Tim Lingo
9a6014d65b
Two consent-flow fixes, gates only get stricter: 1. PAUSE-CONTRACT: the client has sent require_approval:true on every agentic request since Phase 1c, but needs_bridge never consulted it — builtin sub-escalate tools ran server-side unasked, making the app's Ask autonomy silently inert for that whole class. Now the flag is persisted per session (set/reset every request, so /approve resumes keep it) and ask_all bridges EVERY tool turn. Absent/false = behavior byte-identical to before. E2E: the exact probe that executed a write unasked now returns the tool_pending envelope with nothing on disk; full in-app circle verified (card → crash → resurrection → late approve → fence re-fires on re-entry). 2. BUG-LEAK: agent_workspace_root lived in ONE shared state key — any request that omitted a root inherited the previous session's folder (proven: a rootless curl session wrote into another session's run folder). Root is now stored per session and every request re-asserts its own (possibly empty) root into the shared key the guards read; same re-assert on the /approve and resume paths. Env fallback intact. LIMITATION: assumes serialized handling; true per-call scoping means threading session_id through dispatch — flagged for review. Runnable C-patch for the test brain: neuron-container-build/ soul-pause-contract-20260716.patch (pause-contract only; the leak fix needs the #23 root-write which the running C predates — source carries both for the regen). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>