATTERN
@@ -2460,7 +2964,28 @@ function matchSelfProtectHardFloor(gate, toolName, toolInput = {}) {
       const commandTargetPattern = gate.id === 'self-protect-config'
         ? SELF_PROTECT_CONFIG_COMMAND_PATTERN
         : SELF_PROTECT_HOOK_COMMAND_PATTERN;
-      if (!SHELL_FILE_MUTATION_PATTERN.test(command) || !commandTargetPattern.test(command)) return null;
+
+      // Inspect every shell redirection destination (optional fd, optional/no
+      // spaces, attached forms like printf x>file, multiple redirects).
+      const redirectPattern = /(?:^|[\s;&|]|[^\s;&|<>])(?:\d*)>{1,2}\s*([^\s;&|<>]+)/g;
+      const redirectTargets = [];
+      let redirectMatch = redirectPattern.exec(command);
+      while (redirectMatch) {
+        if (redirectMatch[1]) redirectTargets.push(redirectMatch[1]);
+        redirectMatch = redirectPattern.exec(command);
+      }
+      if (redirectTargets.length > 0) {
+        // Deny when any redirect destination is protected.
+        if (redirectTargets.some((target) => commandTargetPattern.test(target))) {
+          // fall through to deny
+        } else if (!SHELL_FILE_MUTATION_PATTERN.test(command) || !commandTargetPattern.test(command)) {
+          // Benign redirects and no other protected mutation → allow.
+          return null;
+        }
+        // Benign redirects but command still mutates a protected path another way → deny.
+      } else {
+        if (!SHELL_FILE_MUTATION_PATTERN.test(command) || !commandTargetPattern.test(command)) return null;
+      }
     } else {
       return null;
     }
@@ -2760,6 +3285,27 @@ async function evaluateGatesAsyncInner(toolName, toolInput, configPath) {
     try {
       const { selectHarness } = require('./harness-selector');
       harnessPath = selectHarness(toolName, toolInput);
+      try {
+        // Opt-in RateBurst only (THUMBGATE_RADWARE_RATE=1). Never persist in tests/CI.
+        if (process.env.THUMBGATE_RADWARE_RATE === '1') {
+          const radware = require('./radware-threat-defense.js');
+          const inTest = Boolean(process.env.NODE_TEST || process.env.NODE_TEST_CONTEXT || process.env.CI || process.env.GITHUB_ACTIONS || process.env.VITEST || process.argv.some((a) => a.includes('node:test') || a.endsWith('.test.js')));
+          if (!inTest) {
+            radware.persistCallTimestamp();
+            const burst = radware.checkRateBurst(radware.loadCallTimestamps());
+            if (burst.tripped) {
+              return recordStructuralGateBlock(toolName, toolInput, {
+                decision: 'deny',
+                gate: 'algorithmic-token-drain-circuit-breaker',
+                action: 'block',
+                severity: 'high',
+                message: burst.message,
+                receipt: 'threat_defense_interdicted=true:type=RateBurst:action=block',
+              });
+            }
+          }
+        }
+      } catch { /* optional */ }
     } catch { /* harness-selector is optional */ }
     config = loadGatesConfig(configPath, harnessPath);
   } catch {
@@ -2782,6 +3328,10 @@ async function evaluateGatesAsyncInner(toolName, toolInput, configPath) {
   if (statefulHelperBypassGate) {
     return recordStructuralGateBlock(toolName, toolInput, statefulHelperBypassGate);
   }
+  const stealthMemoryInjectionGate = evaluateStealthMemoryInjection(toolName, toolInput);
+  if (stealthMemoryInjectionGate) {
+    return recordStructuralGateBlock(toolName, toolInput, stealthMemoryInjectionGate);
+  }
   if (isBreakGlassSettingsRecoveryAction(toolName, toolInput)) {
     recordAuditEvent({
       toolName,
@@ -2795,6 +3345,22 @@ async function evaluateGatesAsyncInner(toolName, toolInput, configPath) {
     return null;
   }
 
+  const agentIdentityLifecycleGate = evaluateAgentIdentityLifecycleGate(toolName, toolInput);
+  if (agentIdentityLifecycleGate) {
+    recordStat(agentIdentityLifecycleGate.gate, 'block', null, { toolName, toolInput });
+    const identityAuditRecord = recordAuditEvent({
+      toolName,
+      toolInput,
+      decision: 'deny',
+      gateId: agentIdentityLifecycleGate.gate,
+      message: agentIdentityLifecycleGate.message,
+      severity: agentIdentityLifecycleGate.severity,
+      source: 'gates-engine',
+    });
+    auditToFeedback(identityAuditRecord);
+    return agentIdentityLifecycleGate;
+  }
+
   const pendingThreadResolutionGate = evaluatePendingPrThreadResolutionGate(toolName, toolInput);
   if (pendingThreadResolutionGate) {
     recordStat(pendingThreadResolutionGate.gate, 'block', null, { toolName, toolInput });
@@ -2899,13 +3465,45 @@ async function evaluateGatesAsyncInner(toolName, toolInput, configPath) {
     });
 
     if (gate.action === 'block') {
+      const adminOverride = evaluateAdminOverride(gate, toolName, toolInput);
+      if (adminOverride && adminOverride.authorized) {
+        recordStat(gate.id, 'approve', gate, { toolName, toolInput });
+        const auditRecord = recordAuditEvent({
+          toolName,
+          toolInput,
+          decision: 'allow',
+          gateId: gate.id,
+          message: `Single-use admin override consumed for sha256:${adminOverride.approvalContextDigest}.`,
+          severity: gate.severity,
+          source: 'gates-engine-admin-override',
+        });
+        auditToFeedback(auditRecord);
+        return {
+          decision: 'allow',
+          gate: gate.id,
+          message: `Single-use admin override consumed for sha256:${adminOverride.approvalContextDigest}.`,
+          severity: gate.severity,
+          reasoning,
+          adminOverride,
+        };
+      }
       // Expired leases report under their own gate id so neither the enforcement posture nor
       // the daily block cap can quietly turn this denial into a warning.
       const gateId = matchDetails && matchDetails.taskScopeViolation
         && matchDetails.taskScopeViolation.reasonCode === 'expired_task_scope'
         ? TASK_SCOPE_LEASE_EXPIRED_GATE_ID
         : gate.id;
-      const denyResult = { decision: 'deny', gate: gateId, message, severity: gate.severity, reasoning };
+      const overrideMessage = adminOverride
+        ? `${message} Approval request: ${adminOverride.escalationId}. Action digest: sha256:${adminOverride.approvalContextDigest}.${adminOverride.replayed ? ' The approved override was already consumed.' : ''}`
+        : message;
+      const denyResult = {
+        decision: 'deny',
+        gate: gateId,
+        message: overrideMessage,
+        severity: gate.severity,
+        reasoning,
+        ...(adminOverride ? { requiresAdminOverride: true, adminOverride } : {}),
+      };
       // Free-tier daily block cap: after N blocks/day, deny → warn + upgrade CTA
       const cappedResult = applyDailyBlockCap(denyResult);
       if (cappedResult) {
@@ -2915,7 +3513,7 @@ async function evaluateGatesAsyncInner(toolName, toolInput, configPath) {
         return cappedResult;
       }
       recordStat(gate.id, 'block', gate, { toolName, toolInput });
-      const auditRecord = recordAuditEvent({ toolName, toolInput, decision: 'deny', gateId: gate.id, message, severity: gate.severity, source: 'gates-engine' });
+      const auditRecord = recordAuditEvent({ toolName, toolInput, decision: 'deny', gateId: gate.id, message: overrideMessage, severity: gate.severity, source: 'gates-engine' });
       auditToFeedback(auditRecord);
       return denyResult;
     }
@@ -3003,6 +3601,22 @@ async function evaluateGatesAsyncInner(toolName, toolInput, configPath) {
     return sentinelResult;
   }
 
+  const brokerReceiptResultAsync = evaluateBrokerReceiptGate(toolName, toolInput);
+  if (brokerReceiptResultAsync && brokerReceiptResultAsync.decision === 'deny') {
+    recordStat(brokerReceiptResultAsync.gate, 'block', null, { toolName, toolInput });
+    const auditRecord = recordAuditEvent({
+      toolName,
+      toolInput,
+      decision: 'deny',
+      gateId: brokerReceiptResultAsync.gate,
+      message: brokerReceiptResultAsync.message,
+      severity: brokerReceiptResultAsync.severity,
+      source: 'broker-execution-receipts',
+    });
+    auditToFeedback(auditRecord);
+    return brokerReceiptResultAsync;
+  }
+
   // Audit trail: record allow (no gate matched)
   recordAuditEvent({ toolName, toolInput, decision: 'allow', source: 'gates-engine' });
   return null;
@@ -3015,6 +3629,27 @@ function evaluateGatesInner(toolName, toolInput, configPath) {
     try {
       const { selectHarness } = require('./harness-selector');
       harnessPath = selectHarness(toolName, toolInput);
+      try {
+        // Opt-in RateBurst only (THUMBGATE_RADWARE_RATE=1). Never persist in tests/CI.
+        if (process.env.THUMBGATE_RADWARE_RATE === '1') {
+          const radware = require('./radware-threat-defense.js');
+          const inTest = Boolean(process.env.NODE_TEST || process.env.NODE_TEST_CONTEXT || process.env.CI || process.env.GITHUB_ACTIONS || process.env.VITEST || process.argv.some((a) => a.includes('node:test') || a.endsWith('.test.js')));
+          if (!inTest) {
+            radware.persistCallTimestamp();
+            const burst = radware.checkRateBurst(radware.loadCallTimestamps());
+            if (burst.tripped) {
+              return recordStructuralGateBlock(toolName, toolInput, {
+                decision: 'deny',
+                gate: 'algorithmic-token-drain-circuit-breaker',
+                action: 'block',
+                severity: 'high',
+                message: burst.message,
+                receipt: 'threat_defense_interdicted=true:type=RateBurst:action=block',
+              });
+            }
+          }
+        }
+      } catch { /* optional */ }
     } catch { /* harness-selector is optional */ }
     config = loadGatesConfig(configPath, harnessPath);
   } catch {
@@ -3038,6 +3673,10 @@ function evaluateGatesInner(toolName, toolInput, configPath) {
   if (statefulHelperBypassGate) {
     return recordStructuralGateBlock(toolName, toolInput, statefulHelperBypassGate);
   }
+  const stealthMemoryInjectionGate = evaluateStealthMemoryInjection(toolName, toolInput);
+  if (stealthMemoryInjectionGate) {
+    return recordStructuralGateBlock(toolName, toolInput, stealthMemoryInjectionGate);
+  }
   if (isBreakGlassSettingsRecoveryAction(toolName, toolInput)) {
     recordAuditEvent({
       toolName,
@@ -3051,6 +3690,22 @@ function evaluateGatesInner(toolName, toolInput, configPath) {
     return null;
   }
 
+  const agentIdentityLifecycleGate = evaluateAgentIdentityLifecycleGate(toolName, toolInput);
+  if (agentIdentityLifecycleGate) {
+    recordStat(agentIdentityLifecycleGate.gate, 'block', null, { toolName, toolInput });
+    const identityAuditRecord = recordAuditEvent({
+      toolName,
+      toolInput,
+      decision: 'deny',
+      gateId: agentIdentityLifecycleGate.gate,
+      message: agentIdentityLifecycleGate.message,
+      severity: agentIdentityLifecycleGate.severity,
+      source: 'gates-engine',
+    });
+    auditToFeedback(identityAuditRecord);
+    return agentIdentityLifecycleGate;
+  }
+
   const pendingThreadResolutionGate = evaluatePendingPrThreadResolutionGate(toolName, toolInput);
   if (pendingThreadResolutionGate) {
     recordStat(pendingThreadResolutionGate.gate, 'block', null, { toolName, toolInput });
@@ -3128,13 +3783,45 @@ function evaluateGatesInner(toolName, toolInput, configPath) {
     const reasoning = buildReasoning(gate, toolName, toolInput, matchDetails);
 
     if (gate.action === 'block') {
+      const adminOverride = evaluateAdminOverride(gate, toolName, toolInput);
+      if (adminOverride && adminOverride.authorized) {
+        recordStat(gate.id, 'approve', gate, { toolName, toolInput });
+        const auditRecord = recordAuditEvent({
+          toolName,
+          toolInput,
+          decision: 'allow',
+          gateId: gate.id,
+          message: `Single-use admin override consumed for sha256:${adminOverride.approvalContextDigest}.`,
+          severity: gate.severity,
+          source: 'gates-engine-admin-override',
+        });
+        auditToFeedback(auditRecord);
+        return {
+          decision: 'allow',
+          gate: gate.id,
+          message: `Single-use admin override consumed for sha256:${adminOverride.approvalContextDigest}.`,
+          severity: gate.severity,
+          reasoning,
+          adminOverride,
+        };
+      }
       // Expired leases report under their own gate id so neither the enforcement posture nor
       // the daily block cap can quietly turn this denial into a warning.
       const gateId = matchDetails && matchDetails.taskScopeViolation
         && matchDetails.taskScopeViolation.reasonCode === 'expired_task_scope'
         ? TASK_SCOPE_LEASE_EXPIRED_GATE_ID
         : gate.id;
-      const denyResult = { decision: 'deny', gate: gateId, message, severity: gate.severity, reasoning };
+      const overrideMessage = adminOverride
+        ? `${message} Approval request: ${adminOverride.escalationId}. Action digest: sha256:${adminOverride.approvalContextDigest}.${adminOverride.replayed ? ' The approved override was already consumed.' : ''}`
+        : message;
+      const denyResult = {
+        decision: 'deny',
+        gate: gateId,
+        message: overrideMessage,
+        severity: gate.severity,
+        reasoning,
+        ...(adminOverride ? { requiresAdminOverride: true, adminOverride } : {}),
+      };
       // Free-tier daily block cap: after N blocks/day, deny → warn + upgrade CTA
       const cappedResult = applyDailyBlockCap(denyResult);
       if (cappedResult) {
@@ -3144,7 +3831,7 @@ function evaluateGatesInner(toolName, toolInput, configPath) {
         return cappedResult;
       }
       recordStat(gate.id, 'block', gate, { toolName, toolInput });
-      const auditRecord = recordAuditEvent({ toolName, toolInput, decision: 'deny', gateId: gate.id, message, severity: gate.severity, source: 'gates-engine' });
+      const auditRecord = recordAuditEvent({ toolName, toolInput, decision: 'deny', gateId: gate.id, message: overrideMessage, severity: gate.severity, source: 'gates-engine' });
       auditToFeedback(auditRecord);
       return denyResult;
     }
@@ -3231,6 +3918,24 @@ function evaluateGatesInner(toolName, toolInput, configPath) {
     return sentinelResult;
   }
 
+  // Broker-signed execution receipts: verify attached proof; optionally require
+  // for high-risk provider side effects (THUMBGATE_BROKER_RECEIPT_MODE=enforce).
+  const brokerReceiptResult = evaluateBrokerReceiptGate(toolName, toolInput);
+  if (brokerReceiptResult && brokerReceiptResult.decision === 'deny') {
+    recordStat(brokerReceiptResult.gate, 'block', null, { toolName, toolInput });
+    const auditRecord = recordAuditEvent({
+      toolName,
+      toolInput,
+      decision: 'deny',
+      gateId: brokerReceiptResult.gate,
+      message: brokerReceiptResult.message,
+      severity: brokerReceiptResult.severity,
+      source: 'broker-execution-receipts',
+    });
+    auditToFeedback(auditRecord);
+    return brokerReceiptResult;
+  }
+
   // Audit trail: record allow
   recordAuditEvent({ toolName, toolInput, decision: 'allow', source: 'gates-engine' });
   return null;
@@ -3394,6 +4099,7 @@ function evaluateUnconditionalHardFloor(input = {}, options = {}) {
 
 function evaluateFinancialHardFloor(input = {}, consumeReservation = false, options = {}) {
   const toolName = input.tool_name || input.toolName || 'unknown';
+  if (isRemedyToolName(toolName)) return null;
   const rawToolInput = input.tool_input ?? input.toolInput;
   const toolInput = rawToolInput && typeof rawToolInput === 'object'
     ? rawToolInput
@@ -4233,7 +4939,87 @@ function verifyClaimEvidence(claimText, options = {}) {
 // Exports
 // ---------------------------------------------------------------------------
 
+// ---------------------------------------------------------------------------
+// Agent identity plane (Okta AI-identity checklist: shadow AI + lifecycle)
+// ---------------------------------------------------------------------------
+
+// Warn-dedup per process: one shadow/lifecycle warning per agent id, so the
+// audit log records the finding without spamming every tool call.
+const AGENT_IDENTITY_WARNED = new Set();
+
+function resolveActingAgentId() {
+  return process.env.THUMBGATE_SESSION_AGENT
+    || process.env.THUMBGATE_AGENT_ID
+    || null;
+}
+
+/**
+ * Identity gate for the enforced evaluation path. Every attributed tool call
+ * is recorded as an observation (the producer side of shadow-AI detection).
+ * An observed-but-unregistered agent is a shadow agent: warn-only on every
+ * mode — a strict-mode deny here would brick sessions on repos where nothing
+ * registers agents yet. A registry-retired or disabled agent that keeps
+ * acting is denied under THUMBGATE_STRICT_ENFORCEMENT=1 and warned otherwise:
+ * retirement is an explicit operator action, so enforcing it cannot surprise
+ * a healthy session. Fails open on any registry error — identity tracking
+ * must never break the hook path.
+ */
+function evaluateAgentIdentityLifecycleGate(toolName, toolInput) {
+  try {
+    const agentId = resolveActingAgentId();
+    if (!agentId) return null;
+    const identityStore = require('./audit-trail');
+    try {
+      identityStore.recordObservedAgent(agentId);
+    } catch {
+      // Observation is best-effort.
+    }
+    const registryRow = identityStore.loadAgentRegistry()
+      .filter((agent) => agent && agent.id === agentId)
+      .pop();
+    const strict = process.env.THUMBGATE_STRICT_ENFORCEMENT === '1';
+    const lifecycleStatus = registryRow?.metadata?.lifecycleStatus;
+    if (registryRow && (lifecycleStatus === 'retired' || lifecycleStatus === 'disabled')) {
+      const message = `Agent identity "${agentId}" is ${lifecycleStatus} in the agent registry but is still acting. `
+        + 'Re-activate it via registerAgent with lifecycleStatus "active", or stop the agent.';
+      if (strict) {
+        return { gate: 'agent-identity-lifecycle', decision: 'deny', message, severity: 'critical' };
+      }
+      if (!AGENT_IDENTITY_WARNED.has(`retired:${agentId}`)) {
+        AGENT_IDENTITY_WARNED.add(`retired:${agentId}`);
+        recordAuditEvent({
+          toolName,
+          toolInput,
+          decision: 'warn',
+          gateId: 'agent-identity-lifecycle',
+          message,
+          severity: 'high',
+          source: 'gates-engine',
+        });
+      }
+      return null;
+    }
+    if (!registryRow && !AGENT_IDENTITY_WARNED.has(`shadow:${agentId}`)) {
+      AGENT_IDENTITY_WARNED.add(`shadow:${agentId}`);
+      recordAuditEvent({
+        toolName,
+        toolInput,
+        decision: 'warn',
+        gateId: 'agent-identity-shadow',
+        message: `Shadow agent: "${agentId}" is acting but has never been registered in the agent registry. `
+          + 'Register it via registerAgent so identity, lifecycle, and audit attribution are explicit.',
+        severity: 'medium',
+        source: 'gates-engine',
+      });
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
 module.exports = {
+  evaluateAgentIdentityLifecycleGate,
   loadGatesConfig,
   loadState,
   saveState,
@@ -4246,6 +5032,8 @@ module.exports = {
   isTaskScopeExpired,
   TASK_SCOPE_LEASE_EXPIRED_GATE_ID,
   applyEnforcementPosture,
+  resolveGovernanceMode,
+  alignmentLayerForResult,
   buildTaskScopeViolation,
   setBranchGovernance,
   approveProtectedAction,
@@ -4264,7 +5052,17 @@ module.exports = {
   matchesGate,
   evaluateGates,
   evaluateGatesAsync,
+  actionApprovalDigest,
+  buildMatchSurfaces,
   extractAffectedFiles,
+  extractGitMinusCPaths,
+  resolveRepoRoot,
+  governanceStatePath,
+  currentScopeSessionId,
+  isRemedyToolName,
+  isCommandPositionPermissionChange,
+  isGhApiPrCreateCommand,
+  helperBypassActionKey,
   parseGitPathspec,
   canonicalizeGitCommand,
   canonicalizeCommandForGates,
@@ -4322,6 +5120,7 @@ module.exports = {
   evaluateLocalOnlyRemoteSideEffectGate,
   recordHelperScriptWrite,
   evaluateStatefulHelperBypassGate,
+  evaluateStealthMemoryInjection,
   isAgentHookSettingsFile,
   isBreakGlassSettingsRecoveryAction,
   PR_THREAD_RESOLUTION_ACTION,
@@ -4330,6 +5129,8 @@ module.exports = {
   applyDailyBlockCap,
   getTodayBlockCount,
   incrementTodayBlockCount,
+  effectiveCommandCwd,
+  resolveRepoRoot,
 };
 
 // ---------------------------------------------------------------------------