a

docs/orchestration-engine.md

@@ -37,6 +37,11 @@ Before each actor invocation, orchestration resolves an immutable `ResolvedExecu
 
 This keeps orchestration policy resolution separate from executor enforcement. Executors do not need to parse manifests or MCP registry internals.
 
+Worktree ownership invariant:
+
+- In UI session mode, orchestration/session lifecycle is the single owner of git worktree allocation.
+- Provider adapters (Codex/Claude runtime wrappers) must execute inside `ResolvedExecutionContext.security.worktreePath` and must not provision independent worktrees.
+
 ## Execution topology model
 
 - Pipeline graph execution is DAG-based with ready-node frontiers.

docs/security-middleware.md

@@ -30,6 +30,7 @@ This middleware provides a first-pass hardening layer for agent-executed shell c
 
 - `hard_abort` (default): fail fast and stop the pipeline.
 - `validation_fail`: map violation to retry-unrolled behavior so the actor can attempt a compliant alternative.
+- `dangerous_warn_only`: emit security audit/runtime events but continue execution. This is intentionally unsafe and should only be used for temporary unblock/debug workflows.
 
 ## MCP integration