Archive authorized primary-session evidence before lossy transforms

Capture the post-policy representation that enters primary history —
messages, tool args lifecycle, assistant text, structured/error results,
MCP blocks, and attachment/overflow blob provenance — into a session-owned
evidence archive with completeness certificates. Workers omit the hook.

Author: TheGreatAxios

docs/IMPLEMENTATION.md

@@ -80,6 +80,8 @@ src/
     state.ts              RunState JSON save/load
     compactor.ts          Context compactor
     summarizer.ts         Model-backed structured compaction summary (+ deterministic fallback)
+    compaction-archive.ts Primary-only authorized evidence archive (post-policy capture)
+    compaction-archive-schema.ts Archive occurrence / completeness certificate schemas
     run-sink.ts           Run-level event sink
     stream-consumer.ts    Async stream consumer with error handling
     hooks.ts              Lifecycle hooks: discovery, turn collector, run summary

src/agent/posix-tool-plugins.ts

@@ -23,6 +23,7 @@ import {
 } from "../plugins/read-file-guard-plugin.js";
 import type { PermissionGate } from "../permission/gate.js";
 import { createWorktreeRootsProvider } from "../permission/worktree-roots.js";
+import type { CompactionArchive } from "../session/compaction-archive.js";
 
 export interface CorePosixToolPluginsArgs {
   cwd: string;
@@ -37,6 +38,8 @@ export interface CorePosixToolPluginsArgs {
   getContextDir?: () => string | undefined;
   // Per-project settings.env, merged into the run_shell spawn environment.
   shellEnv?: Record<string, string>;
+  /** Primary-only evidence archive; workers omit this getter. */
+  getEvidenceArchive?: () => CompactionArchive | undefined;
 }
 
 // Middleware order matches docs/ARCHITECTURE.md: path escape through truncation,
@@ -71,6 +74,7 @@ export function buildCorePosixToolPlugins(args: CorePosixToolPluginsArgs): ToolP
     getBlobWriter,
     getContextDir,
     shellEnv,
+    getEvidenceArchive,
   } = args;
   // Pre-gate sandboxes honor yolo mode so outside-workspace path tools and shell
   // cwd are not hard-denied after the gate already auto-allows. Pass a live
@@ -79,10 +83,11 @@ export function buildCorePosixToolPlugins(args: CorePosixToolPluginsArgs): ToolP
   // regardless.
   const allowOutside = (): boolean => permissionGate.getSkipPermissions();
   const truncationOptions =
-    getBlobWriter !== undefined || getContextDir !== undefined
+    getBlobWriter !== undefined || getContextDir !== undefined || getEvidenceArchive !== undefined
       ? {
           ...(getBlobWriter !== undefined ? { getBlobWriter } : {}),
           ...(getContextDir !== undefined ? { getContextDir } : {}),
+          ...(getEvidenceArchive !== undefined ? { getEvidenceArchive } : {}),
         }
       : {};
   return [

src/agent/tools.ts

@@ -22,6 +22,7 @@ import { buildCorePosixToolPlugins } from "./posix-tool-plugins.js";
 import { createLazyBlobReader } from "./lazy-blob-reader.js";
 import type { BlobReader } from "@intx/types/runtime";
 import type { SpillBlobWriter } from "../plugins/result-truncation-plugin.js";
+import type { CompactionArchive } from "../session/compaction-archive.js";
 import {
   connectMCPServer as connectMCPClient,
   type MCPClient,
@@ -157,6 +158,8 @@ export interface AgentToolsetArgs {
   getContextDir?: () => string | undefined;
   // Per-project settings.env, merged into the run_shell tool's spawn environment.
   shellEnv?: Record<string, string>;
+  /** Primary-only evidence archive; workers omit this getter. */
+  getEvidenceArchive?: () => CompactionArchive | undefined;
   // Whether a workflow is currently running. submit_output rides the wire
   // every turn (workflow or not), so the model can call it with nothing active;
   // this lets its handler report an honest no-op instead of a false advance.
@@ -270,6 +273,7 @@ export async function createAgentToolset(args: AgentToolsetArgs): Promise<AgentT
     getBlobReader,
     getBlobWriter,
     getContextDir,
+    getEvidenceArchive,
     sessionMode = "orchestrator",
     shellEnv,
     toolAvailability = { languageServerAvailable: true },
@@ -335,6 +339,7 @@ export async function createAgentToolset(args: AgentToolsetArgs): Promise<AgentT
         : {}),
       ...(getBlobWriter !== undefined ? { getBlobWriter } : {}),
       ...(getContextDir !== undefined ? { getContextDir } : {}),
+      ...(getEvidenceArchive !== undefined ? { getEvidenceArchive } : {}),
       ...(shellEnv !== undefined ? { shellEnv } : {}),
     }),
   });
@@ -801,6 +806,7 @@ export async function createAgentToolset(args: AgentToolsetArgs): Promise<AgentT
         const mcpTools = mcpClientToAgentTools(result.client, permissionGate, {
           ...(getBlobWriter !== undefined ? { getBlobWriter } : {}),
           ...(getContextDir !== undefined ? { getContextDir } : {}),
+          ...(getEvidenceArchive !== undefined ? { getEvidenceArchive } : {}),
           ...(isBuiltinExaMCPServer(config) ? { excludeToolNames: ["web_fetch_exa"] } : {}),
         });
         dynamicRunner.addTools(mcpTools);

src/exec/runner.ts

@@ -66,6 +66,7 @@ import {
   loadSessionLocalSettings,
   resolveLiveSessionSources,
 } from "../session/assemble-runtime.js";
+import type { CompactionArchive } from "../session/compaction-archive.js";
 import { emitPluginWarningSummary } from "../plugins/diagnostics.js";
 import { createModelSummarizer } from "../session/summarizer.js";
 import { ID_PREFIX, LOG_NAMESPACE_ROOT } from "../branding.js";
@@ -427,6 +428,7 @@ export async function runExec(config: Config): Promise<ExecResult> {
 
     let currentAgent: Agent | null = null;
     let currentStorage: ContextStore | null = null;
+    const evidenceArchiveHolder: { current?: CompactionArchive } = {};
 
     const overlay = resolveExecDirectorOverlay(config.director);
 
@@ -440,6 +442,7 @@ export async function runExec(config: Config): Promise<ExecResult> {
       ...(toolWatchdog !== undefined ? { toolWatchdog } : {}),
       ...(localSettingsForMode?.env !== undefined ? { shellEnv: localSettingsForMode.env } : {}),
       getBlobWriter: () => currentStorage?.writeBlob,
+      getEvidenceArchive: () => evidenceArchiveHolder.current,
       getContextDir: () => workdir,
       getBlobReader: () => {
         if (currentAgent === null) {
@@ -587,6 +590,7 @@ export async function runExec(config: Config): Promise<ExecResult> {
         currentAgent = agent;
         currentStorage = storage;
       },
+      evidenceArchiveHolder,
     });
 
     const emitter = new EventEmitter();

src/mcp/client.ts

@@ -18,12 +18,25 @@ export interface MCPTool {
   inputSchema: Record<string, unknown>;
   annotations?: McpToolAnnotations;
 }
+export interface MCPContentBlock {
+  type: string;
+  text?: string;
+  [key: string]: unknown;
+}
+
 export interface MCPClient {
   serverName: string;
   tools: MCPTool[];
   call(toolName: string, args: Record<string, unknown>, signal: AbortSignal): Promise<string>;
+  /** Validated content blocks before flattening — for post-policy archive capture. */
+  callBlocks?(
+    toolName: string,
+    args: Record<string, unknown>,
+    signal: AbortSignal,
+  ): Promise<MCPContentBlock[]>;
   close(): Promise<void>;
 }
+
 export type MCPConnectResult =
   { ok: true; client: MCPClient } | { ok: false; serverName: string; error: string };
 export interface MCPConnectOptions {
@@ -58,6 +71,23 @@ export function unwrapToolContent(content: unknown): string {
     .join("\n");
 }
 
+export function validateMcpContentBlocks(content: unknown): MCPContentBlock[] {
+  if (!Array.isArray(content)) return [];
+  const out: MCPContentBlock[] = [];
+  for (const block of content) {
+    if (block === null || typeof block !== "object") continue;
+    const type = (block as { type?: unknown }).type;
+    if (typeof type !== "string") continue;
+    const copy: MCPContentBlock = { type };
+    for (const [key, value] of Object.entries(block)) {
+      if (key === "type") continue;
+      copy[key] = value;
+    }
+    out.push(copy);
+  }
+  return out;
+}
+
 interface HTTPAuthContext {
   url: URL;
   authProvider: CorbitsOAuthProvider;
@@ -191,12 +221,19 @@ async function finishClient(
   return {
     serverName,
     tools,
+    async callBlocks(toolName, args, signal) {
+      const context = authContext === undefined ? undefined : { ...authContext, signal };
+      const result = await withHTTPAuthorizationRecovery(context, () =>
+        client.callTool({ name: toolName, arguments: args }, undefined, { signal }),
+      );
+      return validateMcpContentBlocks(result.content);
+    },
     async call(toolName, args, signal) {
       const context = authContext === undefined ? undefined : { ...authContext, signal };
       const result = await withHTTPAuthorizationRecovery(context, () =>
         client.callTool({ name: toolName, arguments: args }, undefined, { signal }),
       );
-      return unwrapToolContent(result.content);
+      return unwrapToolContent(validateMcpContentBlocks(result.content));
     },
     async close() {
       authContext?.callback.close();

src/mcp/plugin.test.ts

@@ -17,6 +17,7 @@ function fakeClient(reply: string): MCPClient {
       },
     ],
     call: async () => reply,
+    callBlocks: async () => [{ type: "text", text: reply }],
     close: async () => undefined,
   };
 }

src/mcp/plugin.ts

@@ -2,18 +2,43 @@ import type { AgentTool } from "@intx/agent";
 import type { ToolCall, ToolResult } from "@intx/types/runtime";
 import type { PermissionGate } from "../permission/gate.js";
 import { gateToolCall } from "../plugins/permission-plugin.js";
-import { scrubSecretShapedContent } from "../plugins/tool-result-secret-scrub.js";
+import {
+  scrubSecretShapedContent,
+  scrubSecretShapedValue,
+} from "../plugins/tool-result-secret-scrub.js";
 import {
   truncateToolResultContent,
   type SpillBlobWriter,
 } from "../plugins/result-truncation-plugin.js";
-import type { MCPClient } from "./client.js";
+import type { CompactionArchive } from "../session/compaction-archive.js";
+import type { MCPClient, MCPContentBlock } from "./client.js";
 import { mcpToolName } from "./tool-name.js";
+import { unwrapToolContent } from "./client.js";
 
 export interface McpSpillOptions {
   getBlobWriter?: () => SpillBlobWriter | undefined;
   getContextDir?: () => string | undefined;
   excludeToolNames?: readonly string[];
+  /** Primary-only evidence archive; workers omit this getter. */
+  getEvidenceArchive?: () => CompactionArchive | undefined;
+}
+
+function applyPolicyToBlocks(blocks: MCPContentBlock[]): MCPContentBlock[] {
+  return blocks.map((block) => {
+    const next = { ...block };
+    if (typeof next.text === "string") {
+      next.text = scrubSecretShapedContent(next.text);
+    }
+    for (const [key, value] of Object.entries(next)) {
+      if (key === "type" || key === "text") continue;
+      if (typeof value === "string") {
+        next[key] = scrubSecretShapedContent(value);
+      } else if (value !== null && typeof value === "object") {
+        next[key] = scrubSecretShapedValue(value);
+      }
+    }
+    return next;
+  });
 }
 
 // MCP results never reach the posix runner, so the secret-scrub and truncation
@@ -35,7 +60,7 @@ export function mcpClientToAgentTools(
   gate: PermissionGate,
   spillOptions: McpSpillOptions = {},
 ): AgentTool[] {
-  const { getBlobWriter, getContextDir, excludeToolNames = [] } = spillOptions;
+  const { getBlobWriter, getContextDir, excludeToolNames = [], getEvidenceArchive } = spillOptions;
   const excluded = new Set(excludeToolNames);
 
   return client.tools
@@ -50,7 +75,26 @@ export function mcpClientToAgentTools(
       handler: (call: ToolCall, signal: AbortSignal): Promise<ToolResult> =>
         gateToolCall(gate, call, signal, async () => {
           try {
-            const content = await client.call(tool.name, call.arguments, signal);
+            const rawBlocks =
+              typeof client.callBlocks === "function"
+                ? await client.callBlocks(tool.name, call.arguments, signal)
+                : [
+                    {
+                      type: "text",
+                      text: await client.call(tool.name, call.arguments, signal),
+                    } satisfies MCPContentBlock,
+                  ];
+            const authorizedBlocks = applyPolicyToBlocks(rawBlocks);
+            const archive = getEvidenceArchive?.();
+            if (archive !== undefined) {
+              await archive.recordAuthorizedPayload({
+                kind: "tool_result",
+                payload: { blocks: authorizedBlocks },
+                callId: call.id,
+                provenance: "mcp:post-policy-pre-flatten",
+              });
+            }
+            const flattened = unwrapToolContent(authorizedBlocks);
             const writeBlob = getBlobWriter?.();
             const contextDir = getContextDir?.();
             const spill =
@@ -61,14 +105,30 @@ export function mcpClientToAgentTools(
                     ...(contextDir !== undefined ? { contextDir } : {}),
                   }
                 : undefined;
-            return { callId: call.id, content: await sanitizeMcpResultContent(content, spill) };
+            // Content is already scrubbed; truncate only (avoid double-scrub).
+            const content = await truncateToolResultContent(flattened, undefined, spill);
+            return { callId: call.id, content };
           } catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            const scrubbed = scrubSecretShapedContent(message);
+            const archive = getEvidenceArchive?.();
+            if (archive !== undefined) {
+              await archive.recordAuthorizedPayload({
+                kind: "tool_result",
+                payload: scrubbed,
+                callId: call.id,
+                provenance: "mcp:error",
+              });
+            }
             return {
               callId: call.id,
-              content: err instanceof Error ? err.message : String(err),
+              content: scrubbed,
               isError: true,
             };
           }
         }),
     }));
 }
+
+// Keep sanitize helper exported for tests that still call the string path.
+export { sanitizeMcpResultContent };

src/plugins/result-truncation-plugin.ts

@@ -6,6 +6,7 @@ import {
   type MaterializedToolResult,
 } from "./tool-result-materialize.js";
 import { scrubSecretShapedContent } from "./tool-result-secret-scrub.js";
+import { hashAuthorizedBytes, type CompactionArchive } from "../session/compaction-archive.js";
 
 const TRUNCATABLE_TOOLS = new Set(["read_file", "grep", "run_shell", "search_files", "web_fetch"]);
 
@@ -206,13 +207,40 @@ export interface ResultTruncationPluginOptions {
   // Live getter for the absolute session context dir, re-read like
   // getBlobWriter so rotation picks up the new path for the notice.
   getContextDir?: () => string | undefined;
+  /** Primary-only evidence archive; workers omit this getter. */
+  getEvidenceArchive?: () => CompactionArchive | undefined;
+}
+
+async function archiveAuthorizedResult(
+  archive: CompactionArchive | undefined,
+  callId: string,
+  content: string | Record<string, unknown>,
+  isError: boolean | undefined,
+): Promise<void> {
+  if (archive === undefined) return;
+  await archive.recordAuthorizedPayload({
+    kind: "tool_result",
+    payload: content,
+    callId,
+    provenance: isError === true ? "posix:error" : "posix:post-policy-pre-truncation",
+  });
 }
 
 export function resultTruncationPlugin(options: ResultTruncationPluginOptions = {}): ToolPlugin {
-  const { getBlobWriter, getContextDir } = options;
+  const { getBlobWriter, getContextDir, getEvidenceArchive } = options;
   return {
     middleware: (next) => async (call, signal) => {
       const result = await next(call, signal);
+      const archive = getEvidenceArchive?.();
+
+      if (TRUNCATABLE_TOOLS.has(call.name)) {
+        if (typeof result.content === "string") {
+          await archiveAuthorizedResult(archive, call.id, result.content, result.isError);
+        } else if (result.content !== null && typeof result.content === "object") {
+          await archiveAuthorizedResult(archive, call.id, result.content, result.isError);
+        }
+      }
+
       if (!TRUNCATABLE_TOOLS.has(call.name) || result.isError) return result;
 
       const writeBlob = getBlobWriter?.();
@@ -230,11 +258,20 @@ export function resultTruncationPlugin(options: ResultTruncationPluginOptions =
       if (typeof content === "string") {
         const truncated = await truncateToolResultContent(content, MAX_RESULT_CHARS, spill);
         if (truncated === content) return result;
+        if (archive !== undefined && spill !== undefined && content.length > MAX_RESULT_CHARS) {
+          await archive.recordExistingBlobReference({
+            kind: "overflow_blob",
+            blobKey: spillBlobKey(call.id),
+            contentHash: hashAuthorizedBytes(new TextEncoder().encode(content)),
+            callId: call.id,
+            provenance: "result-truncation:full",
+          });
+        }
         return { ...result, content: truncated };
       }
 
       if (content !== null && typeof content === "object") {
-        const record = content as Record<string, unknown>;
+        const record = content;
         const compact = JSON.stringify(record);
         if (compact.length <= MAX_RESULT_CHARS) return result;
         const truncated = await truncateToolResultRecord(record, MAX_RESULT_CHARS, spill);