tickmarkr 2.8.5 → 2.8.6

package/dist/adapters/codex-commit-check.d.ts

@@ -10,6 +10,7 @@ export interface CodexCommitProbe {
     hostileRoot: string;
     token: string;
     signal?: AbortSignal;
+    repoRoot?: string;
 }
 /** Runs the probe script inside the Codex sandbox and resolves its stdout. Injected in tests. */
 export type CodexSandbox = (probe: CodexCommitProbe) => Promise<string>;
@@ -17,10 +18,10 @@ export interface CodexCommitResult {
     status: CodexCommitStatus;
     detail: string;
 }
-/** The `sh` argv production runs at the fixture worktree: `codex sandbox` under the worker grant fragment. */
+/** Queue row 2 (D-2112, D-2114): the fixture uses the same literal grant as a worker. */
 export declare const codexSandboxArgs: (p: CodexCommitProbe, grant?: string) => string[];
-/** A sandbox executing `grant`; production is CODEX_GIT_GRANT. Tests pass a mutant grant to prove discrimination. */
-export declare const codexSandboxFor: (grant: string) => CodexSandbox;
+/** Queue row 2 (D-2112): tests may supply a mutant; production renders each fixture. */
+export declare const codexSandboxFor: (grant?: string) => CodexSandbox;
 export declare const codexSandbox: CodexSandbox;
 export declare function probeCodexCommit(repoRoot: string, sandbox?: CodexSandbox, signal?: AbortSignal): Promise<CodexCommitResult>;
 /** A persisted verdict outside the closed table (an older or newer doctor.json) reads unknown, never allowed. */

package/dist/adapters/codex-commit-check.js

@@ -4,19 +4,20 @@ import { existsSync, mkdtempSync, readFileSync, rmdirSync, rmSync } from "node:f
 import { tmpdir } from "node:os";
 import { basename, dirname, join } from "node:path";
 import { promisify } from "node:util";
-import { assertGitTrust, GitTrustRefusal, protectedGitEnv } from "../run/git-trust.js";
+import { assertGitTrust, GitTrustRefusal } from "../run/git-trust.js";
+import { shGitOk } from "../run/git.js";
 import { withoutHostSession } from "../drivers/host-env.js";
-import { CODEX_GIT_GRANT, codex } from "./codex.js";
+import { renderCodexGitGrant, codex } from "./codex.js";
 import { shq } from "./types.js";
 const exec = promisify(execFile);
-const git = async (cwd, ...args) => (await exec("git", args, { cwd })).stdout.trim();
-// v2.6.7 T4: host git after the sandbox has had the fixture — validation and cleanup — runs the uncached trust
-// check and the forced child config on every call, so seat-rewritten metadata can neither run a config program
-// nor answer for the probe's commit.
-const hostGit = async (cwd, ...args) => {
-    assertGitTrust(cwd);
-    return (await exec("git", args, { cwd, env: protectedGitEnv(process.env) })).stdout.trim();
-};
+// v2.6.7 T4 → queue row 2 item b (D-2112): every fixture git — setup, validation and cleanup — is tickmarkr's own git
+// (shGitOk): the uncached trust check, the forced inert fsmonitor and hooks and, in a linked checkout, the pin, so
+// seat-rewritten metadata can neither run a config program or hook nor answer for the probe's commit. A trust refusal
+// rejects with GitTrustRefusal naming the path and is reported as an unknown verdict, never folded into another answer.
+const hostGit = async (cwd, args, own) => (await shGitOk(["git", ...args].map(shq).join(" "), cwd, own)).trim();
+/** An ordinary git failure is `fallback`; a trust refusal propagates. */
+const unlessRefused = (fallback) => (error) => { if (error instanceof GitTrustRefusal)
+    throw error; return fallback; };
 /** The fixture checkout's trust after the sandbox returned or threw: a refusal is reported with its path. */
 const fixtureRefusal = (worktree) => {
     try {
@@ -35,14 +36,14 @@ const SCRIPT = `printf %s "$2" > "$1" && echo control=ok || echo control=fail
 git add -- "$1" && git -c core.hooksPath=/dev/null -c core.logAllRefUpdates=true -c commit.gpgsign=false -c user.name=tickmarkr -c user.email=probe@tickmarkr.invalid commit -q -m "tickmarkr-probe $2" && echo commit=ok || echo commit=fail
 (set -C; printf %s "$2" > "$3") 2>/dev/null && echo hook=written || echo hook=denied
 (set -C; printf %s "$2" > "$4") 2>/dev/null && echo root=written || echo root=denied`;
-/** The `sh` argv production runs at the fixture worktree: `codex sandbox` under the worker grant fragment. */
-export const codexSandboxArgs = (p, grant = CODEX_GIT_GRANT) => [
+/** Queue row 2 (D-2112, D-2114): the fixture uses the same literal grant as a worker. */
+export const codexSandboxArgs = (p, grant = renderCodexGitGrant({ cwd: p.worktree, branch: p.branch, repoRoot: p.repoRoot ?? p.commonDir })) => [
     "-c",
     `codex sandbox -c 'sandbox_mode="workspace-write"' ${grant} -- sh -c ${shq(SCRIPT)} sh ${[p.control, p.token, p.hostileHook, p.hostileRoot].map(shq).join(" ")}`,
 ];
-/** A sandbox executing `grant`; production is CODEX_GIT_GRANT. Tests pass a mutant grant to prove discrimination. */
+/** Queue row 2 (D-2112): tests may supply a mutant; production renders each fixture. */
 export const codexSandboxFor = (grant) => async (p) => (await exec("sh", codexSandboxArgs(p, grant), { cwd: p.worktree, timeout: 20_000, signal: p.signal, env: withoutHostSession() })).stdout;
-export const codexSandbox = codexSandboxFor(CODEX_GIT_GRANT);
+export const codexSandbox = codexSandboxFor();
 const holds = (path, token) => {
     try {
         return readFileSync(path, "utf8") === token;
@@ -67,18 +68,28 @@ const contradictory = (out) => {
     }
     return false;
 };
-const tipOf = async (repo, ref) => hostGit(repo, "rev-parse", "--verify", "--quiet", `${ref}^{commit}`).catch(() => undefined);
+const tipOf = async (repo, ref) => hostGit(repo, ["rev-parse", "--verify", "--quiet", `${ref}^{commit}`]).catch(unlessRefused(undefined));
 // This probe's commit and nothing else: one parent (the fixture base), its token in the subject and the control.
 const isProbeCommit = async (repo, commit, base, token) => {
     try {
-        return await hostGit(repo, "log", "-1", "--format=%P %s", commit) === `${base} tickmarkr-probe ${token}`
-            && await hostGit(repo, "cat-file", "blob", `${commit}:${CONTROL}`) === token;
+        return await hostGit(repo, ["log", "-1", "--format=%P %s", commit]) === `${base} tickmarkr-probe ${token}`
+            && await hostGit(repo, ["cat-file", "blob", `${commit}:${CONTROL}`]) === token;
     }
-    catch {
-        return false;
+    catch (e) {
+        return unlessRefused(false)(e);
     }
 };
 export async function probeCodexCommit(repoRoot, sandbox = codexSandbox, signal) {
+    // queue row 2 item b: cleanup stays best effort for ordinary git failures, but a trust refusal there is never
+    // folded into the verdict already reached — it is reported as unknown naming its path (an escape still dominates)
+    let refusal;
+    const result = await probeFixture(repoRoot, sandbox, signal, (e) => { refusal ??= e; });
+    return refusal && result.status !== "escape" ? unknown(`fixture git refused (${refusal.message})`) : result;
+}
+async function probeFixture(repoRoot, sandbox, signal, refused) {
+    /** A cleanup git's ordinary failure is `fallback`; its trust refusal is reported to the caller, then `fallback`. */
+    const cleanup = (fallback) => (e) => { if (e instanceof GitTrustRefusal)
+        refused(e); return fallback; };
     const token = randomUUID();
     const parent = mkdtempSync(join(tmpdir(), "tickmarkr-codex-commit-"));
     // git names the fixture's metadata directory after the checkout's basename; a unique one makes that
@@ -91,21 +102,22 @@ export async function probeCodexCommit(repoRoot, sandbox = codexSandbox, signal)
     let hostile = [];
     let sandboxed = false;
     try {
-        const commonDir = await git(repoRoot, "rev-parse", "--path-format=absolute", "--git-common-dir");
+        const commonDir = await hostGit(repoRoot, ["rev-parse", "--path-format=absolute", "--git-common-dir"]);
         lock = join(commonDir, "worktrees", basename(worktree), "index.lock");
         const hostileHook = join(commonDir, "hooks", branch), hostileRoot = join(commonDir, branch);
         hostile = [hostileHook, hostileRoot];
         if (hostile.some((m) => existsSync(m)))
             return unknown("a foreign file already holds a hostile probe path");
-        base = await git(repoRoot, "rev-parse", "--verify", "HEAD^{commit}");
-        await git(repoRoot, "worktree", "add", "-b", branch, worktree, base);
-        if (join(await git(worktree, "rev-parse", "--absolute-git-dir"), "index.lock") !== lock)
+        base = await hostGit(repoRoot, ["rev-parse", "--verify", "HEAD^{commit}"]);
+        // the add declares the branch capability: a result refused after its child ran is rolled back (checkout and branch)
+        await hostGit(repoRoot, ["worktree", "add", "-b", branch, worktree, base], { createsWorktree: "branch", rollback: { dir: worktree, branch: { name: branch } } });
+        if (join(await hostGit(worktree, ["rev-parse", "--absolute-git-dir"]), "index.lock") !== lock)
             return unknown("the fixture worktree metadata is not where git was expected to put it");
         const control = join(worktree, CONTROL);
         if (existsSync(lock))
             return unknown("a foreign index.lock already holds the fixture worktree");
         sandboxed = true;
-        const out = await sandbox({ worktree, commonDir, branch, control, lock, hostileHook, hostileRoot, token, signal });
+        const out = await sandbox({ worktree, commonDir, branch, control, lock, hostileHook, hostileRoot, token, signal, repoRoot });
         // An escape on disk dominates; every other verdict needs consistent receipts AND disk — and trusted metadata.
         const escape = escaped(hostile, token);
         if (escape)
@@ -145,6 +157,8 @@ export async function probeCodexCommit(repoRoot, sandbox = codexSandbox, signal)
         const refused = sandboxed ? fixtureRefusal(worktree) : undefined;
         if (refused)
             return refused;
+        if (e instanceof GitTrustRefusal)
+            return unknown(`fixture git refused (${e.message})`);
         return unknown(signal?.aborted ? "probe cancelled" : `probe did not run (${(e instanceof Error ? e.message : String(e)).split("\n")[0]})`);
     }
     finally {
@@ -159,7 +173,7 @@ export async function probeCodexCommit(repoRoot, sandbox = codexSandbox, signal)
         // prune — that would take an earlier probe's preserved foreign lock (or anyone's prunable worktree).
         const foreign = lock !== undefined && existsSync(lock);
         if (lock && !foreign) {
-            await hostGit(repoRoot, "worktree", "remove", "--force", worktree).catch(() => undefined);
+            await hostGit(repoRoot, ["worktree", "remove", "--force", worktree]).catch(cleanup(undefined));
             // a failed `worktree add` leaves metadata git no longer removes by path: drop this probe's own directory
             rmSync(dirname(lock), { recursive: true, force: true });
             try {
@@ -170,9 +184,9 @@ export async function probeCodexCommit(repoRoot, sandbox = codexSandbox, signal)
         // The fixture branch and its reflog go only while the tip is still this probe's (the base or its own
         // commit), and update-ref's old-value check refuses if anyone moves it between this read and the delete.
         // Metadata preserved for a foreign lock keeps its branch too: that checkout's HEAD still names it.
-        const tip = base === undefined || foreign ? undefined : await tipOf(repoRoot, ref);
-        if (tip && base && (tip === base || await isProbeCommit(repoRoot, tip, base, token))) {
-            await hostGit(repoRoot, "update-ref", "-d", ref, tip).catch(() => undefined);
+        const tip = base === undefined || foreign ? undefined : await tipOf(repoRoot, ref).catch(cleanup(undefined));
+        if (tip && base && (tip === base || await isProbeCommit(repoRoot, tip, base, token).catch(cleanup(false)))) {
+            await hostGit(repoRoot, ["update-ref", "-d", ref, tip]).catch(cleanup(undefined));
         }
         rmSync(parent, { recursive: true, force: true });
     }

package/dist/adapters/codex.d.ts

@@ -1,11 +1,11 @@
-import { type ModelRetirement, type TrustDialog, type TrustVerdict, type WorkerAdapter } from "./types.js";
+import { type ModelRetirement, type TrustDialog, type TrustVerdict, type WorkerAdapter, type WorkerLaunchContext } from "./types.js";
 export declare function readCodexModelsCache(path?: string): {
     models: string[];
     fetchedAt?: string;
     retirements?: Record<string, ModelRetirement | null>;
     hidden?: string[];
 };
-export declare const CODEX_GIT_GRANT = "-c \"sandbox_workspace_write.writable_roots=[$(tkr_common=$(git rev-parse --path-format=absolute --git-common-dir && echo /) && tkr_gitdir=$(git rev-parse --absolute-git-dir && echo /) && tkr_common=${tkr_common%?/} && tkr_gitdir=${tkr_gitdir%?/} && { tkr_head=$(git symbolic-ref -q HEAD); [ $? -le 1 ]; } && case $tkr_head in (refs/heads/*) tkr_leaf=${tkr_head%/*};; (*) tkr_leaf=;; esac && [ \"$(printf %s \"$tkr_common$tkr_gitdir$tkr_leaf\" | LC_ALL=C tr -d '\\0-\\37\\177\"\\\\')\" = \"$tkr_common$tkr_gitdir$tkr_leaf\" ] && { [ \"$tkr_gitdir\" = \"$tkr_common\" ] || printf '\"%s\",' \"$tkr_gitdir\"; } && printf '\"%s/objects\"' \"$tkr_common\" && { [ -z \"$tkr_leaf\" ] || printf ',\"%s/%s\",\"%s/logs/%s\"' \"$tkr_common\" \"$tkr_leaf\" \"$tkr_common\" \"$tkr_leaf\"; })]\"";
+export declare function renderCodexGitGrant(ctx?: Partial<WorkerLaunchContext>): string;
 export declare const CODEX_TRUST_DIALOG: TrustDialog;
 export declare const CODEX_INPUT_BOX: import("./types.js").InputBox;
 export declare function seedCodexTrust(repoRoot: string, configPath?: string): TrustVerdict;

package/dist/adapters/codex.js

@@ -1,6 +1,7 @@
 import { mkdirSync, readdirSync, readFileSync, realpathSync, statSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
+import { checkedAuthority } from "../run/git-trust.js";
 import { probeVersion } from "./claude-code.js";
 import { parseWorkerResult } from "./prompt.js";
 import { channelsFromConfig, declareInputBox, MODEL_ID_RE, promptFitsArgv, shq, TokenUsageSchema } from "./types.js";
@@ -100,32 +101,37 @@ function codexRetirement(upgrade) {
     // the successor id comes from an external file and is rendered in lints — same charset gate as slugs
     return typeof u.model === "string" && MODEL_ID_RE.test(u.model) ? { retiresAt: u.retirement_at, successor: u.model } : undefined;
 }
-// tickmarkr worktrees keep their gitdir under the MAIN repo's .git/worktrees/<name> — outside the
-// workspace-write sandbox root — so git commit dies on index.lock (incident run-20260709-104447
-// P87-08: "Unable to create …/.git/worktrees/…/index.lock"). Expanded by the launching shell at the
-// worktree cwd, for Codex WORKERS only: v2.6.7 T4 (D-1046) — invoke() (the headless worker form, including
-// the interactive size fallback) and interactiveCommand carry it; headlessCommand, which judge, review,
-// consult and the model probe launch, carries no writable_roots at all (those seats never commit).
-// v2.6.6 T9 (K, D-912) → v2.8.0 T1 (rows 17/18, D-910): the grant is a LEAF of what a linked-worktree branch
-// commit writes, never the shared hooks/config (the shipped [common] and D-910's [common, gitdir] let a seat
-// write <common>/hooks and <common>/config, which unsandboxed git later runs) and never whole common/refs and
-// common/logs (which let a seat move main, any branch or tag, or the stash). The closed root table, in order:
-//   - the worktree's own gitdir, only when it differs from the common dir (an ordinary checkout gets none);
-//   - <common>/objects;
-//   - only when HEAD is a symbolic ref refs/heads/<B>: <common>/refs/heads/<D> and <common>/logs/refs/heads/<D>,
-//     <D> being <B> without its last slash-separated segment (refs/heads itself when <B> holds no slash);
-//     a detached HEAD gets no refs or reflog root.
-// A directory outside any repository, any failed git read, or any root holding a character of the closed
-// forbidden set (U+0000 to U+001F, U+007F DEL, the double quote, the backslash) yields the EMPTY array `[]`:
-// no git write root, so a commit fails closed — never a partial array, an escaped string or codex's
-// literal-string fallback. Every emitted root is therefore a TOML basic string that parses back to the exact
-// path (git's own trailing newline is stripped through a sentinel, never a path's). No common-root fallback;
-// packed-refs is not granted (packed-ref ops fail closed); stash, tags, notes and branches outside the leaf
-// are denied. Declared (queue row 151): sibling refs in the same leaf (other task branches, the run's integration
-// branch under the default prefix) stay writable; since 2.8.1 a write to the integration ref parks the merge and is
-// never published.
-// doctor's probe (codex-commit-check.ts) executes these exact bytes; it never rebuilds the grant.
-export const CODEX_GIT_GRANT = `-c "sandbox_workspace_write.writable_roots=[$(tkr_common=$(git rev-parse --path-format=absolute --git-common-dir && echo /) && tkr_gitdir=$(git rev-parse --absolute-git-dir && echo /) && tkr_common=\${tkr_common%?/} && tkr_gitdir=\${tkr_gitdir%?/} && { tkr_head=$(git symbolic-ref -q HEAD); [ $? -le 1 ]; } && case $tkr_head in (refs/heads/*) tkr_leaf=\${tkr_head%/*};; (*) tkr_leaf=;; esac && [ "$(printf %s "$tkr_common$tkr_gitdir$tkr_leaf" | LC_ALL=C tr -d '\\0-\\37\\177"\\\\')" = "$tkr_common$tkr_gitdir$tkr_leaf" ] && { [ "$tkr_gitdir" = "$tkr_common" ] || printf '"%s",' "$tkr_gitdir"; } && printf '"%s/objects"' "$tkr_common" && { [ -z "$tkr_leaf" ] || printf ',"%s/%s","%s/logs/%s"' "$tkr_common" "$tkr_leaf" "$tkr_common" "$tkr_leaf"; })]"`;
+// Queue row 2 item a (D-2112, D-2114): tickmarkr renders literal roots from the checked authority,
+// never a launch-shell git lookup. The worker's common dir must be the run repository's trusted one.
+// Closed table: gitdir only when distinct, common objects, and the assigned branch's ref/reflog leaf
+// only while its HEAD still names that branch. Ordinary checkouts omit gitdir; packed-refs stays denied.
+// Any refusal, absent context or forbidden byte yields []; permitted bytes survive TOML and shq exactly.
+// Queue row 151: sibling refs inside the assigned leaf remain writable.
+export function renderCodexGitGrant(ctx) {
+    let roots = [];
+    try {
+        if (!ctx?.cwd || !ctx.branch || !ctx.repoRoot)
+            throw new Error("missing launch context");
+        const authority = checkedAuthority(ctx.cwd);
+        const run = checkedAuthority(ctx.repoRoot);
+        if (!authority || !run || authority.common !== run.common)
+            throw new Error("foreign git authority");
+        const { gitdir, common } = authority;
+        roots = [...(gitdir === common ? [] : [gitdir]), `${common}/objects`];
+        const head = readFileSync(join(gitdir, "HEAD"), "utf8");
+        if (head === `ref: refs/heads/${ctx.branch}\n` || head === `ref: refs/heads/${ctx.branch}`) {
+            const ref = `refs/heads/${ctx.branch}`;
+            const leaf = ref.slice(0, ref.lastIndexOf("/"));
+            roots.push(`${common}/${leaf}`, `${common}/logs/${leaf}`);
+        }
+        if (roots.some(root => /[\x00-\x1f\x7f"\\]/.test(root)))
+            roots = [];
+    }
+    catch {
+        roots = [];
+    }
+    return `-c ${shq(`sandbox_workspace_write.writable_roots=[${roots.map(root => `"${root}"`).join(",")}]`)}`;
+}
 // OBS-125: codex 0.144.x gates enabled hooks behind PER-PROJECT-PATH hook trust — a NEW gate distinct
 // from the directory trust seedCodexTrust seeds. Every worker runs in a fresh ephemeral worktree, an
 // untrusted project, so codex re-prompts "Hooks need review" and the interactive worker stalls forever
@@ -275,7 +281,7 @@ export function codexMcpSuppressionFlags(configPath) {
     }
     return flags.join(" ");
 }
-// The one headless form: `grant` is "" for every non-worker seat and ` ${CODEX_GIT_GRANT}` for the worker.
+// Queue row 2 (D-2112): non-worker seats omit the grant; workers carry the rendered argument.
 const codexExec = (promptFile, model, effort, grant) => `codex exec --sandbox workspace-write ${CODEX_HOOK_TRUST} ${codexMcpSuppressionFlags()}${grant}${codexEffortFlag(effort)} --model ${shq(model)} - < ${shq(promptFile)}`;
 export const codex = {
     id: "codex",
@@ -286,7 +292,7 @@ export const codex = {
     probe: async () => probeVersion("codex"),
     channels: (cfg) => channelsFromConfig("codex", cfg),
     // v1.65 T3: every flag the command builder below hardcodes (incl. codexMcpSuppressionFlags' -c/
-    // --disable and CODEX_GIT_GRANT's -c) — all listed by top-level `codex --help`, verified 2026-07-22.
+    // --disable and renderCodexGitGrant's -c) — all listed by top-level `codex --help`, verified 2026-07-22.
     hardcodedFlags: { binary: "codex", flags: ["--sandbox", "-a", "-s", "--model", "-c", "--disable", "--dangerously-bypass-hook-trust"] },
     // --sandbox workspace-write is the autonomous sandbox mode (codex v0.144.1+)
     // MCP suppression built per dispatch (config can change between runs) — see codexMcpSuppressionFlags.
@@ -304,11 +310,11 @@ export const codex = {
     // autonomous approval policy (exec has no approvals to configure).
     // OBS-930 (Linux): the inlined prompt is ONE argv string and Linux caps one at 131072 bytes, so a
     // prompt over promptArgvCeiling() returns null → worker-mode-fallback → the headless form (types.ts).
-    interactiveCommand: (promptFile, model, effort) => promptFitsArgv(promptFile)
-        ? `codex -a never -s workspace-write ${CODEX_HOOK_TRUST} ${codexMcpSuppressionFlags()} ${CODEX_GIT_GRANT}${codexEffortFlag(effort)} --model ${shq(model)} "$(cat ${shq(promptFile)})"`
+    interactiveCommand: (promptFile, model, effort, ctx) => promptFitsArgv(promptFile)
+        ? `codex -a never -s workspace-write ${CODEX_HOOK_TRUST} ${codexMcpSuppressionFlags()} ${renderCodexGitGrant(ctx)}${codexEffortFlag(effort)} --model ${shq(model)} "$(cat ${shq(promptFile)})"`
         : null,
-    invoke(task, _cwd, a, ctx) {
-        return { command: codexExec(ctx.promptFile, a.model, a.effort, ` ${CODEX_GIT_GRANT}`) };
+    invoke(task, cwd, a, ctx) {
+        return { command: codexExec(ctx.promptFile, a.model, a.effort, ` ${renderCodexGitGrant({ ...ctx, cwd })}`) };
     },
     parse: parseWorkerResult,
     // v1.22 T5: seed [projects."<repoRoot>"] trust_level="trusted" so fresh worktrees never stall on

package/dist/adapters/model-lints.js

@@ -1,8 +1,8 @@
-import { spawnSync } from "node:child_process";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { DEFAULT_CONFIG, TIER_RANK } from "../config/config.js";
 import { filesGlob } from "../graph/files-glob.js";
+import { gitSync } from "../run/git.js";
 import { piModelVendor } from "./pi.js";
 import { buildTaskPrompt } from "./prompt.js";
 import { channelKey, MODEL_ID_RE } from "./types.js";
@@ -249,7 +249,8 @@ const GLOB_CHARS = /[*?{[]/;
 // and `-z` is load-bearing correctness, not economy: without it git quotes any non-ASCII path, so
 // every Arabic/UTF-8 tracked file read as absent.
 function baseTreeAtHead(dir) {
-    const git = (...args) => spawnSync("git", ["-C", dir, ...args], { encoding: "utf8", maxBuffer: 1 << 28 });
+    // queue row 2 item b: protected git; a trust refusal throws instead of reading as "no base tree"
+    const git = (...args) => gitSync(dir, args);
     const top = git("rev-parse", "--show-toplevel");
     const tree = git("ls-tree", "--full-tree", "-r", "-l", "-z", "HEAD");
     if (top.status !== 0 || tree.status !== 0 || typeof top.stdout !== "string" || typeof tree.stdout !== "string")
@@ -287,7 +288,7 @@ function measureBytes(tree, rel) {
     return covered ? total : undefined;
 }
 function absentContextReason(root, path) {
-    if (spawnSync("git", ["-C", root, "check-ignore", "-q", "--", path]).status === 0)
+    if (gitSync(root, ["check-ignore", "-q", "--", path]).status === 0)
         return "gitignored";
     return existsSync(join(root, path)) ? "untracked" : "absent";
 }

package/dist/adapters/types.d.ts

@@ -187,6 +187,12 @@ export declare class SettledTrailerTracker {
     constructor(markers: readonly BusyFrameMarker[]);
     sample(paneText: string, trailer: boolean): boolean;
 }
+/** Queue row 2 item a (D-2112, D-2114): context owned by the task dispatcher. */
+export interface WorkerLaunchContext {
+    cwd: string;
+    branch: string;
+    repoRoot: string;
+}
 export interface WorkerAdapter {
     id: string;
     vendor: string;
@@ -197,13 +203,15 @@ export interface WorkerAdapter {
     headlessCommand(promptFile: string, model: string, effort?: Effort): string;
     harnessBannerRows?: readonly string[];
     paneReviewBuffersOutput?: boolean;
-    interactiveCommand(promptFile: string, model: string, effort?: Effort): string | null;
+    interactiveCommand(promptFile: string, model: string, effort?: Effort, ctx?: WorkerLaunchContext): string | null;
     interactiveSeed?: InteractiveSeed;
     resumeCommand?(sessionId: string, promptFile: string, model: string, effort?: Effort): string;
     sessionIdFrom?(output: string): string | undefined;
     resumeUnknownContext?: boolean;
     invoke(task: Task, cwd: string, a: Assignment, ctx: {
         promptFile: string;
+        branch?: string;
+        repoRoot?: string;
     }): Invocation;
     parse(output: string, nonce: string): WorkerResult;
     listModels?(): Promise<string[]>;

package/dist/cli/commands/approve.js

@@ -1,11 +1,11 @@
 import { graphDefinitionHash, loadGraph, saveGraph, taskDefinitionFingerprint } from "../../graph/graph.js";
 import { filesGlob } from "../../graph/files-glob.js";
-import { execFileSync } from "node:child_process";
 import { userInfo } from "node:os";
 import { allAdapters } from "../../adapters/registry.js";
 import { channelKey } from "../../adapters/types.js";
 import { loadConfig } from "../../config/config.js";
 import { integrationBranch } from "../../run/merge.js";
+import { gitSync } from "../../run/git.js";
 import { integrationAnchor } from "../../run/daemon.js";
 import { separabilityErrors, surfaceErrors, taskBudgetErrors } from "../../compile/collateral.js";
 import { GATE_NAMES } from "../../graph/schema.js";
@@ -444,15 +444,10 @@ function mergedSiblingExempt(cwd, events, status, siblingId, requesterRef) {
     if (commit === undefined || !FULL_OBJECT_ID.test(commit))
         return false;
     const ref = requesterRef();
-    try {
-        execFileSync("git", ["rev-parse", "--verify", ref], { cwd, stdio: "ignore" });
-        execFileSync("git", ["merge-base", "--is-ancestor", commit, ref], { cwd, stdio: "ignore" });
-    }
-    catch {
-        return false;
-    }
-    return true;
+    return gitOk(cwd, "rev-parse", "--verify", ref) && gitOk(cwd, "merge-base", "--is-ancestor", commit, ref);
 }
+/** Queue row 2 item b: approve's git runs through the protected path; a trust refusal throws, never reads as false. */
+const gitOk = (cwd, ...args) => gitSync(cwd, args).status === 0;
 /** The conflicting unordered pairs of separabilityErrors, in its exact emission order. */
 function separabilityPairs(tasks) {
     const byId = new Map(tasks.map((t) => [t.id, t.deps ?? []]));
@@ -531,27 +526,13 @@ function failedTaskCommitsAhead(cwd, journal, runId, taskId) {
     const preservedRef = preserved?.data.ref;
     let ref = taskRef;
     if (preservedRef) {
-        try {
-            execFileSync("git", ["rev-parse", "--verify", taskRef], { cwd, stdio: "ignore" });
-            execFileSync("git", ["merge-base", "--is-ancestor", taskRef, preservedRef], { cwd, stdio: "ignore" });
+        if (gitOk(cwd, "rev-parse", "--verify", taskRef) && gitOk(cwd, "merge-base", "--is-ancestor", taskRef, preservedRef))
+            ref = preservedRef;
+        else if (!gitOk(cwd, "rev-parse", "--verify", taskRef))
             ref = preservedRef;
-        }
-        catch {
-            try {
-                execFileSync("git", ["rev-parse", "--verify", taskRef], { cwd, stdio: "ignore" });
-            }
-            catch {
-                ref = preservedRef;
-            }
-        }
-    }
-    try {
-        const out = execFileSync("git", ["rev-list", "--count", `${integration.base}..${ref}`], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
-        return { ref, base, count: Number.parseInt(out.trim(), 10) || 0 };
-    }
-    catch {
-        return { ref, base, count: 0 };
     }
+    const out = gitSync(cwd, ["rev-list", "--count", `${integration.base}..${ref}`]);
+    return { ref, base, count: out.status === 0 ? Number.parseInt(out.stdout.trim(), 10) || 0 : 0 };
 }
 // The status is command OUTPUT, not a typed sibling result: the registered approve function returns
 // one primitive string and the dispatcher prints those bytes unchanged. A compact sentinel followed

package/dist/cli/commands/init.js

@@ -1,4 +1,3 @@
-import { execFileSync } from "node:child_process";
 import { appendFileSync, cpSync, existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -11,7 +10,8 @@ import { LEGACY_PREFIX, specTemplate } from "../../compile/native.js";
 import { BANNER, kvRow, legend, rule, statusRow, title } from "../../brand.js";
 import { stateDirName, tickmarkrDir } from "../../graph/graph.js";
 import { orcaHostDetected } from "../../drivers/index.js";
-import { WORKTREES_DIR } from "../../run/git.js";
+import { gitSync, WORKTREES_DIR } from "../../run/git.js";
+import { GitTrustRefusal } from "../../run/git-trust.js";
 import { Journal } from "../../run/journal.js";
 import { runLockOwner, runLockRunId, runStatusLine } from "../../run/lock.js";
 import { doctor } from "./doctor.js";
@@ -256,13 +256,8 @@ function gitTracked(cwd, path) {
     const rel = relative(cwd, path);
     if (rel.startsWith(".."))
         return false;
-    try {
-        execFileSync("git", ["ls-files", "--error-unmatch", "--", rel], { cwd, stdio: "ignore" });
-        return true;
-    }
-    catch {
-        return false;
-    }
+    // queue row 2 item b: protected git; a trust refusal throws, an ordinary failure still reads as untracked
+    return gitSync(cwd, ["ls-files", "--error-unmatch", "--", rel]).status === 0;
 }
 async function installAgentFiles(cwd, force, docs, notes) {
     const interactive = process.stdin.isTTY === true && process.stdout.isTTY === true;
@@ -375,19 +370,29 @@ function isPathInside(parentDir, candidatePath) {
 }
 /**
  * The ONLY way the --remove path runs git: GIT_DIR, GIT_WORK_TREE and GIT_COMMON_DIR are stripped so the repository acted on
- * is always cwd's own, and LC_ALL=C keeps stderr parseable. Throws execFileSync's error (status, stderr) unchanged.
+ * is always cwd's own, and LC_ALL=C keeps stderr parseable. Queue row 2 item b: it runs through the protected path (gitSync),
+ * whose GitTrustRefusal propagates unchanged; a failed git throws an error carrying its status and stderr.
  */
 function removeGit(cwd, args) {
     const { GIT_DIR: _dir, GIT_WORK_TREE: _workTree, GIT_COMMON_DIR: _commonDir, ...env } = process.env;
-    return execFileSync("git", args, { cwd, env: { ...env, LC_ALL: "C" }, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+    const r = gitSync(cwd, args, { env: { ...env, LC_ALL: "C" } });
+    if (r.error)
+        throw r.error;
+    if (r.status !== 0)
+        throw Object.assign(new Error(`git ${args.join(" ")} failed (${r.status ?? r.signal})`), { status: r.status, stderr: r.stderr });
+    return r.stdout;
 }
+/** A trust refusal is never one of the --remove path's fail-open answers. */
+const rethrowRefusal = (error) => { if (error instanceof GitTrustRefusal)
+    throw error; };
 function isLinkedWorktree(cwd) {
     try {
         const gitDir = removeGit(cwd, ["rev-parse", "--git-dir"]).trim();
         const gitCommonDir = removeGit(cwd, ["rev-parse", "--git-common-dir"]).trim();
         return resolve(cwd, gitDir) !== resolve(cwd, gitCommonDir);
     }
-    catch {
+    catch (error) {
+        rethrowRefusal(error);
         return false;
     }
 }
@@ -405,7 +410,8 @@ function checkLiveLock(cwd) {
                 return mainOwner;
         }
     }
-    catch {
+    catch (error) {
+        rethrowRefusal(error);
         // not a git repo
     }
     return undefined;
@@ -420,6 +426,7 @@ function isGitRepo(cwd) {
         return true;
     }
     catch (err) {
+        rethrowRefusal(err);
         const e = err;
         const stderr = String(e.stderr ?? "").trim();
         if (e.status === 128 && stderr.startsWith("fatal: not a git repository (or any of the parent directories)"))
@@ -433,6 +440,7 @@ function git(cwd, args, message) {
         return removeGit(cwd, args);
     }
     catch (err) {
+        rethrowRefusal(err);
         const stderr = String(err.stderr ?? "").trim();
         throw new Error(stderr ? `${message}: ${stderr}` : message);
     }
@@ -522,16 +530,16 @@ function handleRemove(cwd) {
         const out = removeGit(cwd, ["for-each-ref", "--format=%(refname:short)", "refs/heads/tickmarkr/"]);
         branches = out.split("\n").map((b) => b.trim()).filter(Boolean);
     }
-    catch {
-        // ignore
+    catch (error) {
+        rethrowRefusal(error);
     }
     let preservedRefs = [];
     try {
         const out = removeGit(cwd, ["for-each-ref", "--format=%(refname)", "refs/tickmarkr/preserved/"]);
         preservedRefs = out.split("\n").map((r) => r.trim()).filter(Boolean);
     }
-    catch {
-        // ignore
+    catch (error) {
+        rethrowRefusal(error);
     }
     for (const b of branches) {
         notes.push(`left branch: ${b}`);

package/dist/cli/commands/status.js

@@ -13,7 +13,7 @@ import { projectOperatorSummary } from "../../run/operator-summary.js";
 import { trackJournalRows } from "../../run/protocol.js";
 import { newestPark, permittedDecisionVerbs } from "./approve.js";
 import { currentOwed, endToEndFirstPass, firstPassText, leadLines, leadRows, needsYouText, wallText } from "./report.js";
-import { Journal, bindingToken, effectiveEvents, formatJournalNarration, parseJournalText, physicalLine, engagementComparable, isQualityFailureParkKind, parseRunId, preservedRefsByTask, fatalRunEndCause, recordedTaskFailureKind, runHasEnded, upheldFeedbackByTask, visibleControls, } from "../../run/journal.js";
+import { Journal, bindingToken, effectiveEvents, formatJournalNarration, parseJournalText, physicalLine, engagementComparable, isQualityFailureParkKind, parseRunId, preservedRefsByTask, fatalRunEndCause, recordedTaskFailureKind, runHasEnded, restoresUpheldFeedback, visibleControls, } from "../../run/journal.js";
 import { isPidLive, runLockRunId, runStatusLine } from "../../run/lock.js";
 import { normalizeGateOutcome } from "../../run/outcome.js";
 import { desiredPanes } from "../../run/reconcile.js";
@@ -1070,15 +1070,18 @@ binaryVersion, now = Date.now(), animationFrame = 0, workerLiveness = new Map(),
         }).map(sanitizeTaskText)
         : [];
     // OBS-738: recovery facts stay on the journal's two established reducers. The prefix fold keeps an
-    // older journal equally readable by asking upheldFeedbackByTask what was active at that exact
+    // older journal equally readable by asking restoresUpheldFeedback what was funded at that exact
     // restore boundary; current resume-restore rows additionally carry the same task for narration.
     // OBS-1178: both folds read decisions through the one decision fold over the whole journal.
+    // Queue row 225 (D-2111): only each task's NEWEST restore speaks — never a historical set.
     const decided = effectiveEvents(events);
     const preservedRefs = preservedRefsByTask(events);
-    const restoredUpheldFeedback = new Set(decided.flatMap((event, index) => event.event === "resume-restore" && event.taskId
-        && upheldFeedbackByTask(decided.slice(0, index)).has(event.taskId)
-        ? [event.taskId]
-        : []));
+    const newestRestores = new Map();
+    decided.forEach((event, index) => { if (event.event === "resume-restore" && event.taskId)
+        newestRestores.set(event.taskId, index); });
+    const restoredUpheldFeedback = new Set([...newestRestores]
+        .filter(([taskId, index]) => restoresUpheldFeedback(decided.slice(0, index), taskId))
+        .map(([taskId]) => taskId));
     // OBS-1178: a failed task's newest task-failed row is the token its recheck binds to. Only an
     // effective decision consumes it — a refused or unsound recheck leaves the task failed and the token shown.
     const failureTokens = new Map();

package/dist/compile/gsd.js

@@ -1,9 +1,9 @@
-import { spawnSync } from "node:child_process";
 import { existsSync, readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative } from "node:path";
 import { parse as parseYaml } from "yaml";
 import { AcceptanceItemSchema, TIERS, validateGraph } from "../graph/schema.js";
 import { CompileError, assertWriteScope, inferShape, sha256 } from "./common.js";
+import { gitSync } from "../run/git.js";
 import { classifyContextPath } from "./native.js";
 // GSD artifact front-end (spec v1.3): one GSD *plan* is one tickmarkr *task* — a plan is
 // worktree-sized; its inner <task> steps stay in the worker prompt via context[0] = the plan file.
@@ -306,9 +306,10 @@ export function compileGsd(src, root) {
     // Match native context reachability against the committed tree. This block only obtains the HEAD
     // snapshot; classifyContextPath remains the single authority for missing, untracked, and glob refs.
     const gitDir = dirname(files[0]);
-    const top = spawnSync("git", ["-C", gitDir, "rev-parse", "--show-toplevel"], { encoding: "utf8", maxBuffer: 1 << 28 });
+    // queue row 2 item b: protected git; a trust refusal throws instead of reading as "no repository"
+    const top = gitSync(gitDir, ["rev-parse", "--show-toplevel"]);
     // -z (queue row 71): without it a non-ASCII path is C-quoted and a tracked ref reads as untracked
-    const tree = spawnSync("git", ["-C", gitDir, "ls-tree", "--full-tree", "-r", "--name-only", "-z", "HEAD"], { encoding: "utf8", maxBuffer: 1 << 28 });
+    const tree = gitSync(gitDir, ["ls-tree", "--full-tree", "-r", "--name-only", "-z", "HEAD"]);
     const repoRoot = typeof top.stdout === "string" ? top.stdout.trim() : "";
     // `root` is the repository whose worktrees will consume these refs. A source nested inside some
     // unrelated repository (as with vendored fixtures) must not be judged against that outer tree.

package/dist/compile/native.js

@@ -1,9 +1,9 @@
-import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { basename, dirname, join, resolve } from "node:path";
 import { filesGlob } from "../graph/files-glob.js";
 import picomatch from "picomatch";
 import { GATE_NAMES, GRAPH_ROUTING_MODES, ORACLES, renderAcceptanceItem, SHAPES, TIERS, validateGraph, } from "../graph/schema.js";
+import { gitSync } from "../run/git.js";
 import { criterionReadsOnly } from "./collateral.js";
 import { CompileError, inferShape, sha256 } from "./common.js";
 // OBS-170/OBS-184: `context:` is a promise to the worker, and nothing ever checked it could be kept.
@@ -18,7 +18,8 @@ import { CompileError, inferShape, sha256 } from "./common.js";
 // `ls-tree -r HEAD` enumerates that tree once; per-path `cat-file -e HEAD:<path>` is the same oracle
 // one path at a time, and one spawn beats N.
 function trackedAtHead(dir) {
-    const git = (...args) => spawnSync("git", ["-C", dir, ...args], { encoding: "utf8", maxBuffer: 1 << 28 });
+    // queue row 2 item b: every compile git runs through the protected path; a trust refusal throws, never fails open
+    const git = (...args) => gitSync(dir, args);
     const top = git("rev-parse", "--show-toplevel");
     // --full-tree is load-bearing: without it `ls-tree` scopes to the CWD's subtree and prints paths
     // relative to it, so a spec in specs/ would see only specs/-relative names and misjudge every
@@ -146,7 +147,7 @@ function symlinkScopeWarnings(file, tasks, base) {
     if (!scoped.length || !repositoryRoot(file))
         return [];
     const tree = base ?? "HEAD";
-    const git = (...args) => spawnSync("git", ["-C", dirname(file), ...args], { encoding: "utf8", maxBuffer: 1 << 28 });
+    const git = (...args) => gitSync(dirname(file), args);
     const failed = (r) => r.error || r.signal || r.status !== 0 || typeof r.stdout !== "string";
     const why = (r) => r.signal ? `signal ${r.signal}` : r.status === null ? "git did not run" : `git exit ${r.status}`;
     const advisory = (what, r) => `tickmarkr: advisory: files[] symlink inspection could not read ${what} in the selected git tree ${JSON.stringify(tree)} (${why(r)}) — symlink scope is unverified for this compile.`;
@@ -270,7 +271,7 @@ function testsAtHead(root) {
     const cached = headTestCache.get(root);
     if (cached)
         return cached;
-    const grep = spawnSync("git", ["-C", root, "grep", "-I", "-n", "-e", "", "HEAD", "--", "tests/*.test.ts", "tests/**/*.test.ts"], { encoding: "utf8", maxBuffer: 1 << 25 });
+    const grep = gitSync(root, ["grep", "-I", "-n", "-e", "", "HEAD", "--", "tests/*.test.ts", "tests/**/*.test.ts"]);
     if (grep.status !== 0 || typeof grep.stdout !== "string") {
         headTestCache.set(root, []);
         return [];
@@ -389,7 +390,7 @@ function criterionScopeFinding(task, text, criterion, id, tests) {
 // 20-task spec compiled in seconds and the committed-spec corpus test timed out. Fail-open like
 // testsAtHead: no git answer means no corpus, and the lint stays quiet rather than wrong.
 function repoFileList(root) {
-    const ls = spawnSync("git", ["-C", root, "ls-files", "-z", "--cached", "--others", "--exclude-standard"], { encoding: "utf8", maxBuffer: 1 << 25 });
+    const ls = gitSync(root, ["ls-files", "-z", "--cached", "--others", "--exclude-standard"]);
     if (ls.status !== 0 || typeof ls.stdout !== "string")
         return [];
     return ls.stdout.split("\0").filter(Boolean).sort();
@@ -949,7 +950,8 @@ acceptance is required on every task (a nested list of observable outcomes).
     mode: partner-led | risk-based | staff-led — this engagement's routing mode
           (loses only to an explicit \`run --mode\` flag)
     base: commit-or-ref — optional declared source base; the declaration must begin at column zero
-                          (runtime enforcement happens before a run)
+                          (proven against the run's starting commit at run and resume start; a drifted
+                          or unresolvable base is refused before anything is written)
 
   Fields available per task:
     goal:        outcome the task must achieve (defaults to the title if omitted)

package/dist/gates/baseline.js

@@ -1,11 +1,10 @@
 import { createHash, randomUUID } from "node:crypto";
-import { execFileSync } from "node:child_process";
 import { EVICTION_TOMBSTONE_LIMIT, EVICTION_TOMBSTONES_FILE, parseEvictionTombstones } from "../run/receipt-resolver.js";
 import { existsSync, readFileSync, mkdirSync, readdirSync, renameSync, statSync, unlinkSync, writeFileSync, rmdirSync } from "node:fs";
 import { availableParallelism, loadavg, tmpdir } from "node:os";
 import { basename, join } from "node:path";
 import { DEFAULT_EVIDENCE_QUOTA_BYTES } from "../config/config.js";
-import { dependencyLinkRefusal, DEFAULT_SHELL_TIMEOUT_MS, describeCapacity, sameCapacity, sh } from "../run/git.js";
+import { dependencyLinkRefusal, gitSync, DEFAULT_SHELL_TIMEOUT_MS, describeCapacity, sameCapacity, sh } from "../run/git.js";
 import { executionSignal } from "../run/execution-budget.js";
 import { isVitestTestCommand, manifestChildEnv, manifestFileCount } from "./test-manifest.js";
 export const EVIDENCE_TAIL_BYTES = 16 * 1024;
@@ -121,7 +120,9 @@ export function beginGateEvidence(cwd, gate, command, opts = {}, nonce) {
     let subjectCommit = opts.subjectCommit ?? null;
     if (!subjectCommit) {
         try {
-            subjectCommit = execFileSync("git", ["rev-parse", "HEAD"], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+            const result = gitSync(cwd, ["rev-parse", "HEAD"]);
+            if (result.status === 0 && result.stdout.trim())
+                subjectCommit = result.stdout.trim();
         }
         catch { /* unknown subject */ }
     }

package/dist/gates/cache.js

@@ -1,10 +1,10 @@
 import { createHash } from "node:crypto";
-import { execSync } from "node:child_process";
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, resolve } from "node:path";
 import { tmpdir } from "node:os";
 import { checkoutIncarnation, describeCapacity, inventoryDependencyLinks, resolvedCapacity, shGit, verificationProtocol } from "../run/git.js";
 import { shq } from "../adapters/types.js";
+import { trustedCommonDir } from "../run/git-trust.js";
 import { titleEnvironment } from "../run/title-environment.js";
 export const DEFAULT_VERDICT_CACHE_BOUND = 128;
 let testCacheBound;
@@ -269,9 +269,7 @@ export function resolveStateDir(worktree, artifactDir) {
         return join(worktree, ".tickmarkr");
     }
     try {
-        const commonDir = execSync("git rev-parse --git-common-dir", { cwd: worktree, encoding: "utf8" }).trim();
-        const resolved = resolve(worktree, commonDir);
-        const commonRoot = realpathSync(dirname(resolved));
+        const commonRoot = realpathSync(dirname(trustedCommonDir(worktree)));
         if (existsSync(join(commonRoot, ".tickmarkr"))) {
             return join(commonRoot, ".tickmarkr");
         }

package/dist/graph/schema.js

@@ -118,7 +118,9 @@ export const RunGraphSchema = z
         source: z.enum(SPEC_SOURCES),
         paths: z.array(z.string()),
         hash: z.string(),
-        // Q11 compile half: an author-declared ref only. Runtime Git resolution/enforcement is later.
+        // Q11 / queue row 220: an author-declared ref, proven at run and resume start against the run's
+        // starting commit (HEAD for a run, the recorded run-start base for a resume) by ancestry or patch-id;
+        // drifted or unresolvable, the run or resume is refused before it writes anything. Never rebased onto.
         base: z.string().min(1).optional(),
     }),
     tasks: z.array(TaskSchema).min(1),

package/dist/run/daemon.js

@@ -34,7 +34,7 @@ import { executionSignal, remainingExecutionMs, withExecutionBudget, withoutExec
 import { repairSelectionDecision, repairSelectionEnabled } from "./repair-selection.js";
 import { failureDisposition, reserveInfrastructureRetry } from "./recovery.js";
 import { runEnvironment } from "./environment.js";
-import { addDetachedWorktree, changeRepresented, cleanupRunWorktrees, deriveForkCap, FORK_CAP_ENV, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, PRESERVE_COMMIT_SUBJECT, PRESERVE_PRODUCER_TRAILER, preserveWorktree, producerFields, reflogWitness, removeWorktree, resolvedCapacity, runWithForkBudget, runWithVerificationBudget, sameCapacity, sameVerification, sh, shell, shGit, SUITE_PARENT_ENV, verificationProtocol, WORKTREE_LAYOUT_CONTRACT, WORKTREES_DIR, worktreePath } from "./git.js";
+import { addDetachedWorktree, changeRepresented, cleanupRunWorktrees, declaredBaseContainment, deriveForkCap, FORK_CAP_ENV, gitHead, linkNodeModules, npmDependencyInstallCommand, npmDependencyManifestChanged, PRESERVE_COMMIT_SUBJECT, PRESERVE_PRODUCER_TRAILER, preserveWorktree, producerFields, reflogWitness, removeWorktree, resolvedCapacity, runWithForkBudget, runWithVerificationBudget, sameCapacity, sameVerification, sh, shell, shGit, SUITE_PARENT_ENV, verificationProtocol, WORKTREE_LAYOUT_CONTRACT, WORKTREES_DIR, worktreePath } from "./git.js";
 import { MASK } from "./redact.js";
 import { runInteractiveSeed } from "./interactive-seed.js";
 import { classifyRepairDisposition, resolveScopeHints } from "./repair-disposition.js";
@@ -1145,6 +1145,48 @@ export function integrationAnchor(events) {
         return { unreadable: `the newest merge row's from is ${show(merge.data.from)}, not an object id` };
     return { anchor: merge.data.commit };
 }
+/**
+ * Queue row 220 (D-2111): prove the spec's declared base against the commit this run starts from — the
+ * checkout HEAD for a fresh run (recorded as its run-start baseRef), the recorded run-start baseRef for a
+ * resume, never the checkout's current HEAD: a resume never re-bases, and no run rebases onto the declared
+ * ref. Drift and an unresolvable answer throw; runDaemon calls this before it writes anything.
+ */
+async function proveDeclaredBase(repoRoot, runId, ref, resume) {
+    const action = resume ? `resume ${runId}` : "run";
+    const remedy = `Remedy: check out a branch that contains ${ref}, or correct base: in the spec and recompile.`;
+    const unresolvable = (against, why) => new Error(`refusing to ${action}: declared base ${ref} is unresolvable against ${against} — ${why}. ${remedy}`);
+    let start;
+    let against;
+    if (resume) {
+        const recorded = Journal.open(repoRoot, runId).read().find((e) => e.event === "run-start")?.data.baseRef;
+        if (typeof recorded !== "string" || !recorded)
+            throw unresolvable("the recorded run-start base", "the journal's run-start records no baseRef");
+        start = recorded;
+        against = `the recorded run-start base ${short(start)}`;
+    }
+    else {
+        const head = await shGit("git rev-parse --verify HEAD^{commit}", repoRoot);
+        if (head.code !== 0)
+            throw unresolvable("HEAD", `git said for HEAD: ${(head.stderr || head.stdout).trim()}`);
+        start = head.stdout.trim();
+        against = `HEAD ${short(start)}`;
+    }
+    const probe = await declaredBaseContainment(repoRoot, ref, start);
+    if (probe.result === "contained")
+        return { ref, via: probe.via, start };
+    if (probe.result === "unresolvable")
+        throw unresolvable(against, `git said for ${probe.ref}: ${probe.evidence}`);
+    const lines = await Promise.all(probe.missing.map(async (m) => {
+        const subject = await shGit(`git log -1 --format=%s ${shq(m.commit)}`, repoRoot);
+        // a drift refusal must name the subject: an unreadable one refuses as unresolvable, quoting git
+        if (subject.code !== 0)
+            throw unresolvable(against, `git said for missing commit ${short(m.commit)}: ${(subject.stderr || subject.stdout).trim()}`);
+        return `  ${short(m.commit)} ${subject.stdout.trim()}${m.merge ? " (merge)" : ""}`
+            + ` — ${m.paths.length > 0 ? m.paths.join(", ") : "no paths"}`;
+    }));
+    throw new Error(`refusing to ${action}: declared base ${ref} has drifted from ${against} — `
+        + `${probe.missing.length} declared commit(s) missing:\n${lines.join("\n")}\n${remedy}`);
+}
 /** The ref legs' details: the leg, both commits, the symbolic target and the repair text. */
 export function identityDetails(leg, state, branch, runId, expected) {
     const found = state.kind === "regular" || state.kind === "symbolic" ? state.commit : undefined;
@@ -2105,6 +2147,12 @@ export async function runDaemon(repoRoot, opts = {}) {
     let baselineFailed = false;
     try {
         graph = loadGraph(repoRoot);
+        // Queue row 220 (D-2111): a declared base is proven HERE — before any journal row (lock-reclaimed and
+        // exit-cause included), the resume anchor checks, a worktree, the integration ref or baseline capture —
+        // so a refusal leaves nothing; the finally releases the lock and repository claim. No base: unchanged.
+        const declaredBase = graph.spec.base === undefined ? undefined
+            : await proveDeclaredBase(repoRoot, runId, graph.spec.base, opts.resume === true);
+        const declaredBaseRow = declaredBase ? { declaredBase: { ref: declaredBase.ref, via: declaredBase.via } } : {};
         // One bounded snapshot supplies every dispatch. On resume the current journal still participates
         // in the fold so its task-done/ordinary-approval events can retire older evidence, but findings it
         // produced are suppressed: same-run feedback already replays those bytes and must not deliver them
@@ -2943,6 +2991,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         ...(replayedExclusions.size > 0 ? { excludedChannels: [...replayedExclusions].sort() } : {}),
                         ...(opts.retryFailed ? { retryFailed: true } : {}),
                         ...(opts.graphChanged ? { graphChanged: true } : {}), // OBS-1073: the release is the engagement's
+                        ...declaredBaseRow,
                     });
                     runStarted = true;
                     await placeBoard();
@@ -2993,7 +3042,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     }
                 }
                 else {
-                    baseRef = await gitHead(repoRoot);
+                    baseRef = declaredBase?.start ?? await gitHead(repoRoot); // row 220: the proven commit is the run's base
                     journal.append("baseline-start", undefined, { baseRef, commands, capacity: resolvedCapacity() });
                     await placeBoard();
                     baselinePending = true;
@@ -3034,6 +3083,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         branch, graphDefinitionHash: graphDefinitionHash(graph),
                         integrationAnchor: "journal", // 2.8.1 T2: this run creates its branch at baseRef and journals every publication with `from`
                         ...(prior ? { supersedes: prior.runId } : {}),
+                        ...declaredBaseRow,
                     }); // graphDefinitionHash: T3 engagement identity (status+resume share it); pid: v1.13 (VIS-11) liveness; mode/modeSource: v1.51 T2; supersedes: v1.53 T5
                     runStarted = true;
                     // v1.53 T5: mark the prior run AFTER this run's run-start exists, so the prior journal never
@@ -5186,7 +5236,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         const icmd = retryMode === "resume"
                             ? adapter.resumeCommand(sessionId, promptFile, assignment.model, assignment.effort)
                             : cfg.visibility.worker === "interactive" && driver.interactive
-                                ? adapter.interactiveCommand(promptFile, assignment.model, assignment.effort)
+                                ? adapter.interactiveCommand(promptFile, assignment.model, assignment.effort, { cwd: wt, branch: taskBranch, repoRoot })
                                 : null;
                         // v1.69 T6: adapters that declare interactiveSeed launch the real TUI and inject the prompt as a
                         // user turn; they do NOT need the argv-seeding surface that interactiveCommand represents.
@@ -5203,7 +5253,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                         // timing can never interleave a `$(…)` with what follows it (the codex corruption class).
                         const workerCmd = interactive
                             ? (hasSeed ? ":" : icmd)
-                            : adapter.invoke(t, wt, assignment, { promptFile }).command;
+                            : adapter.invoke(t, wt, assignment, { promptFile, branch: taskBranch, repoRoot }).command;
                         const dispatchScript = promptFile.replace(/\.md$/, ".sh");
                         // Approval can reset the attempt counter while the old pane remains retained.
                         // Its ownership claim must survive a new engagement reusing the script path.

package/dist/run/git-trust.d.ts

@@ -4,11 +4,21 @@ export declare class GitTrustRefusal extends Error {
     readonly detail: string;
     constructor(path: string, detail: string, options?: ErrorOptions);
 }
+interface Authority {
+    gitdir: string;
+    common: string;
+    linked: boolean;
+}
 /**
  * The canonical, independently expected common git directory for the checkout enclosing `cwd` — never what
  * a mutable commondir says. Throws GitTrustRefusal naming the authority path when it cannot be established.
  */
 export declare function trustedCommonDir(cwd: string): string;
+/** The checked authority for `cwd` (see assertGitTrust), with the canonical worktree root the gitfile sits in. */
+export declare function checkedAuthority(cwd: string): (Authority & {
+    worktree: string;
+    stamp?: string;
+}) | undefined;
 /**
  * The uncached pre-spawn check for a covered git invocation at `cwd`. Outside any checkout it is a no-op
  * (unrelated shell commands stay compatible). Inside one it refuses, naming the file, when the commondir git
@@ -119,3 +129,4 @@ export declare const INERT_HOOKS_PATH = "/dev/null";
  * children (shGit/shGitOk) receive it; payload shells (gate commands, suites) keep the operator's git config.
  */
 export declare function protectedGitEnv(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export {};

package/dist/run/git-trust.js

@@ -151,7 +151,7 @@ catch {
     return false;
 } };
 /** The checked authority for `cwd` (see assertGitTrust), with the canonical worktree root the gitfile sits in. */
-function checkedAuthority(cwd) {
+export function checkedAuthority(cwd) {
     const dotGit = dotGitOf(cwd);
     if (!dotGit)
         return undefined;

package/dist/run/git.d.ts

@@ -1,5 +1,5 @@
 import type { CommandReceiptAttribution, ShellReceipt } from "./protocol.js";
-import { spawn } from "node:child_process";
+import { spawn, type SpawnSyncReturns } from "node:child_process";
 import { ROUTING_ENV_SEAMS } from "../route/router.js";
 import { type OwnGitCapability } from "./git-trust.js";
 export { ROUTING_ENV_SEAMS };
@@ -187,6 +187,18 @@ export declare function sh(cmd: string, cwd: string, timeoutMs?: number, options
 export declare function shGit(cmd: string, cwd: string, timeoutMs?: number, own?: OwnGitOptions, options?: Pick<ShellOptions, "bytes">): Promise<ShResult>;
 export declare function shOk(cmd: string, cwd: string): Promise<string>;
 export declare function shGitOk(cmd: string, cwd: string, own?: OwnGitOptions): Promise<string>;
+/**
+ * Queue row 2 item b (D-1042, D-2112, D-2114): the SYNCHRONOUS own-git entry for operator commands — argv, no shell.
+ * It applies what shGit's own-git entry applies, from the same sources: the uncached trust check and, in a linked
+ * checkout, ownGitPin's pin, post-exit recheck and ref-view release, each derived from `dir` — the directory git
+ * targets (a site's -C directory), never the caller's cwd — and protectedGitEnv's forced core.fsmonitor=false and
+ * inert core.hooksPath appended last. A trust refusal throws GitTrustRefusal naming the path (before the spawn, or
+ * after it for a commondir changed while the child ran); every other outcome is spawnSync's own result, so a caller's
+ * fail-open answer for an ordinary git failure is unchanged.
+ */
+export declare function gitSync(dir: string, args: readonly string[], { env }?: {
+    env?: NodeJS.ProcessEnv;
+}): SpawnSyncReturns<string>;
 /**
  * v2.6.8 T2: the DETACHED worktree capability, declared by calling it (the daemon's baseline recapture and standalone
  * verify's base worktree). Under the ref-store pin git stubs a detached add's new HEAD as `ref: refs/heads/.invalid`

package/dist/run/git.js

@@ -2,7 +2,7 @@ import { observeVerificationReceipt, observeVerificationSpawn, verificationJobEn
 import { executionSignal, withoutExecutionBudget } from "./execution-budget.js";
 import { commandLeaseEnvironment, repositoryLeaseEnvironment, registerRepositoryChild, withCommandLease } from "./lease.js";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { execFile, execFileSync, spawn } from "node:child_process";
+import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
 import { existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, readlinkSync, realpathSync, rmdirSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
 import { availableParallelism, homedir, tmpdir } from "node:os";
 import { isAbsolute, join, relative, resolve, sep } from "node:path";
@@ -600,6 +600,27 @@ export async function shGitOk(cmd, cwd, own = {}) {
         throw new Error(`command failed (${r.code}): ${cmd}\n${r.stderr || r.stdout}`);
     return r.stdout;
 }
+/**
+ * Queue row 2 item b (D-1042, D-2112, D-2114): the SYNCHRONOUS own-git entry for operator commands — argv, no shell.
+ * It applies what shGit's own-git entry applies, from the same sources: the uncached trust check and, in a linked
+ * checkout, ownGitPin's pin, post-exit recheck and ref-view release, each derived from `dir` — the directory git
+ * targets (a site's -C directory), never the caller's cwd — and protectedGitEnv's forced core.fsmonitor=false and
+ * inert core.hooksPath appended last. A trust refusal throws GitTrustRefusal naming the path (before the spawn, or
+ * after it for a commondir changed while the child ran); every other outcome is spawnSync's own result, so a caller's
+ * fail-open answer for an ordinary git failure is unchanged.
+ */
+export function gitSync(dir, args, { env = process.env } = {}) {
+    const forced = protectedGitEnv(env);
+    const pin = ownGitPin(dir, forced);
+    try {
+        const r = spawnSync("git", args, { cwd: dir, env: pin?.env ?? forced, encoding: "utf8", maxBuffer: 1 << 28, stdio: ["ignore", "pipe", "pipe"] });
+        pin?.recheck();
+        return pin && typeof r.stdout === "string" ? { ...r, stdout: pin.unview(r.stdout), stderr: pin.unview(r.stderr) } : r;
+    }
+    finally {
+        pin?.release();
+    }
+}
 /**
  * v2.6.8 T2: the DETACHED worktree capability, declared by calling it (the daemon's baseline recapture and standalone
  * verify's base worktree). Under the ref-store pin git stubs a detached add's new HEAD as `ref: refs/heads/.invalid`

package/dist/run/journal.d.ts

@@ -42,7 +42,14 @@ export declare const bindingToken: (binding: DecisionBinding) => string;
 export declare function parseBindingToken(token: string): DecisionBinding | undefined;
 /** The binding a task-approved row recorded under `park` or `failure`, when well formed. */
 export declare function recordedBinding(value: unknown): DecisionBinding | undefined;
-/** The newest failed gate before a park row — the gate a waive of that park would satisfy. */
+/**
+ * The newest failed gate before a park row — the gate a waive of that park would satisfy.
+ * Queue row 225 (D-2111): a gate-fail park with no task-dispatch, gate-result (passing or failing) or
+ * unvoided task-approved row of its task since its previous task-human — a resume's re-park at the same
+ * review round cap — inherits that park's failed gate, the walk continuing past it. A task-approved row
+ * an approval-refused row of the task voids before the newer park (its lines name it, or it names none)
+ * does not end the walk; refusals are read here directly, never through foldDecisions (which calls this).
+ */
 export declare function failedGateBeforePark(events: readonly JournalEvent[], taskId: string, parkIndex: number): GateName | undefined;
 /** The physical journal line of `events[i]` (see SOURCE_LINE). */
 export declare const physicalLine: (events: readonly JournalEvent[], i: number) => number;
@@ -96,6 +103,13 @@ export interface PreservedRef {
 export declare function preservedRefsByTask(events: JournalEvent[]): Map<string, PreservedRef[]>;
 export declare function reviewRoundsSinceApproval(events: JournalEvent[], taskId: string, rounds?: (decided: JournalEvent[]) => JournalEvent[]): number;
 export declare function upheldFeedbackByTask(events: JournalEvent[]): Map<string, string>;
+/**
+ * Queue row 225 (D-2111): a restore names upheld feedback only when it is FUNDED — the task carries an
+ * active uphold brief AND an effective task-approved row newer than its newest task-human. A restore
+ * that only re-parks at the same cap announces nothing, so a spent uphold is never re-announced.
+ * `decided` is already read through the decision fold (effectiveEvents).
+ */
+export declare function restoresUpheldFeedback(decided: JournalEvent[], taskId: string): boolean;
 export interface StructuredFinding {
     class: string;
     path: string;

package/dist/run/journal.js

@@ -97,17 +97,44 @@ export function recordedBinding(value) {
     const { line, ts } = value;
     return typeof line === "number" && Number.isSafeInteger(line) && line > 0 && typeof ts === "string" ? { line, ts } : undefined;
 }
-/** The newest failed gate before a park row — the gate a waive of that park would satisfy. */
+/**
+ * The newest failed gate before a park row — the gate a waive of that park would satisfy.
+ * Queue row 225 (D-2111): a gate-fail park with no task-dispatch, gate-result (passing or failing) or
+ * unvoided task-approved row of its task since its previous task-human — a resume's re-park at the same
+ * review round cap — inherits that park's failed gate, the walk continuing past it. A task-approved row
+ * an approval-refused row of the task voids before the newer park (its lines name it, or it names none)
+ * does not end the walk; refusals are read here directly, never through foldDecisions (which calls this).
+ */
 export function failedGateBeforePark(events, taskId, parkIndex) {
+    let inherits = events[parkIndex]?.data.kind === "gate-fail";
+    let refused = new Set();
     for (let i = parkIndex - 1; i >= 0; i -= 1) {
         const event = events[i];
         if (event.taskId !== taskId)
             continue;
-        if (event.event === "task-approved" || event.event === "task-human" || event.event === "task-dispatch")
+        if (event.event === "task-human") {
+            // Only a gate-fail predecessor has a failed gate to hand down; any other kind ends the walk as today.
+            if (!inherits || event.data.kind !== "gate-fail")
+                return undefined;
+            // The walk now reads the previous park's own span, under that park's own refusals.
+            refused = new Set();
+        }
+        else if (event.event === APPROVAL_REFUSED) {
+            if (refused !== "all")
+                refused = Array.isArray(event.data.lines) ? new Set([...refused, ...event.data.lines]) : "all";
+        }
+        else if (event.event === "task-approved") {
+            if (!inherits || (refused !== "all" && !refused.has(physicalLine(events, i))))
+                return undefined;
+        }
+        else if (event.event === "task-dispatch") {
             return undefined;
-        if (event.event === "gate-result" && event.data.pass === false
-            && typeof event.data.gate === "string" && GATE_NAMES.includes(event.data.gate)) {
-            return event.data.gate;
+        }
+        else if (event.event === "gate-result") {
+            if (event.data.pass === false && typeof event.data.gate === "string" && GATE_NAMES.includes(event.data.gate)) {
+                return event.data.gate;
+            }
+            inherits = false; // a passing gate-result keeps the park's own span
         }
     }
     return undefined;
@@ -321,6 +348,16 @@ export function upheldFeedbackByTask(events) {
     }
     return upheld;
 }
+/**
+ * Queue row 225 (D-2111): a restore names upheld feedback only when it is FUNDED — the task carries an
+ * active uphold brief AND an effective task-approved row newer than its newest task-human. A restore
+ * that only re-parks at the same cap announces nothing, so a spent uphold is never re-announced.
+ * `decided` is already read through the decision fold (effectiveEvents).
+ */
+export function restoresUpheldFeedback(decided, taskId) {
+    const newest = (event) => decided.reduce((at, e, i) => e.taskId === taskId && e.event === event ? i : at, -1);
+    return newest("task-approved") > newest("task-human") && upheldFeedbackByTask(decided).has(taskId);
+}
 const CONSULT_ACTIONS = ["retry", "reroute", "decompose", "human"];
 const consultAction = (action) => typeof action === "string" && CONSULT_ACTIONS.includes(action)
     ? action
@@ -2008,7 +2045,7 @@ export class Journal {
                 const folded = !decisionRow && data.fatal === true ? [...priorEvents, { ts: new Date().toISOString(), event, data }] : priorEvents;
                 return decisionRow ? reduced : { ...reduced, owedChecks: foldOwedChecks(folded, join(this.dir, "..", "..", "..")) };
             })()
-            : event === "resume-restore" && rowTaskId && upheldFeedbackByTask(effectiveEvents(priorEvents)).has(rowTaskId)
+            : event === "resume-restore" && rowTaskId && restoresUpheldFeedback(effectiveEvents(priorEvents), rowTaskId)
                 ? {
                     ...inputData,
                     upheldFeedbackRestoredFor: rowTaskId,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.8.5",
+  "version": "2.8.6",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",