Repository navigation
Expand file tree
/
Copy pathlayers.tsv
More file actions
We can make this file beautiful and searchable if this error is corrected: It looks like row 4 should actually have 1 column, instead of 10 in line 3.
198 lines (198 loc) · 26.1 KB
/
Copy pathlayers.tsv
File metadata and controls
198 lines (198 loc) · 26.1 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
# Formal layout policy. UTF-8 TSV; kinds: module, forbid, restrict, thirdparty, symbol, allow, exempt, exception, metadata.
# exception rows require rule, path (from), target (to), owner, expires (YYYY-MM-DD), note. No initial waivers.
# Paths use canonical destinations. src_layout_map.tsv supplies temporary P0-P2 locations; strict/final rejects those aliases.
kind path module group rank rule target owner expires note
module src/base/utils/ utils base 0 D1 D2 D15
module src/base/image/ image base 1 D1 D2 D15
module src/base/platform/ platform base 2 D1 D2 D15
module src/base/config/ config base 3 D1 D2 D15
module src/base/network/ network base 4 D1 D2 D15
module src/base/ipc/ ipc base 5 D1 D2 D15
module src/base/workspace/ workspace base 6 D1 D2 D15
module src/base/pty/ pty base 7 D1 D2 D15
module src/base/environment/ environment base 8 D1 D2 D15
module src/domain/llm/ llm domain 10 D1 D2 D15
module src/domain/permissions/ permissions domain 11 D1 D2 D15
module src/domain/security/ security domain 12 D1 D2 D15
module src/domain/sandbox/ sandbox domain 13 D1 D2 D15
module src/domain/experts/ experts domain 14 D1 D2 D15
module src/domain/project_instructions/ project_instructions domain 15 D1 D2 D15
module src/domain/memory/ memory domain 16 D1 D2 D15
module src/domain/history/ history domain 17 D1 D2 D15
module src/domain/connectors/ connectors domain 18 D1 D2 D15
module src/domain/hooks/ hooks domain 19 D1 D2 D15
module src/domain/skills/ skills domain 20 D1 D2 D15
module src/domain/worktree/ worktree domain 21 D1 D2 D15
module src/domain/gitinfo/ gitinfo domain 22 D1 D2 D15
module src/domain/session/ session domain 23 D1 D2 D15
module src/adapters/upgrade/ upgrade adapters 24 D1 D2 D15
module src/adapters/themes/ themes adapters 25 D1 D2 D15
module src/adapters/feedback/ feedback adapters 26 D1 D2 D15
module src/adapters/computer_use/ computer_use adapters 27 D1 D2 D15
module src/adapters/lsp/ lsp adapters 28 D1 D2 D15
module src/adapters/pa/ pa adapters 29 D1 D2 D15
module src/adapters/provider/ provider adapters 30 D1 D2 D15
module src/adapters/tool/ tool adapters 31 D1 D2 D15
module src/adapters/im/ im adapters 32 add-desktop-im-channels: QQ / Telegram transports
module src/adapters/speech/ speech adapters 33 External speech recognition services
module src/engine/tool_preamble/ tool_preamble engine 40 D1 D2 D15
module src/engine/prompt/ prompt engine 41 D1 D2 D15
module src/engine/agent/ agent engine 42 D1 D2 D15
module src/host/session_host/ session_host host 50 D1 D2 D15
module src/host/loop/ loop host 51 D1 D2 D15
module src/host/remote_control/ remote_control host 52 D1 D2 D15
module src/host/channels/ channels host 53 D1 D2 D15
module src/host/app_runtime/ app_runtime host 54 Reserved for phase 2; do not create in phase 1
module src/apps/tui/ tui apps 60 D1 D2 D15
module src/apps/web/ web apps 61 D1 D2 D15
module src/apps/headless/ headless apps 62 D1 D2 D15
module src/apps/desktop/ desktop apps 63 D1 D2 D15
module src/apps/daemon/ daemon apps 64 D1 D2 D15
module src/apps/cli/ cli apps 65 D1 D2 D15
module src/apps/installer/ installer apps 66 Self-built Windows installer; reuses the desktop splash animation
forbid src/domain/* R3 provider Domain never depends on provider
forbid src/domain/* R3 @cpr Domain never depends on CPR
forbid src/adapters/provider/* R3 feedback -
forbid src/adapters/provider/* R3 upgrade -
forbid src/adapters/tool/* R3 feedback -
forbid src/adapters/tool/* R3 upgrade -
restrict src/apps/desktop/* R6 base -
restrict src/base/config/vocab/* R6 standard -
restrict src/apps/tui/model/* R6 no-ftxui -
restrict src/adapters/computer_use/helper_main* R6 computer-helper -
restrict src/adapters/computer_use/native_* R6 computer-helper -
restrict src/adapters/computer_use/macos_*.mm R6 computer-helper -
restrict src/adapters/computer_use/pointer_* R6 computer-helper -
thirdparty R7 ^(ftxui/|ftxui\.) tui;cli
thirdparty R7 ^(crow/|crow\.) web;daemon;channels;remote_control
thirdparty R7 ^(webview/|webview\.) desktop
thirdparty R7 ^(mcp/|mcp_|cpp-mcp/) tool
thirdparty R7 ^(winpty\.h|winpty/) pty
thirdparty R7 ^(AgentLocation\.h|LibWinptyException\.h)$ pty
thirdparty R7 ^(stb/|stb_|external/stb/) image
symbol src/* R11:provider_messages \bmodel_facing_provider_messages\b -
symbol src/engine/agent/* R11:approval \b(?:evaluate_tool_approval|resolve_tool_approval|approve_tool_call|permission_gate)\b|\bToolPermissionGate::decide\b|\bexec_permission\s*= -
symbol src/* R11:audit \b(?:audit_gate|record_audit)\b -
symbol src/* R11:tool_names \bset_model_tool_name_mappings\s*\( -
symbol src/engine/agent/* R11:messages_write \bmessages_\s*(?:\.(?:push_back|emplace_back|emplace|pop_back|clear|insert|erase|swap|resize|assign)\s*\(|(?:\[[^\]\n]+\]|\.(?:back|front|at)\([^)\n]*\))?(?:\.\w+|\[[^\]\n]+\])*\s*(?:=(?!=)|\+=|-=))|\b(?:swap|sort|reverse)\s*\(\s*messages_ -
symbol src/* R11:pa \bpa::|\b(?:note_pa_context_rejection|note_pa_context_accepted|pa_rescue_state_)\b -
symbol src/engine/agent/* R11:provider_chat (?:->|\.)\s*chat(?:_stream)?\s*\( -
allow src/engine/agent/request/provider_history.* R11:provider_messages Single outlet / PA contact table
allow src/engine/agent/request/api_request_builder.* R11:provider_messages Single outlet / PA contact table
allow src/engine/agent/side_question/agent_side_question.cpp R11:provider_messages Single outlet / PA contact table
allow src/engine/agent/approval/tool_permission_gate.* R11:approval Single outlet / PA contact table
allow src/engine/agent/approval/* R11:audit Single outlet / PA contact table
allow src/adapters/tool/tool_rewrites.cpp R11:tool_names Single outlet / PA contact table
allow src/domain/llm/tool_protocol_names.* R11:tool_names Single outlet / PA contact table
allow src/engine/agent/transcript/conversation_history.* R11:messages_write Single outlet / PA contact table
allow src/adapters/pa/* R11:pa Single outlet / PA contact table
allow src/adapters/provider/retry_policy.cpp R11:pa Single outlet / PA contact table
allow src/engine/agent/recovery/context_overflow_recovery.* R11:pa Single outlet / PA contact table
allow src/engine/agent/recovery/pa_rescue_host.* R11:pa Single outlet / PA contact table
allow src/engine/agent/model_step/active_model_view.* R11:pa Single outlet / PA contact table
allow src/engine/agent/compaction/compact.cpp R11:pa Single outlet / PA contact table
allow src/engine/agent/model_step/provider_stream_collector.* R11:provider_chat Single outlet / PA contact table
allow src/engine/agent/side_question/side_question_service.* R11:provider_chat Single outlet / PA contact table
allow src/engine/agent/side_question/side_chat.* R11:provider_chat Single outlet / PA contact table
allow src/engine/agent/compaction/compact.cpp R11:provider_chat Single outlet / PA contact table
allow src/engine/agent/progress/* R3:tool_preamble -
allow src/adapters/tool/theme_create_tool.* R3:themes -
exempt src/apps/web/* R12,R15 D21 user constraint; includes old src/web through mapping
exempt external/stb/* R12,R15 Third-party vendored code
exempt src/image/stb/* R12,R15 Third-party pre-move location
metadata R4 Reserved: the approved design defines no R4
symbol src/* R5:composition \b(?:lsp|web_search)::(?:init|shutdown)\s*\(|\bmake_(?:unique|shared)\s*<\s*(?:SessionRegistry|SubagentHost)\s*> -
allow src/apps/tui/app/* R5:composition -
allow src/apps/daemon/worker.* R5:composition -
allow src/apps/headless/headless_runner.* R5:composition -
allow src/apps/cli/* R5:composition -
allow src/host/app_runtime/* R5:composition -
allow src/adapters/computer_use/accessibility_context.hpp R6:computer-contract -
allow src/adapters/computer_use/application_identity.hpp R6:computer-contract -
allow src/adapters/computer_use/coordinate_transform.hpp R6:computer-contract -
allow src/adapters/computer_use/element_target.hpp R6:computer-contract -
allow src/adapters/computer_use/keyboard_input.hpp R6:computer-contract -
allow src/adapters/computer_use/macos_geometry.hpp R6:computer-contract -
allow src/adapters/computer_use/macos_keyboard.hpp R6:computer-contract -
allow src/adapters/computer_use/macos_native.hpp R6:computer-contract -
allow src/adapters/computer_use/native_backend.hpp R6:computer-contract -
allow src/adapters/computer_use/native_windows.hpp R6:computer-contract -
allow src/adapters/computer_use/pointer_capture.hpp R6:computer-contract -
allow src/adapters/computer_use/pointer_overlay.hpp R6:computer-contract -
allow src/adapters/computer_use/surface_policy.hpp R6:computer-contract -
ownership_allow src/base/utils/joining_thread.hpp 1 R15:detach join_or_detach_self ownership/P2-01 C8 self-join fallback only; P2-01
ownership_allow src/base/utils/joining_thread.hpp 1 R15:std_thread JoiningThread ownership/P2-01 C8 owned thread member; P2-01
ownership_allow src/base/utils/joining_thread.hpp 1 R15:std_thread JoiningThreadGroup ownership/P2-01 C8 legacy worker group owner; P2-01
ownership_allow src/base/utils/abandonable_call.cpp 1 R15:std_thread abandonable_detail::start_owned_work ownership/P2-01 C8 owned abandonable worker; P2-01
ownership_allow src/base/utils/abandonable_call.cpp 1 R15:detach abandonable_detail::start_owned_work ownership/P2-01 C8 detached worker owns captured lifetime; P2-01
allow src/engine/agent/approval/exec_permission_gate.* R11:approval Command evaluation delegated by the single tool approval gate
allow src/engine/agent/agent_runtime_env.* R11:pa A-14 injected process-service access point; algorithms remain at approved PA contacts
ownership_allow src/adapters/lsp/lsp_client.cpp 1 R15:raw_new LspClient::create ownership/final-audit Private constructor factory; new is immediately owned by unique_ptr
ownership_allow src/adapters/tool/mcp_manager.cpp 1 R15:unsafe_capture McpManager::start_entry_async ownership/final-audit call=with; Synchronous borrow; LifetimeRef::with admits and finishes its callback before returning
ownership_allow src/apps/daemon/worker.cpp 1 R15:unsafe_capture acecode::daemon ownership/final-audit call=with; Synchronous borrow; LifetimeRef::with admits and finishes its callback before returning
ownership_allow src/apps/daemon/worker.cpp 1 R15:unsafe_capture run_worker ownership/final-audit call=shutdown_step; local DaemonShutdownSequence action; run invokes each step inline before stack teardown
ownership_allow src/apps/tui/app/animation_ticker.cpp 1 R15:unsafe_capture acecode::tui ownership/final-audit call=worker_; C5 JoiningThread is the last member; destructor requests stop and joins before referenced state
ownership_allow src/apps/tui/app/copilot_auth_task.cpp 1 R15:unsafe_capture CopilotAuthTask::CopilotAuthTask ownership/final-audit call=JoiningThread; C5 last-member JoiningThread joins before provider snapshot and lifetime token
ownership_allow src/apps/tui/app/copilot_auth_task.cpp 1 R15:unsafe_capture CopilotAuthTask::authenticate ownership/final-audit call=with; Synchronous borrow; LifetimeRef::with admits and finishes its callback before returning
ownership_allow src/apps/tui/app/full_screen_surfaces.hpp 2 R15:unsafe_capture FullScreenSurfaces ownership/final-audit call=with; Synchronous borrow; LifetimeRef::with admits and finishes its callback before returning
ownership_allow src/apps/tui/app/inbound_submit_registration.cpp 1 R15:unsafe_capture InboundSubmitRegistration::InboundSubmitRegistration ownership/final-audit call=with; Synchronous borrow; LifetimeRef::with admits and finishes its callback before returning
ownership_allow src/apps/tui/app/mcp_status_binding.cpp 1 R15:unsafe_capture McpStatusBinding::McpStatusBinding ownership/final-audit call=with; Synchronous borrow; LifetimeRef::with admits and finishes its callback before returning
ownership_allow src/apps/tui/app/model_pool_monitor_subscription.cpp 1 R15:unsafe_capture ModelPoolMonitorSubscription::changed ownership/final-audit call=with; Synchronous borrow; LifetimeRef::with admits and finishes its callback before returning
ownership_allow src/apps/tui/app/tui_agent_bridge.hpp 1 R15:unsafe_capture TuiAgentBridge ownership/final-audit call=with; Synchronous borrow; LifetimeRef::with admits and finishes its callback before returning
ownership_allow src/apps/tui/app/tui_app.cpp 1 R15:unsafe_capture TuiApp::publish_configuration ownership/final-audit call=with; Synchronous borrow; LifetimeRef::with admits and finishes its callback before returning
ownership_allow src/apps/tui/app/tui_app.hpp 2 R15:unsafe_capture TuiApp ownership/final-audit call=with; Synchronous borrow; LifetimeRef::with admits and finishes its callback before returning
ownership_allow src/apps/tui/app/tui_command_context_factory.cpp 4 R15:unsafe_capture TuiCommandContextFactory::make ownership/final-audit call=with; Synchronous borrow; LifetimeRef::with admits and finishes its callback before returning
ownership_allow src/apps/tui/app/tui_event_router.cpp 1 R15:unsafe_capture TuiEventRouter::wrap ownership/final-audit call=with; Synchronous borrow; LifetimeRef::with admits and finishes its callback before returning
ownership_allow src/apps/tui/app/tui_notification_binding.cpp 2 R15:unsafe_capture TuiNotificationBinding::TuiNotificationBinding ownership/final-audit call=with; Synchronous borrow; LifetimeRef::with admits and finishes its callback before returning
ownership_allow src/apps/tui/app/tui_overlay_gate.cpp 1 R15:unsafe_capture PermissionResult ownership/final-audit call=with; Synchronous borrow; LifetimeRef::with admits and finishes its callback before returning
ownership_allow src/apps/tui/app/tui_submitter.cpp 3 R15:unsafe_capture TuiSubmitter::submit_input ownership/final-audit call=with; Synchronous borrow; LifetimeRef::with admits and finishes its callback before returning
ownership_allow src/apps/tui/app/tui_submitter.cpp 1 R15:unsafe_capture acecode::tui ownership/final-audit call=with; Synchronous borrow; LifetimeRef::with admits and finishes its callback before returning
ownership_allow src/apps/tui/app/tui_turn_lifecycle.cpp 3 R15:unsafe_capture acecode::tui ownership/final-audit call=with; Synchronous borrow; LifetimeRef::with admits and finishes its callback before returning
ownership_allow src/apps/tui/app/ui_post_target.cpp 1 R15:unsafe_capture UiPostTarget::post_event ownership/final-audit call=with; Synchronous borrow; LifetimeRef::with admits and finishes its callback before returning
ownership_allow src/apps/tui/app/ui_post_target.cpp 1 R15:unsafe_capture UiPostTarget::post_task ownership/final-audit call=with; Synchronous borrow; LifetimeRef::with admits and finishes its callback before returning
ownership_allow src/apps/tui/app/update_check_task.cpp 1 R15:unsafe_capture acecode::tui ownership/final-audit call=worker_; C5 last-member JoiningThread joins before its owned configuration and borrowed UI dependencies
ownership_allow src/apps/tui/commands/builtin_commands.cpp 1 R15:unsafe_capture register_builtin_commands ownership/final-audit call=with; Synchronous borrow; LifetimeRef::with admits and finishes its callback before returning
ownership_allow src/base/utils/logger.hpp 1 R15:raw_new lease ownership/final-audit Private constructor factory; new is immediately owned by unique_ptr
ownership_allow src/engine/agent/control/agent_control.cpp 1 R15:unsafe_capture AgentLoop::retry_last_user_message ownership/final-audit call=with_locked; Synchronous borrow; AgentTaskQueue::with_locked invokes its callback inline under the queue gate
ownership_allow src/engine/agent/control/task_handoff.cpp 1 R15:unsafe_capture TaskHandoff::complete ownership/final-audit call=with_locked; Synchronous borrow; AgentTaskQueue::with_locked invokes its callback inline under the queue gate
ownership_allow src/engine/agent/control/task_handoff.cpp 1 R15:unsafe_capture TaskHandoff::try_start_side_task ownership/final-audit call=with_locked; Synchronous borrow; AgentTaskQueue::with_locked invokes its callback inline under the queue gate
ownership_allow src/engine/agent/goal/goal_runtime.cpp 1 R15:unsafe_capture GoalRuntime::maybe_continue ownership/final-audit call=with_locked; Synchronous borrow; AgentTaskQueue::with_locked invokes its callback inline under the queue gate
ownership_allow src/engine/agent/side_question/side_chat.cpp 1 R15:unsafe_capture run_side_chat ownership/final-audit call=chat_stream; provider chat_stream callback completes before the synchronous provider call returns
ownership_allow src/engine/agent/side_question/side_question_service.cpp 1 R15:unsafe_capture SideQuestionService::ask_async ownership/final-audit call=with; Synchronous borrow; LifetimeRef::with admits and finishes its callback before returning
ownership_allow src/engine/agent/tool_exec/ask_question_binding.cpp 2 R15:unsafe_capture AskQuestionBinding::bind ownership/final-audit call=with; Synchronous borrow; LifetimeRef::with admits and finishes its callback before returning
ownership_allow src/engine/agent/tool_exec/tool_batch_scheduler.cpp 2 R15:unsafe_capture ToolBatchScheduler::execute ownership/final-audit call=with; Synchronous borrow; LifetimeRef::with admits and finishes its callback before returning
ownership_allow src/engine/agent/tool_exec/tool_context_factory.cpp 11 R15:unsafe_capture ToolContextFactory::for_tool ownership/final-audit call=with; Synchronous borrow; LifetimeRef::with admits and finishes its callback before returning
ownership_allow src/engine/agent/tool_exec/tool_lifecycle_events.cpp 1 R15:unsafe_capture ToolLifecycleEvents::Stream::bind ownership/final-audit call=with; Synchronous borrow; LifetimeRef::with admits and finishes its callback before returning
ownership_allow src/engine/agent/tool_exec/tool_result_presenter.cpp 1 R15:unsafe_capture ToolResultPresenter::materialize_attachments ownership/final-audit call=with; Synchronous borrow; LifetimeRef::with admits and finishes its callback before returning
ownership_allow src/engine/agent/turn/active_turn_gate.cpp 1 R15:unsafe_capture ActiveTurnGate::promise_pending_and_abort_locked ownership/final-audit call=with_locked; Synchronous borrow; AgentTaskQueue::with_locked invokes its callback inline under the queue gate
ownership_allow src/engine/agent/turn/turn_finalizer.cpp 1 R15:unsafe_capture TurnFinalizer::step ownership/final-audit call=with; Synchronous borrow; LifetimeRef::with admits and finishes its callback before returning
ownership_allow src/engine/agent/turn/turn_runner_support.cpp 1 R15:unsafe_capture TurnRunner::execute_tools ownership/final-audit call=with; Synchronous borrow; LifetimeRef::with admits and finishes its callback before returning
ownership_allow src/engine/agent/turn/user_shell_task.cpp 2 R15:unsafe_capture UserShellTask::run ownership/final-audit call=with; Synchronous borrow; LifetimeRef::with admits and finishes its callback before returning
ownership_allow src/engine/agent/worker/agent_task_queue.cpp 1 R15:unsafe_capture AgentTaskQueue::enqueue ownership/final-audit call=with_locked; Synchronous borrow; AgentTaskQueue::with_locked invokes its callback inline under the queue gate
ownership_allow src/engine/agent/worker/agent_task_queue.cpp 1 R15:unsafe_capture AgentTaskQueue::enqueue_control ownership/final-audit call=with_locked; Synchronous borrow; AgentTaskQueue::with_locked invokes its callback inline under the queue gate
ownership_allow src/engine/agent/worker/agent_task_queue.cpp 1 R15:unsafe_capture AgentTaskQueue::enqueue_suggestion ownership/final-audit call=with_locked; Synchronous borrow; AgentTaskQueue::with_locked invokes its callback inline under the queue gate
ownership_allow src/engine/agent/worker/agent_task_queue.cpp 1 R15:unsafe_capture AgentTaskQueue::has_pending_work ownership/final-audit call=with_locked; Synchronous borrow; AgentTaskQueue::with_locked invokes its callback inline under the queue gate
ownership_allow src/engine/agent/worker/agent_task_queue.cpp 1 R15:unsafe_capture AgentTaskQueue::has_suggestion ownership/final-audit call=with_locked; Synchronous borrow; AgentTaskQueue::with_locked invokes its callback inline under the queue gate
ownership_allow src/engine/agent/worker/agent_task_queue.cpp 1 R15:unsafe_capture AgentTaskQueue::try_run_idle ownership/final-audit call=with_locked; Synchronous borrow; AgentTaskQueue::with_locked invokes its callback inline under the queue gate
ownership_allow src/host/session_host/auto_title_runner.cpp 1 R15:unsafe_capture AutoTitleRunner::start_attempt ownership/final-audit call=with; Synchronous borrow; LifetimeRef::with admits and finishes its callback before returning
ownership_allow src/host/session_host/session_registry.cpp 1 R15:unsafe_capture SessionRegistry::enqueue_entry_control ownership/final-audit call=with; Synchronous borrow; LifetimeRef::with admits and finishes its callback before returning
ownership_allow src/host/session_host/session_registry.cpp 2 R15:unsafe_capture SessionRegistry::make_entry_locked ownership/final-audit call=with; Synchronous borrow; LifetimeRef::with admits and finishes its callback before returning
ownership_allow src/host/session_host/session_registry.cpp 1 R15:unsafe_capture SessionRegistry::reload_model_profile ownership/final-audit call=resolver; SessionModelResolver is consumed synchronously by apply_model_to_session or ensure_current; neither stores it
ownership_allow src/host/session_host/session_registry.cpp 1 R15:unsafe_capture SessionRegistry::set_reasoning_effort ownership/final-audit call=resolver; SessionModelResolver is consumed synchronously by apply_model_to_session or ensure_current; neither stores it
ownership_allow src/host/session_host/session_registry.cpp 1 R15:unsafe_capture SessionRegistry::set_reasoning_effort ownership/final-audit call=try_run_idle_control; AgentTaskQueue idle control runs inline under its queue gate and is never enqueued
ownership_allow src/host/session_host/session_registry.cpp 2 R15:unsafe_capture SessionRegistry::start_auto_title_attempt ownership/final-audit call=with; Synchronous borrow; LifetimeRef::with admits and finishes its callback before returning
ownership_allow src/host/session_host/session_registry.cpp 1 R15:unsafe_capture SessionRegistry::switch_model ownership/final-audit call=resolver; SessionModelResolver is consumed synchronously by apply_model_to_session or ensure_current; neither stores it
ownership_allow src/host/session_host/task_suggestion_service.cpp 2 R15:unsafe_capture TaskSuggestionService::accept ownership/final-audit call=update; TaskSuggestionStore update invokes its mutator inline inside the transaction
ownership_allow src/host/session_host/task_suggestion_service.cpp 1 R15:unsafe_capture fail_job ownership/final-audit call=update; TaskSuggestionStore update invokes its mutator inline inside the transaction
ownership_allow src/host/session_host/task_suggestion_service.cpp 2 R15:unsafe_capture launch ownership/final-audit call=update; TaskSuggestionStore update invokes its mutator inline inside the transaction
ownership_allow src/host/session_host/task_suggestion_service.cpp 1 R15:unsafe_capture launch ownership/final-audit call=dispatch; TaskHandoff complete and try_start_side_task consume dispatch synchronously under the queue gate
ownership_allow src/host/session_host/task_suggestion_service.cpp 1 R15:unsafe_capture start ownership/final-audit call=acecode::JoiningThread; C5 coordinator is the last State member; stop joins before State dependencies
ownership_allow src/host/session_host/thread_service.cpp 1 R15:unsafe_capture ThreadService::repair ownership/final-audit call=history_on_worker; worker history accessor invokes its visitor immediately without retaining it
ownership_allow src/domain/session/global_session_search.cpp 1 R15:unsafe_capture GlobalSessionSearchService::recent_user_sessions ownership/release-1.0.10 call=score; GlobalSessionCatalogIndex::select_entries invokes this predicate synchronously without storing it; recent_mu protects borrowed cache and stack state until selection returns
ownership_allow src/domain/session/global_session_search.cpp 1 R15:unsafe_capture GlobalSessionSearchService::recent_user_sessions ownership/release-1.0.10 call=before; GlobalSessionCatalogIndex::select_entries invokes this ordering callback only in synchronous sort/partial_sort and never retains it; borrowed user_time and cache outlive selection
ownership_allow src/apps/desktop/linux_desktop.cpp 1 R15:delayed_injection acecode::desktop ownership/release-1.0.14 set_linux_trusted_page_origin only borrows the widget during g_object_set_data_full; it stores an owned copy of the origin string and never retains the widget or injects a service
ownership_allow src/apps/desktop/linux_desktop.hpp 1 R15:delayed_injection acecode::desktop ownership/release-1.0.14 set_linux_trusted_page_origin only borrows the widget during g_object_set_data_full; it stores an owned copy of the origin string and never retains the widget or injects a service
ownership_allow src/host/session_host/auto_title_runner.cpp 1 R15:unsafe_capture AutoTitleRunner::execute ownership/release-1.0.18 call=generate_auto_session_title_with_fallback; Synchronous cancellation predicate; fallback invokes it inline and never retains it; execute is guarded by lifetime_.with
ownership_allow src/host/session_host/follow_up_prompt.cpp 1 R15:unsafe_capture generate_session_follow_up_prompt ownership/release-1.0.18 call=run; SummaryModelFallback::run invokes attempts synchronously and stores no callback; owned provider work captures copies
ownership_allow src/host/session_host/memory_scheduler.cpp 1 R15:unsafe_capture call_model ownership/release-1.0.18 call=run; SummaryModelFallback::run invokes attempts synchronously and stores no callback; State and call locals outlive all attempts
ownership_allow src/host/session_host/session_auto_title.cpp 1 R15:unsafe_capture generate_auto_session_title_with_fallback ownership/release-1.0.18 call=run; SummaryModelFallback::run invokes attempts synchronously and stores no callback; config, text and output outlive all attempts