phase-loop-runtime 0.7.17__tar.gz → 0.7.18__tar.gz

{phase_loop_runtime-0.7.17 → phase_loop_runtime-0.7.18}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: phase-loop-runtime
-Version: 0.7.17
+Version: 0.7.18
 Summary: Harness-neutral phase-loop orchestration runtime and CLI
 Author-email: ViperJuice <viperjuice@users.noreply.github.com>
 License-Expression: Apache-2.0
@@ -49,7 +49,7 @@ To install just this runtime package directly:
 
 ```sh
 pip install phase-loop-runtime              # latest compatible release
-pip install phase-loop-runtime==0.7.17      # …or pin an exact version
+pip install phase-loop-runtime==0.7.18      # …or pin an exact version
 ```
 
 To pin a specific tag from source instead, substitute a tag from

{phase_loop_runtime-0.7.17 → phase_loop_runtime-0.7.18}/README.md

@@ -19,7 +19,7 @@ To install just this runtime package directly:
 
 ```sh
 pip install phase-loop-runtime              # latest compatible release
-pip install phase-loop-runtime==0.7.17      # …or pin an exact version
+pip install phase-loop-runtime==0.7.18      # …or pin an exact version
 ```
 
 To pin a specific tag from source instead, substitute a tag from

{phase_loop_runtime-0.7.17 → phase_loop_runtime-0.7.18}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "phase-loop-runtime"  # PyPI dist name; NOT "agent-harness" (an unrelated third-party PyPI project)
-version = "0.7.17"
+version = "0.7.18"
 description = "Harness-neutral phase-loop orchestration runtime and CLI"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -154,6 +154,7 @@ phase_loop_runtime = [
 [tool.pytest.ini_options]
 markers = [
     "dotfiles_integration: test requires a dotfiles fleet tree (skipped standalone)",
+    "quarantine(reason): known flake tracked by an OPEN issue; deselected on pull-request CI only (agent-harness#1029)",
 ]
 
 [tool.setuptools.data-files]

{phase_loop_runtime-0.7.17 → phase_loop_runtime-0.7.18}/src/phase_loop_runtime/__init__.py

@@ -18,4 +18,4 @@ __all__ = [
     "state_ops",
 ]
 
-__version__ = "0.7.17"
+__version__ = "0.7.18"

{phase_loop_runtime-0.7.17 → phase_loop_runtime-0.7.18}/src/phase_loop_runtime/_contract_docs/phase-loop/protocol.md

@@ -2659,6 +2659,73 @@ Fields:
 A synthetic `_train_review_` record (`node_id="_train_review_"`) is appended
 when the train-level review panel approves. Its `status` is `"approved"`.
 
+An approval with usable-reviewer evidence may also carry the optional
+`review_packet_sha256` field, omitted on historical and non-review records.
+Reuse requires its exact immutable packet bytes and the current usable-reviewer
+floor; a legacy approval without the digest cannot authorize pending merges.
+
+The version-1 train review packet binds train order/edges, full admitted heads,
+PR identities, live base tips, unique merge bases, tree IDs, changed-path/mode/blob
+inventory, full substantive patches, acceptance and head-bound evidence.
+`--review-material FILE` declares supporting material for every exact node ID;
+local command/disposal evidence is labelled operator-supplied attestation.
+GitHub check runs are fetched by identity and checked against the admitted head.
+Optional explicit whole-subtree disposal certificates bind full inventories and
+unabridged diff hashes; they certify deletion mechanics, not generatedness.
+Operator-only removal sidecars never enter reviewer scratch.
+
+`run-train --governed --review-only --review-material FILE --preview-review DIR`
+prepares identical review material before broker construction, leases, recovery,
+admission or models. A ready receipt is not approval. The rendered prompt,
+including framing and instructions, must fit 512 KiB; the separate 1 MiB packet
+parser limit does not establish readiness. There is no truncation fallback.
+
+`run-train --governed --monitoring-policy heartbeat_only` runs the train-level review
+under review monitoring policy v1 heartbeat-only: the frozen four-vendor default board
+(any other composition is refused), no model deadline, no native host seat. The policy
+is bound into the review authorization and passed to the invoker, which refuses a
+mismatch. Native emission/fill, a non-governed run or an unqualified Gemini route is
+refused before ledger, broker, publish or packet effects (CLI and direct callers), and
+re-checked before any seat launches. The bounded review path is unchanged.
+
+Trusted-opt-in FAB readmission during ordinary governed merging first freezes
+the entire prospective packet against proposed-head evidence without granting
+authority. Existing broker readmission and fresh complete durable bindings must
+then match before those identical bytes enter review/cache/native sinks. Current
+readmission eligibility is checked immediately before recovery. While FAB promotion
+is active, real repository revocation is replayed before recovery, sinks, approval
+and each merge. Review-only/native emission perform no recovery/readmission; preview
+does not consult broker evidence. No late head advancement follows train review.
+Transport readiness does not attest actual provider consumption of all content.
+
+Production stores read-back packets under `review-packets/<sha256>/` beside the
+ledger. Missing/corrupt packet storage holds. Explicit fresh material invalidates
+changed approvals; omitted material retains stored snapshots without asserting
+checks were refreshed. Native fills retain artifact/brief/composition validation.
+Partial resumes keep original merged-node sections only after validating their
+complete admission bindings (node, branch, PR, head and FAB run) and live merge
+outcomes; unavailable history holds rather than
+reconstructing scope from current main. Observed pending base/head drift before
+approval and each merge requires a fresh packet. GitHub's existing head pin
+remains independent; these reads do not atomically pin the base.
+
+Direct patch text preserves LF/TAB and reversibly escapes backslashes, CR and
+disallowed Unicode. JSON sections decode as outer escapes, JSON, then nested
+`content.text` escapes, including four-digit `\u` and supplementary eight-digit
+`\U` escapes (the latter are not standard JSON escapes).
+`raw_sha256` hashes original bytes; `escaped_sha256`
+hashes intermediate escaped text; preview `presentation_sha256` hashes the
+final rendered section. Readback integrity is not a power-loss durability
+guarantee; that recovery work is tracked in agent-harness#977.
+Packet identity, material and revocation checkpoints, including finalization,
+storage and checks immediately before review and approval, use `review_halted`
+before recovery/readmission begins and `merge_halted` afterward. The per-node
+recovery/readmission handler alone appends a blocked row, and only after that
+node's helper began; later packet holds retain the latest durable binding.
+Panel rejections and native-fill refusals remain `review_halted`; merge-loop
+refusals remain `merge_halted`. All retain the typed reason and prior merges. Malformed
+stored metadata and excessive JSON nesting yield a typed hold and preview receipt.
+
 Idempotent resume: re-running `run_train` reads the ledger to skip nodes that
 are already `pr_open` (confirmed via a live `_pr_is_open` check) or already
 `merged`. A `blocked` node in the ledger is retried on resume.

{phase_loop_runtime-0.7.17 → phase_loop_runtime-0.7.18}/src/phase_loop_runtime/cli.py

@@ -915,6 +915,14 @@ def build_parser() -> argparse.ArgumentParser:
             "(per-repo governed panel review before merge)."
         ),
     )
+    run_train_sub.add_argument("--review-material", metavar="FILE", help="Version-1 head-bound train review evidence manifest.")
+    run_train_sub.add_argument("--preview-review", metavar="DIR", help="With --governed --review-only: prepare a packet without broker, lease, ledger mutation or models.")
+    run_train_sub.add_argument(
+        "--monitoring-policy", choices=("bounded", "heartbeat_only"), default="bounded",
+        help=("With --governed: how the train review watches its seats. heartbeat_only runs the "
+              "frozen four-vendor default board with no model deadline and no native seat, as "
+              "advisor-board --monitoring-policy heartbeat_only does. Default: bounded."),
+    )
     run_train_sub.add_argument(
         "--emit-native-request", dest="emit_native_request", action="store_true", default=False,
         help=("With --governed --review-only: stage the train bundle and the claude seat's native-fill "
@@ -1174,6 +1182,31 @@ def build_parser() -> argparse.ArgumentParser:
     return parser
 
 
+
+def _confirmed_outside_git_work_tree(path: Path | str) -> bool:
+    """True ONLY when no ``.git`` entry exists at ``path`` or any ancestor.
+
+    Structural: git's output is never parsed. Any ``.git`` entry (directory, ``gitdir:``
+    file -- reachable or not -- or symlink) means "maybe a repository", and so does ANY
+    error: ``os.lstat`` is called directly because ``Path.exists``/``is_symlink`` swallow
+    OSError on newer Pythons (EACCES/EIO would read as "absent"), and a symlink loop in
+    ``resolve`` raises RuntimeError on Python <= 3.12 (agent-harness#1054/#1055 r2/r3).
+    """
+    try:
+        # strict=True: non-strict resolve() swallows lookup errors and returns the
+        # unresolved alias, whose lexical ancestors can miss the real repository
+        # (#1054 r4 / #1055 r3, codex). Any error -- incl. a missing path -- fails closed.
+        resolved = Path(path).resolve(strict=True)
+        for directory in (resolved, *resolved.parents):
+            try:
+                os.lstat(directory / ".git")
+            except (FileNotFoundError, NotADirectoryError):
+                continue
+            return False
+    except (OSError, RuntimeError, ValueError):  # ValueError: an embedded NUL byte
+        return False
+    return True
+
 def main(argv: list[str] | None = None) -> int:
     parser = build_parser()
     args = parser.parse_args(argv)
@@ -1401,11 +1434,24 @@ def _main(parser: argparse.ArgumentParser, args: argparse.Namespace, command: st
             # specs/roadmap-status.json at all) is a silent no-op.
             candidate_path = Path(candidate)
             status_repo = candidate_path.resolve().parent.parent
-            try:
-                roadmap_lint.validate_roadmap_status_coherence(status_repo, required=True)
-            except roadmap_lint.RoadmapStatusError as exc:
-                print(f"validate-roadmap: roadmap-status coherence error: {exc}", file=sys.stderr)
-                return 1
+            # The repository is inferred as the roadmap's grandparent
+            # (<repo>/specs/<roadmap>.md). Outside a git work tree that guess is
+            # not a repository at all -- a roadmap loose in a tempdir made it
+            # ``/tmp`` itself -- so there is no canonical repository to check:
+            # skip with a note rather than validate a shared system directory
+            # (agent-harness#987 / #1053, maintainer decision 2026-09-25).
+            if _confirmed_outside_git_work_tree(status_repo):
+                print(
+                    f"validate-roadmap: note: {status_repo} is not inside a git work tree; "
+                    "skipping the repository roadmap-status coherence check",
+                    file=sys.stderr,
+                )
+            else:
+                try:
+                    roadmap_lint.validate_roadmap_status_coherence(status_repo, required=True)
+                except roadmap_lint.RoadmapStatusError as exc:
+                    print(f"validate-roadmap: roadmap-status coherence error: {exc}", file=sys.stderr)
+                    return 1
         if getattr(args, "check_assumptions", False):
             from . import roadmap_assumptions
 
@@ -4474,9 +4520,37 @@ def _run_train_command(*, parser: argparse.ArgumentParser, args: argparse.Namesp
         return 1  # unreachable
     emit_native_request = bool(getattr(args, "emit_native_request", False))
     native_leg_specs = list(getattr(args, "native_legs", []) or [])
+    preview_output = getattr(args, "preview_review", None)
+    review_material = getattr(args, "review_material", None)
+    if preview_output == "":
+        parser.error("--preview-review requires a non-empty directory")
+    if preview_output is not None and (not review_only or run_mode != "governed" or emit_native_request or native_leg_specs):
+        parser.error("--preview-review requires --governed --review-only and cannot combine with native emission/fill")
     if (emit_native_request or native_leg_specs) and not review_only:
         parser.error("--emit-native-request / --native-leg require --governed --review-only")
         return 1  # unreachable
+    monitoring_policy = getattr(args, "monitoring_policy", "bounded")
+    review_board_preview = None
+    if monitoring_policy == "heartbeat_only":
+        if run_mode != "governed":
+            parser.error("--monitoring-policy heartbeat_only requires --governed")
+        if emit_native_request:
+            parser.error("--monitoring-policy heartbeat_only cannot combine with --emit-native-request "
+                         "(heartbeat-only review has no native seat)")
+        # Refuse an unsupported board before any ledger, broker or packet effect, exactly
+        # as advisor-board does (a native fill is one such route).
+        from .advisor_board.backing import resolve_review_monitoring_policy
+        from .advisor_board.fixtures import DEFAULT_BOARD
+        from .panel_invoker import _preflight_gemini_heartbeat
+        try:
+            resolve_review_monitoring_policy(monitoring_policy, DEFAULT_BOARD,
+                                             native_fill_requested=bool(native_leg_specs))
+            _preflight_gemini_heartbeat(DEFAULT_BOARD, monitoring_policy)
+        except (OSError, ValueError) as exc:
+            print(f"run-train: review monitoring policy refused: {exc}", file=sys.stderr)
+            return 2
+        review_board_preview = [{"harness": seat.harness, "model": seat.model, "effort": seat.effort}
+                                for seat in DEFAULT_BOARD.seats]
     native_leg_fills = None
     if native_leg_specs:
         from .panel_invoker import load_native_leg_fills as _load_fill
@@ -4521,6 +4595,22 @@ def _run_train_command(*, parser: argparse.ArgumentParser, args: argparse.Namesp
 
     as_json = bool(getattr(args, "json", False))
 
+    if preview_output is not None:
+        import hashlib
+        from .train_review_packet import preview_review_packet
+        receipt = preview_review_packet(
+            roadmap, ledger_path, _resolve_workspace, review_material, Path(preview_output),
+            train_digest=hashlib.sha256(train_path.read_bytes()).hexdigest(),
+        )
+        result = {"status": "review_packet_ready" if receipt["ready"] else "review_halted", **receipt,
+                  # The review this packet would get. A bounded board is composed at review
+                  # time (availability- and auth-aware), so it has no fixed seats to show.
+                  "review_monitoring_policy": monitoring_policy, "review_board": review_board_preview}
+        print(json.dumps(result, sort_keys=True) if as_json else
+              (f"Review packet prepared at {preview_output}; no review approval recorded." if receipt["ready"] else
+               "Review packet held: " + "; ".join(receipt["errors"])))
+        return 0 if receipt["ready"] else 1
+
     # Build a broker-authoritative coordinator runtime so publish actually opens PRs.
     # Without a broker_client, publish_from_worktree fail-closes `broker_required` and
     # the train opens ZERO PRs.  The routing broker binds per BrokerRequest.repo (the
@@ -4593,6 +4683,8 @@ def _run_train_command(*, parser: argparse.ArgumentParser, args: argparse.Namesp
             review_only=review_only,
             emit_native_request=emit_native_request,
             native_leg_fills=native_leg_fills,
+            review_material=review_material,
+            review_monitoring_policy=monitoring_policy,
         )
     finally:
         try:
@@ -4640,17 +4732,18 @@ def _run_train_command(*, parser: argparse.ArgumentParser, args: argparse.Namesp
     if result["status"] == "native_fill_requested":
         # REVIEWTRUTH early slice: the emit arm staged the bundle + request; nothing was spent.
         if not as_json:
+            native_leg = shlex.quote(f"claude={Path(result['request_path']).parent}")
+            material_arg = f" --review-material {shlex.quote(str(review_material))}" if review_material is not None else ""
+            print("Keep the original --train, --workspace-root/--workspace and --ledger-dir arguments.")
             print(
                 f"run-train: native fill requested for seat {result.get('seat_key')} — write the review to "
                 f"{Path(result['request_path']).parent / 'review.md'} and re-run with "
-                f"--governed --review-only --native-leg claude={Path(result['request_path']).parent}"
+                f"--governed --review-only --native-leg {native_leg}{material_arg}"
             )
         return 0
     if result["status"] == "review_approved":
         # agent-harness#906: --review-only terminal — approval recorded, ZERO merges.
         nodes = result.get("nodes", {})
-        if not as_json and emit_native_request:
-            print("run-train: the train review is already approved on the ledger; no native fill request was emitted.")
         if not as_json:
             print(
                 f"run-train: train-level review APPROVED — {len(nodes)} admitted PR(s), "

{phase_loop_runtime-0.7.17 → phase_loop_runtime-0.7.18}/src/phase_loop_runtime/governed_review.py

@@ -329,9 +329,17 @@ def governed_board_gate(
     native_leg_fills: Sequence[object] | None = None,
     emit_native_request: bool = False,
     native_fill_dir: "Path | str | None" = None,
+    monitoring_policy: str = "bounded",
 ) -> "GateResult | dict[str, object]":
     """A governed gate backed by the broker-AUTHORIZED review board (agent-harness#906).
 
+    ``monitoring_policy="heartbeat_only"`` (agent-harness#906, ``run-train
+    --monitoring-policy``) runs the review the way ``advisor-board --monitoring-policy
+    heartbeat_only`` does: the frozen default four-vendor board (any other composition is
+    refused, even from an injected ``compose``), no model deadline, and no native host seat.
+    It is checked here, before minting or any launch, and forwarded to both the
+    authorization and ``invoke_board``, which refuse a mismatch between the two.
+
     REVIEWTRUTH early slice (EC-REVIEWTRUTH-14, plan agent-harness#918): ``emit_native_request``
     performs the same composition, author exclusion, floor and staging the invoke arm will
     redo, writes ``request.json`` / ``artifact.md`` / ``instructions.md`` under
@@ -391,11 +399,29 @@ def governed_board_gate(
             "(the coordinator's git toplevel or the first node's workspace); none was "
             "resolved; holding (non-human)",
         )
+    heartbeat_only = monitoring_policy == "heartbeat_only"
+    if monitoring_policy not in ("bounded", "heartbeat_only"):
+        return _block_result(
+            "review_isolation_unavailable", "governed_board_monitoring_policy_refused",
+            f"review monitoring policy {monitoring_policy!r} is not supported; holding (non-human)",
+        )
+    if heartbeat_only and (native_leg_fills or emit_native_request):
+        # CONTRACTS.md, review monitoring policy v1: heartbeat-only has no native host seat.
+        return _block_result(
+            "review_isolation_unavailable", "governed_board_monitoring_policy_refused",
+            "review_monitoring_unsupported_route:native_fill: heartbeat_only review has no "
+            "native host seat; holding (non-human)",
+        )
     from . import panel_invoker as _pi
     from .advisor_board import backing as _backing
     from .advisor_board.composition import FLOOR_SEATS, compose_review_board
+    from .advisor_board.fixtures import DEFAULT_BOARD
 
-    compose_fn = compose if compose is not None else compose_review_board
+    # heartbeat_only seats the frozen default board, as the advisor-board CLI does: an
+    # unavailable vendor then fails its own seat instead of being silently backfilled.
+    compose_fn = compose if compose is not None else (
+        (lambda: DEFAULT_BOARD) if heartbeat_only else compose_review_board
+    )
     try:
         _backing.prepare_review_composition_authorization()
         try:
@@ -425,9 +451,37 @@ def governed_board_gate(
         )
     if dropped:
         board = _replace(board, seats=seats)
+    if heartbeat_only:
+        if board != DEFAULT_BOARD:
+            # Frozen composition, whatever produced it: an injected composer or author
+            # exclusion that changes the seats is refused, never reviewed (agent-harness#1061 r1).
+            return _block_result(
+                "review_isolation_unavailable", "governed_board_monitoring_policy_refused",
+                "heartbeat_only review requires the frozen four-vendor default board; "
+                f"composed {sorted(getattr(s, 'harness', '?') for s in board.seats)}; holding (non-human)",
+            )
+        try:
+            _backing.resolve_review_monitoring_policy(monitoring_policy, board)
+            _pi._preflight_gemini_heartbeat(board, monitoring_policy)
+        except (OSError, ValueError) as exc:
+            return _block_result(
+                "review_isolation_unavailable", "governed_board_monitoring_policy_refused",
+                f"review monitoring policy refused before any launch: {exc}; holding (non-human)",
+            )
+    policy_kwargs: dict[str, object] = {"monitoring_policy": monitoring_policy} if heartbeat_only else {}
     invoke_fn = invoke if invoke is not None else _pi.invoke_board
     from .advisor_board.composition import composition_digest
 
+    if artifact.startswith("# Train review packet v1\n"):
+        try:
+            from .train_review_packet import preflight_packet
+            preflight_packet(artifact, instructions=_pi._resolve_brief("review", brief_ref), board=board)
+        except (OSError, UnicodeError, ValueError) as exc:
+            return _block_result(
+                "review_isolation_unavailable", "governed_board_packet_preflight_failed",
+                f"review packet transport preflight failed: {exc}; holding (non-human)",
+            )
+
     if emit_native_request:
         # Emit arm: no authorization, no seat, no digest binding beyond the read-back bytes.
         try:
@@ -497,6 +551,7 @@ def governed_board_gate(
             staged_artifact,
             mode="review",
             canonical_repo_authority=canonical_repo_authority,
+            **policy_kwargs,
         )
         invoke_kwargs: dict[str, object] = {
             "repo_dir": provider_scratch,
@@ -504,6 +559,7 @@ def governed_board_gate(
             "review_authorization": authorization,
             "canonical_repo_authority": canonical_repo_authority,
             "spawn": spawn,
+            **policy_kwargs,
         }
         if brief_ref is not None:
             invoke_kwargs["brief_ref"] = brief_ref

{phase_loop_runtime-0.7.17 → phase_loop_runtime-0.7.18}/src/phase_loop_runtime/panel_invoker.py

@@ -1728,6 +1728,57 @@ def _canonical_review_repo_authority(repo_dir: Path | str | None) -> Path:
     return Path(root).resolve()
 
 
+def _outside_any_git_work_tree(path: Path | str) -> bool:
+    """True ONLY when no ``.git`` entry exists at ``path`` or any ancestor.
+
+    Structural: git's output is never parsed. Any ``.git`` entry (directory, ``gitdir:``
+    file -- reachable or not -- or symlink) means "maybe a repository", and so does ANY
+    error: ``os.lstat`` is called directly because ``Path.exists``/``is_symlink`` swallow
+    OSError on newer Pythons (EACCES/EIO would read as "absent"), and a symlink loop in
+    ``resolve`` raises RuntimeError on Python <= 3.12 (agent-harness#1054/#1055 r2/r3).
+    """
+    try:
+        # strict=True: non-strict resolve() swallows lookup errors and returns the
+        # unresolved alias, whose lexical ancestors can miss the real repository
+        # (#1054 r4 / #1055 r3, codex). Any error -- incl. a missing path -- fails closed.
+        resolved = Path(path).resolve(strict=True)
+        for directory in (resolved, *resolved.parents):
+            try:
+                os.lstat(directory / ".git")
+            except (FileNotFoundError, NotADirectoryError):
+                continue
+            return False
+    except (OSError, RuntimeError, ValueError):  # ValueError: an embedded NUL byte
+        return False
+    return True
+
+
+def _resolve_review_authority(
+    canonical_repo_authority: Path | str | None,
+    repo_dir: Path | str | None,
+    *,
+    governed: bool,
+    resolve: Callable[[Path | str | None], Path] | None = None,
+) -> Path:
+    """The HARDEN review authority -- the tree fingerprinted AND staged -- resolved once.
+
+    Order (agent-harness#1053, maintainer decision 2026-09-25): an explicit
+    ``canonical_repo_authority``; else ``repo_dir``, the repository under review; else the
+    process cwd. ``repo_dir`` is not consulted for a GOVERNED request (a pre-minted
+    authorization is bound to its own authority). A ``repo_dir`` falls back to the cwd only
+    when it is structurally outside any git work tree -- it cannot be fingerprinted as a
+    repository -- so a real repository whose resolution FAILS (git missing, refused, timed
+    out) reaches the typed refusal instead of silently reviewing the cwd. Each call makes
+    exactly one resolution (a frozen static-import probe pins that single ``git`` call).
+    """
+    resolve = resolve or _canonical_review_repo_authority
+    if canonical_repo_authority is not None or repo_dir is None or governed:
+        return resolve(canonical_repo_authority)
+    if _outside_any_git_work_tree(repo_dir):
+        return resolve(None)
+    return resolve(repo_dir)
+
+
 def _completion_ok(text: str, mode: str = "review") -> bool:
     """Is a leg's output a COMPLETE response for this mode?
 
@@ -2335,7 +2386,7 @@ def _provider_launch_prefix(cwd, retain_caps=()):
         # its cwd -- codex's own sandbox does -- then fails with ENOENT before any inference
         # (agent-harness#908 board round 4, finding (f); reproduced with the real codex CLI:
         # `--wd` -> exit 1 "No such file or directory (os error 2)", path-based chdir -> OK).
-        # `env --chdir` runs after nsenter and setpriv, so the chdir is a plain path lookup in
+        # `env --chdir` runs after nsenter and capability setup, so the chdir is a plain path lookup in
         # the namespace the provider will live in; the cwd attested as ``provider_cwd_sha256``
         # is unchanged. A plain nested user+mount namespace does NOT reproduce the failure --
         # the fchdir()ed cwd stays reachable there -- so the class needs the provider's own
@@ -2369,10 +2420,28 @@ def launch_provider(argv, *, process_owner=(), retain_caps=(), **kwargs) -> "sub
     """
     prefix = _provider_launch_prefix(kwargs.get("cwd"), retain_caps)
     if process_owner:
-        # Enter the network namespace before creating the ownership PID namespace,
-        # but drop capabilities only AFTER both namespaces exist.
         position = prefix.index("setpriv") if "setpriv" in prefix else len(prefix)
-        prefix[position:position] = process_owner
+        if tuple(retain_caps) not in ((), ("setfcap",)):
+            raise ValueError("unsupported owned provider capability policy")
+        if retain_caps:
+            # Keep Codex in the holder's user namespace so its own sandbox can
+            # create another one. The unshare supervisor owns the PID namespace;
+            # the inner setpriv still drops every capability except SETFCAP.
+            prefix[position:position] = ["setpriv", "--pdeathsig", "SIGKILL", "--",
+                                         "/usr/bin/unshare", "--pid", "--fork",
+                                         "--kill-child=SIGKILL", "--mount-proc"]
+            inner_setpriv = prefix.index("setpriv", position + 1)
+            prefix[inner_setpriv + 1:inner_setpriv + 1] = ["--pdeathsig", "keep"]
+        else:
+            # Bubblewrap drops CAP_SETPCAP before a later setpriv can use it.
+            owner = list(process_owner)
+            if owner[0] != "/usr/bin/bwrap":
+                raise ValueError("unsupported owned provider")
+            owner[1:1] = ["--unshare-user", "--uid", str(os.getuid()),
+                          "--gid", str(os.getgid()), "--cap-drop", "ALL"]
+            if position < len(prefix):
+                del prefix[position:prefix.index("--", position) + 1]
+            prefix[position:position] = owner
     return subprocess.Popen([*prefix, *argv], **kwargs)
 
 
@@ -3017,6 +3086,21 @@ def _render_broker_inline_prompt(
             verdict,
         ))
     )
+    return _assemble_broker_inline_prompt(
+        artifact, instructions, preamble,
+        (instructions_begin, instructions_end), (artifact_begin, artifact_end),
+    )
+
+
+def _assemble_broker_inline_prompt(
+    artifact: str, instructions: str, preamble: str,
+    instruction_frames: tuple[str, str], artifact_frames: tuple[str, str],
+) -> str:
+    """Pure assembly shared by validated launches and non-authorizing preflight."""
+    artifact_bytes = artifact.encode("utf-8", errors="strict")
+    instruction_bytes = instructions.encode("utf-8", errors="strict")
+    instructions_begin, instructions_end = instruction_frames
+    artifact_begin, artifact_end = artifact_frames
     prompt = "\n".join((
         preamble,
         f"AUTHORITATIVE-INSTRUCTIONS sha256={sha256(instruction_bytes).hexdigest()} bytes={len(instruction_bytes)}",
@@ -4486,7 +4570,9 @@ def _normalize_tui_line(line: str) -> str:
     return " ".join(line.split()).strip().lower()
 
 
-def _tui_chunk_has_novel_content(chunk: bytes, seen: set[str]) -> bool:
+def _tui_chunk_has_novel_content(
+    chunk: bytes, seen: set[str], ignore: Callable[[str], bool] | None = None
+) -> bool:
     """True iff a PTY chunk carries SUBSTANTIVE new (non-cosmetic) terminal text.
 
     Strips ANSI escapes, splits on newline AND carriage-return (spinner overwrite),
@@ -4503,10 +4589,50 @@ def _tui_chunk_has_novel_content(chunk: bytes, seen: set[str]) -> bool:
         norm = _normalize_tui_line(raw)
         if len(norm) >= _TUI_PROGRESS_MIN_CHARS and norm not in seen:
             seen.add(norm)
-            novel = True
+            # ``ignore`` lines are recorded as seen but are never progress (#992).
+            if ignore is None or not ignore(norm):
+                novel = True
     return novel
 
 
+# The workspace-trust modal's own vocabulary, normalized like any TUI line. After the
+# modal is answered, lines of the modal that were still rendering (it can arrive in
+# pieces) must not arm editor readiness (agent-harness#992).
+_TUI_TRUST_MODAL_NORMS = tuple(
+    _normalize_tui_line(text)
+    for text in (
+        _CLAUDE_TUI_TRUST_HEADER,
+        _CLAUDE_TUI_TRUST_HEADER_CURRENT,
+        _CLAUDE_TUI_TRUST_QUESTION,
+        _CLAUDE_TUI_TRUST_CHOICE,
+        _CLAUDE_TUI_TRUST_PROMPT,
+        "no, exit",
+        # The rest of the live Claude Code 2.1.282 selector modal (captured 2026-09-25,
+        # agent-harness#1053): its explanation, link and footer can also arrive after the
+        # answer and are not editor output either.
+        # Short fragments, so a paragraph WRAPPED at the terminal width still matches line by
+        # line (#1060 r1, claude): e.g. at 80 columns the explanation breaks mid-sentence.
+        "your own code",
+        "well-known open source",
+        "work from your team",
+        "take a moment to review",
+        "folder first",
+        "read, edit, and execute",
+        "execute files here",
+        "security guide",
+        "enter to confirm",
+        "esc to cancel",
+    )
+)
+
+
+def _tui_trust_modal_line(norm: str, cwd_norms: Sequence[str]) -> bool:
+    """Is this normalized line part of the workspace-trust modal (incl. its cwd line)?"""
+    return any(token in norm for token in _TUI_TRUST_MODAL_NORMS) or any(
+        token and token in norm for token in cwd_norms
+    )
+
+
 # A single ``os.read(8192)`` can split a novel review line across two chunks; each
 # fragment normalizes differently (or collides with a seen/too-short form), so the
 # whole-line progress signal is lost. Carry the trailing PARTIAL line (bytes after
@@ -4677,6 +4803,10 @@ def _run_claude_tui_session(
     cwd_tokens = _cwd_trust_tokens(
         cwd
     )  # run-unique FULL-path tokens (not the bare basename)
+    cwd_norms = tuple(
+        norm for norm in (_normalize_tui_line(token) for token in cwd_tokens)
+        if len(norm) >= _TUI_PROGRESS_MIN_CHARS
+    )
 
     def _current_output() -> str:
         return (
@@ -4804,8 +4934,16 @@ def _run_claude_tui_session(
                         # boundaries so a novel line split by ``os.read`` is scanned
                         # WHOLE (only complete lines are evaluated).
                         complete = _tui_take_complete_lines(tui_carry, chunk)
+                        # Between answering the trust modal and submitting, the
+                        # modal's own late-rendering lines are not editor output
+                        # (agent-harness#992): they must not arm readiness.
+                        modal_ignore = (
+                            (lambda norm: _tui_trust_modal_line(norm, cwd_norms))
+                            if trust_answered and not prompt_sent
+                            else None
+                        )
                         if complete and _tui_chunk_has_novel_content(
-                            complete, seen_tui_lines
+                            complete, seen_tui_lines, modal_ignore
                         ):
                             now_novel = time.monotonic()
                             last_heartbeat = now_novel
@@ -8466,8 +8604,19 @@ def invoke_board(
                     review_instruction_token = set_review_instruction_digest(
                         _resolve_brief(mode, brief_ref)
                     )
-                    canonical_repo_authority = _canonical_review_repo_authority(
-                        canonical_repo_authority
+                    # The repository under review is the authority: an explicit
+                    # ``canonical_repo_authority`` first, then ``repo_dir`` when it IS a
+                    # git repository, and only then the process cwd -- so the fingerprinted
+                    # and staged tree is the one the caller named (agent-harness#1053,
+                    # maintainer decision 2026-09-25). A non-git ``repo_dir`` cannot be
+                    # fingerprinted as a repository and keeps the historical cwd authority,
+                    # so every later typed refusal is unchanged. Falling back to
+                    # ``repo_dir`` does NOT make this a governed request:
+                    # ``governed_review_request`` above keys on the caller's explicit
+                    # authority / authorization only.
+                    canonical_repo_authority = _resolve_review_authority(
+                        canonical_repo_authority, repo_dir,
+                        governed=governed_review_request,
                     )
                 except (OSError, UnicodeError, ValueError) as exc:
                     return review_refusal(str(exc))

{phase_loop_runtime-0.7.17 → phase_loop_runtime-0.7.18}/src/phase_loop_runtime/roadmap_assumptions.py

@@ -28,8 +28,8 @@ from typing import Any, Mapping, Sequence
 PROBE_SIDECAR_REL = "specs/roadmap-assumption-probes-v10.json"
 PROBE_SCHEMA = "roadmap_assumption_probe.v1"
 CANONICAL_ROADMAP_REL = "specs/phase-plans-v10.md"
-CANONICAL_ROADMAP_SHA256 = "3e465669d4a30be1334e40c6998a6f5aae610d7204b94346bdd27ab1f0c4a9b0"
-CANONICAL_PROBES_SHA256 = "684c7773fa214a00dcee6c225712b03c9c6dcc06507a12c09df64e3f38b332fc"
+CANONICAL_ROADMAP_SHA256 = "ae5b814a9be561ca78fdcf976e77bcc582a4e0a09c775563a8bbaf4daf740ff4"
+CANONICAL_PROBES_SHA256 = "42d473e2396df4c9dd2a9f98f9c330fa0362bfc51d3e1c99580ed48e3619ebf1"
 CANONICAL_PROBE_IDS = (
     "LEGIBLE-A1-CONFORM-UNGATED", "LEGIBLE-A1-I118", "LEGIBLE-A1-PIN-SHA",
     "LEGIBLE-A1-PIN-TAG", "LEGIBLE-A1-PR102", "LEGIBLE-A1-PR377",