Archive authorized primary-session evidence before lossy transforms

Capture the post-policy representation that enters primary history —
messages, tool args lifecycle, assistant text, structured/error results,
MCP blocks, and attachment/overflow blob provenance — into a session-owned
evidence archive with completeness certificates. Workers omit the hook.

Author: TheGreatAxios

docs/IMPLEMENTATION.md

@@ -80,6 +80,8 @@ src/
     state.ts              RunState JSON save/load
     compactor.ts          Context compactor
     summarizer.ts         Model-backed structured compaction summary (+ deterministic fallback)
+    compaction-archive.ts Primary-only authorized evidence archive (post-policy capture)
+    compaction-archive-schema.ts Archive occurrence / completeness certificate schemas
     run-sink.ts           Run-level event sink
     stream-consumer.ts    Async stream consumer with error handling
     hooks.ts              Lifecycle hooks: discovery, turn collector, run summary

src/agent/posix-tool-plugins.ts

@@ -27,6 +27,7 @@ import {
 } from "../plugins/read-file-guard-plugin.js";
 import type { PermissionGate } from "../permission/gate.js";
 import { createWorktreeRootsProvider } from "../permission/worktree-roots.js";
+import type { CompactionArchive } from "../session/compaction-archive.js";
 
 export interface CorePosixToolPluginsArgs {
   cwd: string;
@@ -44,6 +45,8 @@ export interface CorePosixToolPluginsArgs {
   // Live getter for the background-shell registry (run_shell background:true).
   // Omitted makes background runs fail closed in shell-guard.
   getBackgroundShellRegistry?: () => BackgroundShellRegistry | undefined;
+  /** Primary-only evidence archive; workers omit this getter. */
+  getEvidenceArchive?: () => CompactionArchive | undefined;
 }
 
 // Middleware order matches docs/ARCHITECTURE.md: path escape through truncation,
@@ -81,6 +84,7 @@ export function buildCorePosixToolPlugins(
     getContextDir,
     shellEnv,
     getBackgroundShellRegistry,
+    getEvidenceArchive,
   } = args;
   // Pre-gate sandboxes honor yolo mode so outside-workspace path tools and shell
   // cwd are not hard-denied after the gate already auto-allows. Pass a live
@@ -89,10 +93,11 @@ export function buildCorePosixToolPlugins(
   // regardless.
   const allowOutside = (): boolean => permissionGate.getSkipPermissions();
   const truncationOptions =
-    getBlobWriter !== undefined || getContextDir !== undefined
+    getBlobWriter !== undefined || getContextDir !== undefined || getEvidenceArchive !== undefined
       ? {
           ...(getBlobWriter !== undefined ? { getBlobWriter } : {}),
           ...(getContextDir !== undefined ? { getContextDir } : {}),
+          ...(getEvidenceArchive !== undefined ? { getEvidenceArchive } : {}),
         }
       : {};
   return [

src/agent/tools.ts

@@ -26,6 +26,7 @@ import {
   wrapAgentToolsWithResultTruncation,
   type SpillBlobWriter,
 } from "../plugins/result-truncation-plugin.js";
+import type { CompactionArchive } from "../session/compaction-archive.js";
 import {
   connectMCPServer as connectMCPClient,
   type MCPClient,
@@ -199,6 +200,8 @@ export interface AgentToolsetArgs {
   // deliver the exit as a system message so the reactor re-enters on a later
   // turn; omit it and background runs still start/collect but never notify.
   onBackgroundShellExit?: (exit: BackgroundShellExit) => void;
+  /** Primary-only evidence archive; workers omit this getter. */
+  getEvidenceArchive?: () => CompactionArchive | undefined;
   // Whether a workflow is currently running. submit_output rides the wire
   // every turn (workflow or not), so the model can call it with nothing active;
   // this lets its handler report an honest no-op instead of a false advance.
@@ -334,6 +337,7 @@ export async function createAgentToolset(
     getBlobReader,
     getBlobWriter,
     getContextDir,
+    getEvidenceArchive,
     sessionMode = "orchestrator",
     shellEnv,
     toolAvailability = { languageServerAvailable: true },
@@ -420,6 +424,7 @@ export async function createAgentToolset(
   const truncationOptions = {
     ...(getBlobWriter !== undefined ? { getBlobWriter } : {}),
     ...(getContextDir !== undefined ? { getContextDir } : {}),
+    ...(getEvidenceArchive !== undefined ? { getEvidenceArchive } : {}),
   };
   const posixTools = createPosixTools({
     cwd,
@@ -435,6 +440,7 @@ export async function createAgentToolset(
         ? { readFileGuard: { blobReader: sessionBlobReader } }
         : {}),
       ...truncationOptions,
+      ...(getEvidenceArchive !== undefined ? { getEvidenceArchive } : {}),
       ...(shellEnv !== undefined ? { shellEnv } : {}),
       getBackgroundShellRegistry: () => backgroundShells,
     }),
@@ -977,6 +983,7 @@ export async function createAgentToolset(
         const mcpTools = mcpClientTools(result.client, {
           ...(getBlobWriter !== undefined ? { getBlobWriter } : {}),
           ...(getContextDir !== undefined ? { getContextDir } : {}),
+          ...(getEvidenceArchive !== undefined ? { getEvidenceArchive } : {}),
           ...(isBuiltinExaMCPServer(config)
             ? { excludeToolNames: ["web_fetch_exa"] }
             : {}),

src/exec/runner.ts

@@ -102,6 +102,7 @@ import {
   loadSessionLocalSettings,
   resolveLiveSessionSources,
 } from "../session/assemble-runtime.js";
+import type { CompactionArchive } from "../session/compaction-archive.js";
 import { emitPluginWarningSummary } from "../plugins/diagnostics.js";
 import { createModelSummarizer } from "../session/summarizer.js";
 import { ID_PREFIX, LOG_NAMESPACE_ROOT } from "../branding.js";
@@ -524,6 +525,7 @@ export async function runExec(config: Config): Promise<ExecResult> {
 
     let currentAgent: Agent | null = null;
     let currentStorage: ContextStore | null = null;
+    const evidenceArchiveHolder: { current?: CompactionArchive } = {};
 
     const overlay = resolveExecDirectorOverlay(config.director);
     const workflowHostHolder: { instance?: WorkflowHost } = {};
@@ -541,6 +543,7 @@ export async function runExec(config: Config): Promise<ExecResult> {
         ? { shellEnv: localSettingsForMode.env }
         : {}),
       getBlobWriter: () => currentStorage?.writeBlob,
+      getEvidenceArchive: () => evidenceArchiveHolder.current,
       getContextDir: () => workdir,
       // Background run_shell completions re-enter the reactor on a later turn.
       onBackgroundShellExit: (exit) => {
@@ -706,6 +709,7 @@ export async function runExec(config: Config): Promise<ExecResult> {
         currentAgent = agent;
         currentStorage = storage;
       },
+      evidenceArchiveHolder,
     });
 
     const workflowHost = new WorkflowHost({

src/mcp/client.ts

@@ -21,6 +21,12 @@ export interface MCPTool {
   inputSchema: Record<string, unknown>;
   annotations?: McpToolAnnotations;
 }
+export interface MCPContentBlock {
+  type: string;
+  text?: string;
+  [key: string]: unknown;
+}
+
 export interface MCPClient {
   serverName: string;
   tools: MCPTool[];
@@ -29,8 +35,15 @@ export interface MCPClient {
     args: Record<string, unknown>,
     signal: AbortSignal,
   ): Promise<string>;
+  /** Validated content blocks before flattening — for post-policy archive capture. */
+  callBlocks?(
+    toolName: string,
+    args: Record<string, unknown>,
+    signal: AbortSignal,
+  ): Promise<MCPContentBlock[]>;
   close(): Promise<void>;
 }
+
 export type MCPConnectResult =
   | { ok: true; client: MCPClient }
   | { ok: false; serverName: string; error: string };
@@ -69,6 +82,23 @@ export function unwrapToolContent(content: unknown): string {
     .join("\n");
 }
 
+export function validateMcpContentBlocks(content: unknown): MCPContentBlock[] {
+  if (!Array.isArray(content)) return [];
+  const out: MCPContentBlock[] = [];
+  for (const block of content) {
+    if (block === null || typeof block !== "object") continue;
+    const type = (block as { type?: unknown }).type;
+    if (typeof type !== "string") continue;
+    const copy: MCPContentBlock = { type };
+    for (const [key, value] of Object.entries(block)) {
+      if (key === "type") continue;
+      copy[key] = value;
+    }
+    out.push(copy);
+  }
+  return out;
+}
+
 interface HTTPAuthContext {
   url: URL;
   authProvider: CorbitsOAuthProvider;
@@ -515,6 +545,13 @@ async function finishClient(
   return {
     serverName,
     tools,
+    async callBlocks(toolName, args, signal) {
+      const context = authContext === undefined ? undefined : { ...authContext, signal };
+      const result = await withHTTPAuthorizationRecovery(context, () =>
+        client.callTool({ name: toolName, arguments: args }, undefined, { signal }),
+      );
+      return validateMcpContentBlocks(result.content);
+    },
     async call(toolName, args, signal) {
       const result = await withHTTPAuthorizationRecovery(
         authContext,
@@ -524,7 +561,7 @@ async function finishClient(
           }),
         signal,
       );
-      return unwrapToolContent(result.content);
+      return unwrapToolContent(validateMcpContentBlocks(result.content));
     },
     async close() {
       closeLifecycle?.();

src/mcp/plugin.test.ts

@@ -21,6 +21,7 @@ function fakeClient(reply: string): MCPClient {
       },
     ],
     call: async () => reply,
+    callBlocks: async () => [{ type: "text", text: reply }],
     close: async () => undefined,
   };
 }

src/mcp/plugin.ts

@@ -2,18 +2,43 @@ import type { AgentTool } from "@intx/agent";
 import type { ToolCall, ToolResult } from "@intx/types/runtime";
 import type { PermissionGate } from "../permission/gate.js";
 import { gateAgentTools } from "../plugins/permission-plugin.js";
-import { scrubSecretShapedContent } from "../plugins/tool-result-secret-scrub.js";
+import {
+  scrubSecretShapedContent,
+  scrubSecretShapedValue,
+} from "../plugins/tool-result-secret-scrub.js";
 import {
   truncateToolResultContent,
   type SpillBlobWriter,
 } from "../plugins/result-truncation-plugin.js";
-import type { MCPClient } from "./client.js";
+import type { CompactionArchive } from "../session/compaction-archive.js";
+import type { MCPClient, MCPContentBlock } from "./client.js";
 import { mcpToolName } from "./tool-name.js";
+import { unwrapToolContent } from "./client.js";
 
 export interface McpSpillOptions {
   getBlobWriter?: () => SpillBlobWriter | undefined;
   getContextDir?: () => string | undefined;
   excludeToolNames?: readonly string[];
+  /** Primary-only evidence archive; workers omit this getter. */
+  getEvidenceArchive?: () => CompactionArchive | undefined;
+}
+
+function applyPolicyToBlocks(blocks: MCPContentBlock[]): MCPContentBlock[] {
+  return blocks.map((block) => {
+    const next = { ...block };
+    if (typeof next.text === "string") {
+      next.text = scrubSecretShapedContent(next.text);
+    }
+    for (const [key, value] of Object.entries(next)) {
+      if (key === "type" || key === "text") continue;
+      if (typeof value === "string") {
+        next[key] = scrubSecretShapedContent(value);
+      } else if (value !== null && typeof value === "object") {
+        next[key] = scrubSecretShapedValue(value);
+      }
+    }
+    return next;
+  });
 }
 
 // MCP results never reach the posix runner, so the secret-scrub and truncation
@@ -35,7 +60,7 @@ export function mcpClientTools(
   client: MCPClient,
   spillOptions: McpSpillOptions = {},
 ): AgentTool[] {
-  const { getBlobWriter, getContextDir, excludeToolNames = [] } = spillOptions;
+  const { getBlobWriter, getContextDir, excludeToolNames = [], getEvidenceArchive } = spillOptions;
   const excluded = new Set(excludeToolNames);
 
   return client.tools
@@ -52,7 +77,30 @@ export function mcpClientTools(
         signal: AbortSignal,
       ): Promise<ToolResult> => {
         try {
-          const content = await client.call(tool.name, call.arguments, signal);
+          const rawBlocks =
+            typeof client.callBlocks === "function"
+              ? await client.callBlocks(tool.name, call.arguments, signal)
+              : [
+                  {
+                    type: "text",
+                    text: await client.call(tool.name, call.arguments, signal),
+                  } satisfies MCPContentBlock,
+                ];
+          const authorizedBlocks = applyPolicyToBlocks(rawBlocks);
+          const archive = getEvidenceArchive?.();
+          if (archive !== undefined) {
+            try {
+              await archive.recordAuthorizedPayload({
+                kind: "tool_result",
+                payload: { blocks: authorizedBlocks },
+                callId: call.id,
+                provenance: "mcp:post-policy-pre-flatten",
+              });
+            } catch {
+              // Archive write must not fail a successful tool result.
+            }
+          }
+          const flattened = unwrapToolContent(authorizedBlocks);
           const writeBlob = getBlobWriter?.();
           const contextDir = getContextDir?.();
           const spill =
@@ -63,14 +111,31 @@ export function mcpClientTools(
                   ...(contextDir !== undefined ? { contextDir } : {}),
                 }
               : undefined;
-          return {
-            callId: call.id,
-            content: await sanitizeMcpResultContent(content, spill),
-          };
+          const content = await truncateToolResultContent(
+            flattened,
+            undefined,
+            spill,
+          );
+          return { callId: call.id, content };
         } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          const scrubbed = scrubSecretShapedContent(message);
+          const archive = getEvidenceArchive?.();
+          if (archive !== undefined) {
+            try {
+              await archive.recordAuthorizedPayload({
+                kind: "tool_result",
+                payload: scrubbed,
+                callId: call.id,
+                provenance: "mcp:error",
+              });
+            } catch {
+              // Archive write must not fail a successful tool result.
+            }
+          }
           return {
             callId: call.id,
-            content: err instanceof Error ? err.message : String(err),
+            content: scrubbed,
             isError: true,
           };
         }