feat: community governance layer — task state, undo, policy, audit, health, isolation

[isair]

Summary

Brings sjackson0109's community governance work (the develop-community branch) into develop, rebased onto the current head with original authorship preserved. The five feature commits are cherry-picked verbatim under Simon Jackson's authorship; only conflict resolution and a small test-adaptation commit were added on top.

• Task state tracking + undo registry (community Task State Tracking and Approval Gating #131): session-scoped task/step state machine, risk assessment per tool, act-then-undo model with a language-agnostic undo tool (replaces English-only regex detection).
• Policy engine + path guard + agent loop errors (community Policy Engine, Path Guard, and Formal Agent Loop Errors #132): workspace confinement (home_only default), kill-switch policy mode, formal error taxonomy for the reply loop.
• SQLite audit trail (community SQLite Audit Trail for Task and Tool Execution #133): opt-in, PII-redacted task/step/policy decision logging.
• Runtime health registry + graceful shutdown (community Runtime Health Registry and Graceful Bootstrap #134): critical vs optional service tracking.
• Process isolation for high-risk tools (community Process Isolation for High-Risk Tool Execution #130): subprocess worker containment.

Integration notes

• Rebased across 93 commits of drift: merged with the planner-era reply/engine.py (task steps, undo registration, and audit recording now coexist with the pre-flight planner, toolSearchTool allow-list widening, and tool-result digest), the llm/ package refactor, and the removal of recallConversation (fix(reply): small-model robustness — weather location, JSON leak scrub, router follow-ups, remove broken recallConversation #255).
• undo registered alongside toolSearchTool in the builtin registry.
• Spec files for all five areas are included and registered in the CLAUDE.md spec table; reply.spec.md merged to describe classification, approval checking, and task-state transitions alongside the current TTS/planner flow.
• No new LLM contexts: all five features are deterministic, so docs/llm_contexts.md is unchanged.
• Test adaptations: removed recallConversation references; path-guard tests now use a home-directory path so home_only assertions hold on every platform.

Tests

• All new suites pass: 131 tests across task state, approval, undo registry/tool, classification, audit, runner, and orchestration.
• Full suite vs develop baseline: zero regressions (the 68 pre-existing local Qt failures are identical on origin/develop).

Closes #130
Closes #131
Closes #132
Closes #133
Closes #134

🤖 Generated with Claude Code

[isair]

Multi-agent adversarial review completed (five specialists + verifier). All must-fix findings have been addressed in 2da83bd:

Fixed

• Undo snapshot corruption: snapshots were captured via the localFiles read operation, whose 10k-char display truncation meant undoing a write on any larger file would have restored truncated content. Snapshots now use a direct bounded read (1 MB cap); oversized files get no undo entry rather than a corrupting one.
• Planner direct-exec bypass: the fast path executed plan steps with no policy check, undo, or audit. It now runs only SAFE-risk, policy-allowed steps and defers anything else to the governed loop, failing closed.
• Success gating: step completion and undo registration were keyed on reply_text presence, so failed or denied actions were marked complete and offered undo. Now gated on result.success, with the audit record using the same predicate.
• Default path guard now blocks home credential stores (.ssh, .aws, .gnupg, .kube, .docker, .netrc, .npmrc, .pypirc, .git-credentials), and containment checks use device+inode identity so case tricks cannot evade blocked roots on macOS or Windows (verified against a live bypass reproduction).
• Hardcoded English spoken warnings replaced with model-directed instructions on the tool-result message, so the reply LLM phrases irreversibility warnings and undo notes in the user's language.
• Audit TaskRecord now finalised on the stop path.
• Spec honesty: reply.spec.md rewritten to the act-then-undo model actually implemented; execution.spec.md and runtime.spec.md now state that ToolRunner and ShutdownManager are not yet integrated (with wiring preconditions); policy_mode docstring corrected to active | deny.

Follow-ups to file as issues (not blockers)

• Wire ToolRunner (with policy fallback, scrubbed env, framed worker protocol) and ShutdownManager, then activate the two inert config keys.
• Engine-level integration tests for the policy-deny / undo / audit interleaving, and an undo-routing eval.
• Settings window metadata for the new policy keys; README section for undo and workspace confinement.
• TaskState per-turn isolation (currently a module singleton, safe today with the single voice call site).
• Async audit writes; remove the unused ApprovalStore grants machinery.

Test status: all 183 governance tests pass; full suite shows zero regressions against the develop baseline.