tickmarkr 2.8.5 → 2.8.7

package/dist/adapters/codex-commit-check.d.ts

@@ -10,6 +10,7 @@ export interface CodexCommitProbe {
     hostileRoot: string;
     token: string;
     signal?: AbortSignal;
+    repoRoot?: string;
 }
 /** Runs the probe script inside the Codex sandbox and resolves its stdout. Injected in tests. */
 export type CodexSandbox = (probe: CodexCommitProbe) => Promise<string>;
@@ -17,10 +18,10 @@ export interface CodexCommitResult {
     status: CodexCommitStatus;
     detail: string;
 }
-/** The `sh` argv production runs at the fixture worktree: `codex sandbox` under the worker grant fragment. */
+/** Queue row 2 (D-2112, D-2114): the fixture uses the same literal grant as a worker. */
 export declare const codexSandboxArgs: (p: CodexCommitProbe, grant?: string) => string[];
-/** A sandbox executing `grant`; production is CODEX_GIT_GRANT. Tests pass a mutant grant to prove discrimination. */
-export declare const codexSandboxFor: (grant: string) => CodexSandbox;
+/** Queue row 2 (D-2112): tests may supply a mutant; production renders each fixture. */
+export declare const codexSandboxFor: (grant?: string) => CodexSandbox;
 export declare const codexSandbox: CodexSandbox;
 export declare function probeCodexCommit(repoRoot: string, sandbox?: CodexSandbox, signal?: AbortSignal): Promise<CodexCommitResult>;
 /** A persisted verdict outside the closed table (an older or newer doctor.json) reads unknown, never allowed. */

package/dist/adapters/codex-commit-check.js

@@ -4,19 +4,20 @@ import { existsSync, mkdtempSync, readFileSync, rmdirSync, rmSync } from "node:f
 import { tmpdir } from "node:os";
 import { basename, dirname, join } from "node:path";
 import { promisify } from "node:util";
-import { assertGitTrust, GitTrustRefusal, protectedGitEnv } from "../run/git-trust.js";
+import { assertGitTrust, GitTrustRefusal } from "../run/git-trust.js";
+import { shGitOk } from "../run/git.js";
 import { withoutHostSession } from "../drivers/host-env.js";
-import { CODEX_GIT_GRANT, codex } from "./codex.js";
+import { renderCodexGitGrant, codex } from "./codex.js";
 import { shq } from "./types.js";
 const exec = promisify(execFile);
-const git = async (cwd, ...args) => (await exec("git", args, { cwd })).stdout.trim();
-// v2.6.7 T4: host git after the sandbox has had the fixture — validation and cleanup — runs the uncached trust
-// check and the forced child config on every call, so seat-rewritten metadata can neither run a config program
-// nor answer for the probe's commit.
-const hostGit = async (cwd, ...args) => {
-    assertGitTrust(cwd);
-    return (await exec("git", args, { cwd, env: protectedGitEnv(process.env) })).stdout.trim();
-};
+// v2.6.7 T4 → queue row 2 item b (D-2112): every fixture git — setup, validation and cleanup — is tickmarkr's own git
+// (shGitOk): the uncached trust check, the forced inert fsmonitor and hooks and, in a linked checkout, the pin, so
+// seat-rewritten metadata can neither run a config program or hook nor answer for the probe's commit. A trust refusal
+// rejects with GitTrustRefusal naming the path and is reported as an unknown verdict, never folded into another answer.
+const hostGit = async (cwd, args, own) => (await shGitOk(["git", ...args].map(shq).join(" "), cwd, own)).trim();
+/** An ordinary git failure is `fallback`; a trust refusal propagates. */
+const unlessRefused = (fallback) => (error) => { if (error instanceof GitTrustRefusal)
+    throw error; return fallback; };
 /** The fixture checkout's trust after the sandbox returned or threw: a refusal is reported with its path. */
 const fixtureRefusal = (worktree) => {
     try {
@@ -35,14 +36,14 @@ const SCRIPT = `printf %s "$2" > "$1" && echo control=ok || echo control=fail
 git add -- "$1" && git -c core.hooksPath=/dev/null -c core.logAllRefUpdates=true -c commit.gpgsign=false -c user.name=tickmarkr -c user.email=probe@tickmarkr.invalid commit -q -m "tickmarkr-probe $2" && echo commit=ok || echo commit=fail
 (set -C; printf %s "$2" > "$3") 2>/dev/null && echo hook=written || echo hook=denied
 (set -C; printf %s "$2" > "$4") 2>/dev/null && echo root=written || echo root=denied`;
-/** The `sh` argv production runs at the fixture worktree: `codex sandbox` under the worker grant fragment. */
-export const codexSandboxArgs = (p, grant = CODEX_GIT_GRANT) => [
+/** Queue row 2 (D-2112, D-2114): the fixture uses the same literal grant as a worker. */
+export const codexSandboxArgs = (p, grant = renderCodexGitGrant({ cwd: p.worktree, branch: p.branch, repoRoot: p.repoRoot ?? p.commonDir })) => [
     "-c",
     `codex sandbox -c 'sandbox_mode="workspace-write"' ${grant} -- sh -c ${shq(SCRIPT)} sh ${[p.control, p.token, p.hostileHook, p.hostileRoot].map(shq).join(" ")}`,
 ];
-/** A sandbox executing `grant`; production is CODEX_GIT_GRANT. Tests pass a mutant grant to prove discrimination. */
+/** Queue row 2 (D-2112): tests may supply a mutant; production renders each fixture. */
 export const codexSandboxFor = (grant) => async (p) => (await exec("sh", codexSandboxArgs(p, grant), { cwd: p.worktree, timeout: 20_000, signal: p.signal, env: withoutHostSession() })).stdout;
-export const codexSandbox = codexSandboxFor(CODEX_GIT_GRANT);
+export const codexSandbox = codexSandboxFor();
 const holds = (path, token) => {
     try {
         return readFileSync(path, "utf8") === token;
@@ -67,18 +68,28 @@ const contradictory = (out) => {
     }
     return false;
 };
-const tipOf = async (repo, ref) => hostGit(repo, "rev-parse", "--verify", "--quiet", `${ref}^{commit}`).catch(() => undefined);
+const tipOf = async (repo, ref) => hostGit(repo, ["rev-parse", "--verify", "--quiet", `${ref}^{commit}`]).catch(unlessRefused(undefined));
 // This probe's commit and nothing else: one parent (the fixture base), its token in the subject and the control.
 const isProbeCommit = async (repo, commit, base, token) => {
     try {
-        return await hostGit(repo, "log", "-1", "--format=%P %s", commit) === `${base} tickmarkr-probe ${token}`
-            && await hostGit(repo, "cat-file", "blob", `${commit}:${CONTROL}`) === token;
+        return await hostGit(repo, ["log", "-1", "--format=%P %s", commit]) === `${base} tickmarkr-probe ${token}`
+            && await hostGit(repo, ["cat-file", "blob", `${commit}:${CONTROL}`]) === token;
     }
-    catch {
-        return false;
+    catch (e) {
+        return unlessRefused(false)(e);
     }
 };
 export async function probeCodexCommit(repoRoot, sandbox = codexSandbox, signal) {
+    // queue row 2 item b: cleanup stays best effort for ordinary git failures, but a trust refusal there is never
+    // folded into the verdict already reached — it is reported as unknown naming its path (an escape still dominates)
+    let refusal;
+    const result = await probeFixture(repoRoot, sandbox, signal, (e) => { refusal ??= e; });
+    return refusal && result.status !== "escape" ? unknown(`fixture git refused (${refusal.message})`) : result;
+}
+async function probeFixture(repoRoot, sandbox, signal, refused) {
+    /** A cleanup git's ordinary failure is `fallback`; its trust refusal is reported to the caller, then `fallback`. */
+    const cleanup = (fallback) => (e) => { if (e instanceof GitTrustRefusal)
+        refused(e); return fallback; };
     const token = randomUUID();
     const parent = mkdtempSync(join(tmpdir(), "tickmarkr-codex-commit-"));
     // git names the fixture's metadata directory after the checkout's basename; a unique one makes that
@@ -91,21 +102,22 @@ export async function probeCodexCommit(repoRoot, sandbox = codexSandbox, signal)
     let hostile = [];
     let sandboxed = false;
     try {
-        const commonDir = await git(repoRoot, "rev-parse", "--path-format=absolute", "--git-common-dir");
+        const commonDir = await hostGit(repoRoot, ["rev-parse", "--path-format=absolute", "--git-common-dir"]);
         lock = join(commonDir, "worktrees", basename(worktree), "index.lock");
         const hostileHook = join(commonDir, "hooks", branch), hostileRoot = join(commonDir, branch);
         hostile = [hostileHook, hostileRoot];
         if (hostile.some((m) => existsSync(m)))
             return unknown("a foreign file already holds a hostile probe path");
-        base = await git(repoRoot, "rev-parse", "--verify", "HEAD^{commit}");
-        await git(repoRoot, "worktree", "add", "-b", branch, worktree, base);
-        if (join(await git(worktree, "rev-parse", "--absolute-git-dir"), "index.lock") !== lock)
+        base = await hostGit(repoRoot, ["rev-parse", "--verify", "HEAD^{commit}"]);
+        // the add declares the branch capability: a result refused after its child ran is rolled back (checkout and branch)
+        await hostGit(repoRoot, ["worktree", "add", "-b", branch, worktree, base], { createsWorktree: "branch", rollback: { dir: worktree, branch: { name: branch } } });
+        if (join(await hostGit(worktree, ["rev-parse", "--absolute-git-dir"]), "index.lock") !== lock)
             return unknown("the fixture worktree metadata is not where git was expected to put it");
         const control = join(worktree, CONTROL);
         if (existsSync(lock))
             return unknown("a foreign index.lock already holds the fixture worktree");
         sandboxed = true;
-        const out = await sandbox({ worktree, commonDir, branch, control, lock, hostileHook, hostileRoot, token, signal });
+        const out = await sandbox({ worktree, commonDir, branch, control, lock, hostileHook, hostileRoot, token, signal, repoRoot });
         // An escape on disk dominates; every other verdict needs consistent receipts AND disk — and trusted metadata.
         const escape = escaped(hostile, token);
         if (escape)
@@ -145,6 +157,8 @@ export async function probeCodexCommit(repoRoot, sandbox = codexSandbox, signal)
         const refused = sandboxed ? fixtureRefusal(worktree) : undefined;
         if (refused)
             return refused;
+        if (e instanceof GitTrustRefusal)
+            return unknown(`fixture git refused (${e.message})`);
         return unknown(signal?.aborted ? "probe cancelled" : `probe did not run (${(e instanceof Error ? e.message : String(e)).split("\n")[0]})`);
     }
     finally {
@@ -159,7 +173,7 @@ export async function probeCodexCommit(repoRoot, sandbox = codexSandbox, signal)
         // prune — that would take an earlier probe's preserved foreign lock (or anyone's prunable worktree).
         const foreign = lock !== undefined && existsSync(lock);
         if (lock && !foreign) {
-            await hostGit(repoRoot, "worktree", "remove", "--force", worktree).catch(() => undefined);
+            await hostGit(repoRoot, ["worktree", "remove", "--force", worktree]).catch(cleanup(undefined));
             // a failed `worktree add` leaves metadata git no longer removes by path: drop this probe's own directory
             rmSync(dirname(lock), { recursive: true, force: true });
             try {
@@ -170,9 +184,9 @@ export async function probeCodexCommit(repoRoot, sandbox = codexSandbox, signal)
         // The fixture branch and its reflog go only while the tip is still this probe's (the base or its own
         // commit), and update-ref's old-value check refuses if anyone moves it between this read and the delete.
         // Metadata preserved for a foreign lock keeps its branch too: that checkout's HEAD still names it.
-        const tip = base === undefined || foreign ? undefined : await tipOf(repoRoot, ref);
-        if (tip && base && (tip === base || await isProbeCommit(repoRoot, tip, base, token))) {
-            await hostGit(repoRoot, "update-ref", "-d", ref, tip).catch(() => undefined);
+        const tip = base === undefined || foreign ? undefined : await tipOf(repoRoot, ref).catch(cleanup(undefined));
+        if (tip && base && (tip === base || await isProbeCommit(repoRoot, tip, base, token).catch(cleanup(false)))) {
+            await hostGit(repoRoot, ["update-ref", "-d", ref, tip]).catch(cleanup(undefined));
         }
         rmSync(parent, { recursive: true, force: true });
     }

package/dist/adapters/codex.d.ts

@@ -1,11 +1,11 @@
-import { type ModelRetirement, type TrustDialog, type TrustVerdict, type WorkerAdapter } from "./types.js";
+import { type ModelRetirement, type TrustDialog, type TrustVerdict, type WorkerAdapter, type WorkerLaunchContext } from "./types.js";
 export declare function readCodexModelsCache(path?: string): {
     models: string[];
     fetchedAt?: string;
     retirements?: Record<string, ModelRetirement | null>;
     hidden?: string[];
 };
-export declare const CODEX_GIT_GRANT = "-c \"sandbox_workspace_write.writable_roots=[$(tkr_common=$(git rev-parse --path-format=absolute --git-common-dir && echo /) && tkr_gitdir=$(git rev-parse --absolute-git-dir && echo /) && tkr_common=${tkr_common%?/} && tkr_gitdir=${tkr_gitdir%?/} && { tkr_head=$(git symbolic-ref -q HEAD); [ $? -le 1 ]; } && case $tkr_head in (refs/heads/*) tkr_leaf=${tkr_head%/*};; (*) tkr_leaf=;; esac && [ \"$(printf %s \"$tkr_common$tkr_gitdir$tkr_leaf\" | LC_ALL=C tr -d '\\0-\\37\\177\"\\\\')\" = \"$tkr_common$tkr_gitdir$tkr_leaf\" ] && { [ \"$tkr_gitdir\" = \"$tkr_common\" ] || printf '\"%s\",' \"$tkr_gitdir\"; } && printf '\"%s/objects\"' \"$tkr_common\" && { [ -z \"$tkr_leaf\" ] || printf ',\"%s/%s\",\"%s/logs/%s\"' \"$tkr_common\" \"$tkr_leaf\" \"$tkr_common\" \"$tkr_leaf\"; })]\"";
+export declare function renderCodexGitGrant(ctx?: Partial<WorkerLaunchContext>): string;
 export declare const CODEX_TRUST_DIALOG: TrustDialog;
 export declare const CODEX_INPUT_BOX: import("./types.js").InputBox;
 export declare function seedCodexTrust(repoRoot: string, configPath?: string): TrustVerdict;

package/dist/adapters/codex.js

@@ -1,6 +1,7 @@
 import { mkdirSync, readdirSync, readFileSync, realpathSync, statSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
+import { checkedAuthority } from "../run/git-trust.js";
 import { probeVersion } from "./claude-code.js";
 import { parseWorkerResult } from "./prompt.js";
 import { channelsFromConfig, declareInputBox, MODEL_ID_RE, promptFitsArgv, shq, TokenUsageSchema } from "./types.js";
@@ -100,32 +101,37 @@ function codexRetirement(upgrade) {
     // the successor id comes from an external file and is rendered in lints — same charset gate as slugs
     return typeof u.model === "string" && MODEL_ID_RE.test(u.model) ? { retiresAt: u.retirement_at, successor: u.model } : undefined;
 }
-// tickmarkr worktrees keep their gitdir under the MAIN repo's .git/worktrees/<name> — outside the
-// workspace-write sandbox root — so git commit dies on index.lock (incident run-20260709-104447
-// P87-08: "Unable to create …/.git/worktrees/…/index.lock"). Expanded by the launching shell at the
-// worktree cwd, for Codex WORKERS only: v2.6.7 T4 (D-1046) — invoke() (the headless worker form, including
-// the interactive size fallback) and interactiveCommand carry it; headlessCommand, which judge, review,
-// consult and the model probe launch, carries no writable_roots at all (those seats never commit).
-// v2.6.6 T9 (K, D-912) → v2.8.0 T1 (rows 17/18, D-910): the grant is a LEAF of what a linked-worktree branch
-// commit writes, never the shared hooks/config (the shipped [common] and D-910's [common, gitdir] let a seat
-// write <common>/hooks and <common>/config, which unsandboxed git later runs) and never whole common/refs and
-// common/logs (which let a seat move main, any branch or tag, or the stash). The closed root table, in order:
-//   - the worktree's own gitdir, only when it differs from the common dir (an ordinary checkout gets none);
-//   - <common>/objects;
-//   - only when HEAD is a symbolic ref refs/heads/<B>: <common>/refs/heads/<D> and <common>/logs/refs/heads/<D>,
-//     <D> being <B> without its last slash-separated segment (refs/heads itself when <B> holds no slash);
-//     a detached HEAD gets no refs or reflog root.
-// A directory outside any repository, any failed git read, or any root holding a character of the closed
-// forbidden set (U+0000 to U+001F, U+007F DEL, the double quote, the backslash) yields the EMPTY array `[]`:
-// no git write root, so a commit fails closed — never a partial array, an escaped string or codex's
-// literal-string fallback. Every emitted root is therefore a TOML basic string that parses back to the exact
-// path (git's own trailing newline is stripped through a sentinel, never a path's). No common-root fallback;
-// packed-refs is not granted (packed-ref ops fail closed); stash, tags, notes and branches outside the leaf
-// are denied. Declared (queue row 151): sibling refs in the same leaf (other task branches, the run's integration
-// branch under the default prefix) stay writable; since 2.8.1 a write to the integration ref parks the merge and is
-// never published.
-// doctor's probe (codex-commit-check.ts) executes these exact bytes; it never rebuilds the grant.
-export const CODEX_GIT_GRANT = `-c "sandbox_workspace_write.writable_roots=[$(tkr_common=$(git rev-parse --path-format=absolute --git-common-dir && echo /) && tkr_gitdir=$(git rev-parse --absolute-git-dir && echo /) && tkr_common=\${tkr_common%?/} && tkr_gitdir=\${tkr_gitdir%?/} && { tkr_head=$(git symbolic-ref -q HEAD); [ $? -le 1 ]; } && case $tkr_head in (refs/heads/*) tkr_leaf=\${tkr_head%/*};; (*) tkr_leaf=;; esac && [ "$(printf %s "$tkr_common$tkr_gitdir$tkr_leaf" | LC_ALL=C tr -d '\\0-\\37\\177"\\\\')" = "$tkr_common$tkr_gitdir$tkr_leaf" ] && { [ "$tkr_gitdir" = "$tkr_common" ] || printf '"%s",' "$tkr_gitdir"; } && printf '"%s/objects"' "$tkr_common" && { [ -z "$tkr_leaf" ] || printf ',"%s/%s","%s/logs/%s"' "$tkr_common" "$tkr_leaf" "$tkr_common" "$tkr_leaf"; })]"`;
+// Queue row 2 item a (D-2112, D-2114): tickmarkr renders literal roots from the checked authority,
+// never a launch-shell git lookup. The worker's common dir must be the run repository's trusted one.
+// Closed table: gitdir only when distinct, common objects, and the assigned branch's ref/reflog leaf
+// only while its HEAD still names that branch. Ordinary checkouts omit gitdir; packed-refs stays denied.
+// Any refusal, absent context or forbidden byte yields []; permitted bytes survive TOML and shq exactly.
+// Queue row 151: sibling refs inside the assigned leaf remain writable.
+export function renderCodexGitGrant(ctx) {
+    let roots = [];
+    try {
+        if (!ctx?.cwd || !ctx.branch || !ctx.repoRoot)
+            throw new Error("missing launch context");
+        const authority = checkedAuthority(ctx.cwd);
+        const run = checkedAuthority(ctx.repoRoot);
+        if (!authority || !run || authority.common !== run.common)
+            throw new Error("foreign git authority");
+        const { gitdir, common } = authority;
+        roots = [...(gitdir === common ? [] : [gitdir]), `${common}/objects`];
+        const head = readFileSync(join(gitdir, "HEAD"), "utf8");
+        if (head === `ref: refs/heads/${ctx.branch}\n` || head === `ref: refs/heads/${ctx.branch}`) {
+            const ref = `refs/heads/${ctx.branch}`;
+            const leaf = ref.slice(0, ref.lastIndexOf("/"));
+            roots.push(`${common}/${leaf}`, `${common}/logs/${leaf}`);
+        }
+        if (roots.some(root => /[\x00-\x1f\x7f"\\]/.test(root)))
+            roots = [];
+    }
+    catch {
+        roots = [];
+    }
+    return `-c ${shq(`sandbox_workspace_write.writable_roots=[${roots.map(root => `"${root}"`).join(",")}]`)}`;
+}
 // OBS-125: codex 0.144.x gates enabled hooks behind PER-PROJECT-PATH hook trust — a NEW gate distinct
 // from the directory trust seedCodexTrust seeds. Every worker runs in a fresh ephemeral worktree, an
 // untrusted project, so codex re-prompts "Hooks need review" and the interactive worker stalls forever
@@ -275,7 +281,7 @@ export function codexMcpSuppressionFlags(configPath) {
     }
     return flags.join(" ");
 }
-// The one headless form: `grant` is "" for every non-worker seat and ` ${CODEX_GIT_GRANT}` for the worker.
+// Queue row 2 (D-2112): non-worker seats omit the grant; workers carry the rendered argument.
 const codexExec = (promptFile, model, effort, grant) => `codex exec --sandbox workspace-write ${CODEX_HOOK_TRUST} ${codexMcpSuppressionFlags()}${grant}${codexEffortFlag(effort)} --model ${shq(model)} - < ${shq(promptFile)}`;
 export const codex = {
     id: "codex",
@@ -286,7 +292,7 @@ export const codex = {
     probe: async () => probeVersion("codex"),
     channels: (cfg) => channelsFromConfig("codex", cfg),
     // v1.65 T3: every flag the command builder below hardcodes (incl. codexMcpSuppressionFlags' -c/
-    // --disable and CODEX_GIT_GRANT's -c) — all listed by top-level `codex --help`, verified 2026-07-22.
+    // --disable and renderCodexGitGrant's -c) — all listed by top-level `codex --help`, verified 2026-07-22.
     hardcodedFlags: { binary: "codex", flags: ["--sandbox", "-a", "-s", "--model", "-c", "--disable", "--dangerously-bypass-hook-trust"] },
     // --sandbox workspace-write is the autonomous sandbox mode (codex v0.144.1+)
     // MCP suppression built per dispatch (config can change between runs) — see codexMcpSuppressionFlags.
@@ -304,11 +310,11 @@ export const codex = {
     // autonomous approval policy (exec has no approvals to configure).
     // OBS-930 (Linux): the inlined prompt is ONE argv string and Linux caps one at 131072 bytes, so a
     // prompt over promptArgvCeiling() returns null → worker-mode-fallback → the headless form (types.ts).
-    interactiveCommand: (promptFile, model, effort) => promptFitsArgv(promptFile)
-        ? `codex -a never -s workspace-write ${CODEX_HOOK_TRUST} ${codexMcpSuppressionFlags()} ${CODEX_GIT_GRANT}${codexEffortFlag(effort)} --model ${shq(model)} "$(cat ${shq(promptFile)})"`
+    interactiveCommand: (promptFile, model, effort, ctx) => promptFitsArgv(promptFile)
+        ? `codex -a never -s workspace-write ${CODEX_HOOK_TRUST} ${codexMcpSuppressionFlags()} ${renderCodexGitGrant(ctx)}${codexEffortFlag(effort)} --model ${shq(model)} "$(cat ${shq(promptFile)})"`
         : null,
-    invoke(task, _cwd, a, ctx) {
-        return { command: codexExec(ctx.promptFile, a.model, a.effort, ` ${CODEX_GIT_GRANT}`) };
+    invoke(task, cwd, a, ctx) {
+        return { command: codexExec(ctx.promptFile, a.model, a.effort, ` ${renderCodexGitGrant({ ...ctx, cwd })}`) };
     },
     parse: parseWorkerResult,
     // v1.22 T5: seed [projects."<repoRoot>"] trust_level="trusted" so fresh worktrees never stall on

package/dist/adapters/grok.js

@@ -115,16 +115,12 @@ export const grok = {
         return { command: this.headlessCommand(ctx.promptFile, a.model) };
     },
     parse: parseWorkerResult, // prompt.ts — last-valid-trailer, hard-wrap tolerant. No grok fork.
-    // v1.89 T1 / OBS-414: no capture exists, so none is invented. grok 0.2.93 has never been observed
-    // rendering a workspace/folder-trust prompt: it loads the operator's global Claude-Code-compat
-    // config rather than keeping a per-directory trust store, and no grok dispatch in any recorded run
-    // has stalled before launch (OBS-414's own sweep lists grok's gap as MCP suppression, not trust).
-    // FALSIFIER, and it is cheap: dispatch grok into a never-seen worktree and read the pane. One
-    // capture of a trust prompt replaces this with {fingerprint, key} — the capture is the only
-    // admissible evidence, and a guess here would press a key on whatever it happened to match.
+    // Queue row 215 (D-2118 add.1, D-2125): recorded Grok Build 1.0.62 and 1.0.67 directory-trust
+    // modal, quoted in GROK_TRUST_PANE. Enter is the measured acceptance key (y also accepts).
+    // Accepted residual: answering persists grok's trust for the main checkout root.
     trustDialog: {
-        kind: "none",
-        reason: "grok 0.2.93 keeps no per-directory trust store and no recorded pane shows it rendering a workspace-trust prompt; falsified by one capture from a fresh worktree",
+        fingerprint: "Grok Build may run or modify contents in this directory",
+        key: "Enter",
     },
     // v1.5 MODEL-01: fail OPEN to [] (advisory detection, unlike gates). Parses the model LIST only —
     // the auth banner on line 1 is ignored BY CONSTRUCTION (parseGrokModels anchors on the header).

package/dist/adapters/model-lints.js

@@ -1,8 +1,8 @@
-import { spawnSync } from "node:child_process";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { DEFAULT_CONFIG, TIER_RANK } from "../config/config.js";
 import { filesGlob } from "../graph/files-glob.js";
+import { gitSync } from "../run/git.js";
 import { piModelVendor } from "./pi.js";
 import { buildTaskPrompt } from "./prompt.js";
 import { channelKey, MODEL_ID_RE } from "./types.js";
@@ -249,7 +249,8 @@ const GLOB_CHARS = /[*?{[]/;
 // and `-z` is load-bearing correctness, not economy: without it git quotes any non-ASCII path, so
 // every Arabic/UTF-8 tracked file read as absent.
 function baseTreeAtHead(dir) {
-    const git = (...args) => spawnSync("git", ["-C", dir, ...args], { encoding: "utf8", maxBuffer: 1 << 28 });
+    // queue row 2 item b: protected git; a trust refusal throws instead of reading as "no base tree"
+    const git = (...args) => gitSync(dir, args);
     const top = git("rev-parse", "--show-toplevel");
     const tree = git("ls-tree", "--full-tree", "-r", "-l", "-z", "HEAD");
     if (top.status !== 0 || tree.status !== 0 || typeof top.stdout !== "string" || typeof tree.stdout !== "string")
@@ -287,7 +288,7 @@ function measureBytes(tree, rel) {
     return covered ? total : undefined;
 }
 function absentContextReason(root, path) {
-    if (spawnSync("git", ["-C", root, "check-ignore", "-q", "--", path]).status === 0)
+    if (gitSync(root, ["check-ignore", "-q", "--", path]).status === 0)
         return "gitignored";
     return existsSync(join(root, path)) ? "untracked" : "absent";
 }

package/dist/adapters/prompt.js

@@ -12,13 +12,21 @@ import { CAPACITY_RE } from "./types.js";
 // and the allowlist stays exactly as immutable during a run as it was before this text changed.
 export function buildTaskPrompt(task, feedback = "", nonce = "") {
     const list = (xs) => xs.map((x) => `- ${x}`).join("\n");
+    // Queue row 234 (D-2130 add.1, D-2131): only the worker brief carries the suite;
+    // the judge and the review brief keep the shared criterion text byte-equal.
+    const criteria = task.acceptance.map((item) => typeof item !== "string" && item.oracle === "test" && item.landing !== undefined
+        ? `${renderAcceptanceItem(item)} | suite: ${item.landing}`
+        : renderAcceptanceItem(item));
+    const suiteNote = task.acceptance.some((item) => typeof item !== "string" && item.oracle === "test" && item.landing !== undefined)
+        ? '\n\nFor test criteria with ` | suite: `, the test title is the text before the marker, and the test must pass in the named file.'
+        : "";
     return `You are an autonomous coding worker dispatched by tickmarkr into an isolated git worktree.
 
 ## Task ${task.id}: ${task.title}
 Goal: ${task.goal}
 
 ## Acceptance criteria (you will be judged against these, verbatim)
-${list(task.acceptance.map(renderAcceptanceItem))}
+${list(criteria)}${suiteNote}
 ${task.files.length ? `\n## File scope — touch ONLY paths matching:\n${list(task.files)}\n` : ""}${task.context.length ? `\n## Context (read these first)\n${list(task.context)}\n` : ""}${task.outOfScope?.length ? `\n## Out of scope\nStay within the task’s declared bounds; do not pursue these items:\n${list(task.outOfScope)}\n` : ""}
 ## Rules
 - Work only inside the current directory (your isolated worktree). Never push. Never switch branches.

package/dist/adapters/types.d.ts

@@ -117,6 +117,7 @@ export declare const TRUST_DIALOG_BLANK_MESSAGE = "trust-dialog fingerprint must
 export declare const CLAUDE_TRUST_PANE: string;
 export declare const CODEX_TRUST_PANE: string;
 export declare const CURSOR_TRUST_PANE = "Workspace Trust Required\nTrust this folder?";
+export declare const GROK_TRUST_PANE: string;
 export declare const KIMI_TRUST_PANE: string;
 export declare const KIMI_TRUST_PANE_029: string;
 export declare const KIMI_MCP_TRUST_PANE: string;
@@ -187,6 +188,12 @@ export declare class SettledTrailerTracker {
     constructor(markers: readonly BusyFrameMarker[]);
     sample(paneText: string, trailer: boolean): boolean;
 }
+/** Queue row 2 item a (D-2112, D-2114): context owned by the task dispatcher. */
+export interface WorkerLaunchContext {
+    cwd: string;
+    branch: string;
+    repoRoot: string;
+}
 export interface WorkerAdapter {
     id: string;
     vendor: string;
@@ -197,13 +204,15 @@ export interface WorkerAdapter {
     headlessCommand(promptFile: string, model: string, effort?: Effort): string;
     harnessBannerRows?: readonly string[];
     paneReviewBuffersOutput?: boolean;
-    interactiveCommand(promptFile: string, model: string, effort?: Effort): string | null;
+    interactiveCommand(promptFile: string, model: string, effort?: Effort, ctx?: WorkerLaunchContext): string | null;
     interactiveSeed?: InteractiveSeed;
     resumeCommand?(sessionId: string, promptFile: string, model: string, effort?: Effort): string;
     sessionIdFrom?(output: string): string | undefined;
     resumeUnknownContext?: boolean;
     invoke(task: Task, cwd: string, a: Assignment, ctx: {
         promptFile: string;
+        branch?: string;
+        repoRoot?: string;
     }): Invocation;
     parse(output: string, nonce: string): WorkerResult;
     listModels?(): Promise<string[]>;

package/dist/adapters/types.js

@@ -59,6 +59,16 @@ export const CODEX_TRUST_PANE = [
 ].join("\n");
 // v1.22 T5 / OBS-19, cursor-agent's per-worktree dialog.
 export const CURSOR_TRUST_PANE = "Workspace Trust Required\nTrust this folder?";
+// Queue row 215 (D-2118 add.1, D-2125): quoted from the recorded Grok Build 1.0.62 modal in
+// tests/fixtures/grok-trust/grok-1.0.62.screen.txt; 1.0.67 renders these same modal rows centered.
+export const GROK_TRUST_PANE = [
+    "Do you trust the contents of this directory?",
+    "/Users/…/repo",
+    "Grok Build may run or modify contents in this directory,",
+    "posing security risks.",
+    "Yes, proceed                 y",
+    "No, quit                     n",
+].join("\n");
 // Queue row 198, kimi 2.2.0's folder-trust modal on a fresh task worktree (run 1394 T3, read off the
 // Orca screen before its one Enter). The worktree path is shortened as above; every other row is as
 // rendered. 2.2.0 renamed the selected option, so the 0.29.0 fingerprint below never matched it and the
@@ -92,6 +102,7 @@ export const KIMI_MCP_TRUST_PANE = [
 ].join("\n");
 export const RECORDED_TRUST_PANES = [
     CLAUDE_TRUST_PANE, CODEX_TRUST_PANE, CURSOR_TRUST_PANE, KIMI_TRUST_PANE, KIMI_TRUST_PANE_029, KIMI_MCP_TRUST_PANE,
+    GROK_TRUST_PANE,
 ];
 // v1.89 T1 / OBS-414 round 4 — EXACT, not "leading bytes of a recorded line". Round 3 accepted any
 // prefix of a captured line, and every prefix of a trust prompt is also a substring of unrelated
@@ -111,6 +122,7 @@ export const APPROVED_TRUST_FINGERPRINTS = [
     "Workspace Trust Required", // cursor-agent, OBS-19
     "❯ Trust this folder", // kimi 0.29.0, OBS-358 + OBS-406 — the cursor glyph is load-bearing
     "❯ Trust and continue", // kimi 2.2.0, queue row 198 — the same gate with its option renamed
+    "Grok Build may run or modify contents in this directory", // queue row 215, D-2125
 ];
 const isApprovedFingerprint = (fingerprint) => APPROVED_TRUST_FINGERPRINTS.includes(fingerprint)
     && RECORDED_TRUST_PANES.some((pane) => pane.includes(fingerprint));

package/dist/cli/commands/approve.js

@@ -1,11 +1,11 @@
 import { graphDefinitionHash, loadGraph, saveGraph, taskDefinitionFingerprint } from "../../graph/graph.js";
 import { filesGlob } from "../../graph/files-glob.js";
-import { execFileSync } from "node:child_process";
 import { userInfo } from "node:os";
 import { allAdapters } from "../../adapters/registry.js";
 import { channelKey } from "../../adapters/types.js";
 import { loadConfig } from "../../config/config.js";
 import { integrationBranch } from "../../run/merge.js";
+import { gitSync } from "../../run/git.js";
 import { integrationAnchor } from "../../run/daemon.js";
 import { separabilityErrors, surfaceErrors, taskBudgetErrors } from "../../compile/collateral.js";
 import { GATE_NAMES } from "../../graph/schema.js";
@@ -444,15 +444,10 @@ function mergedSiblingExempt(cwd, events, status, siblingId, requesterRef) {
     if (commit === undefined || !FULL_OBJECT_ID.test(commit))
         return false;
     const ref = requesterRef();
-    try {
-        execFileSync("git", ["rev-parse", "--verify", ref], { cwd, stdio: "ignore" });
-        execFileSync("git", ["merge-base", "--is-ancestor", commit, ref], { cwd, stdio: "ignore" });
-    }
-    catch {
-        return false;
-    }
-    return true;
+    return gitOk(cwd, "rev-parse", "--verify", ref) && gitOk(cwd, "merge-base", "--is-ancestor", commit, ref);
 }
+/** Queue row 2 item b: approve's git runs through the protected path; a trust refusal throws, never reads as false. */
+const gitOk = (cwd, ...args) => gitSync(cwd, args).status === 0;
 /** The conflicting unordered pairs of separabilityErrors, in its exact emission order. */
 function separabilityPairs(tasks) {
     const byId = new Map(tasks.map((t) => [t.id, t.deps ?? []]));
@@ -531,27 +526,13 @@ function failedTaskCommitsAhead(cwd, journal, runId, taskId) {
     const preservedRef = preserved?.data.ref;
     let ref = taskRef;
     if (preservedRef) {
-        try {
-            execFileSync("git", ["rev-parse", "--verify", taskRef], { cwd, stdio: "ignore" });
-            execFileSync("git", ["merge-base", "--is-ancestor", taskRef, preservedRef], { cwd, stdio: "ignore" });
+        if (gitOk(cwd, "rev-parse", "--verify", taskRef) && gitOk(cwd, "merge-base", "--is-ancestor", taskRef, preservedRef))
+            ref = preservedRef;
+        else if (!gitOk(cwd, "rev-parse", "--verify", taskRef))
             ref = preservedRef;
-        }
-        catch {
-            try {
-                execFileSync("git", ["rev-parse", "--verify", taskRef], { cwd, stdio: "ignore" });
-            }
-            catch {
-                ref = preservedRef;
-            }
-        }
-    }
-    try {
-        const out = execFileSync("git", ["rev-list", "--count", `${integration.base}..${ref}`], { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
-        return { ref, base, count: Number.parseInt(out.trim(), 10) || 0 };
-    }
-    catch {
-        return { ref, base, count: 0 };
     }
+    const out = gitSync(cwd, ["rev-list", "--count", `${integration.base}..${ref}`]);
+    return { ref, base, count: out.status === 0 ? Number.parseInt(out.stdout.trim(), 10) || 0 : 0 };
 }
 // The status is command OUTPUT, not a typed sibling result: the registered approve function returns
 // one primitive string and the dispatcher prints those bytes unchanged. A compact sentinel followed

package/dist/cli/commands/init.d.ts

@@ -1,3 +1,12 @@
+interface SkillDrift {
+    skill: string;
+    dir: string;
+    missing: string[];
+    modified: string[];
+}
+export declare function skillDrift(cwd: string): SkillDrift[];
+export declare const docsDrift: (cwd: string) => string[];
+export declare function installedAgentGuidance(cwd: string): string[];
 export type DetectedHost = "herdr" | "orca" | "subprocess";
 export declare function detectedHost(env?: NodeJS.ProcessEnv): DetectedHost;
 /** Test seam mirroring FleetIO: production callers omit it and get the process streams. */
@@ -6,3 +15,4 @@ export type InitIO = {
     output?: NodeJS.WriteStream;
 };
 export declare function init(argv: string[], cwd?: string, io?: InitIO): Promise<string>;
+export {};