phase-loop-runtime 0.7.23__tar.gz → 0.7.25__tar.gz

{phase_loop_runtime-0.7.23/src/phase_loop_runtime.egg-info → phase_loop_runtime-0.7.25}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: phase-loop-runtime
-Version: 0.7.23
+Version: 0.7.25
 Summary: Harness-neutral phase-loop orchestration runtime and CLI
 Author-email: ViperJuice <viperjuice@users.noreply.github.com>
 License-Expression: Apache-2.0
@@ -50,7 +50,7 @@ To install just this runtime package directly:
 
 ```sh
 pip install phase-loop-runtime              # latest compatible release
-pip install phase-loop-runtime==0.7.23      # …or pin an exact version
+pip install phase-loop-runtime==0.7.25      # …or pin an exact version
 ```
 
 To pin a specific tag from source instead, substitute a tag from

{phase_loop_runtime-0.7.23 → phase_loop_runtime-0.7.25}/README.md

@@ -19,7 +19,7 @@ To install just this runtime package directly:
 
 ```sh
 pip install phase-loop-runtime              # latest compatible release
-pip install phase-loop-runtime==0.7.23      # …or pin an exact version
+pip install phase-loop-runtime==0.7.25      # …or pin an exact version
 ```
 
 To pin a specific tag from source instead, substitute a tag from

{phase_loop_runtime-0.7.23 → phase_loop_runtime-0.7.25}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "phase-loop-runtime"  # PyPI dist name; NOT "agent-harness" (an unrelated third-party PyPI project)
-version = "0.7.23"
+version = "0.7.25"
 description = "Harness-neutral phase-loop orchestration runtime and CLI"
 readme = "README.md"
 requires-python = ">=3.10"
@@ -156,6 +156,7 @@ phase_loop_runtime = [
 markers = [
     "dotfiles_integration: test requires a dotfiles fleet tree (skipped standalone)",
     "quarantine(reason): known flake tracked by an OPEN issue; deselected on pull-request CI only (agent-harness#1029)",
+    "host_seat_credentials: live jailed-seat test that reads the host's Claude login and seat-jail state (agent-harness#1132)",
 ]
 
 [tool.setuptools.data-files]

{phase_loop_runtime-0.7.23 → phase_loop_runtime-0.7.25}/src/phase_loop_runtime/__init__.py

@@ -18,4 +18,4 @@ __all__ = [
     "state_ops",
 ]
 
-__version__ = "0.7.23"
+__version__ = "0.7.25"

phase_loop_runtime-0.7.25/src/phase_loop_runtime/_proc_cpu.py

@@ -0,0 +1,57 @@
+"""Linux CPU observations for a process group and its descendants.
+
+Owner wrappers can start a child in another session. Include that child tree
+when sampling the leg. Missing /proc data yields zero; CPU activity alone does
+not establish completion or grant heartbeat-only termination authority.
+"""
+from __future__ import annotations
+
+import os
+
+
+def _pgrp_and_ticks(pid: int) -> tuple[int, int]:
+    """Return ``(process_group_id, utime+stime)`` for ``pid`` from /proc/<pid>/stat.
+
+    The ``comm`` field (2nd) is wrapped in parens and may itself contain spaces or
+    parens, so parse the fixed fields AFTER the last ``)``: from there field 3
+    (state) is index 0, so pgrp (field 5) = index 2, utime (14) = index 11, and
+    stime (15) = index 12.
+    """
+    with open(f"/proc/{pid}/stat", encoding="ascii", errors="replace") as fh:
+        data = fh.read()
+    after = data[data.rfind(")") + 2 :].split()
+    pgrp = int(after[2])
+    return pgrp, int(after[11]) + int(after[12])
+
+
+def group_cpu_ticks(leader_pid: int) -> int:
+    """Sum observed ticks for the group and children, including new sessions."""
+    samples = {}
+    try:
+        entries = os.listdir("/proc")
+    except OSError:
+        return 0
+    for entry in entries:
+        if not entry.isdigit():
+            continue
+        try:
+            with open(f"/proc/{entry}/stat", encoding="ascii", errors="replace") as fh:
+                data = fh.read()
+            fields = data[data.rfind(")") + 2 :].split()
+            samples[int(entry)] = (int(fields[1]), int(fields[2]),
+                                   int(fields[11]) + int(fields[12]))
+        except (OSError, ValueError, IndexError):
+            continue  # process exited mid-scan, or an unreadable/odd stat line
+    members = {pid for pid, (_, group, _) in samples.items() if group == leader_pid}
+    if leader_pid in samples:
+        members.add(leader_pid)
+    children = {}
+    for pid, (parent, _, _) in samples.items():
+        children.setdefault(parent, []).append(pid)
+    pending = list(members)
+    while pending:
+        for child in children.get(pending.pop(), ()):
+            if child not in members:
+                members.add(child)
+                pending.append(child)
+    return sum(samples[pid][2] for pid in members)

{phase_loop_runtime-0.7.23 → phase_loop_runtime-0.7.25}/src/phase_loop_runtime/advisor_board/CONTRACTS.md

@@ -28,8 +28,8 @@ equivalence is proven by a test (not asserted in prose).
   the **agy/gemini leg where effort is embedded in the model-name string**
   (`render_gemini_model`, panel_invoker.py:1016). Built-3 lanes are concrete;
   breadth lanes raise `EffortMappingError` until ABDREG/ABDHOME/ABDOMNI.
-  Round-trip (proven): claude→`--effort max`, codex→
-  `-c model_reasoning_effort=xhigh`, Gemini Flash→`gemini-3.8-flash-high`;
+  Default round-trip (proven): claude→`--effort high`, codex→
+  `-c model_reasoning_effort=high`, Gemini Flash→`gemini-3.8-flash-medium`;
   explicit legacy Pro display names remain compatible.
 - **Seat identity for result re-keying** — `Seat.seat_key` is a stable LABEL over
   every distinguishing field (lane, model, effort, lens), so lens-only-different
@@ -563,6 +563,15 @@ only in a private 0600 per-leg file under the run's stream dir (`leg-logs/`, 070
 reasons or the board summary. Its name carries only closed fields:
 `leg-logs/<registry harness | leg>-<24 hex>.log`.
 
+**Seat-jail codes (agent-harness#1132, F030).** Every seat-jail notice code is an exact
+literal of `_HARNESS_DETAIL_CODES`: `seat_sandbox_unavailable_{host,seat_uid,tiocsti}`,
+`seat_sandbox_not_staged`, each `seat_sandbox_refused:<sub>` as its own literal
+(`jail_build`, `namespace`, `identity`, `preseed`, `token_file_unsafe`,
+`gemini_credential_unsafe`, `stage_not_private`, `stage_changed`, `output_unsafe`),
+`seat_sandbox_retained_after_teardown`, and the `claude_seat_*` / `gemini_seat_*` codes. No
+regex template admits a seat code, and there is no parallel vocabulary: `seat_jail.NOTICES`
+only renders each code's literal what/why/fix, and a test holds the two sets equal.
+
 **Threat model.** I3 defends against untrusted TEXT: CLI stdout/stderr, leg bodies, exception messages and PTY output. None of it can choose or enter `detail`. In-process Python code is trusted runtime code and is out of scope: it can do anything (for example `object.__setattr__` on arbitrary objects, or replacing this module's functions). The exact-type checks (`PanelLegResult` refuses any subclass instance; only an exact `_HarnessCode` / `_LegFailure` has provenance; contents are read with `str.__str__` and re-created as a fresh `_HarnessCode`) close the cheap structural bypasses, but they are not a sandbox against hostile in-process code.
 
 ## ABDMODE — Purpose-derived default mode + advisory prompt hygiene · `panel_invoker.py` (#107)
@@ -889,8 +898,11 @@ set `gemini_heartbeat.QUALIFIED_IMAGES`: 1.2.11 SHA256
 `ec7cf797ecb0e1d91ddf3b6d9d6c1d616bb89f78a5b0e43536b72a7fce695f56`, 1.2.12 SHA256
 `ce6fdd9e7621ee9ac6eedaa337731ca1f235e412ff57cf9eabcd2aa23b3576ca`, 1.2.14 SHA256
 `0d0d3eba22daf29504dd290151c7ed9a4d33b0c6aa0acfc5da27bc3b01d2f029`, 1.2.15 SHA256
-`5f9c16b286895f8f7fdecd423883ca256a85077b8acf9a6bc1111761d34df164` or 1.2.16 SHA256
-`a759ce7c7a235d9b6c281a25ead97cbbf2e92314a3ffd224e2f9144f3fae7a86`. Each member
+`5f9c16b286895f8f7fdecd423883ca256a85077b8acf9a6bc1111761d34df164`, 1.2.16 SHA256
+`a759ce7c7a235d9b6c281a25ead97cbbf2e92314a3ffd224e2f9144f3fae7a86`, 1.2.17 SHA256
+`c54ef90651a8646ae67334d39212c81f5946feec373ad6aa335f9ef401662bc5`, 1.3.0 SHA256
+`19be6af38f7beeaa0db415df9297e314ab3d33fdd6f853434d49f88819bc68e4` or 1.3.1 SHA256
+`ce1bdaed3201bb84f35d69d2773caec4f18af52af00e8c25f6cace07e4359615`. Each member
 carries its measured help digest and has its own qualification record; the
 evidence catalog and the runtime set must name exactly the same members.
 The running Python/kernel must support sealed memfds, pidfds and pidfd signaling;
@@ -1043,6 +1055,312 @@ A non-release `agy` image is admitted only by verifying it, never by trusting it
   created PR back (the PR body's copy is display-only). "Up to date" requires that local record, `headRefOid` and `ls-remote` to
   agree. It refuses when it cannot prove its open-PR listing complete.
 
+## SEATJAIL — Full-permission review seats inside a per-seat jail (agent-harness#1132)
+
+Plan: `plans/detailed-seat-sandbox-permissions-1132-20260928.md`. Maintainer decisions D1-D8
+are recorded on agent-harness#1132.
+
+- **Route (J7).** A production brokered Claude or Gemini leg decides its route once, after
+  the public-entry authorization and before staging, in this order; the first failure wins
+  and yields exactly one code: (0) no staged tree -> `seat_sandbox_not_staged`; (1) a
+  recorded Gemini P4/P3 stop -> its code (today `gemini_seat_egress_unconfined`: the agy
+  token carries `cloud-platform`, and the "prove then enable" containment probe found jail
+  egress not limited to agy's inference hosts; P3 was not run and the tooled profile is not
+  built); (2) host capability -> `seat_sandbox_unavailable_host`,
+  `_tiocsti`, or `_seat_uid`; (3) credential presence -> `claude_seat_token_missing` /
+  `gemini_seat_credential_missing`; (4) Gemini tooled qualification ->
+  `gemini_seat_profile_unqualified`. Steps 0-4 send the seat to the sealed inline route,
+  byte-identical to before, with that notice, except a Claude seat's step 3, which is not
+  run (plan amendment A3b, below). Codex and grok are not jailed
+  (agent-harness#895) and carry `seat_filesystem_unconfined` when given a tree.
+- **No sealed fallback for a jail-eligible seat (plan amendment A3b).** A Claude seat that
+  would take the jailed route but cannot (no credential, a failed first-use qualification,
+  a login not renewed within the wait, an unqualified or unsafe gate, an unsafe override)
+  is DEGRADED and NOT RUN, typed, with a fix. It is never a toolless substitute.
+  `seat_jail.JAIL_NOT_RUN_CODES` names the route codes this applies to; none of them is in
+  `SEALED_FALLBACK_CODES`. The sealed route stays for hosts without the jail prerequisites,
+  an unstaged review and the Gemini seat (agent-harness#1244).
+- **The jailed route is Claude-only.** `JAILED_LEGS` is exactly `{"claude"}`. A Gemini
+  seat always takes the sealed route with its typed notice, whatever its credential,
+  qualification or recorded stop; a tooled Gemini seat is agent-harness#1170.
+- **EC-EXECFIND-2 gate.** A jailed route whose jail profile digest has no EC-EXECFIND-2
+  falsifier pass recorded on THIS host is REFUSED before any effect with
+  `seat_sandbox_refused:jail_unqualified`. The notice names the per-host qualification as
+  the fix.
+  - **Where passes live:** per user and per host, at
+    `$XDG_STATE_HOME/phase-loop/seat-jail-passes/<digest>.json`. A record qualifies only if it
+    binds all of:
+    - the digest;
+    - this host (sha256 of `/etc/machine-id`);
+    - the EC-EXECFIND-2 falsifier-run layout: `seat_jail.falsifier_layout_identity()`, a
+      digest of the EXECFIND staging and run code, so a change to either invalidates every
+      pass;
+    - the run's evidence file, which the gate re-hashes and which must name the same values.
+
+    The record and the evidence must be regular, operator-owned files that are not group- or
+    other-writable and are not links. They are read non-blocking with size caps.
+  - **The directory chain:** every directory up to the state home must be operator-owned,
+    must not be a link, and must not be other-writable. It may be group-writable only when
+    its group is the operator's user-private group, which is the umask-002 default. That
+    means all of the following hold:
+    - it is the operator's primary gid;
+    - the group is named after the operator;
+    - it lists no other member;
+    - no other account has it as its primary group.
+
+    Any other chain is refused with `seat_sandbox_refused:pass_store_unsafe`, whose notice
+    names the chmod. The recorder applies the same rule and never re-permissions an
+    existing directory.
+  - **One fail-closed boundary:** the whole evaluation is inside a single
+    `except Exception`. Any error is the typed refusal `jail_unqualified`, and no provider
+    is launched. The route detail stays the closed code. The verdict's typed reason
+    (`no_record`, `binding_mismatch`, `evidence_mismatch`, `store_unsafe:...` or
+    `error:<ExceptionClass>`) is logged, and is carried in the launch refusal's message.
+  - **Checked at launch:** qualification is re-checked against the jail actually built.
+  - **Threat model:** the operator's own account can forge a record, and is trusted to. The
+    store defends against the seat uid, stale records, other hosts and accidental reuse.
+  - **Why per host:** the digest binds the host's layout (maintainer decision, option A).
+    A shipped host-independent policy digest plus a first-use self-check is
+    agent-harness#1186.
+  - **Recording a pass:** `phase-loop seat-sandbox qualify` runs EC-EXECFIND-2's jail
+    falsifiers (`seat_jail_qualification`) against a real falsifier run, using the EXECFIND
+    staging, the dependency snapshot and the bounded bwrap runner:
+    - the run holds a nonce sentinel in every protected directory, a sentinel process, and
+      TCP, UDP, pathname Unix and abstract Unix listeners;
+    - concurrently, a probe program running as the seat in the production jail tries to
+      create entries, change sentinels, signal and connect, through the host paths and
+      through anything it resolves by device and inode;
+    - the parent judges the result: sentinels intact, no events, single-link protected
+      files, no seat mount or descriptor resolving to a protected object or an ancestor, and
+      the run `green_on_head`.
+
+    Only a pass is recorded.
+  - **`seat_sandbox_refused:identity`** remains the code for a jail that is not the
+    qualified profile at launch, or a failed identity probe.
+- **Jail profile (`seat_jail_v1`).** bwrap, no `--unshare-user` and no `--unshare-net`:
+  read-only `/usr` (merged-`/usr` links recreated), an `/etc` subset, the provider image at
+  `/seat/bin/<leg>`, the bundle and instructions as sealed memfds at `/seat/review/`, the
+  staged clone read-write at `/seat/tree`, fresh `/seat/home` and `/seat/out`, tmpfs `/tmp`
+  and `/dev/shm`, `--remount-ro /`, `--clearenv` plus a declared environment (the seat's
+  `TMPDIR` and `CLAUDE_CODE_TMPDIR` are `/seat/home/.tmp`, on the disk-backed staging root,
+  never the tmpfs `/tmp`; agent-harness#1147), and the J14
+  seccomp filter (architecture kill, x32 EPERM, nested user/mount namespaces, `setns`,
+  `clone3` ENOSYS, key syscalls, AF_ALG sockets, TIOCSTI/TIOCLINUX). The profile digest
+  covers the mount set, the flags and the filter digest.
+- **Seat uid (D8).** The seat runs as a subordinate uid leased from the operator's
+  `/etc/subuid` range, inside an egress holder namespace mapped by `newuidmap`/`newgidmap`
+  (in it, uid 0 is the operator). Launch order: fresh session keyring, `nsenter` into H,
+  the private-inode hand-off (`seat_sandbox_refused:stage_not_private` on any hard link),
+  bwrap with `--cap-drop ALL` then exactly `CAP_SETUID`, `CAP_SETGID`, `CAP_SETPCAP` (P5:
+  bwrap as namespace root otherwise keeps every capability), then `setpriv` to the seat
+  uid with every capability set, the bounding set included, emptied and no-new-privs set,
+  then `env --chdir=/seat/tree` as the seat. `/seat`, `/seat/bin`, `/seat/review` and
+  `/etc` are created 0755 and the tmpfs mounts 1777, so the seat uid can traverse and use
+  them (P5, P1).
+  The host prerequisite (`apt install uidmap`, `usermod --add-subuids/--add-subgids`) is a
+  one-time root step by the maintainer, never run by the runtime.
+- **Credential channels (plan amendment A1).** The Claude credential is resolved afresh at
+  each jailed launch, in this order:
+  1. The seat-token override, the record `$XDG_STATE_HOME/phase-loop/seat-credentials/
+     claude.override.json` (owner-only, in a 0700 directory, owned by the euid). It is
+     written only by `phase-loop seat-sandbox store-token` and used only when it is bound to
+     the account and organization the launching session is logged in to (plan amendment A4,
+     below). A hand-placed raw `seat-credentials/claude` file is never used.
+  2. Otherwise, the current Claude login's `claudeAiOauth.accessToken` only, never its
+     refresh token. It comes from the CLI's own store: `$CLAUDE_CONFIG_DIR/.credentials.json`
+     or `~/.claude/.credentials.json`, and the login Keychain on macOS.
+
+  - **The login token's margin:** it must have the seat's hard deadline (its explicit
+    per-leg timeout, else the 1800 s backstop) or `PHASE_LOOP_SEAT_LOGIN_TOKEN_MARGIN_S`
+    left. One function (`_claude_seat_login_margin_s`) gives this margin to the pre-launch
+    seat mode, the wait and the launch.
+  - **A short login (plan amendment A3):** the harness never runs the Claude CLI to renew a
+    credential. The mode line carries `claude_seat_login_token_awaiting_refresh` with the
+    minutes left. Before staging, and before any seat id or namespace is held, the seat
+    waits: `seat_credentials.await_login_margin` reads the store read-only every
+    `PHASE_LOOP_SEAT_LOGIN_REFRESH_POLL_S` (30 s), for up to
+    `PHASE_LOOP_SEAT_LOGIN_REFRESH_WAIT_S` (900 s; 0 means no wait).
+    - **Renewed:** the seat runs jailed (logged `jailed (login refreshed)`), re-reading the
+      token at launch.
+    - **Not renewed in time:** the seat is DEGRADED and NOT RUN with
+      `claude_seat_login_token_expiring`. A store that stops yielding a login ends it with
+      `claude_seat_token_missing`. Nothing is launched (plan amendment A3b).
+    - **Monitoring:** under `heartbeat_only` the wait is recorded as `login_wait` in the
+      monitoring record, not as a stall, and the stall clock starts after it. Under a
+      bounded policy it is charged to the leg's deadline. The monitor's cancel event and the
+      quiescence latch end it.
+  - **Delivery:** either credential is delivered only through one drained pipe named by
+    `CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR`. No credential is in any argv, environment
+    value, evidence or log.
+  - **The output scan:** seat output is scanned for the credential's bytes and its
+    standard, URL-safe and hex encodings (`claude_seat_token_in_output`).
+  - **The residual:** a seat can use the credential for its remaining lifetime. That is
+    hours for a login access token. The response is to log out and back in; the token also
+    expires on its own.
+  - **Gemini:** the D7 access-token-only copy (builder only; the tooled Gemini route is gated
+    on P4 then P3).
+- **Credential outcomes by source.** For the override: `claude_seat_token_rate_limited` and
+  `claude_seat_token_rejected`. For the login: `claude_seat_login_rate_limited` and
+  `claude_seat_login_rejected`. A login token at or past its launch-time expiry fails as
+  `claude_seat_login_token_expired`, in both the detail and the notice, and is safe to
+  relaunch. None of these is a `seat_sandbox_refused:*` code. On both the sealed and the
+  jailed route, an authentication failure in the PTY tail takes priority over the generic
+  journaled give-up (`claude_seat_provider_api_error`), so a credential outcome is never
+  hidden behind it; every typed give-up (limits, output budget, rejected transcript) keeps
+  its priority.
+- **First-use qualification (plan amendment A2; folds in agent-harness#1186 option C).** A
+  jailed route with no recorded pass for this host, digest and layout runs the host's jail
+  qualification once, before launch. It is serialized by an exclusive lock in the per-user
+  state directory, and on a pass it records the pass.
+  - **On a pass:** the seat stays jailed, and its mode reports `qualified_now`.
+  - **On a failure, or a run that cannot happen (a cached failure included):** the seat is
+    DEGRADED and NOT RUN with `seat_jail_qualification_failed` and a typed reason
+    (`prerequisite_missing`, `store_unsafe`, `uid_switch_denied`, `falsifiers_failed`, `timeout` or
+    `error`),
+    each with a literal fix (plan amendment A3b supersedes A2's sealed fallback).
+  - **The failure cache:** failures are cached per host, digest and layout for
+    `PHASE_LOOP_SEAT_JAIL_QUALIFY_RETRY_S` (default 3600 s). A lock timeout is not cached.
+  - **The launch-time re-check** against the built jail still refuses an unrecorded digest.
+- **Seat modes (plan amendment A1).** Before any seat launches, every board publishes one
+  mode per seat: `jailed`, `unconfined`, `sealed`, `degraded` or `native`. Each mode carries
+  its notice code, reason and fix, and the modes are delivered through `on_seat_modes`, the
+  log and `seat-modes.json`. The `advisor-board` CLI prints them to stderr and carries them as
+  `seat_modes` in `--json`.
+- **Launch helpers.** The pre-jail and in-namespace helpers (`seat_keyring_exec`, the
+  `seat_uid` handoff and its in-namespace verbs) run from the installation the parent
+  imported: `python -I` with this package's root put first on the import path
+  (`seat_uid.trusted_module_argv`), never `python -m`, whatever the launch's working
+  directory is. An inventory test fails on any `sys.executable -m` launch of a package
+  module.
+- **Scratch decision (agent-harness#1147).** A jailed launch's helper chain gets one env
+  from `child_scratch_env` (`_jail_launch_env`), and that same object is handed to the
+  identity probe and the launch. The seat never sees it: bwrap clears the environment and
+  sets the seat's own.
+- **The override follows the launching session (plan amendment A4).** A seat's credential
+  follows the subscription of the session that launched the leg.
+  - **Storing:** `phase-loop seat-sandbox store-token` reads the override with no echo, or
+    from stdin. A terminal that cannot hide the input is refused. The token and its account
+    are stored as ONE record, `seat-credentials/claude.override.json`
+    (`{"schema": "seat_credential_override.v1", "account": ..., "token": ...}`).
+    - **The account** is the current login's `oauthAccount.accountUuid`, from
+      `$CLAUDE_CONFIG_DIR/.claude.json` or `~/.claude.json`, read without running the CLI.
+    - **Refused** with no login. An unsafe account file is named in the refusal.
+    - **The write:** it goes relative to the held directory descriptors (each directory
+      component opened without following links and checked on the descriptor), as a new
+      0600 file under a random name renamed into place. A store is therefore atomic, and
+      concurrent stores leave one complete record.
+  - **At launch:** the record is read once, without following a link and without blocking.
+    - **Used:** only when its account equals the launching session's account, and the
+      launch uses exactly the token bytes whose account was checked.
+    - **Not used:** when the accounts differ, when either is unknown, when the record is
+      malformed, or when only a hand-placed raw `seat-credentials/claude` exists. The seat
+      then uses the login and carries the notice `claude_seat_override_other_subscription`,
+      also on its mode line, beside any login notice. That notice is not a jail refusal.
+    - **Unsafe:** a record that is not a private regular file the euid owns refuses the
+      launch (`seat_sandbox_refused:token_file_unsafe`).
+  - **When the seat does not run:** a refusal (no login, a login short of the margin, a wait
+    that ended short) carries `claude_seat_override_other_subscription` beside its one
+    refusal code whenever a stored override was ignored. The seat's notices, the A3b
+    DEGRADED result and the mode line all carry it.
+  - **Per harness:** the rule lives once, in `override_decision(adapter)`. Each harness's
+    `SeatCredentialAdapter` answers `override_present()`, `read_override()` (the record,
+    read once) and `current_account()`, and declares its credential `sources` in precedence
+    order; an adapter without the override source never uses one. Claude is the only
+    adapter today, and `store-token` stores Claude's override.
+  - **One slot per user:** the override lives under the Unix user's `$XDG_STATE_HOME`, so
+    there is one per user, not one per config directory or account. A store from another
+    account replaces it, and sessions on the earlier account then use their login, with
+    the notice.
+  - **Independent reads:** the mode line, the A3 wait and the launch each read the decision
+    afresh. A `/login` between them can change the outcome. Every such change falls toward
+    the login, never toward an unbound override.
+  - **macOS:** the CLI keeps the login in the Keychain service named from
+    `CLAUDE_SECURESTORAGE_CONFIG_DIR` when that is set, and the account in
+    `CLAUDE_CONFIG_DIR/.claude.json`. With only the former set, the account and the login
+    can describe different identities. Set both, or neither.
+  - **Organization (maintainer ruling 2026-10-05):** the record (schema
+    `seat_credential_override.v2`) binds both `oauthAccount.accountUuid` and
+    `oauthAccount.organizationUuid`, read from the same `.claude.json`.
+    - **At launch:** the override applies only when both are known and both equal the
+      session's. A v1 or organization-less record is unbound.
+    - **Storing:** `store-token` refuses when the organization is unknown.
+  - **Permissions:** the record must be owner-only: any group or other bit refuses with
+    `token_file_unsafe`. The store opens every directory component, the state root
+    included, without following links; a linked state root is refused, naming the directory
+    to set `XDG_STATE_HOME` to.
+  - **Refusals after resolution:** a refusal raised after the credential is resolved (the
+    jail build, the pre-seed, the namespace) also carries the ignored-override notice beside
+    its one refusal code.
+  - **Modes without the notice:** sealed, unconfined and native Claude modes carry no
+    override notice, by design: the override is never their credential.
+  - **Status:** `phase-loop seat-sandbox token-status` shows the bound account and
+    organization, this session's, and whether the override applies. It exits 0 only when
+    the override applies, and never shows the token.
+- **Seat-token rotation.** The override record is read at each jailed launch and never
+  cached across legs or rounds.
+  - **Rotating:** `phase-loop seat-sandbox store-token` is the only way to rotate it. It
+    replaces the record with one rename, and the next launch uses the new token; a running
+    leg keeps the token it was launched with.
+  - **By hand:** a token file replaced by hand is ignored.
+  The token is per-launch input only: neither the jail profile digest nor an EC-EXECFIND-2
+  pass binds it, so replacing it trips no qualification check.
+- **A rate-limited seat token is not a jail fault.** When the provider refuses the seat
+  token's subscription for a rate or usage limit (the shared leg-failure classifier's
+  `usage_limit` class, with the provider's reset time when it gives one), the leg ends with
+  that detail and the notice `claude_seat_token_rate_limited`: rotate or replace the seat
+  token, or wait for the reset. It is never a `seat_sandbox_refused:*` code. A token the provider
+  rejects (the classifier's `auth_failure`, measured in P2) carries
+  `claude_seat_token_rejected`.
+- **Pointer-brief preflight.** On a `--pointer-brief` board, a seat whose launch takes the
+  jailed route (the same J7 decision and EC-EXECFIND-2 gate the launch applies) has file
+  access to the staged tree, so it is source-grounded and never marked
+  `seat_pointer_brief_unreadable`. A jail that would be refused is not counted as one.
+- **Pointer mode.** A jailed seat gets a pointer brief: jail-path preamble, the
+  AUTHORITATIVE INSTRUCTIONS inline, and POINTER frames naming the bundle (path, sha256,
+  size) and the tree (path, source commit, approved digest). Evidence records
+  `provider_input_mode: "pointer"`, `provider_input_inline: false`,
+  `sandbox_filesystem_confined: true` and the jail profile id and digests;
+  `verify_harden_evidence.py` reports EC-HARDEN-5 UNMET (accepted residual
+  agent-harness#361, D3) on every such record.
+- **Notices.** `{code, seat_key, what, why, fix}`, rendered only from literals, on the
+  `advisor-board` payload (`notices`, `legs[].notices`) and text summary, and on the
+  governed path as one non-gating `seat_notice` finding per notice (L4b).
+- **Retention.** A failed in-namespace teardown keeps the seat directories under the leg's
+  operator-owned 0700 scratch dir, adds `seat_sandbox_retained_after_teardown`, and records
+  the path. `phase-loop seat-sandbox reap PATH` accepts only a recorded path under the
+  stage root, opened `O_NOFOLLOW|O_DIRECTORY` component by component, and owned by a
+  subordinate uid.
+
+## SEATOWNER — The seat-launch owner (agent-harness#1222)
+
+Every review seat, the president and executor `review` start through one owner,
+`panel_invoker.launch_owned`. A jailed Claude seat (SEATJAIL) launches through its jail
+instead, and the jail is that launch's owner.
+
+- **Credentials, the narrowest each CLI runs with.** No seat receives a refresh token.
+  - **Claude:** the one SEATJAIL decision. That is the bound override, else the login's
+    access token. It is delivered through the drained pipe named by
+    `CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR`.
+  - **Gemini and Grok:** an access-token-only copy.
+  - **Codex:** the auth file with its refresh token's value emptied. The key and the id
+    token stay, because the CLI sends no bearer without them (measured).
+  - **Every copy:** it sits in the seat's private home, and its secret values are
+    redacted from the seat's output.
+- **Refusals.** Each owner refusal is a closed detail code and a `seat_jail.NOTICES`
+  entry, with what happened, why and a fix line (`seat_owner_unavailable`,
+  `seat_filtered_egress_unavailable`, `seat_keyring_unavailable`, ...).
+- **The Claude journal.** The host collects the exact session journal through retained
+  handles, after the provider has been cleaned up, and validates it before any approval.
+  - **Refused on both routes:** a new user turn, a max-token continuation, an unmatched
+    `tool_use`, partial JSONL, or a missing final answer.
+  - **A completed tool cycle is accepted:** every `tool_use` has its `tool_result`.
+  - **A journaled `isApiErrorMessage` record** is never an answer or a continuation. The
+    answer parser (agent-harness#1194) decides the turn.
+  - **The route's own answer rule:**
+    - the president requires a terminal turn;
+    - on the review route, a completed answer outlives a later stray error.
+  - **A refusal or cancellation keeps no partial journal on the host.**
+
 ## ABDFALSIFY — Executable review findings (IF-0-EXECFIND-1)
 
 An optional `falsifier` attachment names one `FindingFalsifier` with

{phase_loop_runtime-0.7.23 → phase_loop_runtime-0.7.25}/src/phase_loop_runtime/advisor_board/backing.py

@@ -483,12 +483,15 @@ class ParentUnixBroker:
         ):
             raise ValueError("broker canonical repository authority is not probeable")
         try:
-            listed = subprocess.check_output(
-                ["git", "-C", str(self.canonical_repo), "ls-files", "-z"],
+            from ..review_stage import host_git
+
+            listed = host_git(
+                self.canonical_repo, "ls-files", "-z", check=True,
                 text=True,
+                stdout=subprocess.PIPE,
                 stderr=subprocess.DEVNULL,
                 timeout=3,
-            ).split("\0")
+            ).stdout.split("\0")
             probe_file = next(
                 (
                     self.canonical_repo / relative
@@ -498,7 +501,7 @@ class ParentUnixBroker:
                 ),
                 None,
             )
-        except (OSError, subprocess.SubprocessError):
+        except (OSError, ValueError, subprocess.SubprocessError):
             probe_file = None
         if probe_file is None:
             raise ValueError("broker canonical repository authority is not probeable")
@@ -696,7 +699,7 @@ class ParentUnixBroker:
         runtime_binds: list[str] = ["--ro-bind", "/usr", "/usr"]
         for runtime in ("/lib", "/lib64"):
             if Path(runtime).exists(): runtime_binds.extend(("--ro-bind", runtime, runtime))
-        argv = [str(bwrap),"--unshare-all","--die-with-parent","--new-session","--clearenv",*runtime_binds,"--dir","/run","--ro-bind",str(self.root),"/run/phase-loop-broker","--ro-bind",str(self.staged_dir),"/run/phase-loop-review","--tmpfs","/tmp","--proc","/proc","--dev","/dev","--setenv","PATH","/usr/bin","--setenv","PYTHONNOUSERSITE","1","--setenv","PYTHONDONTWRITEBYTECODE","1",str(python),"-I","-S","-c",code]
+        argv = [str(bwrap),"--unshare-all","--die-with-parent","--new-session","--clearenv",*runtime_binds,"--dir","/run","--dir","/run/phase-loop-broker","--ro-bind",str(self.path),"/run/phase-loop-broker/intended-inference.sock","--ro-bind",str(self.staged_dir),"/run/phase-loop-review","--tmpfs","/tmp","--proc","/proc","--dev","/dev","--setenv","PATH","/usr/bin","--setenv","PYTHONNOUSERSITE","1","--setenv","PYTHONDONTWRITEBYTECODE","1",str(python),"-I","-S","-c",code]
         error: list[BaseException] = []
         child: list[tuple[subprocess.Popen[bytes], int]] = []
         def serve() -> None:
@@ -882,18 +885,18 @@ def _staged_tree_digest(canonical_repo_authority: Path | str | None) -> str | No
     authorization that permits NO staged tree rather than one asserting a digest
     it could not compute.
     """
-    from ..review_stage import review_tree_manifest_sha256
+    from ..review_stage import host_git, review_tree_manifest_sha256
 
     # Normalize to the SAME git toplevel `_canonical_review_repo_authority` resolves
     # at spawn. Digesting an unnormalized path would bind a different tree than the
     # one actually staged, and the mismatch would only surface as a refusal at launch.
     candidate = Path(canonical_repo_authority) if canonical_repo_authority is not None else Path.cwd()
     try:
-        root = subprocess.check_output(
-            ["git", "-C", str(candidate), "rev-parse", "--show-toplevel"],
-            text=True, stderr=subprocess.DEVNULL, timeout=3,
-        ).strip()
-    except (OSError, subprocess.SubprocessError):
+        root = host_git(
+            candidate, "rev-parse", "--show-toplevel", check=True,
+            text=True, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, timeout=3,
+        ).stdout.strip()
+    except (OSError, ValueError, subprocess.SubprocessError):
         return None
     if not root:
         return None
@@ -912,16 +915,18 @@ def _staged_tree_digest(canonical_repo_authority: Path | str | None) -> str | No
 
 
 def _canonical_repo_digest(canonical_repo_authority: Path | str | None) -> str:
+    from ..review_stage import host_git
+
     candidate = Path(canonical_repo_authority) if canonical_repo_authority is not None else Path.cwd()
     try:
-        root = subprocess.check_output(
-            ["git", "-C", str(candidate), "rev-parse", "--show-toplevel"],
+        root = host_git(
+            candidate, "rev-parse", "--show-toplevel", check=True,
             text=True,
+            stdout=subprocess.PIPE,
             stderr=subprocess.DEVNULL,
             timeout=3,
-            env={key: value for key, value in os.environ.items() if not key.startswith("GIT_")},
-        ).strip()
-    except (OSError, subprocess.SubprocessError):
+        ).stdout.strip()
+    except (OSError, ValueError, subprocess.SubprocessError):
         raise ValueError("HARDEN review has no canonical repository authority") from None
     if not root:
         raise ValueError("HARDEN review has no canonical repository authority")

{phase_loop_runtime-0.7.23 → phase_loop_runtime-0.7.25}/src/phase_loop_runtime/advisor_board/composition.py

@@ -88,13 +88,13 @@ def _uses_production_composition_probe(
     )
 
 # Ideal per-vendor seat, in deterministic composition order. Each vendor runs at
-# its MAX thinking (gemini's ceiling is ``high``) with a distinct primary lens.
+# the panel default effort with a distinct primary lens.
 _VENDOR_ORDER: tuple[str, ...] = ("grok", "claude", "codex", "gemini")
 _VENDOR_SEAT: dict[str, dict[str, str]] = {
-    "grok": {"model": "grok-4.7", "harness": "grok", "effort": "max", "lens": "adversarial"},
-    "claude": {"model": "claude-opus-5-5", "harness": "claude", "effort": "max", "lens": "correctness"},
-    "codex": {"model": "gpt-6-astra", "harness": "codex", "effort": "max", "lens": "red-team"},
-    "gemini": {"model": "gemini-3.8-flash", "harness": "gemini", "effort": "high", "lens": "alternative-approach"},
+    "grok": {"model": "grok-4.7", "harness": "grok", "effort": "high", "lens": "adversarial"},
+    "claude": {"model": "claude-opus-5-5", "harness": "claude", "effort": "high", "lens": "correctness"},
+    "codex": {"model": "gpt-6-astra", "harness": "codex", "effort": "high", "lens": "red-team"},
+    "gemini": {"model": "gemini-3.8-flash", "harness": "gemini", "effort": "medium", "lens": "alternative-approach"},
 }
 
 # Distinct lenses the backfill cycles through (each vendor's primary lens is drawn

{phase_loop_runtime-0.7.23 → phase_loop_runtime-0.7.25}/src/phase_loop_runtime/advisor_board/config.py

@@ -31,6 +31,7 @@ from collections.abc import Mapping
 from dataclasses import dataclass
 from pathlib import Path
 import re
+import subprocess
 from typing import Any, Callable
 
 try:  # Python 3.11+
@@ -311,6 +312,7 @@ def load_president_ladder(
     *,
     env: Mapping[str, str] | None = None,
     path: Path | None = None,
+    review_base: bool = False,
 ) -> tuple[str, ...]:
     """The effective president fallback order, first rung first.
 
@@ -331,7 +333,22 @@ def load_president_ladder(
         ladder = _parse_president(user, str(user_path)) or ladder
     if repo_dir is not None:
         repo_path = repo_board_config_path(repo_dir)
-        repo = _load_toml(repo_path)
+        if review_base:
+            from ..review_stage import trusted_review_control
+
+            try:
+                content = trusted_review_control(Path(repo_dir), REPO_CONFIG_RELATIVE_PATH)
+                repo = tomllib.loads(content.decode("utf-8")) if content is not None else None
+            except ValueError as exc:
+                if str(exc) != "review_base_unavailable":
+                    raise BoardConfigError(f"{repo_path} has no readable base configuration") from exc
+                # No main commit to read it from: the candidate's own copy is never trusted,
+                # so the repository layer is not in force (the user and built-in ladders are).
+                repo = None
+            except (OSError, UnicodeError, subprocess.SubprocessError) as exc:
+                raise BoardConfigError(f"{repo_path} has no readable base configuration") from exc
+        else:
+            repo = _load_toml(repo_path)
         if repo is not None:
             _reject_unknown(repo.keys(), _KNOWN_REPO_TOP_KEYS, str(repo_path))
             ladder = _parse_president(repo, str(repo_path)) or ladder

{phase_loop_runtime-0.7.23 → phase_loop_runtime-0.7.25}/src/phase_loop_runtime/advisor_board/fixtures/advisor-boards.example.toml

@@ -18,8 +18,8 @@ default_board = "default"
 # [agy]
 # self_qualification = false
 
-# The default board reproduces today's 3-leg panel (byte-for-byte back-compat).
-# Its three seats, in panel-leg order, render to today's exact CLI invocations:
+# This explicit example overrides the built-in default board, keeping higher effort.
+# Its three seats, in panel-leg order, render to these CLI invocations:
 #   codex  gpt-6-astra          effort=max  -> -c model_reasoning_effort=xhigh
 #   gemini "Gemini 3.1 Pro" effort=high -> model "Gemini 3.1 Pro (High)"
 #   claude claude-sonnet-5  effort=max  -> --effort max