The resume config-change warning baselines off state.json, inside the tree it polices

[pbean]

Found while re-validating PR #495 (#461 point 4). Minor, but it makes a shipped line of code read as a security control when it is not one.

The asymmetry

PR #495 added two consumers of the launch-time config_digest. Only one of them has a baseline an agent cannot reach.

The auto-sweep gate is sound. _sweep_factory's trusted_digest is threaded in memory from launch — cli.py cmd_run computes it once and passes it in, and _resume_paused_run passes the freshly computed new_digest. It is never read back from disk, so a driven session has nothing to rewrite. That is the refusal path, and it holds.

The resume warning is advisory. It compares against state.trusted_config_digest:

security_config_changed = bool(state.trusted_config_digest) and (
    new_digest != state.trusted_config_digest
)

RunState round-trips through <project>/.bmad-loop/runs/<id>/state.json (runs.RUNS_DIR = .bmad-loop/runs, run_dir_for) — inside the same agent-writable tree config_digest's own docstring says driven sessions can write anywhere in. A session that rewrites policy.toml can also rewrite that field and the operator is never told. Blanking it is enough: the bool(...) guard reads "" as "no prior pin, no warning".

So the warning catches an incidental or accidental config change. It does not catch a deliberate one, which is the case it is worded for ("re-read .bmad-loop/policy.toml … first if you did not make that edit").

Scope

This is not specific to one field. Every RunState field has the property — policy_snapshot, the budget counters, paused_reason. trusted_config_digest is just the first one that reads like a security control, which is why it is worth either fixing or saying out loud.

Fixed for now by saying it out loud: the comment at the comparison site now states that it is advisory and why, so the next reader does not mistake it for the gate.

Options

1. Leave it advisory, documented. What is shipped. Defensible: the human-present path only warns by design, and an adversary who can rewrite state.json has other levers anyway.
2. Hold the resume baseline outside the project tree — e.g. alongside other user-scoped state rather than in the run dir. Closes it for this field only, and puts one RunState field somewhere different from the rest, which is a coherence cost.
3. Treat state.json integrity as its own concern — the honest general fix, and much larger than init vendors the hook relay into the agent-writable workspace, turning a file-write primitive into unattended persistent code execution #461 point 4. Would subsume this.

No action needed for #495 to land; the gate it adds is unaffected.

Related: #461, PR #495.

[coderabbitai]

🔗 Related PRs

#78 - fix(runs): advance the re-arm baseline so a resolved re-drive cannot orphan resolution commits [merged]
#191 - fix(cli): re-stamp the policy snapshot on resume (#189) [merged]
#267 - build(ruff): pin lint.select to CI's rule set + stale-noqa audit (#246) [merged]
#277 - feat(adapters,engine,devcontract): deterministic missing-marker catch + repair [merged]
#495 - fix(sweep): integrity-pin the agent-writable host-exec config across the auto-sweep re-read (#461 point 4) [open]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[pbean]

Triage 2026-08-08: verified — the mechanism is real (cli.py:1645-1646 baselines the warning off state.trusted_config_digest, which lives under .bmad-loop/runs/ inside the policed tree), but option 1 from this issue is already shipped: cli.py:1637-1644 documents the warning as advisory and names this issue. Remaining scope is a decision, not a patch: accept advisory-as-final, or move the baseline out of the agent-writable tree — which dovetails with the #494 / PR #238 relay-primitive rework.

[pbean]

Maintainer decision 2026-08-08: relocate the resume baseline out of the agent-writable tree (issue option 2). trusted_config_digest moves to a user-scoped state root keyed by (project, run_id); all three stamp sites (cli.py:1249/1269, :1452, :1696) move together, the resume re-stamp is preserved, and the sweep gate's in-memory baseline is untouched. Executed as one shared relocation with #494 option 3 (the events/ move in the PR #238 rework) — one new out-of-tree control-plane root, two artifacts move into it. Full state.json sealing (option 3 of the issue) was considered and declined as disproportionate to an advisory warning's baseline.