johnteee · Oct 27, 2026 · Oct 27, 2026 · Oct 27, 2026 · Oct 27, 2026 · Oct 27, 2026
@@ -42,7 +42,7 @@ acceptance flow writes the user TUI state file. In sandboxed environments, run
 them with permission to bind localhost ports and write the TeaAgent state
 directory.
 
-**Current acceptance test count: `673 passed`** (pytest-collected guard target)
+**Current acceptance test count: `674 passed`** (pytest-collected guard target)
 
 Keep historical acceptance-count snapshots in dated analysis or roadmap docs.
 This file only owns the live guard target.

@@ -4,7 +4,7 @@
 
 **Stale threshold:** 90 days since `Last reviewed`
 **Current-truth docs scanned:** 17
-**Needs attention (working tier only):** 7
+**Needs attention (working tier only):** 9
 **Archive-tier docs (exempt from staleness):** 0
 
 Regenerate: `python3 scripts/report_docs_aging.py`
@@ -29,7 +29,7 @@ Regenerate: `python3 scripts/report_docs_aging.py`
 
 | Document | Status | Last reviewed | File mtime | Notes |
 | --- | --- | --- | --- | --- |
-| `docs/maturity-matrix.md` | stale_by_mtime | 2026-09-16 | 2026-10-26 | Missing owner banner; File modified after last reviewed date |
+| `docs/maturity-matrix.md` | stale_by_mtime | 2026-09-16 | 2026-10-27 | Missing owner banner; File modified after last reviewed date |
 
 ### project
 
@@ -41,7 +41,19 @@ Regenerate: `python3 scripts/report_docs_aging.py`
 
 | Document | Status | Last reviewed | File mtime | Notes |
 | --- | --- | --- | --- | --- |
-| `docs/roadmap-status.md` | stale_by_mtime | 2026-10-23 | 2026-10-26 | Missing review trigger banner; File modified after last reviewed date |
+| `docs/roadmap-status.md` | stale_by_mtime | 2026-10-23 | 2026-10-27 | Missing review trigger banner; File modified after last reviewed date |
+
+### strategy
+
+| Document | Status | Last reviewed | File mtime | Notes |
+| --- | --- | --- | --- | --- |
+| `docs/backlog-priority.md` | stale_by_mtime | 2026-10-26 | 2026-10-27 | Missing owner banner; File modified after last reviewed date |
+
+### verification
+
+| Document | Status | Last reviewed | File mtime | Notes |
+| --- | --- | --- | --- | --- |
+| `docs/acceptance.md` | stale_by_mtime | 2026-09-16 | 2026-10-27 | File modified after last reviewed date |
 
 ## Review Triggers (Current-Truth Docs)
 
@@ -67,10 +79,10 @@ Regenerate: `python3 scripts/report_docs_aging.py`
 
 ## Corpus Cost (G5 Signal)
 
-**Total docs:** 675 (baseline 582 at diagnosis, delta +93)
-**Live corpus (non-archive):** 377
+**Total docs:** 676 (baseline 582 at diagnosis, delta +94)
+**Live corpus (non-archive):** 378
 **Archive-tier docs (total):** 298
-**Working-tier docs unreferenced by INDEX.md:** 323
+**Working-tier docs unreferenced by INDEX.md:** 324
 
 Dead-weight candidates (working tier, not linked from INDEX.md):
 
@@ -94,7 +106,7 @@ Dead-weight candidates (working tier, not linked from INDEX.md):
 - `adr/0017-backend-adapter-interfaces.md`
 - `adr/0018-async-from-sync-pattern.md`
 - `adr/0019-phase-4-federated-swarm-consensus.md`
-- ... and 303 more
+- ... and 304 more
 
 ### Archive-tier growth (files added per month, last 6 months)
 

@@ -6,11 +6,11 @@
 Generated by `python3 scripts/generate_docs_inventory.py`.
 Do not edit this file manually — regenerate instead.
 
-**Markdown files:** 674
+**Markdown files:** 675
 
 | Path | Tier | Bytes | SHA256 (12) |
 | --- | --- | ---: | --- |
-| `acceptance.md` | constitution | 22281 | `eb345d401d1c` |
+| `acceptance.md` | constitution | 22281 | `175a778989b1` |
 | `adr/0001-p0-framework.md` | working | 3225 | `d0666420a497` |
 | `adr/0002-p1-primitives.md` | working | 2877 | `d50c03f403a6` |
 | `adr/0003-p2-code-mode-sandbox.md` | working | 3153 | `594b44eb1569` |
@@ -211,7 +211,7 @@ Do not edit this file manually — regenerate instead.
 | `archive/plans/system-transparency-engineering-plan-2026-05-31.md` | archive | 15408 | `81c7914ec72d` |
 | `archive/plans/ux-improvement-roadmap-2026-05-31.md` | archive | 15447 | `b77390585263` |
 | `audit-events.md` | working | 2376 | `b83066076fba` |
-| `backlog-priority.md` | working | 55028 | `b8457396b4b2` |
+| `backlog-priority.md` | working | 57277 | `545b5e977389` |
 | `cli.md` | working | 42072 | `a02a140f784d` |
 | `cloud-deployment.md` | working | 9439 | `b27aada996c9` |
 | `context-bus-and-federated-sync.md` | working | 1564 | `2dde6eed4bf8` |
@@ -259,7 +259,7 @@ Do not edit this file manually — regenerate instead.
 | `error-reference.md` | working | 4897 | `067448aba6f1` |
 | `gateway-oauth-tenants.md` | working | 1818 | `0ff9c7df4652` |
 | `generated/command-snippet-inventory.md` | working | 8128 | `bf21da5dfe66` |
-| `generated/docs-aging-dashboard.md` | working | 5108 | `03e9c10505fb` |
+| `generated/docs-aging-dashboard.md` | working | 5570 | `6a62a1d29358` |
 | `generated/release-docs-evidence.md` | working | 3821 | `acee07427ed9` |
 | `governance-compliance.md` | constitution | 1645 | `d7665f2f7864` |
 | `governance/code-review-checklist.md` | working | 4379 | `f580da208c75` |
@@ -318,7 +318,7 @@ Do not edit this file manually — regenerate instead.
 | `implementation/daily-driver-fix-log.md` | working | 978 | `474648b41793` |
 | `implementation/fix-log-2026-06-02.md` | archive | 8520 | `21239812e63e` |
 | `INDEX.md` | working | 22539 | `40f6954ac592` |
-| `maturity-matrix.md` | working | 7159 | `6b992699e381` |
+| `maturity-matrix.md` | working | 7159 | `2df78e17decd` |
 | `migration-top-level-api.md` | working | 1505 | `2ba32dedee5a` |
 | `model-capability-matrix.md` | working | 4654 | `4843aa15a016` |
 | `modules/approval_manager/api.md` | working | 3905 | `37c89490637d` |
@@ -535,11 +535,12 @@ Do not edit this file manually — regenerate instead.
 | `retrospective/03-architecture-quality.md` | working | 27525 | `fd28fdd70665` |
 | `retrospective/04-ux-usability.md` | working | 26253 | `a9350bc35c4b` |
 | `retrospective/05-compliance-matrix.md` | working | 8285 | `cd2568b5eddb` |
-| `retrospective/06-action-register.md` | working | 45379 | `148cd2acd733` |
+| `retrospective/06-action-register.md` | working | 47037 | `556e9dccdc74` |
 | `retrospective/automation-plan.md` | working | 18716 | `0e0027c4b1c5` |
 | `retrospective/README.md` | working | 8718 | `d93f2a71f6b3` |
 | `retrospective/review-system.md` | working | 15360 | `ce42e83e5bcf` |
 | `retrospective/tool-capability-review.md` | working | 15681 | `20ca7506fc04` |
+| `reviews/98-risk.md` | working | 5511 | `710b7796952f` |
 | `reviews/a-p0-2-observability-risk.md` | working | 2781 | `8a2295be6857` |
 | `reviews/a-p1-3-authorization-extraction-risk.md` | working | 6913 | `fe84ae18f08b` |
 | `reviews/a-p1-3-governed-execution-risk.md` | working | 4979 | `bcb6e5e1fb88` |
@@ -585,7 +586,7 @@ Do not edit this file manually — regenerate instead.
 | `reviews/sec09-sec15-multisig-hardening-risk.md` | working | 11076 | `ae895567bb02` |
 | `reviews/security-risk-assessment-2026-06-02.md` | archive | 24112 | `4c9e2e00d001` |
 | `reviews/seven-control-loops-critical-questioning-2026-06-05.md` | archive | 7531 | `ae1e34b8369d` |
-| `roadmap-status.md` | constitution | 113958 | `19c400a3ad1e` |
+| `roadmap-status.md` | constitution | 114662 | `9df14453d98f` |
 | `run-evidence-and-audit-guide.md` | working | 2494 | `5ef9c11997d7` |
 | `security-whitepaper.md` | working | 9690 | `87fc3c31c4a3` |
 | `security/approval-abuse-cases-2026-06-02.md` | archive | 1281 | `4c43296d1c66` |

@@ -1,6 +1,6 @@
 # TeaAgent Maturity Matrix
 
-> **Last reviewed:** 2026-09-16 (labels unchanged; acceptance posture 131 files / 673 tests matches guard)
+> **Last reviewed:** 2026-09-16 (labels unchanged; acceptance posture 131 files / 674 tests matches guard)
 > **Review trigger:** Subsystem maturity labels change.
 
 Content last changed: 2026-05-31 (TUI evolution Phase A-C + doc review); the 2026-09-16 review above confirmed labels unchanged since.
@@ -80,7 +80,7 @@ Scale reference (internal engineering, not market validation):
 ## Honest External Posture
 
 - Public repo activity ≠ production validation.
-- **Internal acceptance coverage is strong** (131 test files across `tests/acceptance/`, 673 collected tests; counts pinned by `tests/test_docs_consistency.py`).
+- **Internal acceptance coverage is strong** (131 test files across `tests/acceptance/`, 674 collected tests; counts pinned by `tests/test_docs_consistency.py`).
 - External adoption signals (stars, forks, production references) remain early — do not infer enterprise readiness from architecture alone.
 
 ## Related Docs

@@ -42,6 +42,10 @@ Legend: ✅ Done (committed) · 🟡 In progress · ⬜ Not started · 🔵 Alre
 | U-P1-4 | UX | Reconcile stale dated documentation: add supersession notes to `tui-daily-driver-guide.md:54,67`, `tui-chat-reference.md:36-37`, and `run-evidence-and-audit-guide.md:82`, or update them. | As listed | No current-truth contradictions remain; docs-consistency CI passes. | ✅ | Current TUI cost, controller, undo, task-forwarding, root, and resume facts reconciled across operator, troubleshooting, and module docs on 2026-06-21; docs consistency and focused TUI tests pass |
 | U-P1-5 | UX | Remove `--no-tui` from all module documentation or implement it. | `docs/modules/cli/*`; `docs/modules/tui/inspection.md`; `docs/modules/chat_session_controller/api.md`; `docs/decisions/trade-offs.md:101` | Documentation matches code; either `rg --no-tui docs/` has no matches or the flag exists. | ✅ | This session — removed from 7 files; `rg --no-tui docs/` now returns only retrospective references (which document the removal) |
 | U-P1-6 | UX | Add a confirmation gate before chat mode forwards typos: `unknown command "x"; send as task? [y/N]`. | `teaagent/tui/_commands.py:396-397` | A typo no longer silently becomes an LLM task; add a test. | ✅ | Unknown commands require explicit confirmation before task forwarding; `tests/tui/test_tui_typo_confirmation.py` |
+| G-P1-4 | Governance | Make a matched deny preset terminal in `prompt` mode: `POLICY_DENIED` must not fall through to interactive approval, matching the owner decision "block in all modes" (`docs/reviews/dogfood-g1-g22-2026-09-15-risk.md:22`). | `teaagent/runner/_governed_execution.py:314-335`; `teaagent/approval/manager.py:987` | An approving handler is never offered a deny-matched call; the tool does not run; `tool_call_blocked` records `policy_denied`. | ✅ | DENY-OVERRIDE, `docs/backlog-priority.md` |
+| G-P1-5 | Governance | Wire a per-batch cancel token into subagent batches so a timed-out batch stops its running children at their next step instead of letting them keep writing after the batch reported a timeout. | `teaagent/subagents/_tools.py:315-370`; `teaagent/subagents/_manager.py:165-185`; `teaagent/runner/_core.py:907` | After the batch deadline a running child makes no new tool call and the cancellation is audited. | ✅ | WS2-002 residual, `docs/backlog-priority.md` |
+| U-P1-7 | UX | Extend the operator cockpit state with branch, undo availability, last run id and active rules (M4 cockpit carve-out, DR-006 `owner-override: co-maintainer dogfood`). | `teaagent/cockpit.py:367` | A headless test asserts the four fields are exposed and rendered. | ✅ | DU-011, `docs/backlog-priority.md` |
+| U-P1-8 | UX | Make the long-run heartbeat record current tool, elapsed time, cost and next checkpoint (M4 background-lifecycle carve-out, DR-006 `owner-override: co-maintainer dogfood`). | `teaagent/heartbeat.py:40-52` | A test asserts the heartbeat audit payload carries the four fields. | ✅ | DU-014, `docs/backlog-priority.md` |
 
 ## P2 - Cleanup (Polish/Debt/Defense in Depth)
 
@@ -95,7 +99,7 @@ Legend: ✅ Done (committed) · 🟡 In progress · ⬜ Not started · 🔵 Alre
 | --- | --- | --- |
 | P0 | 9 | Security 3, Architecture 2, UX 2, Governance 2 |
 | P2 | 36 | Security 11, Governance 10, Architecture 7, UX 8 |
-| **Total** | **63** | |
+| **Total** | **67** | |
 
 ### Status Summary
 | ✅ Done (verified) | 61 | S-P0-1, S-P0-2, S-P0-3, A-P0-1, A-P0-2, U-P0-1, U-P0-2, G-P0-1, G-P0-2; S-P1-1, S-P1-2, S-P1-3, S-P1-4, G-P1-1, G-P1-2, G-P1-3, A-P1-1, A-P1-2, A-P1-3, A-P1-4, A-P1-5, U-P1-1, U-P1-2, U-P1-3, U-P1-4, U-P1-5, U-P1-6; S-P2-1, S-P2-4, S-P2-5, S-P2-6, S-P2-7, S-P2-8, S-P2-9, S-P2-10, S-P2-11, G-P2-1, G-P2-2, G-P2-3, G-P2-5, G-P2-6, G-P2-7, G-P2-8, G-P2-9, G-P2-10, G-P2-11, G-P2-12, G-P2-13, A-P2-1, A-P2-2, A-P2-3, A-P2-5, A-P2-6, A-P2-7, U-P2-1, U-P2-2, U-P2-3, U-P2-4, U-P2-5, U-P2-6, U-P2-7, U-P2-8 |

@@ -0,0 +1,51 @@
+# Risk Report — PR 98: terminal deny presets, batch cancel token, cockpit and heartbeat fields
+
+> **Claim class:** Risk note for one PR. Not current truth.
+> **Last reviewed:** 2026-10-27
+
+**Date:** 2026-10-27
+**Scope:** G-P1-4, G-P1-5, U-P1-7, U-P1-8 (`docs/retrospective/06-action-register.md`)
+**High-risk path touched:** `teaagent/runner/_core.py` (per `scripts/high_risk_paths.yaml`). The approval change in `teaagent/runner/_governed_execution.py` is not on that list but changes approval behavior, so it is assessed here too.
+
+## What changes
+
+1. **Deny presets are terminal in `prompt` mode (G-P1-4).** `authorize_tool_call` caught every `ToolPermissionError` and, for a destructive tool in `prompt` mode, offered it to the interactive approval handler. A matched deny preset (`POLICY_DENIED`, `teaagent/approval/manager.py:987`) therefore ran when a person approved. It now goes to `record_blocked` and re-raises before the handler. Every other reason code keeps its current path.
+2. **Subagent batches cancel their children at the deadline (G-P1-5).** Each batch creates a `threading.Event`, passes it to its children as `cancel_token`, and sets it at the deadline and on every exit. A set parent token is copied to the batch token while the batch waits. `AgentRunner` already checked the token at the top of each iteration; it now also checks it right before dispatching a tool decision (3 lines in `_core.py`).
+3. **Cockpit run context (U-P1-7).** `ControlCockpitState` gains branch, undo availability, last run id and active rules; the TUI renders them.
+4. **Heartbeat progress (U-P1-8).** Heartbeat ticks can carry tool, in-flight flag, elapsed seconds, cost and last checkpoint from an allow-listed provider.
+
+## Risk assessment
+
+- **Blast radius.**
+  - (1) Only calls that match an explicit deny grant change outcome, and only in `prompt` mode with a destructive tool and an approval handler. Allow, workspace-write, read-only and handler-less prompt runs already blocked.
+  - (2) Only `register_subagent_tools` batches pass the new token; swarm, tournament and team callers still inherit the parent token unchanged.
+  - (3) and (4) Additive read-only observability.
+- **Failure modes.**
+  - (1) A user who relied on approving a denied call at the prompt is now blocked. That behavior contradicted `docs/cli.md:923`, `docs/permission-and-approval-playbook.md:63-64` and the owner decision in `docs/reviews/dogfood-g1-g22-2026-09-15-risk.md:22`. The escape hatch is `teaagent approval revoke <grant_id>`, pinned by a falsifier test.
+  - (2) A child stops at its next check, so a tool call already dispatched may still finish; the guarantee is "no new tool call after the deadline", not "no side effect after the deadline". A cancelled child records the existing `run_failed` (`system`, "run cancelled by cancel token"). The batch wait loop now wakes every 50 ms to poll the parent token.
+  - (3) Each source is wrapped: a failure logs, records an error string and shows `unknown`, never a silent pass (A-P0-2).
+  - (4) A raising provider sets `progress_unavailable` and the tick still records; the provider cannot overwrite `tick` or `interval_seconds`.
+- **Thin harness.** `runner/_core.py` grows from 1,062 to 1,065 lines; god-module exemptions stay at 18. No new framework, event type or dependency: the cancel path reuses `cancel_token` and `RunCancelledError`.
+- **Not changed.** `JIT_NO_APPROVAL`, `MULTISIG_NO_QUORUM` and the protected-path codes (`WORKSPACE_WRITE_MODE`, `SYMLINK_BLOCKED`, `SKILL_WRITE_BLOCKED`) still reach the approval prompt for destructive tools in `prompt` mode. No owner decision on record covers them; flagged in the PR for the owner.
+
+## Dry run and rollback
+
+- **Dry run.** Full suite on the PR head with the locked toolchain: 6830 passed, 34 skipped, 0 failed. All `lint` and `governance-gate` CI steps were run locally and exit 0. Each behavior change has a test that failed on the base: the approving handler ran the denied tool, and 4 tool calls landed after the batch deadline.
+- **Rollback.** Each change is one commit and reverts independently: `801223dd` (deny), `98fa5e59` (cancel token), `57d84d70` (cockpit), `232df373` (heartbeat). Reverting `801223dd` restores prompt-mode override; reverting `98fa5e59` restores the previous behavior where abandoned children keep running. No data migration and no stored-state format change.
+
+## Tests
+
+- `tests/test_deny_preset_runtime_enforcement.py`:
+  - the approving handler is never called and the tool never runs;
+  - `tool_call_blocked` records `policy_denied`;
+  - `approval why-denied` describes it;
+  - revoking the grant lets the same handler run the tool.
+- `tests/test_subagent_batch_cancel_token.py`:
+  - at most one already-dispatched tool call after the batch returns;
+  - a parent cancel mid-batch stops the children.
+- `tests/test_control_cockpit.py` and `tests/acceptance/test_cockpit_snapshot_flow.py`: the four fields, plus the no-git, no-run and failure cases.
+- `tests/test_heartbeat_progress_fields.py`: payload fields, backward compatibility without a provider, and one real run.
+
+## Decision
+
+Proceed. Change (1) aligns code with an owner decision already on record rather than making a new one. Change (2) makes the batch's "timed out" result true by reusing an existing primitive. Changes (3) and (4) are inside the DR-006 M4 cockpit and background-lifecycle carve-out. Human review: the PR is not merged without the owner's review; the protected-path question stays with the owner.