phase-loop-runtime 0.7.21__tar.gz → 0.7.22__tar.gz

{phase_loop_runtime-0.7.21/src/phase_loop_runtime.egg-info → phase_loop_runtime-0.7.22}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: phase-loop-runtime
-Version: 0.7.21
+Version: 0.7.22
 Summary: Harness-neutral phase-loop orchestration runtime and CLI
 Author-email: ViperJuice <viperjuice@users.noreply.github.com>
 License-Expression: Apache-2.0
@@ -49,7 +49,7 @@ To install just this runtime package directly:
 
 ```sh
 pip install phase-loop-runtime              # latest compatible release
-pip install phase-loop-runtime==0.7.21      # …or pin an exact version
+pip install phase-loop-runtime==0.7.22      # …or pin an exact version
 ```
 
 To pin a specific tag from source instead, substitute a tag from
@@ -288,6 +288,12 @@ closeout, the persisted `terminal-summary.json` reflects the runner's blocking v
 (the child's self-reported `complete`/`passed` is not overlaid back), preventing a
 stale "complete" summary from reconcile-skipping the work on the next run.
 
+The `phase-loop-closeout-audit --repo .` command grades **ignored** paths by producer. It
+accepts harness handoffs that carry the handoff contract, and a project's declared build
+outputs backed by a recorded producer run. Declare those outputs in a committed
+`.phase-loop-generated-outputs.json`; anything else still blocks. See
+`docs/phase-loop/closeout-generated-outputs.md` (agent-harness#1139).
+
 ## Conformance library (one library, two roles)
 
 `phase_loop_runtime.conformance` is the named, stable, importable surface for the

{phase_loop_runtime-0.7.21 → phase_loop_runtime-0.7.22}/README.md

@@ -19,7 +19,7 @@ To install just this runtime package directly:
 
 ```sh
 pip install phase-loop-runtime              # latest compatible release
-pip install phase-loop-runtime==0.7.21      # …or pin an exact version
+pip install phase-loop-runtime==0.7.22      # …or pin an exact version
 ```
 
 To pin a specific tag from source instead, substitute a tag from
@@ -258,6 +258,12 @@ closeout, the persisted `terminal-summary.json` reflects the runner's blocking v
 (the child's self-reported `complete`/`passed` is not overlaid back), preventing a
 stale "complete" summary from reconcile-skipping the work on the next run.
 
+The `phase-loop-closeout-audit --repo .` command grades **ignored** paths by producer. It
+accepts harness handoffs that carry the handoff contract, and a project's declared build
+outputs backed by a recorded producer run. Declare those outputs in a committed
+`.phase-loop-generated-outputs.json`; anything else still blocks. See
+`docs/phase-loop/closeout-generated-outputs.md` (agent-harness#1139).
+
 ## Conformance library (one library, two roles)
 
 `phase_loop_runtime.conformance` is the named, stable, importable surface for the

{phase_loop_runtime-0.7.21 → phase_loop_runtime-0.7.22}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "phase-loop-runtime"  # PyPI dist name; NOT "agent-harness" (an unrelated third-party PyPI project)
-version = "0.7.21"
+version = "0.7.22"
 description = "Harness-neutral phase-loop orchestration runtime and CLI"
 readme = "README.md"
 requires-python = ">=3.10"

{phase_loop_runtime-0.7.21 → phase_loop_runtime-0.7.22}/src/phase_loop_runtime/__init__.py

@@ -18,4 +18,4 @@ __all__ = [
     "state_ops",
 ]
 
-__version__ = "0.7.21"
+__version__ = "0.7.22"

{phase_loop_runtime-0.7.21 → phase_loop_runtime-0.7.22}/src/phase_loop_runtime/advisor_board/CONTRACTS.md

@@ -551,7 +551,7 @@ never through — the review operation `public_board_review.v1`. Frozen falsifie
 - **Rung routes** (`president_adapter.build_president_invoke(..., monitoring_policy=)`).
   Unseated rung → typed `president_unavailable` (descend). `sol` / `grok` → the brokered
   `_exec_leg` in a throwaway directory, whose only launch is `launch_provider`. `gemini` →
-  the broker's acknowledged agy stream with the PRESIDENT's own final instruction (a ruling,
+  the broker's agy stream with the PRESIDENT's own final instruction (a ruling,
   not a review verdict), launched through `_run_leg_with_liveness` → `launch_provider` and
   decoded by `_broker_gemini_stream_result`; with the agy subscription credential it runs in
   the broker's agy profile, without one in an empty private HOME (no credential of any kind),
@@ -672,7 +672,60 @@ The TUI timestamp is refreshed by novel output lines, review-file growth and
 transcript growth — a startup banner is novel output and refreshes it; only
 repeated cosmetic repaints do not, once the existing novelty detector has seen
 their text. The CPU-tick heartbeat never refreshes it.
-Neither state is a health attestation or permission to terminate. Frozen
+Neither state is a health attestation or permission to terminate.
+The record also carries a progress notice (agent-harness#1176). When no genuine
+progress has been seen for `stall_notice_s` (default 3600 s; override with
+`PHASE_LOOP_REVIEW_STALL_NOTICE_S`), and no progress at all counts from seat
+start, `progress_notice` is `seat_progress_stalled`, `progress_notice_count`
+counts crossings, and one operator warning with only that code and numbers is
+logged. Resumed progress and a terminal observation clear the active notice;
+`last_progress_notice` and the count stay as history. The notice never ends the
+seat. The record reaches the board: `advisor-board --json` legs carry it as
+`review_monitoring`, the text summary prints a `[seat_progress_stalled]` line
+per affected seat on stderr, each streamed per-leg verdict file carries it, and
+the governed record adds a `seat_progress_stalled` warn finding per seat.
+The exact brokered Claude transcript is classified once per change, by
+`_claude_transcript_outcome`, into one outcome; the answer parser and the
+give-up detector are views of it, so they cannot disagree:
+- `answer`: the route's answer parser (the agent-harness#1002/#1077/#1017
+  rules; the president route fails closed on any error record in the turn)
+  returns text. An accepted answer always wins, whatever follows it. An
+  `isApiErrorMessage` record is never answer text. Every record of the answer
+  must be a member of the current request (defined below; a sidechain sighting
+  counts), so a record that is not evidence for the request never answers it
+  either. If the text is not an
+  accepted verdict, the leg is handed it back as
+  `claude_tui_broker_terminal_nonconforming` instead of waiting.
+- `gave_up`: no answer, and the last live record after the current request is
+  an `isApiErrorMessage` give-up. The leg ends at once as DEGRADED with
+  `claude_seat_output_budget_exhausted` (`error: max_output_tokens`),
+  `claude_seat_usage_limited` (`error: rate_limit` with
+  `quotaLimits.status: rejected`, a subscription cap, followed by
+  `: usage_limit (resets HH:MM, Mon D YYYY)` rendered in UTC from
+  `quotaLimits.resetsAt` when present), `claude_seat_rate_limited` (any other
+  `rate_limit`) or `claude_seat_provider_api_error`.
+- `rejected`: no answer, and the turn ended in a completed (`end_turn` /
+  `stop_sequence`) answer carrying a text block that the route's parser refuses.
+  The leg ends at once as DEGRADED with `claude_seat_transcript_rejected`.
+- `pending`: anything else (an open or capped message, the CLI's resume prompt,
+  a newer request, a writer mid-append). A `max_tokens` stop is never terminal.
+The "last live record" is decided in APPEND order among the current request's
+records, chosen by membership, not position. The current request is the last
+user record that is not `isMeta`, carries no tool_result and is not a replay (its
+uuid and content recurring, whatever its completion metadata, as in the answer
+parser). A record is evidence for it only when it is a new version first seen in
+it: its uuid was first seen after the request (a record of an earlier request is
+never evidence, wherever it is appended, except an `isApiErrorMessage` record
+appended in the current request, which always is); it is not an exact replay of a
+version already seen (same uuid, content, `stop_reason` presence and value, and
+error flag) nor a stale open copy of a stopped record whose content is unchanged;
+and it is not a sidechain record (`isSidechain`), which the answer parser drops
+too. An open record first seen in the current request, even a changed version
+after its own stop, is still streaming and reads `pending`. An `isApiErrorMessage`
+record is terminal event evidence and is never collapsed into an earlier
+version of its uuid. Replays and rewritten metadata are not progress. `provider_terminal_state` records the code that
+ended the leg. `isApiErrorMessage` matches JSON `true` or the string `"true"`,
+on the record or the message. Frozen
 broker request/response keys, status literals, and observer envelopes are unchanged.
 
 When staging requires egress isolation, acquisition follows staged-tree and operation
@@ -687,8 +740,10 @@ review text and the exception in detail; sandbox facts describe actual enforceme
 
 The Linux x64 subscription `agy` entry image must match one member of the closed
 set `gemini_heartbeat.QUALIFIED_IMAGES`: 1.2.11 SHA256
-`ec7cf797ecb0e1d91ddf3b6d9d6c1d616bb89f78a5b0e43536b72a7fce695f56` or 1.2.12 SHA256
-`ce6fdd9e7621ee9ac6eedaa337731ca1f235e412ff57cf9eabcd2aa23b3576ca`. Each member
+`ec7cf797ecb0e1d91ddf3b6d9d6c1d616bb89f78a5b0e43536b72a7fce695f56`, 1.2.12 SHA256
+`ce6fdd9e7621ee9ac6eedaa337731ca1f235e412ff57cf9eabcd2aa23b3576ca`, 1.2.14 SHA256
+`0d0d3eba22daf29504dd290151c7ed9a4d33b0c6aa0acfc5da27bc3b01d2f029` or 1.2.15 SHA256
+`5f9c16b286895f8f7fdecd423883ca256a85077b8acf9a6bc1111761d34df164`. Each member
 carries its measured help digest and has its own qualification record; the
 evidence catalog and the runtime set must name exactly the same members.
 The running Python/kernel must support sealed memfds, pidfds and pidfd signaling;
@@ -710,7 +765,8 @@ HOME fallback truthfully if HOME is absent. Legitimate refresh writes survive.
 The real qualification driver requires an explicit HOME and checks target
 presence before and after, without reading its contents.
 
-The broker transports same-session acknowledged input over stdin, with no tree
+The broker transports same-session input over stdin (one event when the sealed prompt fits
+one chunk, acknowledged chunks otherwise; agent-harness#1175), with no tree
 attachment, `--add-dir`, permission bypass, retry or native thinking timer. Empty,
 rejected and nonzero-exit streams remain non-votes with fixed diagnostics;
 provider stdout/stderr and arbitrary exception strings are not substituted for
@@ -839,3 +895,70 @@ A non-release `agy` image is admitted only by verifying it, never by trusting it
   verified pushed oid in its own `watch_push` entry, and reads both the record and the
   created PR back (the PR body's copy is display-only). "Up to date" requires that local record, `headRefOid` and `ls-remote` to
   agree. It refuses when it cannot prove its open-PR listing complete.
+
+## ABDFALSIFY — Executable review findings (IF-0-EXECFIND-1)
+
+An optional `falsifier` attachment names one `FindingFalsifier` with
+`finding_id`, `new_test_path`, `expected_nodeid`, and a unified `diff` creating
+only `phase-loop-runtime/tests/test_finding_<finding_id>.py`. A
+`FindingFalsifierAttachment` contains a tuple of these entries with unique
+finding IDs. The attachment is a non-field property on `PanelLegResult`; it
+does not change the serialized leg or board schema. The seat supplies text,
+never an executable command or a claimed test outcome.
+
+`run_finding_falsifier` accepts one attached falsifier, board `seat_key`, canonical
+repository, positive wall-clock/output bounds, and a single-use
+`FalsifierIsolationAuthorization` bound to the exact 40-character `reviewed_sha`.
+Its identity is `public_board_falsifier.v1`; its child has no credentials,
+network egress, or live-tree mount. The source must be clean at that SHA.
+Before applying the diff, the staged materialized path set, bytes, symlink
+targets, and executable bits must equal the reviewed Git tree, including no
+ignored extra files. Only the named pytest node runs in the staged clone.
+
+Each run stages its own tree from the canonical repository at the head under
+test, never from a seat's tree, and copies installed dependency files into a
+per-run import root (copies, never links; uv's `--link-mode=copy` equivalent).
+Those two trees are the run's protected objects: every regular file in them,
+`.git` included, must have a link count of exactly one before the node starts
+and after it exits, or the run is `error` (agent-harness#1134). The shared system
+interpreter is read-only to the run and is not a protected object. The runner
+resolves `/usr/bin/python3` once and launches exactly that file. Falsifier runs
+execute without site processing (`-S`): no `.pth`, `sitecustomize` or
+`usercustomize` runs and no host site directory is on `sys.path`, so the
+interpreter's inputs are its standard-library entries plus the run's explicit
+staged paths. Every dependency, pytest included, comes from the per-run staged
+dependency root (a distribution without a RECORD is staged from its declared
+top-level modules); a host site directory on the falsifier path is refused as
+`falsifier_host_site_packages_refused`. The measured set is the launched
+interpreter's own `sys.path` under the same flags and environment, so the
+inventory and the launch are identical by construction. Every entry is
+digested before and after the run: archive entries and `.pth`, archive and
+customize files by content, directories by an lstat manifest (mode, size,
+device, inode, mtime, ctime), and every symlink target outside the set followed
+and hashed by content. An entry the runner cannot digest fails closed, and a
+changed scope or digest is `error`.
+Before staging, the canonical repository must not be reachable through any
+system-root mount (compared by device and in-filesystem path, not by pathname),
+and a repository that contains any mount point is refused as
+`falsifier_repository_submount_refused`. The record schema is unchanged; the reason
+stays in the result's `detail`.
+
+The frozen outcome tuple is `red_on_head`, `green_on_head`, `apply_failed`,
+`node_missing`, `error`. Pytest emits JUnit, but the recorded outcome comes from
+the wrapper's reported call-phase result; the test-writable XML is not read as
+authority. Seat-authored and reviewed-tree Python (including conftest) run
+in the wrapper's process and can forge
+the reported status, including a parent-keyed frame. RED and GREEN are therefore
+observed, untrusted results: neither binds nor dismisses a finding. Drift,
+expiry, unavailable isolation, and incomplete evidence are `error`; every
+valid attached result remains a blocking `finding_receipt` pending a president
+ruling. The metadata-only
+`finding_falsifier.v1` record has exactly `schema`,
+`authorization_identity`, `seat_key`, `reviewed_sha`, `finding_id`, `nodeid`,
+`outcome`, `red_output_digest`, `diff_digest`, `wall_clock_bound_s`, and
+`output_cap_bytes`. `diff_digest` hashes the offered UTF-8 diff bytes;
+`red_output_digest` hashes separately captured stdout followed by stderr
+and is null unless RED. The caller binds the record with SHA-256 over
+canonical JSON (`sort_keys=True`, compact separators, `ensure_ascii=False`).
+The full freeze and golden values live in
+`tests/data/execfind_falsifier_attachment_v1.golden.json`.

{phase_loop_runtime-0.7.21 → phase_loop_runtime-0.7.22}/src/phase_loop_runtime/advisor_board/backing.py

@@ -857,6 +857,22 @@ class ReviewIsolationAuthorization:
     staged_tree_sha256: str | None = None
 
 
+@dataclass(frozen=True)
+class FalsifierIsolationAuthorization:
+    """Single-use authority to run one attached test against a reviewed commit."""
+
+    operation: str
+    reviewed_sha: str
+    canonical_repo_sha256: str
+    child_credentialless: bool
+    child_network_egress: bool
+    live_tree_exposed: bool
+    issued_monotonic_ns: int
+    _seal: object
+    routes: tuple[tuple[str, str], ...] = ()
+    monitoring_policy: str = "bounded"
+
+
 def _staged_tree_digest(canonical_repo_authority: Path | str | None) -> str | None:
     """Digest of the reviewed tree a seat will be allowed to read.
 
@@ -903,6 +919,7 @@ def _canonical_repo_digest(canonical_repo_authority: Path | str | None) -> str:
             text=True,
             stderr=subprocess.DEVNULL,
             timeout=3,
+            env={key: value for key, value in os.environ.items() if not key.startswith("GIT_")},
         ).strip()
     except (OSError, subprocess.SubprocessError):
         raise ValueError("HARDEN review has no canonical repository authority") from None
@@ -1211,6 +1228,83 @@ def close_review_isolation_authorization(
         lease.cancel_event.set()
 
 
+def prepare_falsifier_isolation_authorization(
+    *, repo: Path, reviewed_sha: str,
+) -> FalsifierIsolationAuthorization:
+    """Mint one credentialless, no-egress staged-test operation."""
+    if platform.system() != "Linux" or len(reviewed_sha) != 40 or any(
+        character not in "0123456789abcdef" for character in reviewed_sha
+    ):
+        raise ValueError("invalid falsifier repository or reviewed SHA")
+    authorization = FalsifierIsolationAuthorization(
+        operation="public_board_falsifier.v1",
+        reviewed_sha=reviewed_sha,
+        canonical_repo_sha256=_canonical_repo_digest(repo),
+        child_credentialless=True,
+        child_network_egress=False,
+        live_tree_exposed=False,
+        issued_monotonic_ns=time.monotonic_ns(),
+        _seal=_AUTHORIZATION_SEAL,
+    )
+    _remember_lease(authorization)  # type: ignore[arg-type]
+    return authorization
+
+
+def _falsifier_authorization_lease(
+    authorization: FalsifierIsolationAuthorization | None,
+) -> _ReviewInvocationLease:
+    if (
+        not isinstance(authorization, FalsifierIsolationAuthorization)
+        or authorization._seal is not _AUTHORIZATION_SEAL
+        or authorization.operation != "public_board_falsifier.v1"
+        or not authorization.child_credentialless
+        or authorization.child_network_egress
+        or authorization.live_tree_exposed
+    ):
+        raise ValueError("missing, forged, or mismatched falsifier authorization")
+    return _lease_for(authorization)  # type: ignore[arg-type]
+
+
+def revalidate_falsifier_isolation_authorization(
+    authorization: FalsifierIsolationAuthorization | None, *, repo: Path,
+) -> None:
+    lease = _falsifier_authorization_lease(authorization)
+    if authorization.canonical_repo_sha256 != _canonical_repo_digest(repo):
+        raise ValueError("falsifier authorization repository drifted")
+    with lease.lock:
+        if lease.closed or (
+            not lease.active
+            and time.monotonic_ns() - lease.prepared_monotonic_ns > _PRE_ACTIVATION_FRESHNESS_NS
+        ):
+            raise ValueError("falsifier authorization is closed or expired")
+
+
+def activate_falsifier_isolation_authorization(
+    authorization: FalsifierIsolationAuthorization, *, repo: Path,
+) -> None:
+    revalidate_falsifier_isolation_authorization(authorization, repo=repo)
+    lease = _lease_for(authorization)  # type: ignore[arg-type]
+    with lease.lock:
+        if lease.closed or lease.active:
+            raise ValueError("falsifier authorization already consumed")
+        lease.active = True
+
+
+def close_falsifier_isolation_authorization(
+    authorization: FalsifierIsolationAuthorization | None,
+) -> None:
+    if not isinstance(authorization, FalsifierIsolationAuthorization):
+        return
+    try:
+        lease = _lease_for(authorization)  # type: ignore[arg-type]
+    except ValueError:
+        return
+    with lease.lock:
+        lease.active = False
+        lease.closed = True
+        lease.cancel_event.set()
+
+
 def derive_review_leg_authorization(
     authorization: ReviewIsolationAuthorization | None,
     artifact: str,
@@ -1667,10 +1761,15 @@ __all__ = [
     "harden_subscription_model",
     "harden_subscription_review_board",
     "ReviewIsolationAuthorization",
+    "FalsifierIsolationAuthorization",
     "ReviewCompositionAuthorization",
     "ReviewLegAuthorization",
     "ParentUnixBroker",
     "prepare_review_isolation_authorization",
+    "prepare_falsifier_isolation_authorization",
+    "revalidate_falsifier_isolation_authorization",
+    "activate_falsifier_isolation_authorization",
+    "close_falsifier_isolation_authorization",
     "prepare_review_composition_authorization",
     "current_review_composition_authorization",
     "clear_review_composition_authorization",

{phase_loop_runtime-0.7.21 → phase_loop_runtime-0.7.22}/src/phase_loop_runtime/advisor_board/fixtures.py

@@ -78,7 +78,10 @@ CANONICAL_VALID_PAIRS: tuple[tuple[str, str], ...] = (
     ("gpt-5.6-sol", "codex"),  # legacy default id remains expressible
     ("gpt-6-sol", "codex"),  # explicit seat on user/ad-hoc boards (not a governed grok stand-in)
     ("gpt-6-sol", "opencode"),  # same family; matches the production registry's runnable_by
+    ("gpt-6.1-sol", "codex"),  # explicit seat, selected by board config (not a default)
+    ("gpt-6.1-sol", "opencode"),  # same family; registered by vendor family, not launch-verified
     ("claude-sonnet-5", "claude"),
+    ("claude-sonnet-5-5", "claude"),  # explicit seat, selected by board config (not a default)
     ("claude-opus-5-5", "claude"),
     ("claude-fable-5-1", "claude"),
     ("Gemini 3.1 Pro", "gemini"),

{phase_loop_runtime-0.7.21 → phase_loop_runtime-0.7.22}/src/phase_loop_runtime/advisor_board/registries.py

@@ -257,7 +257,9 @@ _MODEL_DEFS: tuple[tuple[str, str, str], ...] = (
     ("gpt-6-astra", "codex", "max"),
     ("gpt-5.6-sol", "codex", "max"),  # explicit legacy seat (fleet default before 2026-09-04)
     ("gpt-6-sol", "codex", "max"),  # explicit seat (codex's own default model); not a board default
+    ("gpt-6.1-sol", "codex", "max"),  # explicit seat, selected by board config; not a board default
     ("claude-sonnet-5", "claude", "max"),
+    ("claude-sonnet-5-5", "claude", "max"),  # explicit seat, selected by board config; not a board default
     ("claude-opus-4-8", "claude", "max"),
     # design-model-tier-taxonomy.md: claude-opus-5 is the new Claude heavy model.
     # opus-4-8 is retained above — still referenced by tests (advisor_board_schema) —

{phase_loop_runtime-0.7.21 → phase_loop_runtime-0.7.22}/src/phase_loop_runtime/cli.py

@@ -1151,6 +1151,14 @@ def build_parser() -> argparse.ArgumentParser:
         "--agy-canary-private-board-name",
         help="Capture-only basename for the full board JSON inside the private evidence root.",
     )
+    # agent-harness#1204: the brief points at files in the staged tree.
+    advisor_board_sub.add_argument(
+        "--pointer-brief", action="store_true", default=False,
+        help=("Declare that the brief points the reviewers at files in the staged tree instead of "
+              "inlining them. Before any seat launches, each seat whose route cannot open those "
+              "files is warned (seat_pointer_brief_unreadable, on stderr); it still runs, but its "
+              "verdict is not counted as source-grounded, and the floor counts grounded seats only."),
+    )
     # agent-harness#802: an advisory, non-gating run over a standalone document.
     advisor_board_sub.add_argument(
         "--advisory", action="store_true", default=False,
@@ -2068,7 +2076,7 @@ def _advisor_board_command(*, args: argparse.Namespace, _advisory_root: Path | N
         write_private_board,
     )
     from .panel_invoker import _mode_instructions, _preflight_gemini_heartbeat, invoke_board
-    from .panel_invoker import PresidentPolicyError
+    from .panel_invoker import NativeFillRefusalError, PresidentPolicyError
 
     # The authoritative review instructions: the code-review brief, or the advisory contract,
     # staged as the brief file every seat and native fill binds (agent-harness#802).
@@ -2123,6 +2131,12 @@ def _advisor_board_command(*, args: argparse.Namespace, _advisory_root: Path | N
     if capture is None and private_board_name:
         print("advisor-board: private board name requires PHASE_LOOP_AGY_CANARY_EVIDENCE_DIR", file=sys.stderr)
         return 2
+    pointer_brief = bool(getattr(args, "pointer_brief", False))
+    if capture is not None and pointer_brief:
+        # The capture board's schema is closed; a pointer-brief board is not a capture.
+        print("advisor-board: --pointer-brief cannot be combined with agy canary capture", file=sys.stderr)
+        capture.close()
+        return 2
     if capture is not None and not bool(getattr(args, "json", False)):
         print("advisor-board: capture requires --json so full board output stays private", file=sys.stderr)
         capture.close()
@@ -2315,6 +2329,10 @@ def _advisor_board_command(*, args: argparse.Namespace, _advisory_root: Path | N
                 "agy_canary_capture": capture,
                 **({"monitoring_policy": monitoring_policy} if monitoring_policy != "bounded" else {}),
             }
+            if pointer_brief:
+                # agent-harness#1204: the preflight's notices are printed BEFORE any launch.
+                invoke_kwargs["pointer_brief"] = True
+                invoke_kwargs["on_seat_preflight"] = _print_seat_preflight
             if review_authorization is not None:
                 invoke_kwargs["review_authorization"] = review_authorization
                 invoke_kwargs["canonical_repo_authority"] = canonical_repo_authority
@@ -2326,6 +2344,14 @@ def _advisor_board_command(*, args: argparse.Namespace, _advisory_root: Path | N
         if capture is not None:
             capture.close()
         return 2
+    except NativeFillRefusalError as exc:
+        # agent-harness#1183: a fill refused at binding (the seat did not defer) is a native-fill
+        # refusal naming the seat's real outcome, never an artifact-staging failure.
+        refusal = exc.refusal
+        print(f"advisor-board: native fill refused [{refusal.reason}]: {refusal.detail} (seat {refusal.seat_key})", file=sys.stderr)
+        if capture is not None:
+            capture.close()
+        return 2
     except (OSError, ValueError, AgyCanaryEvidenceError) as exc:
         # Artifact staging / resolution failures fail closed with a recoverable exit,
         # not a traceback.
@@ -2351,13 +2377,17 @@ def _advisor_board_command(*, args: argparse.Namespace, _advisory_root: Path | N
     independence = board_independence(board)
     usable_count = len(result.usable_legs)
     usable_vendors = {leg.leg for leg in result.usable_legs}
+    # agent-harness#1204 (ii): the floor counts source-grounded seats only. Without
+    # --pointer-brief no seat is marked, so this equals ``usable_count``.
+    from .seat_preflight import grounded_usable_legs
+    grounded_count = len(grounded_usable_legs(result))
     # A runnable review command must signal when the result is NOT a usable review.
     # Tie the exit code to the board's own contract: it targets 4 independent
     # reviewers with a HARD FLOOR of ``FLOOR_SEATS`` (3). If fewer than the floor of
     # legs returned an OK verdict with text (the rest DEGRADED / ERROR / TIMEOUT /
     # EMPTY / UNAVAILABLE — e.g. the claude leg deferring under Claude Code is one
     # expected non-OK), the board is below its independence floor → exit nonzero.
-    usable = usable_count >= FLOOR_SEATS
+    usable = grounded_count >= FLOOR_SEATS
     exit_code = 0 if usable else 1
     # PRESROUTE: a president-tier board that the president ruled BLOCKING is not a
     # usable landing; say so and exit nonzero.
@@ -2426,10 +2456,22 @@ def _advisor_board_command(*, args: argparse.Namespace, _advisory_root: Path | N
                     # ABDNATIVE (#183): a deferred claude seat carries the
                     # typed native-fill request the harness must run; None otherwise.
                     "needs_native_agent": _native_agent_request_json(leg),
+                    # agent-harness#1176: a heartbeat_only seat's monitoring record (progress
+                    # notice, provider terminal state); absent under the bounded policy.
+                    **({"review_monitoring": dict(leg.review_monitoring)}
+                       if leg.review_monitoring is not None else {}),
                 }
                 for leg in result.legs
             ],
         }
+        if pointer_brief:
+            # agent-harness#1204: present only for a pointer-brief board, so every other
+            # payload (and the closed capture schema) is unchanged.
+            payload["grounded_seats"] = grounded_count
+            payload["notices"] = [n.as_json() for n in result.seat_preflight_notices]
+            for entry, leg in zip(payload["legs"], result.legs):
+                entry["source_grounded"] = leg.source_grounded
+                entry["notices"] = [n.as_json() for n in leg.seat_preflight_notices]
         if advisory:
             payload.update(_advisory_labels(review_brief, composed_board=board.name))
         if capture is not None:
@@ -2475,6 +2517,9 @@ def _advisor_board_command(*, args: argparse.Namespace, _advisory_root: Path | N
         shown = _finalize_leg_detail(leg.detail)
         detail = f" — {shown}" if shown else ""
         print(f"  [{leg.status}] {leg.seat_key}{detail}")
+        for notice in leg.seat_preflight_notices:
+            # agent-harness#1204: once per seat, from the notice table's literals.
+            print(f"      notice {notice.code}: {notice.what} -- fix: {notice.fix}")
         # Print each reviewer's actual verdict text so the board can be reconciled
         # from the command's output (not just leg statuses).
         text = (leg.text or "").strip()
@@ -2484,6 +2529,19 @@ def _advisor_board_command(*, args: argparse.Namespace, _advisory_root: Path | N
     # The statuses/verdicts are ADVISORY evidence — the operator reconciles them; a
     # non-OK leg (DEGRADED/UNAVAILABLE/…) is a gap to fill, not a passed review.
     print("advisor-board: verdicts are advisory — reconcile the legs; check each leg status.")
+    # agent-harness#1176: a heartbeat_only seat that went without genuine progress past its
+    # notice window says so in the board summary, whatever its final status.
+    for leg in result.legs:
+        monitoring = leg.review_monitoring or {}
+        count = monitoring.get("progress_notice_count")
+        if isinstance(count, int) and count > 0:
+            window = monitoring.get("stall_notice_s")
+            window_s = f"{int(window)}s" if isinstance(window, (int, float)) else "its window"
+            print(
+                f"advisor-board:   [seat_progress_stalled] {leg.seat_key} — no genuine progress "
+                f"for {window_s} ({count} notice(s)); final status {leg.status}",
+                file=sys.stderr,
+            )
     # #183: surface the requested-vs-delivered shortfall LOUDLY (stderr) so a
     # floor-satisfying board is never mistaken for the full requested board, and
     # name the seats a native harness can fill itself.
@@ -2504,14 +2562,22 @@ def _advisor_board_command(*, args: argparse.Namespace, _advisory_root: Path | N
             why = f" — {shown}" if shown else ""
             print(f"advisor-board:   [{leg.status}] {leg.seat_key}{why}{fill}", file=sys.stderr)
     if not usable:
+        grounded = (f" ({grounded_count} source-grounded)" if grounded_count != usable_count
+                    else "")
         print(
-            f"advisor-board: only {usable_count} usable review leg(s) < floor {FLOOR_SEATS} "
+            f"advisor-board: only {usable_count} usable review leg(s){grounded} < floor {FLOOR_SEATS} "
             "— below the board's independence floor, not a usable board.",
             file=sys.stderr,
         )
     return exit_code
 
 
+def _print_seat_preflight(notices) -> None:
+    """agent-harness#1204: the pointer-brief preflight, printed before any seat launches."""
+    for notice in notices:
+        print(f"advisor-board: preflight: {notice.render()}", file=sys.stderr)
+
+
 def _outside_agent_preflight_command(args: argparse.Namespace) -> int:
     from .conformance.outside_agent_advisory import (
         build_malformed_outside_agent_advisory_evidence,
@@ -3139,7 +3205,9 @@ def _hotfix_verification_commands(plan_stub: Path) -> list[list[str]]:
 
 
 def _redact_hotfix_reason(reason: str) -> str:
-    return " ".join(reason.split())[:200]
+    from .credential_redaction import redact_text
+
+    return " ".join(redact_text(reason).split())[:200]
 
 
 def _migrate_events_command(*, repo: Path, dry_run: bool, backup_suffix: str) -> int: