phase-loop-runtime 0.7.17__tar.gz → 0.7.19__tar.gz

{phase_loop_runtime-0.7.17 → phase_loop_runtime-0.7.19}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: phase-loop-runtime
-Version: 0.7.17
+Version: 0.7.19
 Summary: Harness-neutral phase-loop orchestration runtime and CLI
 Author-email: ViperJuice <viperjuice@users.noreply.github.com>
 License-Expression: Apache-2.0
@@ -49,7 +49,7 @@ To install just this runtime package directly:
 
 ```sh
 pip install phase-loop-runtime              # latest compatible release
-pip install phase-loop-runtime==0.7.17      # …or pin an exact version
+pip install phase-loop-runtime==0.7.19      # …or pin an exact version
 ```
 
 To pin a specific tag from source instead, substitute a tag from

{phase_loop_runtime-0.7.17 → phase_loop_runtime-0.7.19}/README.md

@@ -19,7 +19,7 @@ To install just this runtime package directly:
 
 ```sh
 pip install phase-loop-runtime              # latest compatible release
-pip install phase-loop-runtime==0.7.17      # …or pin an exact version
+pip install phase-loop-runtime==0.7.19      # …or pin an exact version
 ```
 
 To pin a specific tag from source instead, substitute a tag from

{phase_loop_runtime-0.7.17 → phase_loop_runtime-0.7.19}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "phase-loop-runtime"  # PyPI dist name; NOT "agent-harness" (an unrelated third-party PyPI project)
-version = "0.7.17"
+version = "0.7.19"
 description = "Harness-neutral phase-loop orchestration runtime and CLI"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -154,6 +154,7 @@ phase_loop_runtime = [
 [tool.pytest.ini_options]
 markers = [
     "dotfiles_integration: test requires a dotfiles fleet tree (skipped standalone)",
+    "quarantine(reason): known flake tracked by an OPEN issue; deselected on pull-request CI only (agent-harness#1029)",
 ]
 
 [tool.setuptools.data-files]

{phase_loop_runtime-0.7.17 → phase_loop_runtime-0.7.19}/src/phase_loop_runtime/__init__.py

@@ -18,4 +18,4 @@ __all__ = [
     "state_ops",
 ]
 
-__version__ = "0.7.17"
+__version__ = "0.7.19"

{phase_loop_runtime-0.7.17 → phase_loop_runtime-0.7.19}/src/phase_loop_runtime/_contract_docs/phase-loop/protocol.md

@@ -2659,6 +2659,73 @@ Fields:
 A synthetic `_train_review_` record (`node_id="_train_review_"`) is appended
 when the train-level review panel approves. Its `status` is `"approved"`.
 
+An approval with usable-reviewer evidence may also carry the optional
+`review_packet_sha256` field, omitted on historical and non-review records.
+Reuse requires its exact immutable packet bytes and the current usable-reviewer
+floor; a legacy approval without the digest cannot authorize pending merges.
+
+The version-1 train review packet binds train order/edges, full admitted heads,
+PR identities, live base tips, unique merge bases, tree IDs, changed-path/mode/blob
+inventory, full substantive patches, acceptance and head-bound evidence.
+`--review-material FILE` declares supporting material for every exact node ID;
+local command/disposal evidence is labelled operator-supplied attestation.
+GitHub check runs are fetched by identity and checked against the admitted head.
+Optional explicit whole-subtree disposal certificates bind full inventories and
+unabridged diff hashes; they certify deletion mechanics, not generatedness.
+Operator-only removal sidecars never enter reviewer scratch.
+
+`run-train --governed --review-only --review-material FILE --preview-review DIR`
+prepares identical review material before broker construction, leases, recovery,
+admission or models. A ready receipt is not approval. The rendered prompt,
+including framing and instructions, must fit 512 KiB; the separate 1 MiB packet
+parser limit does not establish readiness. There is no truncation fallback.
+
+`run-train --governed --monitoring-policy heartbeat_only` runs the train-level review
+under review monitoring policy v1 heartbeat-only: the frozen four-vendor default board
+(any other composition is refused), no model deadline, no native host seat. The policy
+is bound into the review authorization and passed to the invoker, which refuses a
+mismatch. Native emission/fill, a non-governed run or an unqualified Gemini route is
+refused before ledger, broker, publish or packet effects (CLI and direct callers), and
+re-checked before any seat launches. The bounded review path is unchanged.
+
+Trusted-opt-in FAB readmission during ordinary governed merging first freezes
+the entire prospective packet against proposed-head evidence without granting
+authority. Existing broker readmission and fresh complete durable bindings must
+then match before those identical bytes enter review/cache/native sinks. Current
+readmission eligibility is checked immediately before recovery. While FAB promotion
+is active, real repository revocation is replayed before recovery, sinks, approval
+and each merge. Review-only/native emission perform no recovery/readmission; preview
+does not consult broker evidence. No late head advancement follows train review.
+Transport readiness does not attest actual provider consumption of all content.
+
+Production stores read-back packets under `review-packets/<sha256>/` beside the
+ledger. Missing/corrupt packet storage holds. Explicit fresh material invalidates
+changed approvals; omitted material retains stored snapshots without asserting
+checks were refreshed. Native fills retain artifact/brief/composition validation.
+Partial resumes keep original merged-node sections only after validating their
+complete admission bindings (node, branch, PR, head and FAB run) and live merge
+outcomes; unavailable history holds rather than
+reconstructing scope from current main. Observed pending base/head drift before
+approval and each merge requires a fresh packet. GitHub's existing head pin
+remains independent; these reads do not atomically pin the base.
+
+Direct patch text preserves LF/TAB and reversibly escapes backslashes, CR and
+disallowed Unicode. JSON sections decode as outer escapes, JSON, then nested
+`content.text` escapes, including four-digit `\u` and supplementary eight-digit
+`\U` escapes (the latter are not standard JSON escapes).
+`raw_sha256` hashes original bytes; `escaped_sha256`
+hashes intermediate escaped text; preview `presentation_sha256` hashes the
+final rendered section. Readback integrity is not a power-loss durability
+guarantee; that recovery work is tracked in agent-harness#977.
+Packet identity, material and revocation checkpoints, including finalization,
+storage and checks immediately before review and approval, use `review_halted`
+before recovery/readmission begins and `merge_halted` afterward. The per-node
+recovery/readmission handler alone appends a blocked row, and only after that
+node's helper began; later packet holds retain the latest durable binding.
+Panel rejections and native-fill refusals remain `review_halted`; merge-loop
+refusals remain `merge_halted`. All retain the typed reason and prior merges. Malformed
+stored metadata and excessive JSON nesting yield a typed hold and preview receipt.
+
 Idempotent resume: re-running `run_train` reads the ledger to skip nodes that
 are already `pr_open` (confirmed via a live `_pr_is_open` check) or already
 `merged`. A `blocked` node in the ledger is retried on resume.

{phase_loop_runtime-0.7.17 → phase_loop_runtime-0.7.19}/src/phase_loop_runtime/advisor_board/CONTRACTS.md

@@ -660,8 +660,8 @@ review text and the exception in detail; sandbox facts describe actual enforceme
 
 ### Qualified Gemini extension (agent-harness#905)
 
-The Linux x64 subscription `agy` 1.2.10 entry image must match SHA256
-`aea7ed8df1e79b716c0ccd14c7d8086db75b14da535ffb7febdec9a488deff67`.
+The Linux x64 subscription `agy` 1.2.11 entry image must match SHA256
+`ec7cf797ecb0e1d91ddf3b6d9d6c1d616bb89f78a5b0e43536b72a7fce695f56`.
 The running Python/kernel must support sealed memfds, pidfds and pidfd signaling;
 Python version alone is not a capability check. Unknown images or missing
 capabilities refuse before availability/auth effects. Required bwrap mount/gate

{phase_loop_runtime-0.7.17 → phase_loop_runtime-0.7.19}/src/phase_loop_runtime/cli.py

@@ -915,6 +915,14 @@ def build_parser() -> argparse.ArgumentParser:
             "(per-repo governed panel review before merge)."
         ),
     )
+    run_train_sub.add_argument("--review-material", metavar="FILE", help="Version-1 head-bound train review evidence manifest.")
+    run_train_sub.add_argument("--preview-review", metavar="DIR", help="With --governed --review-only: prepare a packet without broker, lease, ledger mutation or models.")
+    run_train_sub.add_argument(
+        "--monitoring-policy", choices=("bounded", "heartbeat_only"), default="bounded",
+        help=("With --governed: how the train review watches its seats. heartbeat_only runs the "
+              "frozen four-vendor default board with no model deadline and no native seat, as "
+              "advisor-board --monitoring-policy heartbeat_only does. Default: bounded."),
+    )
     run_train_sub.add_argument(
         "--emit-native-request", dest="emit_native_request", action="store_true", default=False,
         help=("With --governed --review-only: stage the train bundle and the claude seat's native-fill "
@@ -1174,6 +1182,31 @@ def build_parser() -> argparse.ArgumentParser:
     return parser
 
 
+
+def _confirmed_outside_git_work_tree(path: Path | str) -> bool:
+    """True ONLY when no ``.git`` entry exists at ``path`` or any ancestor.
+
+    Structural: git's output is never parsed. Any ``.git`` entry (directory, ``gitdir:``
+    file -- reachable or not -- or symlink) means "maybe a repository", and so does ANY
+    error: ``os.lstat`` is called directly because ``Path.exists``/``is_symlink`` swallow
+    OSError on newer Pythons (EACCES/EIO would read as "absent"), and a symlink loop in
+    ``resolve`` raises RuntimeError on Python <= 3.12 (agent-harness#1054/#1055 r2/r3).
+    """
+    try:
+        # strict=True: non-strict resolve() swallows lookup errors and returns the
+        # unresolved alias, whose lexical ancestors can miss the real repository
+        # (#1054 r4 / #1055 r3, codex). Any error -- incl. a missing path -- fails closed.
+        resolved = Path(path).resolve(strict=True)
+        for directory in (resolved, *resolved.parents):
+            try:
+                os.lstat(directory / ".git")
+            except (FileNotFoundError, NotADirectoryError):
+                continue
+            return False
+    except (OSError, RuntimeError, ValueError):  # ValueError: an embedded NUL byte
+        return False
+    return True
+
 def main(argv: list[str] | None = None) -> int:
     parser = build_parser()
     args = parser.parse_args(argv)
@@ -1401,11 +1434,24 @@ def _main(parser: argparse.ArgumentParser, args: argparse.Namespace, command: st
             # specs/roadmap-status.json at all) is a silent no-op.
             candidate_path = Path(candidate)
             status_repo = candidate_path.resolve().parent.parent
-            try:
-                roadmap_lint.validate_roadmap_status_coherence(status_repo, required=True)
-            except roadmap_lint.RoadmapStatusError as exc:
-                print(f"validate-roadmap: roadmap-status coherence error: {exc}", file=sys.stderr)
-                return 1
+            # The repository is inferred as the roadmap's grandparent
+            # (<repo>/specs/<roadmap>.md). Outside a git work tree that guess is
+            # not a repository at all -- a roadmap loose in a tempdir made it
+            # ``/tmp`` itself -- so there is no canonical repository to check:
+            # skip with a note rather than validate a shared system directory
+            # (agent-harness#987 / #1053, maintainer decision 2026-09-25).
+            if _confirmed_outside_git_work_tree(status_repo):
+                print(
+                    f"validate-roadmap: note: {status_repo} is not inside a git work tree; "
+                    "skipping the repository roadmap-status coherence check",
+                    file=sys.stderr,
+                )
+            else:
+                try:
+                    roadmap_lint.validate_roadmap_status_coherence(status_repo, required=True)
+                except roadmap_lint.RoadmapStatusError as exc:
+                    print(f"validate-roadmap: roadmap-status coherence error: {exc}", file=sys.stderr)
+                    return 1
         if getattr(args, "check_assumptions", False):
             from . import roadmap_assumptions
 
@@ -4474,9 +4520,37 @@ def _run_train_command(*, parser: argparse.ArgumentParser, args: argparse.Namesp
         return 1  # unreachable
     emit_native_request = bool(getattr(args, "emit_native_request", False))
     native_leg_specs = list(getattr(args, "native_legs", []) or [])
+    preview_output = getattr(args, "preview_review", None)
+    review_material = getattr(args, "review_material", None)
+    if preview_output == "":
+        parser.error("--preview-review requires a non-empty directory")
+    if preview_output is not None and (not review_only or run_mode != "governed" or emit_native_request or native_leg_specs):
+        parser.error("--preview-review requires --governed --review-only and cannot combine with native emission/fill")
     if (emit_native_request or native_leg_specs) and not review_only:
         parser.error("--emit-native-request / --native-leg require --governed --review-only")
         return 1  # unreachable
+    monitoring_policy = getattr(args, "monitoring_policy", "bounded")
+    review_board_preview = None
+    if monitoring_policy == "heartbeat_only":
+        if run_mode != "governed":
+            parser.error("--monitoring-policy heartbeat_only requires --governed")
+        if emit_native_request:
+            parser.error("--monitoring-policy heartbeat_only cannot combine with --emit-native-request "
+                         "(heartbeat-only review has no native seat)")
+        # Refuse an unsupported board before any ledger, broker or packet effect, exactly
+        # as advisor-board does (a native fill is one such route).
+        from .advisor_board.backing import resolve_review_monitoring_policy
+        from .advisor_board.fixtures import DEFAULT_BOARD
+        from .panel_invoker import _preflight_gemini_heartbeat
+        try:
+            resolve_review_monitoring_policy(monitoring_policy, DEFAULT_BOARD,
+                                             native_fill_requested=bool(native_leg_specs))
+            _preflight_gemini_heartbeat(DEFAULT_BOARD, monitoring_policy)
+        except (OSError, ValueError) as exc:
+            print(f"run-train: review monitoring policy refused: {exc}", file=sys.stderr)
+            return 2
+        review_board_preview = [{"harness": seat.harness, "model": seat.model, "effort": seat.effort}
+                                for seat in DEFAULT_BOARD.seats]
     native_leg_fills = None
     if native_leg_specs:
         from .panel_invoker import load_native_leg_fills as _load_fill
@@ -4521,6 +4595,22 @@ def _run_train_command(*, parser: argparse.ArgumentParser, args: argparse.Namesp
 
     as_json = bool(getattr(args, "json", False))
 
+    if preview_output is not None:
+        import hashlib
+        from .train_review_packet import preview_review_packet
+        receipt = preview_review_packet(
+            roadmap, ledger_path, _resolve_workspace, review_material, Path(preview_output),
+            train_digest=hashlib.sha256(train_path.read_bytes()).hexdigest(),
+        )
+        result = {"status": "review_packet_ready" if receipt["ready"] else "review_halted", **receipt,
+                  # The review this packet would get. A bounded board is composed at review
+                  # time (availability- and auth-aware), so it has no fixed seats to show.
+                  "review_monitoring_policy": monitoring_policy, "review_board": review_board_preview}
+        print(json.dumps(result, sort_keys=True) if as_json else
+              (f"Review packet prepared at {preview_output}; no review approval recorded." if receipt["ready"] else
+               "Review packet held: " + "; ".join(receipt["errors"])))
+        return 0 if receipt["ready"] else 1
+
     # Build a broker-authoritative coordinator runtime so publish actually opens PRs.
     # Without a broker_client, publish_from_worktree fail-closes `broker_required` and
     # the train opens ZERO PRs.  The routing broker binds per BrokerRequest.repo (the
@@ -4593,6 +4683,8 @@ def _run_train_command(*, parser: argparse.ArgumentParser, args: argparse.Namesp
             review_only=review_only,
             emit_native_request=emit_native_request,
             native_leg_fills=native_leg_fills,
+            review_material=review_material,
+            review_monitoring_policy=monitoring_policy,
         )
     finally:
         try:
@@ -4640,17 +4732,18 @@ def _run_train_command(*, parser: argparse.ArgumentParser, args: argparse.Namesp
     if result["status"] == "native_fill_requested":
         # REVIEWTRUTH early slice: the emit arm staged the bundle + request; nothing was spent.
         if not as_json:
+            native_leg = shlex.quote(f"claude={Path(result['request_path']).parent}")
+            material_arg = f" --review-material {shlex.quote(str(review_material))}" if review_material is not None else ""
+            print("Keep the original --train, --workspace-root/--workspace and --ledger-dir arguments.")
             print(
                 f"run-train: native fill requested for seat {result.get('seat_key')} — write the review to "
                 f"{Path(result['request_path']).parent / 'review.md'} and re-run with "
-                f"--governed --review-only --native-leg claude={Path(result['request_path']).parent}"
+                f"--governed --review-only --native-leg {native_leg}{material_arg}"
             )
         return 0
     if result["status"] == "review_approved":
         # agent-harness#906: --review-only terminal — approval recorded, ZERO merges.
         nodes = result.get("nodes", {})
-        if not as_json and emit_native_request:
-            print("run-train: the train review is already approved on the ledger; no native fill request was emitted.")
         if not as_json:
             print(
                 f"run-train: train-level review APPROVED — {len(nodes)} admitted PR(s), "

{phase_loop_runtime-0.7.17 → phase_loop_runtime-0.7.19}/src/phase_loop_runtime/closeout_classifier.py

@@ -174,6 +174,17 @@ _TOOL_CACHE_DIR_NAMES = frozenset(
 )
 _TOOL_CACHE_DIR_SUFFIXES = (".egg-info",)
 
+def _handoff_root_relpath() -> str:
+    # Taken from the resolver itself rather than restated, so the audit cannot drift from
+    # where the skills are told to write (phase_loop_runtime.skill_paths).
+    from .skill_paths import resolve_handoff_root
+
+    anchor = Path("/")
+    return resolve_handoff_root(anchor).relative_to(anchor.resolve()).as_posix()
+
+
+_HANDOFF_ROOT = _handoff_root_relpath()
+
 
 def classify_ignored_output(repo_relpath: str) -> IgnoredOutputVerdict:
     """Grade one gitignored path by WHO produced it.
@@ -210,6 +221,15 @@ def classify_ignored_output(repo_relpath: str) -> IgnoredOutputVerdict:
                 RUNNER_OWNED, False, f"runner lifecycle state under {entry}"
             )
 
+    # agent-harness#1084: the repo-local skill handoff root is lifecycle state the skills
+    # are REQUIRED to write and to keep ignored. Only the exact root the resolver returns
+    # (repo root, directory form or a path under it) earns this; the same name nested
+    # anywhere else, or a bare file of that name, still blocks.
+    if norm == _HANDOFF_ROOT + "/" or norm.startswith(_HANDOFF_ROOT + "/"):
+        return IgnoredOutputVerdict(
+            RUNNER_OWNED, False, f"required skill handoff under {_HANDOFF_ROOT}/"
+        )
+
     # A cache name only earns trust as a DIRECTORY. Git renders a collapsed
     # directory with a trailing slash and a file without one, so a bare `.venv`
     # or `node_modules` entry is an ordinary FILE (or a symlink) that merely

{phase_loop_runtime-0.7.17 → phase_loop_runtime-0.7.19}/src/phase_loop_runtime/gemini_heartbeat.py

@@ -14,8 +14,8 @@ import time
 from .agy_canary_evidence import AgyCanaryEvidenceError, _linux_memfd_seal_abi, _sealed_tree_fd
 
 
-QUALIFIED_IMAGE_SHA256 = "aea7ed8df1e79b716c0ccd14c7d8086db75b14da535ffb7febdec9a488deff67"
-QUALIFIED_HELP_SHA256 = "5a03bf7dc9d3d7645f5853906cc117363fd8978a79c2a89521f0ff7590dbe454"
+QUALIFIED_IMAGE_SHA256 = "ec7cf797ecb0e1d91ddf3b6d9d6c1d616bb89f78a5b0e43536b72a7fce695f56"
+QUALIFIED_HELP_SHA256 = "83e3a0c36269f23972ba33d0013b9a6b2933ddb07cde268fa40e0fb1a5f33755"
 PROFILE_ID = "agy_memfd_home_deny_all_v1"
 PRIVATE_HOME = "/dev/phase-loop-agy"
 _CAPABILITY = "gemini_heartbeat_capability_unavailable"

{phase_loop_runtime-0.7.17 → phase_loop_runtime-0.7.19}/src/phase_loop_runtime/governed_review.py

@@ -329,9 +329,17 @@ def governed_board_gate(
     native_leg_fills: Sequence[object] | None = None,
     emit_native_request: bool = False,
     native_fill_dir: "Path | str | None" = None,
+    monitoring_policy: str = "bounded",
 ) -> "GateResult | dict[str, object]":
     """A governed gate backed by the broker-AUTHORIZED review board (agent-harness#906).
 
+    ``monitoring_policy="heartbeat_only"`` (agent-harness#906, ``run-train
+    --monitoring-policy``) runs the review the way ``advisor-board --monitoring-policy
+    heartbeat_only`` does: the frozen default four-vendor board (any other composition is
+    refused, even from an injected ``compose``), no model deadline, and no native host seat.
+    It is checked here, before minting or any launch, and forwarded to both the
+    authorization and ``invoke_board``, which refuse a mismatch between the two.
+
     REVIEWTRUTH early slice (EC-REVIEWTRUTH-14, plan agent-harness#918): ``emit_native_request``
     performs the same composition, author exclusion, floor and staging the invoke arm will
     redo, writes ``request.json`` / ``artifact.md`` / ``instructions.md`` under
@@ -391,11 +399,29 @@ def governed_board_gate(
             "(the coordinator's git toplevel or the first node's workspace); none was "
             "resolved; holding (non-human)",
         )
+    heartbeat_only = monitoring_policy == "heartbeat_only"
+    if monitoring_policy not in ("bounded", "heartbeat_only"):
+        return _block_result(
+            "review_isolation_unavailable", "governed_board_monitoring_policy_refused",
+            f"review monitoring policy {monitoring_policy!r} is not supported; holding (non-human)",
+        )
+    if heartbeat_only and (native_leg_fills or emit_native_request):
+        # CONTRACTS.md, review monitoring policy v1: heartbeat-only has no native host seat.
+        return _block_result(
+            "review_isolation_unavailable", "governed_board_monitoring_policy_refused",
+            "review_monitoring_unsupported_route:native_fill: heartbeat_only review has no "
+            "native host seat; holding (non-human)",
+        )
     from . import panel_invoker as _pi
     from .advisor_board import backing as _backing
     from .advisor_board.composition import FLOOR_SEATS, compose_review_board
+    from .advisor_board.fixtures import DEFAULT_BOARD
 
-    compose_fn = compose if compose is not None else compose_review_board
+    # heartbeat_only seats the frozen default board, as the advisor-board CLI does: an
+    # unavailable vendor then fails its own seat instead of being silently backfilled.
+    compose_fn = compose if compose is not None else (
+        (lambda: DEFAULT_BOARD) if heartbeat_only else compose_review_board
+    )
     try:
         _backing.prepare_review_composition_authorization()
         try:
@@ -425,9 +451,37 @@ def governed_board_gate(
         )
     if dropped:
         board = _replace(board, seats=seats)
+    if heartbeat_only:
+        if board != DEFAULT_BOARD:
+            # Frozen composition, whatever produced it: an injected composer or author
+            # exclusion that changes the seats is refused, never reviewed (agent-harness#1061 r1).
+            return _block_result(
+                "review_isolation_unavailable", "governed_board_monitoring_policy_refused",
+                "heartbeat_only review requires the frozen four-vendor default board; "
+                f"composed {sorted(getattr(s, 'harness', '?') for s in board.seats)}; holding (non-human)",
+            )
+        try:
+            _backing.resolve_review_monitoring_policy(monitoring_policy, board)
+            _pi._preflight_gemini_heartbeat(board, monitoring_policy)
+        except (OSError, ValueError) as exc:
+            return _block_result(
+                "review_isolation_unavailable", "governed_board_monitoring_policy_refused",
+                f"review monitoring policy refused before any launch: {exc}; holding (non-human)",
+            )
+    policy_kwargs: dict[str, object] = {"monitoring_policy": monitoring_policy} if heartbeat_only else {}
     invoke_fn = invoke if invoke is not None else _pi.invoke_board
     from .advisor_board.composition import composition_digest
 
+    if artifact.startswith("# Train review packet v1\n"):
+        try:
+            from .train_review_packet import preflight_packet
+            preflight_packet(artifact, instructions=_pi._resolve_brief("review", brief_ref), board=board)
+        except (OSError, UnicodeError, ValueError) as exc:
+            return _block_result(
+                "review_isolation_unavailable", "governed_board_packet_preflight_failed",
+                f"review packet transport preflight failed: {exc}; holding (non-human)",
+            )
+
     if emit_native_request:
         # Emit arm: no authorization, no seat, no digest binding beyond the read-back bytes.
         try:
@@ -497,6 +551,7 @@ def governed_board_gate(
             staged_artifact,
             mode="review",
             canonical_repo_authority=canonical_repo_authority,
+            **policy_kwargs,
         )
         invoke_kwargs: dict[str, object] = {
             "repo_dir": provider_scratch,
@@ -504,6 +559,7 @@ def governed_board_gate(
             "review_authorization": authorization,
             "canonical_repo_authority": canonical_repo_authority,
             "spawn": spawn,
+            **policy_kwargs,
         }
         if brief_ref is not None:
             invoke_kwargs["brief_ref"] = brief_ref