tickmarkr 2.8.4 → 2.8.6

package/dist/cli/commands/fleet.js

@@ -7,7 +7,7 @@ import { allAdapters, discoverChannels, doctorAgeMs, initDoctorReuse, modelAuthE
 import { catalogModelAdvisory, catalogTierRanking, declaredModelWindow, fleetUnclassifiedModels } from "../../adapters/model-lints.js";
 import { CATALOG_REFRESH_TIMEOUT_MS, formatCatalogRefreshLegs, readCachedCatalog, refreshCatalogCommand } from "../../adapters/catalog-remote.js";
 import { CLAUDE_ALIAS_IDENTITY_STAMPS, readClaudeAliasIdentity } from "../../adapters/claude-code.js";
-import { ConfigError, DEFAULT_CONFIG, fleetEditableFromConfig, fleetEditableEquals, formatFleetPrint, globalConfigDir, DENY_SCOPES, initialDenyPropOf, loadConfigWithMode, lowerLayerModelOverrides, overlayBytesLoadError, readOverlayFile, stagedDenyKeyOf, renderFleetOverlayWrite, repoOverlayPath, repoShadowedUserKeys, ROUTING_MODES, TIER_RANK, unifiedYamlDiff, universeEntryMatches, } from "../../config/config.js";
+import { ConfigError, DEFAULT_CONFIG, fleetEditableFromConfig, fleetEditableEquals, formatFleetPrint, globalConfigDir, DENY_SCOPES, initialDenyPropOf, loadConfigWithMode, lowerLayerModelOverrides, overlayBytesLoadError, ownRepoOverlayPath, readOverlayFile, stagedDenyKeyOf, renderFleetOverlayWrite, repoOverlayPath, repoShadowedUserKeys, ROUTING_MODES, TIER_RANK, unifiedYamlDiff, universeEntryMatches, } from "../../config/config.js";
 import { exclusionReason, projectFleetWhy, renderFleetWhy } from "../../config/fleet-why.js";
 import { overlayHoldingLine, overlayHoldsMap } from "../../config/fleet-overlay.js";
 import { SHAPES, TIERS } from "../../graph/schema.js";
@@ -355,7 +355,10 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
     // them (destinationEdits below) — the repository overlay when it declares the key or masks it
     // with null at it or above, else the user overlay.
     const userPath = join(globalDir, "config.yaml");
-    const repoPath = repoOverlayPath(cwd);
+    // Queue row 195 / D-2102: the save destination is the checkout's OWN file even when the reader
+    // fallback (repoOverlayPath) has this linked worktree reading its main checkout's overlay — a
+    // first save here creates the worktree's own overlay, which then wins wholesale.
+    const repoPath = ownRepoOverlayPath(cwd);
     const currentUserText = () => (existsSync(userPath) ? readFileSync(userPath, "utf8") : "");
     const pathOf = (destination) => (destination === "repo" ? repoPath : userPath);
     // the candidate bytes stand in for the destination layer in the one loader path
@@ -1243,7 +1246,12 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
     // T10: both overlays are guarded whichever one is written, so a holder that moved after the review
     // (the destination itself) refuses instead of retargeting. Null = still current.
     const stalePreview = (pending, reviewed, prior) => {
-        const destinationNow = prior ?? (pending.destination === "repo" ? currentRepoOverlayText(cwd) : currentUserText());
+        // Queue row 195 / D-2102: a repo-destination review renders against the EFFECTIVE repository
+        // overlay — in a linked worktree with no overlay of its own that is the main checkout's file,
+        // while the write lands in the worktree's own (ownRepoOverlayPath). The guard therefore
+        // re-reads the effective layer, not the destination's prior bytes; either file moving after
+        // the review moves that read (an own file appearing wins wholesale), so the refusal stands.
+        const destinationNow = pending.destination === "repo" ? currentRepoOverlayText(cwd) : (prior ?? currentUserText());
         const repoNow = pending.destination === "repo" ? destinationNow : currentRepoOverlayText(cwd);
         const userNow = pending.destination === "user" ? destinationNow : currentUserText();
         if (repoNow !== pending.repo) {

package/dist/cli/commands/init.js

@@ -1,4 +1,3 @@
-import { execFileSync } from "node:child_process";
 import { appendFileSync, cpSync, existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -11,7 +10,8 @@ import { LEGACY_PREFIX, specTemplate } from "../../compile/native.js";
 import { BANNER, kvRow, legend, rule, statusRow, title } from "../../brand.js";
 import { stateDirName, tickmarkrDir } from "../../graph/graph.js";
 import { orcaHostDetected } from "../../drivers/index.js";
-import { WORKTREES_DIR } from "../../run/git.js";
+import { gitSync, WORKTREES_DIR } from "../../run/git.js";
+import { GitTrustRefusal } from "../../run/git-trust.js";
 import { Journal } from "../../run/journal.js";
 import { runLockOwner, runLockRunId, runStatusLine } from "../../run/lock.js";
 import { doctor } from "./doctor.js";
@@ -24,7 +24,7 @@ const ENVIRONMENTS_FOOTER = [
     "environments:",
     "  herdr — the full cockpit — every worker, judge, and consult is a visible pane you can watch and unblock · https://herdr.dev · auto picks it first when HERDR_ENV=1",
     "  orca — visible terminals in the Orca app — auto picks it inside an Orca terminal after herdr and before subprocess; set driver: orca to force it · https://onorca.dev",
-    "  claude code — tickmarkr init --agent installs the /tkr skills + AGENTS.md so Claude Code (or any agent CLI) drives the loop natively",
+    "  claude code — tickmarkr init --agent installs the /tkr skills + AGENTS.md so Claude Code (or any agent CLI) drives the loop natively; in Claude Desktop's Code tab (neither herdr nor Orca) one single-tier session runs the loop on the headless subprocess driver, watched with tickmarkr status --watch --plain",
     "  anywhere — no herdr or Orca terminal? same fail-closed gates, headless subprocess driver (legacy: no herdr? same fail-closed gates, headless subprocess driver when Orca markers are absent)",
 ].join("\n");
 /** Current run truth, lock first; falls back to an abandoned journal. */
@@ -115,7 +115,7 @@ A run is green only when ALL of these hold: the run-end event exists in the jour
 
 ### Verified handoffs
 
-When relaying missions between agents, never use bare send-text (\`herdr agent send\` / pane send-text) — it omits Enter. Use \`herdr pane run <pane> "<message>"\` or \`herdr notification show "<message>"\`. Confirm delivery by reading the TARGET composer afterward; if the sent text still sits unsubmitted after ~15 s, retry the Enter only when that composer read shows the staged text and no permission prompt or numbered choice holds focus — an Enter sent onto an active prompt approves it or picks a choice instead of submitting the message (OBS-1119). Under that guard, send-keys enter to that pane once and read again (OBS-975); when a prompt or choice holds focus instead, resolve it first and re-read before retrying. Never report "relayed" without read-back.
+When relaying missions between agents, never use bare send-text (\`herdr agent send\` / pane send-text) — it omits Enter. Use \`herdr pane run <pane> "<message>"\` or \`herdr notification show "<message>"\`. Confirm delivery by reading the TARGET composer afterward; if the sent text still sits unsubmitted after ~15 s, retry the Enter only when that composer read shows the staged text and no permission prompt or numbered choice holds focus — an Enter sent onto an active prompt approves it or picks a choice instead of submitting the message (OBS-1119). Under that guard, send-keys enter to that pane once and read again (OBS-975); when a prompt or choice holds focus instead, resolve it first and re-read before retrying. Never report "relayed" without read-back. On a plain host (neither herdr nor Orca) there is no pane to read back: hand off through the host's cross-session message tool, and count the handoff confirmed only by the peer's reply.
 
 ### Orient before you act — this block may be the ONLY guidance your host loaded
 
@@ -256,13 +256,8 @@ function gitTracked(cwd, path) {
     const rel = relative(cwd, path);
     if (rel.startsWith(".."))
         return false;
-    try {
-        execFileSync("git", ["ls-files", "--error-unmatch", "--", rel], { cwd, stdio: "ignore" });
-        return true;
-    }
-    catch {
-        return false;
-    }
+    // queue row 2 item b: protected git; a trust refusal throws, an ordinary failure still reads as untracked
+    return gitSync(cwd, ["ls-files", "--error-unmatch", "--", rel]).status === 0;
 }
 async function installAgentFiles(cwd, force, docs, notes) {
     const interactive = process.stdin.isTTY === true && process.stdout.isTTY === true;
@@ -375,19 +370,29 @@ function isPathInside(parentDir, candidatePath) {
 }
 /**
  * The ONLY way the --remove path runs git: GIT_DIR, GIT_WORK_TREE and GIT_COMMON_DIR are stripped so the repository acted on
- * is always cwd's own, and LC_ALL=C keeps stderr parseable. Throws execFileSync's error (status, stderr) unchanged.
+ * is always cwd's own, and LC_ALL=C keeps stderr parseable. Queue row 2 item b: it runs through the protected path (gitSync),
+ * whose GitTrustRefusal propagates unchanged; a failed git throws an error carrying its status and stderr.
  */
 function removeGit(cwd, args) {
     const { GIT_DIR: _dir, GIT_WORK_TREE: _workTree, GIT_COMMON_DIR: _commonDir, ...env } = process.env;
-    return execFileSync("git", args, { cwd, env: { ...env, LC_ALL: "C" }, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    const r = gitSync(cwd, args, { env: { ...env, LC_ALL: "C" } });
+    if (r.error)
+        throw r.error;
+    if (r.status !== 0)
+        throw Object.assign(new Error(`git ${args.join(" ")} failed (${r.status ?? r.signal})`), { status: r.status, stderr: r.stderr });
+    return r.stdout;
 }
+/** A trust refusal is never one of the --remove path's fail-open answers. */
+const rethrowRefusal = (error) => { if (error instanceof GitTrustRefusal)
+    throw error; };
 function isLinkedWorktree(cwd) {
     try {
         const gitDir = removeGit(cwd, ["rev-parse", "--git-dir"]).trim();
         const gitCommonDir = removeGit(cwd, ["rev-parse", "--git-common-dir"]).trim();
         return resolve(cwd, gitDir) !== resolve(cwd, gitCommonDir);
     }
-    catch {
+    catch (error) {
+        rethrowRefusal(error);
         return false;
     }
 }
@@ -405,7 +410,8 @@ function checkLiveLock(cwd) {
                 return mainOwner;
         }
     }
-    catch {
+    catch (error) {
+        rethrowRefusal(error);
         // not a git repo
     }
     return undefined;
@@ -420,6 +426,7 @@ function isGitRepo(cwd) {
         return true;
     }
     catch (err) {
+        rethrowRefusal(err);
         const e = err;
         const stderr = String(e.stderr ?? "").trim();
         if (e.status === 128 && stderr.startsWith("fatal: not a git repository (or any of the parent directories)"))
@@ -433,6 +440,7 @@ function git(cwd, args, message) {
         return removeGit(cwd, args);
     }
     catch (err) {
+        rethrowRefusal(err);
         const stderr = String(err.stderr ?? "").trim();
         throw new Error(stderr ? `${message}: ${stderr}` : message);
     }
@@ -522,16 +530,16 @@ function handleRemove(cwd) {
         const out = removeGit(cwd, ["for-each-ref", "--format=%(refname:short)", "refs/heads/tickmarkr/"]);
         branches = out.split("\n").map((b) => b.trim()).filter(Boolean);
     }
-    catch {
-        // ignore
+    catch (error) {
+        rethrowRefusal(error);
     }
     let preservedRefs = [];
     try {
         const out = removeGit(cwd, ["for-each-ref", "--format=%(refname)", "refs/tickmarkr/preserved/"]);
         preservedRefs = out.split("\n").map((r) => r.trim()).filter(Boolean);
     }
-    catch {
-        // ignore
+    catch (error) {
+        rethrowRefusal(error);
     }
     for (const b of branches) {
         notes.push(`left branch: ${b}`);

package/dist/cli/commands/status.js

@@ -13,7 +13,7 @@ import { projectOperatorSummary } from "../../run/operator-summary.js";
 import { trackJournalRows } from "../../run/protocol.js";
 import { newestPark, permittedDecisionVerbs } from "./approve.js";
 import { currentOwed, endToEndFirstPass, firstPassText, leadLines, leadRows, needsYouText, wallText } from "./report.js";
-import { Journal, bindingToken, effectiveEvents, formatJournalNarration, parseJournalText, physicalLine, engagementComparable, isQualityFailureParkKind, parseRunId, preservedRefsByTask, fatalRunEndCause, recordedTaskFailureKind, runHasEnded, upheldFeedbackByTask, visibleControls, } from "../../run/journal.js";
+import { Journal, bindingToken, effectiveEvents, formatJournalNarration, parseJournalText, physicalLine, engagementComparable, isQualityFailureParkKind, parseRunId, preservedRefsByTask, fatalRunEndCause, recordedTaskFailureKind, runHasEnded, restoresUpheldFeedback, visibleControls, } from "../../run/journal.js";
 import { isPidLive, runLockRunId, runStatusLine } from "../../run/lock.js";
 import { normalizeGateOutcome } from "../../run/outcome.js";
 import { desiredPanes } from "../../run/reconcile.js";
@@ -1070,15 +1070,18 @@ binaryVersion, now = Date.now(), animationFrame = 0, workerLiveness = new Map(),
         }).map(sanitizeTaskText)
         : [];
     // OBS-738: recovery facts stay on the journal's two established reducers. The prefix fold keeps an
-    // older journal equally readable by asking upheldFeedbackByTask what was active at that exact
+    // older journal equally readable by asking restoresUpheldFeedback what was funded at that exact
     // restore boundary; current resume-restore rows additionally carry the same task for narration.
     // OBS-1178: both folds read decisions through the one decision fold over the whole journal.
+    // Queue row 225 (D-2111): only each task's NEWEST restore speaks — never a historical set.
     const decided = effectiveEvents(events);
     const preservedRefs = preservedRefsByTask(events);
-    const restoredUpheldFeedback = new Set(decided.flatMap((event, index) => event.event === "resume-restore" && event.taskId
-        && upheldFeedbackByTask(decided.slice(0, index)).has(event.taskId)
-        ? [event.taskId]
-        : []));
+    const newestRestores = new Map();
+    decided.forEach((event, index) => { if (event.event === "resume-restore" && event.taskId)
+        newestRestores.set(event.taskId, index); });
+    const restoredUpheldFeedback = new Set([...newestRestores]
+        .filter(([taskId, index]) => restoresUpheldFeedback(decided.slice(0, index), taskId))
+        .map(([taskId]) => taskId));
     // OBS-1178: a failed task's newest task-failed row is the token its recheck binds to. Only an
     // effective decision consumes it — a refused or unsound recheck leaves the task failed and the token shown.
     const failureTokens = new Map();

package/dist/cli/commands/verify.js

@@ -14,7 +14,7 @@ import { getTask, loadGraph } from "../../graph/graph.js";
 import { GATE_NAMES } from "../../graph/schema.js";
 import { executionSignal } from "../../run/execution-budget.js";
 import { addDetachedWorktree, linkNodeModules, reflogWitness, removeWorktree, shGit, shGitOk } from "../../run/git.js";
-import { foldOwedChecks, integrationMapped, owedCriteria, Journal, OWED_DISCHARGE_EVENT } from "../../run/journal.js";
+import { foldOwedChecks, integrationMapped, owedCriteria, Journal, OWED_DISCHARGE_EVENT, parseRunId } from "../../run/journal.js";
 import { describeLeaseWait, withRepositoryLease } from "../../run/lease.js";
 import { isPidLive } from "../../run/lock.js";
 import { LAUNCHSERVICES_PORT_STOP, probeLaunchServicesPorts, recordLaunchServices } from "../../run/launchservices-check.js";
@@ -195,8 +195,17 @@ export async function verify(argv, cwd = process.cwd(), options = {}) {
     const stateRoot = await verifyStateRoot(cwd);
     const fileRoot = (file) => existsSync(join(cwd, ".tickmarkr", file)) ? cwd : stateRoot;
     if (resolve(stateRoot) !== resolve(cwd)) {
-        console.error(`verify: state files resolved read-only from ${join(stateRoot, ".tickmarkr")} (linked worktree; per-file origins: `
-            + STATE_FILES.map(file => `${file}: ${join(fileRoot(file), ".tickmarkr", file)} (${fileRoot(file) === cwd ? "local" : "common root"})`).join("; ") + ")");
+        // Queue row 195 / D-2102: the fallback is no longer "read-only" — the one line names every
+        // state file with the path it was read from and its origin, AND every path this invocation
+        // writes: the shared verdict store always, doctor.json when present, the --record journal when given.
+        const reads = STATE_FILES.map(file => `${file}: ${join(fileRoot(file), ".tickmarkr", file)} (${fileRoot(file) === cwd ? "local" : "common root"})`).join("; ");
+        const doctorPath = join(fileRoot("doctor.json"), ".tickmarkr", "doctor.json");
+        const writes = [
+            `verdict store ${getVerdictStore(join(stateRoot, ".tickmarkr")).dir}`,
+            ...(existsSync(doctorPath) ? [`doctor.json ${doctorPath}`] : []),
+            ...(values.record ? [`record journal ${join(stateRoot, ".tickmarkr", "runs", parseRunId(values.record), "journal.jsonl")}`] : []),
+        ].join("; ");
+        console.error(`verify: linked worktree — state files resolve from ${join(stateRoot, ".tickmarkr")} (reads: ${reads}; writes: ${writes})`);
     }
     const cfg = loadConfig(fileRoot("config.yaml"));
     const head = (await shGitOk("git rev-parse HEAD", cwd)).trim();

package/dist/compile/gsd.js

@@ -1,9 +1,9 @@
-import { spawnSync } from "node:child_process";
 import { existsSync, readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative } from "node:path";
 import { parse as parseYaml } from "yaml";
 import { AcceptanceItemSchema, TIERS, validateGraph } from "../graph/schema.js";
 import { CompileError, assertWriteScope, inferShape, sha256 } from "./common.js";
+import { gitSync } from "../run/git.js";
 import { classifyContextPath } from "./native.js";
 // GSD artifact front-end (spec v1.3): one GSD *plan* is one tickmarkr *task* — a plan is
 // worktree-sized; its inner <task> steps stay in the worker prompt via context[0] = the plan file.
@@ -306,9 +306,10 @@ export function compileGsd(src, root) {
     // Match native context reachability against the committed tree. This block only obtains the HEAD
     // snapshot; classifyContextPath remains the single authority for missing, untracked, and glob refs.
     const gitDir = dirname(files[0]);
-    const top = spawnSync("git", ["-C", gitDir, "rev-parse", "--show-toplevel"], { encoding: "utf8", maxBuffer: 1 << 28 });
+    // queue row 2 item b: protected git; a trust refusal throws instead of reading as "no repository"
+    const top = gitSync(gitDir, ["rev-parse", "--show-toplevel"]);
     // -z (queue row 71): without it a non-ASCII path is C-quoted and a tracked ref reads as untracked
-    const tree = spawnSync("git", ["-C", gitDir, "ls-tree", "--full-tree", "-r", "--name-only", "-z", "HEAD"], { encoding: "utf8", maxBuffer: 1 << 28 });
+    const tree = gitSync(gitDir, ["ls-tree", "--full-tree", "-r", "--name-only", "-z", "HEAD"]);
     const repoRoot = typeof top.stdout === "string" ? top.stdout.trim() : "";
     // `root` is the repository whose worktrees will consume these refs. A source nested inside some
     // unrelated repository (as with vendored fixtures) must not be judged against that outer tree.

package/dist/compile/index.js

@@ -1,6 +1,7 @@
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { parse } from "yaml";
+import { repoOverlayPath } from "../config/config.js";
 import { validateGraph } from "../graph/schema.js";
 import { taskUnitContractErrors } from "./collateral.js";
 import { blocksCompile, ownershipFindings, renderOwnershipFinding } from "./ownership.js";
@@ -37,7 +38,9 @@ function detect(src) {
 function repoOverlayMode(repoRoot) {
     if (!repoRoot)
         return undefined;
-    const path = join(repoRoot, ".tickmarkr", "config.yaml");
+    // Queue row 195 / D-2102: the ONE repo-layer path rule — a linked worktree without an overlay of
+    // its own proves against the main checkout's file, never against defaults.
+    const path = repoOverlayPath(repoRoot);
     if (!existsSync(path))
         return undefined;
     try {

package/dist/compile/native.js

@@ -1,9 +1,9 @@
-import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { basename, dirname, join, resolve } from "node:path";
 import { filesGlob } from "../graph/files-glob.js";
 import picomatch from "picomatch";
 import { GATE_NAMES, GRAPH_ROUTING_MODES, ORACLES, renderAcceptanceItem, SHAPES, TIERS, validateGraph, } from "../graph/schema.js";
+import { gitSync } from "../run/git.js";
 import { criterionReadsOnly } from "./collateral.js";
 import { CompileError, inferShape, sha256 } from "./common.js";
 // OBS-170/OBS-184: `context:` is a promise to the worker, and nothing ever checked it could be kept.
@@ -18,7 +18,8 @@ import { CompileError, inferShape, sha256 } from "./common.js";
 // `ls-tree -r HEAD` enumerates that tree once; per-path `cat-file -e HEAD:<path>` is the same oracle
 // one path at a time, and one spawn beats N.
 function trackedAtHead(dir) {
-    const git = (...args) => spawnSync("git", ["-C", dir, ...args], { encoding: "utf8", maxBuffer: 1 << 28 });
+    // queue row 2 item b: every compile git runs through the protected path; a trust refusal throws, never fails open
+    const git = (...args) => gitSync(dir, args);
     const top = git("rev-parse", "--show-toplevel");
     // --full-tree is load-bearing: without it `ls-tree` scopes to the CWD's subtree and prints paths
     // relative to it, so a spec in specs/ would see only specs/-relative names and misjudge every
@@ -146,7 +147,7 @@ function symlinkScopeWarnings(file, tasks, base) {
     if (!scoped.length || !repositoryRoot(file))
         return [];
     const tree = base ?? "HEAD";
-    const git = (...args) => spawnSync("git", ["-C", dirname(file), ...args], { encoding: "utf8", maxBuffer: 1 << 28 });
+    const git = (...args) => gitSync(dirname(file), args);
     const failed = (r) => r.error || r.signal || r.status !== 0 || typeof r.stdout !== "string";
     const why = (r) => r.signal ? `signal ${r.signal}` : r.status === null ? "git did not run" : `git exit ${r.status}`;
     const advisory = (what, r) => `tickmarkr: advisory: files[] symlink inspection could not read ${what} in the selected git tree ${JSON.stringify(tree)} (${why(r)}) — symlink scope is unverified for this compile.`;
@@ -270,7 +271,7 @@ function testsAtHead(root) {
     const cached = headTestCache.get(root);
     if (cached)
         return cached;
-    const grep = spawnSync("git", ["-C", root, "grep", "-I", "-n", "-e", "", "HEAD", "--", "tests/*.test.ts", "tests/**/*.test.ts"], { encoding: "utf8", maxBuffer: 1 << 25 });
+    const grep = gitSync(root, ["grep", "-I", "-n", "-e", "", "HEAD", "--", "tests/*.test.ts", "tests/**/*.test.ts"]);
     if (grep.status !== 0 || typeof grep.stdout !== "string") {
         headTestCache.set(root, []);
         return [];
@@ -389,7 +390,7 @@ function criterionScopeFinding(task, text, criterion, id, tests) {
 // 20-task spec compiled in seconds and the committed-spec corpus test timed out. Fail-open like
 // testsAtHead: no git answer means no corpus, and the lint stays quiet rather than wrong.
 function repoFileList(root) {
-    const ls = spawnSync("git", ["-C", root, "ls-files", "-z", "--cached", "--others", "--exclude-standard"], { encoding: "utf8", maxBuffer: 1 << 25 });
+    const ls = gitSync(root, ["ls-files", "-z", "--cached", "--others", "--exclude-standard"]);
     if (ls.status !== 0 || typeof ls.stdout !== "string")
         return [];
     return ls.stdout.split("\0").filter(Boolean).sort();
@@ -949,7 +950,8 @@ acceptance is required on every task (a nested list of observable outcomes).
     mode: partner-led | risk-based | staff-led — this engagement's routing mode
           (loses only to an explicit \`run --mode\` flag)
     base: commit-or-ref — optional declared source base; the declaration must begin at column zero
-                          (runtime enforcement happens before a run)
+                          (proven against the run's starting commit at run and resume start; a drifted
+                          or unresolvable base is refused before anything is written)
 
   Fields available per task:
     goal:        outcome the task must achieve (defaults to the title if omitted)

package/dist/config/config.d.ts

@@ -459,6 +459,21 @@ export type FleetEditable = Partial<Record<DenyScopeKey, string[]>> & {
     map: Record<string, MapEntry>;
     floors: Record<string, Tier>;
 };
+/** The checkout's OWN repo-layer overlay — every writer's destination, and the reader's answer in
+ *  every case but the one fallback below. */
+export declare function ownRepoOverlayPath(repoRoot: string): string;
+/**
+ * Queue row 195 / D-2102: .tickmarkr/ is gitignored, so a fresh session worktree has no overlay of
+ * its own and every command there would silently run on defaults plus the global layer. ONE rule,
+ * and every repo-layer reader goes through it: a checkout whose own state-dir config.yaml exists
+ * reads it; otherwise a LINKED worktree — a gitfile checkout whose trusted common dir
+ * (src/run/git-trust.ts trustedCommonDir) lies outside it — reads
+ * dirname(common dir)/<state dir>/config.yaml when that file exists; every other case (a main
+ * checkout or its subdirectory, no enclosing checkout, a git trust refusal, an absent main file)
+ * keeps the checkout's own path. WRITERS never follow this fallback: they use ownRepoOverlayPath.
+ * The trust check includes missing, redirected or symlinked commondir metadata and config.worktree
+ * under extensions.worktreeConfig; none can authorize a shared overlay.
+ */
 export declare function repoOverlayPath(repoRoot: string): string;
 export declare function readOverlayFile(path: string): Record<string, unknown>;
 /** A discovered fleet universe row: the served models of one adapter and, per model, the resolved

package/dist/config/config.js

@@ -1,11 +1,12 @@
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, lstatSync, readFileSync, realpathSync } from "node:fs";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { dirname, join, sep } from "node:path";
 import { filesGlob } from "../graph/files-glob.js";
 import { Document, isScalar, parse } from "yaml";
 import { z } from "zod";
 import { CITED_MODEL_WINDOWS } from "../adapters/model-windows.js";
 import { stateDirName } from "../graph/graph.js";
+import { assertGitTrust, trustedCommonDir } from "../run/git-trust.js";
 import { EFFORTS, SHAPES, TIERS } from "../graph/schema.js";
 const TierEnum = z.enum(TIERS, {
     error: (iss) => `Invalid option: expected one of "cheap"|"mid"|"frontier" (got ${JSON.stringify(iss.input)})`,
@@ -744,7 +745,7 @@ export function globalConfigDir() {
 }
 export function overlayPreferShapes(repoRoot, opts = {}) {
     const shapes = new Set();
-    for (const layer of [readYaml(join(opts.globalDir ?? globalConfigDir(), "config.yaml")), readYaml(join(repoRoot, stateDirName(repoRoot), "config.yaml"))]) {
+    for (const layer of [readYaml(join(opts.globalDir ?? globalConfigDir(), "config.yaml")), readYaml(repoOverlayPath(repoRoot))]) {
         const map = layer?.routing?.map;
         if (!map)
             continue;
@@ -835,7 +836,7 @@ export function loadConfigWithMode(repoRoot, opts = {}) {
     // v1.52 T2: repoOverlayText substitutes candidate bytes for the on-disk repo layer — the fleet
     // write guard validates EXACTLY what it is about to write through this one loader path.
     const repoCfg = opts.repoOverlayText === undefined
-        ? readYaml(join(repoRoot, stateDirName(repoRoot), "config.yaml"))
+        ? readYaml(repoOverlayPath(repoRoot))
         : parse(opts.repoOverlayText);
     const merged = deepMerge(deepMerge(structuredClone(DEFAULT_CONFIG), globalCfg), repoCfg);
     const r = TickmarkrConfigSchema.safeParse(merged);
@@ -1017,9 +1018,70 @@ export function configTemplate(overlay) {
 }
 // Fleet overlay mutation, legacy serialization, and diff rendering live together in fleet-overlay.ts.
 export { FLEET_OVERLAY_KEYS, fleetEditableEquals, fleetRepoOverlayFromDelta, renderFleetOverlayWrite, repoOverlayYaml, serializeFleetOverlay, unifiedYamlDiff, } from "./fleet-overlay.js";
-export function repoOverlayPath(repoRoot) {
+/** The checkout's OWN repo-layer overlay — every writer's destination, and the reader's answer in
+ *  every case but the one fallback below. */
+export function ownRepoOverlayPath(repoRoot) {
     return join(repoRoot, stateDirName(repoRoot), "config.yaml");
 }
+/**
+ * Queue row 195 / D-2102: .tickmarkr/ is gitignored, so a fresh session worktree has no overlay of
+ * its own and every command there would silently run on defaults plus the global layer. ONE rule,
+ * and every repo-layer reader goes through it: a checkout whose own state-dir config.yaml exists
+ * reads it; otherwise a LINKED worktree — a gitfile checkout whose trusted common dir
+ * (src/run/git-trust.ts trustedCommonDir) lies outside it — reads
+ * dirname(common dir)/<state dir>/config.yaml when that file exists; every other case (a main
+ * checkout or its subdirectory, no enclosing checkout, a git trust refusal, an absent main file)
+ * keeps the checkout's own path. WRITERS never follow this fallback: they use ownRepoOverlayPath.
+ * The trust check includes missing, redirected or symlinked commondir metadata and config.worktree
+ * under extensions.worktreeConfig; none can authorize a shared overlay.
+ */
+export function repoOverlayPath(repoRoot) {
+    const own = ownRepoOverlayPath(repoRoot);
+    if (existsSync(own))
+        return own;
+    let dotGit;
+    try {
+        for (let dir = realpathSync(repoRoot);;) {
+            const candidate = join(dir, ".git");
+            try {
+                lstatSync(candidate);
+                dotGit = candidate;
+                break;
+            }
+            catch { /* keep walking */ }
+            const up = dirname(dir);
+            if (up === dir)
+                break;
+            dir = up;
+        }
+    }
+    catch {
+        return own;
+    }
+    // A directory .git is a main checkout (or one of its subdirectories); only a gitfile can be linked.
+    if (!dotGit)
+        return own;
+    try {
+        if (!lstatSync(dotGit).isFile())
+            return own;
+    }
+    catch {
+        return own;
+    }
+    let common;
+    try {
+        assertGitTrust(repoRoot);
+        common = trustedCommonDir(repoRoot);
+    }
+    catch {
+        return own;
+    }
+    const checkoutRoot = dirname(dotGit);
+    if (common === checkoutRoot || common.startsWith(`${checkoutRoot}${sep}`))
+        return own; // not linked
+    const shared = ownRepoOverlayPath(dirname(common));
+    return existsSync(shared) ? shared : own;
+}
 export function readOverlayFile(path) {
     const raw = readYaml(path);
     if (raw === undefined || raw === null)

package/dist/drivers/host-env.d.ts

@@ -0,0 +1,3 @@
+export declare const HOST_SESSION_VARS: readonly ["CLAUDECODE", "CLAUDE_CODE_ENTRYPOINT", "CLAUDE_CODE_SESSION_ID", "CLAUDE_CODE_HOST_SESSION_ID", "CLAUDE_CODE_CHILD_SESSION", "CLAUDE_CODE_MESSAGING_SOCKET", "CLAUDE_CODE_MESSAGING_TOKEN", "CLAUDE_CODE_SDK_HAS_HOST_AUTH_REFRESH", "CLAUDE_CODE_SESSION_ATTENDED", "CLAUDE_CODE_EXECPATH", "CLAUDE_CODE_DESKTOP_APP_VERSION", "CLAUDE_CODE_TERMINAL_MCP_TOOLS", "CLAUDE_CODE_ENABLE_ASK_USER_QUESTION_TOOL", "CLAUDE_CODE_EMIT_TOOL_USE_SUMMARIES", "CLAUDE_CODE_ENABLE_SDK_FILE_CHECKPOINTING", "CLAUDE_CODE_REPORT_FINDINGS", "CLAUDE_CODE_STARTUP_FAILURE_RESULTS", "CLAUDE_CODE_EAGER_FLUSH", "CLAUDE_CODE_DISABLE_CRON", "CLAUDE_CODE_SIMPLE", "CLAUDE_CODE_DISABLE_TERMINAL_TITLE", "CLAUDE_CODE_ACCOUNT_UUID", "CLAUDE_CODE_ORGANIZATION_UUID", "CLAUDE_CODE_USER_EMAIL", "CLAUDE_CODE_OAUTH_SCOPES", "CLAUDE_AGENT_SDK_VERSION", "CLAUDE_AGENT_SDK_MCP_NO_PREFIX", "CLAUDE_PID", "CLAUDE_EFFORT", "CLAUDE_PREVIEW_CLASSIFIER_FLOOR", "CLAUDE_CODE_BRIDGE_SESSION_ID"];
+/** A copy of `env` without the host-session names; the input (the daemon's own process.env) is never mutated. */
+export declare function withoutHostSession(env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;

package/dist/drivers/host-env.js

@@ -0,0 +1,47 @@
+// Queue row 193 (D-2102 add.1): a daemon launched from an agent session (the Claude Desktop Code tab, or a
+// claude CLI seat on Orca or herdr) carries that session's host variables, and an agent CLI that inherits
+// them gains the host's tools and effort. This CLOSED denylist is stripped at every choke point an agent
+// CLI or gate command passes: the shell seam, the subprocess driver's seal, the pane seeds and the bare
+// probes. Exact names only — never a prefix: an unlisted CLAUDE_CODE variable and every user auth or
+// provider variable reach children byte-equal. Declared residual: a host variable a future host adds
+// reaches children until it is listed here. Leaf module: imports nothing from src/.
+export const HOST_SESSION_VARS = [
+    "CLAUDECODE",
+    "CLAUDE_CODE_ENTRYPOINT",
+    "CLAUDE_CODE_SESSION_ID",
+    "CLAUDE_CODE_HOST_SESSION_ID",
+    "CLAUDE_CODE_CHILD_SESSION",
+    "CLAUDE_CODE_MESSAGING_SOCKET",
+    "CLAUDE_CODE_MESSAGING_TOKEN",
+    "CLAUDE_CODE_SDK_HAS_HOST_AUTH_REFRESH",
+    "CLAUDE_CODE_SESSION_ATTENDED",
+    "CLAUDE_CODE_EXECPATH",
+    "CLAUDE_CODE_DESKTOP_APP_VERSION",
+    "CLAUDE_CODE_TERMINAL_MCP_TOOLS",
+    "CLAUDE_CODE_ENABLE_ASK_USER_QUESTION_TOOL",
+    "CLAUDE_CODE_EMIT_TOOL_USE_SUMMARIES",
+    "CLAUDE_CODE_ENABLE_SDK_FILE_CHECKPOINTING",
+    "CLAUDE_CODE_REPORT_FINDINGS",
+    "CLAUDE_CODE_STARTUP_FAILURE_RESULTS",
+    "CLAUDE_CODE_EAGER_FLUSH",
+    "CLAUDE_CODE_DISABLE_CRON",
+    "CLAUDE_CODE_SIMPLE",
+    "CLAUDE_CODE_DISABLE_TERMINAL_TITLE",
+    "CLAUDE_CODE_ACCOUNT_UUID",
+    "CLAUDE_CODE_ORGANIZATION_UUID",
+    "CLAUDE_CODE_USER_EMAIL",
+    "CLAUDE_CODE_OAUTH_SCOPES",
+    "CLAUDE_AGENT_SDK_VERSION",
+    "CLAUDE_AGENT_SDK_MCP_NO_PREFIX",
+    "CLAUDE_PID",
+    "CLAUDE_EFFORT",
+    "CLAUDE_PREVIEW_CLASSIFIER_FLOOR",
+    "CLAUDE_CODE_BRIDGE_SESSION_ID",
+];
+/** A copy of `env` without the host-session names; the input (the daemon's own process.env) is never mutated. */
+export function withoutHostSession(env = process.env) {
+    const out = { ...env };
+    for (const k of HOST_SESSION_VARS)
+        delete out[k];
+    return out;
+}

package/dist/drivers/orca.js

@@ -7,6 +7,7 @@ import { createWorktree, FORK_CAP_ENV, resolvedForkCap, sh } from "../run/git.js
 import { Journal, parseRunId } from "../run/journal.js";
 import { stateDirName } from "../graph/graph.js";
 import { readWatchBoard, requestWatchBoardStop, stopWatchBoard, supervisionPresencePath, WATCH_OWNER_ENV } from "../run/supervision.js";
+import { HOST_SESSION_VARS } from "./host-env.js";
 import { MAX_BUF } from "./subprocess.js";
 import { formatOwnedName, panesToClose, parseOwnedName } from "./types.js";
 // Orca (onorca.dev) as a third execution surface beside herdr and subprocess. tickmarkr keeps
@@ -966,7 +967,8 @@ export class OrcaDriver {
         // UI's active worktree (`active`/`current`) nor the daemon's cwd — and the command itself moves
         // into the checkout, because Orca cannot be asked to place a terminal in a path it does not
         // track (OBS-1004). Shell startup can swallow that prefix; prove it from scrollback below.
-        const payload = `export ${FORK_CAP_ENV}=${shq(process.env[FORK_CAP_ENV] ?? resolvedForkCap())}; ${cmd}`;
+        // Queue row 193: the fork cap stays first; the agent session's host variables never reach the worker.
+        const payload = `export ${FORK_CAP_ENV}=${shq(process.env[FORK_CAP_ENV] ?? resolvedForkCap())}; unset ${HOST_SESSION_VARS.join(" ")}; ${cmd}`;
         launchGuards.getStore()?.(); // v2.6.8 T1: eligibility is re-read here, after every awaited lookup above
         const env = await this.call("create", [
             "terminal", "create", "--worktree", `path:${tracked}`, "--title", st.title, "--command", inCheckout(st.cwd, payload),

package/dist/drivers/subprocess.d.ts

@@ -2,7 +2,7 @@ import type { ExecutorDriver, NotifyOpts, Slot, TransportState } from "./types.j
 export declare const MAX_BUF: number;
 export declare const HERDR_CONTROL_VARS: readonly ["HERDR_ENV", "HERDR_SOCKET_PATH", "ORCA_TERMINAL_HANDLE", "ORCA_PANE_KEY", "ORCA_TAB_ID"];
 /**
- * Copy of worker env with the fork cap applied and host control-plane vars stripped.
+ * Copy of worker env with the fork cap applied and host control-plane and host-session vars stripped.
  * Workers retain the run's concurrency-derived cap (resolvedForkCap), independently of
  * verification's suite-window budget. The operator's own export still wins.
  */

package/dist/drivers/subprocess.js

@@ -1,6 +1,7 @@
 import { spawn } from "node:child_process";
 import { shq } from "../adapters/types.js";
 import { createWorktree, FORK_CAP_ENV, resolvedForkCap } from "../run/git.js";
+import { HOST_SESSION_VARS, withoutHostSession } from "./host-env.js";
 // HARD-03: cap retained worker output so a chatty worker can't grow tickmarkr's heap unbounded.
 // 2MB is safe against BOTH consumers: the largest read() call site asks for 1000 lines
 // (daemon.ts:217/247), and every marker (TICKMARKR_RESULT, TICKMARKR_EXIT_<nonce>) is emitted at the
@@ -21,12 +22,12 @@ export const HERDR_CONTROL_VARS = [
     "ORCA_TAB_ID",
 ];
 /**
- * Copy of worker env with the fork cap applied and host control-plane vars stripped.
+ * Copy of worker env with the fork cap applied and host control-plane and host-session vars stripped.
  * Workers retain the run's concurrency-derived cap (resolvedForkCap), independently of
  * verification's suite-window budget. The operator's own export still wins.
  */
 export function sealHerdrEnv(env = process.env) {
-    const out = { ...env };
+    const out = withoutHostSession(env); // queue row 193
     if (!(FORK_CAP_ENV in out))
         out[FORK_CAP_ENV] = resolvedForkCap();
     for (const k of HERDR_CONTROL_VARS)
@@ -37,7 +38,7 @@ export function sealHerdrEnv(env = process.env) {
 export function herdrSealShellPrefix(env = process.env) {
     const forkCap = sealHerdrEnv(env)[FORK_CAP_ENV] ?? resolvedForkCap();
     return `export ${FORK_CAP_ENV}=${shq(forkCap)}; ` +
-        HERDR_CONTROL_VARS.map((k) => `unset ${k}`).join("; ") + "; ";
+        HERDR_CONTROL_VARS.map((k) => `unset ${k}`).join("; ") + `; unset ${HOST_SESSION_VARS.join(" ")}; `;
 }
 export class SubprocessDriver {
     id = "subprocess";

package/dist/gates/baseline.d.ts

@@ -60,7 +60,7 @@ export declare function beginGateEvidence(cwd: string, gate: string, command: st
             subjectCommit: string | null;
         };
         termination: {
-            kind: "unknown" | "timeout" | "signal" | "not-started" | "exit";
+            kind: "unknown" | "signal" | "timeout" | "not-started" | "exit";
             exitCode: number | null;
             signal: string | null;
             timedOut: boolean | null;

package/dist/gates/baseline.js

@@ -1,11 +1,10 @@
 import { createHash, randomUUID } from "node:crypto";
-import { execFileSync } from "node:child_process";
 import { EVICTION_TOMBSTONE_LIMIT, EVICTION_TOMBSTONES_FILE, parseEvictionTombstones } from "../run/receipt-resolver.js";
 import { existsSync, readFileSync, mkdirSync, readdirSync, renameSync, statSync, unlinkSync, writeFileSync, rmdirSync } from "node:fs";
 import { availableParallelism, loadavg, tmpdir } from "node:os";
 import { basename, join } from "node:path";
 import { DEFAULT_EVIDENCE_QUOTA_BYTES } from "../config/config.js";
-import { dependencyLinkRefusal, DEFAULT_SHELL_TIMEOUT_MS, describeCapacity, sameCapacity, sh } from "../run/git.js";
+import { dependencyLinkRefusal, gitSync, DEFAULT_SHELL_TIMEOUT_MS, describeCapacity, sameCapacity, sh } from "../run/git.js";
 import { executionSignal } from "../run/execution-budget.js";
 import { isVitestTestCommand, manifestChildEnv, manifestFileCount } from "./test-manifest.js";
 export const EVIDENCE_TAIL_BYTES = 16 * 1024;
@@ -121,7 +120,9 @@ export function beginGateEvidence(cwd, gate, command, opts = {}, nonce) {
     let subjectCommit = opts.subjectCommit ?? null;
     if (!subjectCommit) {
         try {
-            subjectCommit = execFileSync("git", ["rev-parse", "HEAD"], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+            const result = gitSync(cwd, ["rev-parse", "HEAD"]);
+            if (result.status === 0 && result.stdout.trim())
+                subjectCommit = result.stdout.trim();
         }
         catch { /* unknown subject */ }
     }