pwn 0.5.783 → 0.5.785

data/lib/pwn/ai/agent/learning.rb

@@ -101,7 +101,14 @@ module PWN
         # Plan by default; no provider calls, vault reads, transcript logging or deletion.
         public_class_method def self.migrate_evidence(opts = {})
           dry = opts[:dry_run] != false
-          lock = learning_lock unless dry
+          max_sessions = opts[:max_sessions]
+          stop = opts[:stop]
+          raise ArgumentError, 'max_sessions must be positive' if max_sessions && (!max_sessions.is_a?(Integer) || max_sessions <= 0)
+
+          leases = []
+          lock = learning_lock(nonblocking: opts[:nonblocking]) unless dry
+          return { dry_run: false, deferred: 'learning_writer_active', migrated_rows: 0 } if lock == :busy
+
           original = File.exist?(LEARNING_FILE) ? evidence_read(path: LEARNING_FILE) : ''
           malformed = 0
           rows = original.lines.filter_map do |line|
@@ -116,9 +123,13 @@ module PWN
 
           report = { dry_run: dry, rows: rows.length, malformed_rows: malformed, session_refs: 0, migratable_sessions: 0,
                      missing_sessions: 0, malformed_sessions: 0, malformed_refs: 0, verified_rows: 0,
-                     estimated_source_bytes: 0, migrated_rows: 0 }
+                     estimated_source_bytes: 0, migrated_rows: 0, deferred_active_sessions: 0 }
           snapshots = {}
           rows.each do |row|
+            if stop&.call || (max_sessions && report[:migratable_sessions] >= max_sessions)
+              report[:bounded] = true
+              break
+            end
             sid = row[:session_id]
             next if sid.nil? || sid == ''
 
@@ -140,6 +151,22 @@ module PWN
               next
             end
             begin
+              # Keep the permanent exclusive lease through index publication;
+              # a point-in-time active? check alone races subsequent activation.
+              if dry
+                if PWN::Sessions.active?(session_id: sid)
+                  report[:deferred_active_sessions] += 1
+                  next
+                end
+              else
+                lease = File.open(PWN::Sessions.support_path(kind: :lease, session_id: sid), File::RDWR | File::CREAT | File::NOFOLLOW, 0o600) # rubocop:disable Style/FileOpen -- released together after commit
+                leases << lease
+                unless lease.flock(File::LOCK_EX | File::LOCK_NB)
+                  lease.close
+                  report[:deferred_active_sessions] += 1
+                  next
+                end
+              end
               body = evidence_read(path: path)
               transcript = body.lines.map { |line| JSON.parse(line, symbolize_names: true) }
               raise IOError, 'Malformed source transcript' if transcript.empty? || !transcript.all?(Hash)
@@ -179,7 +206,8 @@ module PWN
 
           evidence_commit(rows: rows, original: original, snapshots: snapshots, report: report)
         ensure
-          learning_unlock(lock: lock) if lock
+          leases&.each { |lease| lease.close unless lease.closed? }
+          learning_unlock(lock: lock) if lock && lock != :busy
         end
 
         private_class_method def self.evidence_read(opts = {})
@@ -233,7 +261,7 @@ module PWN
           root = File.join(File.dirname(LEARNING_FILE), 'learning', 'migrations')
           path = File.join(root, "#{id}.json")
           record = JSON.parse(evidence_read(path: path), symbolize_names: true)
-          backup = evidence_read(path: File.join(root, "#{id}.backup.jsonl"))
+          backup = evidence_read(path: record[:backup] || File.join(root, "#{id}.backup.jsonl"))
           raise IOError, 'Invalid migration backup' unless record[:before_sha256] == id && Digest::SHA256.hexdigest(backup) == id
 
           current = evidence_read(path: LEARNING_FILE)
@@ -253,6 +281,8 @@ module PWN
 
             raise IOError, 'Restore source sessions before rollback' unless evidence_complete?(row: row) && File.file?(File.join(PWN::Sessions::SESSIONS_DIR, "#{sid}.jsonl"))
           end
+          return { dry_run: true, restored: false } if opts[:dry_run] == true
+
           evidence_write(path: LEARNING_FILE, body: backup)
           evidence_write(path: path, body: JSON.generate(record.merge(state: 'rolled_back')))
           { restored: true }
@@ -290,11 +320,12 @@ module PWN
         end
 
         private_class_method def self.evidence_commit(opts = {})
+          return PWN::Backups.transaction { evidence_commit(opts) } unless PWN::Backups.active?
+
           rows, original, snapshots, report = opts.values_at(:rows, :original, :snapshots, :report)
           root = File.join(File.dirname(LEARNING_FILE), 'learning')
           before_hash = Digest::SHA256.hexdigest(original)
-          backup = File.join(root, 'migrations', "#{before_hash}.backup.jsonl")
-          evidence_write(path: backup, body: original) unless File.exist?(backup)
+          backup = PWN::Backups.capture(path: LEARNING_FILE, label: 'learning-migration')
           raise IOError, 'Invalid migration backup' unless evidence_read(path: backup) == original
 
           rows.each do |row|
@@ -310,7 +341,7 @@ module PWN
           end
           updated = rows.map { |row| "#{JSON.generate(row)}\n" }.join
           ledger = File.join(root, 'migrations', "#{before_hash}.json")
-          record = { version: 1, state: 'prepared', before_sha256: before_hash,
+          record = { version: 1, state: 'prepared', backup: backup, before_sha256: before_hash,
                      after_sha256: Digest::SHA256.hexdigest(updated), migrated_rows: report[:migrated_rows] }
           evidence_write(path: ledger, body: JSON.generate(record))
           raise IOError, 'Learning changed during migration' unless evidence_read(path: LEARNING_FILE) == original
@@ -332,10 +363,11 @@ module PWN
         end
 
         # Reentrant across note_outcome -> pruning; flock serializes cooperating processes.
-        private_class_method def self.learning_lock
+        private_class_method def self.learning_lock(opts = {})
           key = :pwn_learning_write_lock
           owner = Thread.current[key]
           return nil if owner.is_a?(Hash) && owner[:pid] == Process.pid && owner[:thread] == Thread.current && !owner[:file].closed?
+          raise IOError, 'Acquire the learning writer lock before the backup transaction' if PWN::Backups.active?
 
           root = File.dirname(LEARNING_FILE)
           FileUtils.mkdir_p(root, mode: 0o700)
@@ -344,7 +376,10 @@ module PWN
 
           # Ownership transfers to the caller's ensure/learning_unlock.
           file = File.open(path, File::RDWR | File::CREAT | File::NOFOLLOW, 0o600) # rubocop:disable Style/FileOpen
-          file.flock(File::LOCK_EX)
+          unless file.flock(File::LOCK_EX | (opts[:nonblocking] ? File::LOCK_NB : 0))
+            file.close
+            return :busy
+          end
           Thread.current[key] = { pid: Process.pid, thread: Thread.current, file: file }
           file
         end
@@ -2199,12 +2234,13 @@ module PWN
         end
 
         private_class_method def self.atomic_jsonl_write(opts = {})
+          return PWN::Backups.transaction { atomic_jsonl_write(opts) } unless PWN::Backups.active?
+
           path = opts[:path]
           rows = Array(opts[:rows])
           dir = File.dirname(path)
           FileUtils.mkdir_p(dir)
-          bak = "#{path}.bak-lean-#{Time.now.utc.strftime('%Y%m%d')}"
-          FileUtils.cp(path, bak) if File.exist?(path) && !File.exist?(bak)
+          PWN::Backups.capture(path: path, label: 'learning') if File.exist?(path)
           tmp = File.join(dir, ".#{File.basename(path)}.#{Process.pid}.tmp")
           File.open(tmp, File::WRONLY | File::CREAT | File::TRUNC, 0o644) do |f|
             f.flock(File::LOCK_EX)
@@ -2365,16 +2401,9 @@ module PWN
         end
 
         public_class_method def self.compact!(opts = {})
-          max_baks = (opts[:max_baks] || learning_max_baks).to_i
-          max_baks = 5 if max_baks <= 0
-          dir = File.dirname(LEARNING_FILE)
-          baks = Dir[File.join(dir, '*.bak*')].sort_by { |p| File.mtime(p) }.reverse
-          pruned = 0
-          baks.drop(max_baks).each do |path|
-            File.delete(path)
-            pruned += 1
-          end
-          { pruned: pruned, kept: [baks.length, max_baks].min, max_baks: max_baks }
+          # Compatibility option cannot override the shared total retention cap.
+          opts[:max_baks]
+          { pruned: 0, max_baks: PWN::Backups::LIMIT, scope: 'global', legacy: 'explicit migration required' }
         end
 
         # Author(s):: 0day Inc. <support@0dayinc.com>
@@ -2388,10 +2417,18 @@ module PWN
         public_class_method def self.help
           puts "
             # Plan a full-snapshot evidence migration, or explicitly apply it.
-            #{self}.migrate_evidence(dry_run: 'optional - Boolean; defaults true, false writes evidence and references')
+            #{self}.migrate_evidence(
+              dry_run: 'optional - Boolean; defaults true, false writes evidence and references',
+              max_sessions: 'optional - Positive maximum source snapshots per transaction',
+              nonblocking: 'optional - Boolean; defer instead of waiting for a cooperating learning writer',
+              stop: 'optional - Cooperative stop callable checked between source snapshots'
+            )
 
             # Restore an unchanged learning ledger before any source-session cleanup.
-            #{self}.rollback_evidence(migration: 'required - SHA-256 migration ID from the ledger filename')
+            #{self}.rollback_evidence(
+              migration: 'required - SHA-256 migration ID from the ledger filename',
+              dry_run: 'optional - validate rollback without replacing learning bytes; defaults to false'
+            )
 
             # Persist derived PRM rewards without rewriting immutable supporting content.
             #{self}.annotate_evidence(
@@ -2438,9 +2475,9 @@ module PWN
               dry_run: 'optional - true to count without writing'
             )
 
-            # Prune excess *.bak siblings under the learning directory.
+            # Report the shared global seven-generation retention policy.
             #{self}.compact!(
-              max_baks: 'optional - newest bak files to keep (defaults to 5)'
+              max_baks: 'optional - legacy compatibility value; cannot override global seven-folder limit'
             )
 
             # Export an inert regression contract from a persisted verified failure.

data/lib/pwn/ai/agent/loop.rb

@@ -990,6 +990,15 @@ module PWN
           text.sub(%r{\s*\[/UNTRUSTED TOOL OUTPUT\]\s*\z}m, '')
         end
 
+        private_class_method def self.terminal_effect_blocker(opts = {})
+          runtime = opts[:runtime]
+          diagnostic = runtime&.blocker
+          return nil unless diagnostic
+
+          runtime.finish!(status: 'blocked', unmet: runtime.unmet + [diagnostic])
+          "[pwn-ai] blocked: #{diagnostic}"
+        end
+
         private_class_method def self.declared_deliverables(opts = {})
           Array(declared_contract(request: opts[:request])[:paths])
         end
@@ -1004,7 +1013,7 @@ module PWN
                      end
           # Paths are user-owned. Inference cannot invent a destination or
           # convert the source document into a write obligation.
-          contract = contract.merge(paths: literals.any? ? literals : contract[:paths])
+          contract = contract.merge(paths: literals)
           Thread.current[:pwn_loop_deliverables] = contract if Thread.current[:pwn_loop_active]
           contract
         end
@@ -2091,6 +2100,10 @@ module PWN
             model = opts[:model] || Thread.current[:pwn_swarm_model] || config[:model]
             cwt_opts[:model] = model unless model.to_s.strip.empty?
             cwt_opts[:temp] = opts[:temp] unless opts[:temp].nil?
+            if PWN::AI::ServerTools.mixable?(engine: engine, model: cwt_opts[:model])
+              hosted = Array(config[:server_tools]).map(&:to_s).reject(&:empty?)
+              cwt_opts[:server_tools] = hosted if hosted.any?
+            end
             if tools && !tools.empty?
               env_tc = begin
                 config[:tool_choice]
@@ -3637,6 +3650,9 @@ module PWN
                   return "[pwn-ai] #{status}: explicit request verification did not pass."
                 end
               end
+              effect_blocker = terminal_effect_blocker(runtime: runtime)
+              return effect_blocker if effect_blocker
+
               # Completion is an evidence decision, never a prose classifier.
               unless may_finalize?(
                 request: request,

data/lib/pwn/ai/agent/mission_namespace.rb

@@ -0,0 +1,331 @@
+# frozen_string_literal: true
+
+require 'socket'
+require 'fiddle'
+require 'json'
+require 'date'
+require 'rbconfig'
+require 'timeout'
+
+# Load root autoloads before opening nested namespaces on direct require.
+require 'pwn'
+
+module PWN
+  module AI
+    module Agent
+      # Exec-based user namespace bootstrap; the terminal never enters a namespace.
+      # Only typed descriptors cross the private socket. Ruby closures are permitted
+      # below an existing owner, where fork does not need a new user namespace.
+      class MissionNamespace # rubocop:disable Metrics/ClassLength -- one exec handshake and process ownership protocol
+        class Unavailable < StandardError; end
+        CONTEXT_KEYS = %i[pwn_swarm_engine pwn_swarm_model pwn_swarm_id pwn_swarm_depth pwn_solve_workspace pwn_solve_tools
+                          pwn_session_id pwn_artifact_contract pwn_active_steering_request pwn_turn_finalizer_depth
+                          pwn_reflect_depth pwn_request_intent pwn_loop_budget_s pwn_loop_mutations pwn_loop_tokens].freeze
+        attr_reader :status
+
+        class << self
+          attr_accessor :owned, :bootstrap_requires, :force_exec
+
+          def prepared?
+            rows = File.readlines('/proc/self/uid_map').map { |line| line.split.map(&:to_i) }
+            count = rows.length == 1 ? rows.first.last : nil
+            # The initial host map is the full 32-bit range. Any smaller single
+            # line is a user namespace, including a root test bootstrap that must
+            # still include a non-root account.
+            count.is_a?(Integer) && count.positive? && count < 4_294_967_295
+          rescue SystemCallError
+            false
+          end
+
+          def io(number)
+            stream = Thread.current[:pwn_mission_fds]&.fetch(number, nil) || IO.for_fd(number)
+            stream.close_on_exec = true if number > 2
+            stream
+          end
+
+          def native(name, arguments)
+            Fiddle::Function.new(Fiddle::Handle::DEFAULT[name], arguments, Fiddle::TYPE_INT)
+          end
+
+          def checked(result, operation)
+            raise Unavailable, "#{operation}: #{SystemCallError.new(operation, Fiddle.last_error).message}; install util-linux unshare and enable Linux user/PID namespaces and pidfds" if result.negative?
+
+            result
+          end
+
+          # Tagged JSON preserves Symbol hash keys and values without deserializing
+          # executable Ruby objects or placing credentials in argv or temporary files.
+          def encode(value, depth = 0)
+            raise ArgumentError, 'mission snapshot is too deep or cyclic' if depth > 30
+
+            case value
+            when Hash then ['hash', value.map { |key, item| [encode(key, depth + 1), encode(item, depth + 1)] }]
+            when Array then ['array', value.map { |item| encode(item, depth + 1) }]
+            when Time then ['time', value.to_i, value.nsec, value.utc_offset, value.utc?]
+            when DateTime then ['datetime', value.iso8601(9)]
+            when Date then ['date', value.iso8601]
+            when Symbol then ['symbol', value.to_s]
+            when String then ['string', [value.b].pack('m0'), value.encoding.name]
+            when NilClass, TrueClass, FalseClass, Numeric then ['scalar', value]
+            else raise ArgumentError, "mission snapshot cannot transfer #{value.class}; use a serializable descriptor"
+            end
+          end
+
+          def decode(value)
+            type, body, encoding = value
+            case type
+            when 'hash' then body.to_h { |key, item| [decode(key), decode(item)] }
+            when 'array' then body.map { |item| decode(item) }
+            when 'time' then value[4] ? Time.at(body, encoding, :nanosecond).utc : Time.at(body, encoding, :nanosecond).getlocal(value[3])
+            when 'datetime' then DateTime.iso8601(body)
+            when 'date' then Date.iso8601(body)
+            when 'symbol' then body.to_sym
+            when 'string' then body.unpack1('m0').force_encoding(encoding)
+            when 'scalar' then body
+            else raise ArgumentError, 'invalid mission snapshot'
+            end
+          end
+
+          def supervise
+            channel = UNIXSocket.for_fd(3)
+            snapshot = decode(JSON.parse(channel.gets))
+            checked(native('unshare', [Fiddle::TYPE_INT]).call(0x20000000), 'unshare PID namespace')
+            reader, writer = IO.pipe
+            armed, arm = IO.pipe
+            init = fork do
+              armed.close
+              checked(native('prctl', [Fiddle::TYPE_INT, Fiddle::TYPE_LONG, Fiddle::TYPE_LONG, Fiddle::TYPE_LONG, Fiddle::TYPE_LONG]).call(1, Signal.list.fetch('KILL'), 0, 0, 0), 'PR_SET_PDEATHSIG')
+              arm.write('1')
+              arm.close
+              channel.close
+              writer.close
+              exit! unless reader.read(1) == '1'
+
+              reader.close
+              self.owned = true
+              self.bootstrap_requires = snapshot.fetch(:requires, [])
+              PWN::Env.replace(decode(encode(snapshot.fetch(:env))))
+              bootstrap_requires.each { |path| require path }
+              PWN::Env.replace(snapshot.fetch(:env))
+              PWN.const_set(:Skills, snapshot[:skills]) if snapshot[:skills] && !PWN.const_defined?(:Skills)
+              snapshot.fetch(:locals).each { |key, value| Thread.current[key] = value }
+              begin
+                Thread.handle_interrupt(Exception => :immediate) { execute(snapshot.fetch(:descriptor)) }
+                completed = true
+              ensure
+                exit!(completed ? 0 : 1)
+              end
+            end
+            arm.close
+            raise Unavailable, 'namespace init exited before arming parent-death protection' unless armed.read(1) == '1'
+
+            armed.close
+            reader.close
+            fd = IO.new(checked(native('pidfd_open', [Fiddle::TYPE_INT, Fiddle::TYPE_INT]).call(init, 0), 'pidfd_open'))
+            channel.send_io(fd)
+            exit! unless channel.read(1) == '1'
+
+            writer.write('1')
+            writer.close
+            readable = IO.select([channel, fd]).first
+            native('pidfd_send_signal', [Fiddle::TYPE_INT, Fiddle::TYPE_INT, Fiddle::TYPE_VOIDP, Fiddle::TYPE_INT]).call(fd.fileno, Signal.list.fetch('KILL'), 0, 0) if readable.include?(channel)
+            _pid, status = Process.wait2(init)
+            init = nil
+            fd.close
+            status.exitstatus || (128 + status.termsig)
+          rescue Exception => e # rubocop:disable Lint/RescueException -- startup must fail closed
+            warn "Mission namespace unavailable: #{e.class}: #{e.message}"
+          ensure
+            if init
+              begin
+                Process.kill('KILL', init)
+              rescue Errno::ESRCH
+                nil
+              end
+              begin
+                Process.wait(init)
+              rescue Errno::ECHILD
+                nil
+              end
+            end
+            channel&.close unless channel&.closed?
+          end
+
+          def execute(descriptor)
+            case descriptor.fetch(:operation).to_sym
+            when :command
+              _pid, status = Process.wait2(Process.spawn(*descriptor.fetch(:argv)))
+              exit!(status.exitstatus || (128 + status.termsig))
+            when :loop
+              require 'pwn/ai/cli'
+              PWN::AI::CLI.send(:mission_entry, descriptor)
+            when :protected
+              PWN::Plugins::AISandbox.send(:mission_entry, descriptor)
+            when :console, :slash
+              PWN::Plugins::REPL::AIConsole::Console.send(:mission_entry, descriptor: descriptor)
+            when :legacy, :steerable
+              PWN::Plugins::REPL.pwn_ai_mission_entry(descriptor)
+            when :swarm
+              PWN::Plugins::REPL::AISwarm::Controller.send(:mission_entry, descriptor: descriptor)
+            else
+              raise ArgumentError, 'unknown mission operation'
+            end
+          end
+        end
+
+        def initialize(opts = {}, &operation)
+          @mutex = Mutex.new
+          raise Unavailable, 'mission containment requires Linux' unless RUBY_PLATFORM.include?('linux')
+
+          if self.class.prepared? && !self.class.force_exec && !(opts[:inherit_namespace] && self.class.owned)
+            start_prepared(opts, &operation)
+            return
+          end
+
+          if operation
+            raise Unavailable, 'host closures cannot cross an exec boundary; use a mission descriptor or explicitly bootstrap under unshare --user --map-current-user --keep-caps' unless self.class.owned
+
+            @pid = fork do
+              Thread.handle_interrupt(Exception => :immediate) { operation.call }
+            ensure
+              exit!
+            end
+            @pidfd = IO.new(self.class.checked(self.class.native('pidfd_open', [Fiddle::TYPE_INT, Fiddle::TYPE_INT]).call(@pid, 0), 'pidfd_open'))
+            return
+          end
+          snapshot = { requires: Array(self.class.bootstrap_requires), descriptor: opts.fetch(:descriptor), env: PWN::Env, locals: CONTEXT_KEYS.to_h { |key| [key, Thread.current[key]] } }
+          if PWN.const_defined?(:Skills)
+            snapshot[:skills] = PWN::Skills
+            ruby_skills = PWN::Skills.values.select { |skill| skill[:loaded] && skill[:type] == :ruby }
+            snapshot[:requires] += ruby_skills.flat_map do |skill|
+              skill[:format] == :legacy ? [skill.fetch(:path)] : Dir.glob(File.join(skill.fetch(:dir), 'scripts', '*.rb'))
+            end
+            snapshot[:requires].uniq!
+          end
+          payload = JSON.generate(self.class.encode(snapshot))
+          @channel, child = UNIXSocket.pair
+          mapping = opts.fetch(:fds, {}).merge(3 => child)
+          @pid = Process.spawn('unshare', '--user', '--map-current-user', '--keep-caps', RbConfig.ruby, '-I', $LOAD_PATH.join(File::PATH_SEPARATOR), '-rpwn', '-e', 'exit!(PWN::AI::Agent::MissionNamespace.supervise || 1)', mapping.merge(close_others: true))
+          child.close
+          Timeout.timeout(15) do
+            @channel.puts(payload)
+            @pidfd = @channel.recv_io
+            @channel.write('1')
+          end
+        rescue Exception => e # rubocop:disable Lint/RescueException -- failed startup cannot leak a child
+          close
+          raise Unavailable, "mission not started: #{e.message}; install util-linux unshare and enable Linux user/PID namespaces and pidfds"
+        ensure
+          child&.close unless child&.closed?
+        end
+
+        def wait
+          @pidfd.wait_readable if @pidfd && !@pidfd.closed?
+          @mutex.synchronize { reap }
+        rescue IOError, Errno::EBADF
+          @mutex.synchronize { reap }
+        end
+
+        def close
+          return :reaped unless @mutex
+
+          @mutex.synchronize do
+            if @pidfd && !@pidfd.closed?
+              result = self.class.native('pidfd_send_signal', [Fiddle::TYPE_INT, Fiddle::TYPE_INT, Fiddle::TYPE_VOIDP, Fiddle::TYPE_INT]).call(@pidfd.fileno, Signal.list.fetch('KILL'), 0, 0)
+              self.class.checked(result, 'pidfd_send_signal') unless result.negative? && Fiddle.last_error == Errno::ESRCH::Errno
+            elsif @pid
+              begin
+                Process.kill('KILL', @pid)
+              rescue Errno::ESRCH
+                nil
+              end
+            end
+            reap
+          end
+        end
+
+        public_class_method def self.authors
+          "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+        end
+
+        public_class_method def self.help
+          puts <<~HELP
+            # Identify module authors.
+            #{self}.authors
+
+            # Launch a private Linux mission and retain its cancellation owner.
+            #{self}.new(
+              descriptor: 'required - serializable operation and request parameters',
+              fds: 'optional - explicitly inherited descriptor map'
+            )
+          HELP
+        end
+
+        private
+
+        def start_prepared(opts, &operation)
+          ready, announce = IO.pipe
+          release, gate = IO.pipe
+          owner = Process.pid
+          @pid = fork do
+            ready.close
+            gate.close
+            begin
+              self.class.checked(self.class.native('prctl', [Fiddle::TYPE_INT, Fiddle::TYPE_LONG, Fiddle::TYPE_LONG, Fiddle::TYPE_LONG, Fiddle::TYPE_LONG]).call(1, Signal.list.fetch('KILL'), 0, 0, 0), 'PR_SET_PDEATHSIG')
+              exit! unless Process.ppid == owner
+              self.class.checked(self.class.native('unshare', [Fiddle::TYPE_INT]).call(0x20000000), 'unshare PID namespace')
+              armed, arm = IO.pipe
+              init = fork do
+                armed.close
+                announce.close
+                self.class.checked(self.class.native('prctl', [Fiddle::TYPE_INT, Fiddle::TYPE_LONG, Fiddle::TYPE_LONG, Fiddle::TYPE_LONG, Fiddle::TYPE_LONG]).call(1, Signal.list.fetch('KILL'), 0, 0, 0), 'PR_SET_PDEATHSIG')
+                arm.write('1')
+                arm.close
+                exit! unless release.read(1) == '1'
+                release.close
+                self.class.owned = true
+                Thread.current[:pwn_mission_fds] = opts.fetch(:fds, {})
+                begin
+                  Thread.handle_interrupt(Exception => :immediate) { operation ? operation.call : self.class.execute(opts.fetch(:descriptor)) }
+                  completed = true
+                ensure
+                  exit!(completed ? 0 : 1)
+                end
+              end
+              arm.close
+              raise Unavailable, 'namespace init exited before arming parent-death protection' unless armed.read(1) == '1'
+
+              armed.close
+              announce.puts(JSON.generate(pid: init))
+              announce.close
+              release.close
+              _pid, status = Process.wait2(init)
+              exit!(status.exitstatus || (128 + status.termsig))
+            rescue Exception => e # rubocop:disable Lint/RescueException -- report child startup errors
+              announce.puts(JSON.generate(error: e.message)) unless announce.closed?
+            ensure
+              exit!
+            end
+          end
+          announce.close
+          release.close
+          message = JSON.parse(ready.gets || '{}')
+          raise Unavailable, message.fetch('error', 'namespace supervisor exited') unless message['pid']
+
+          @pidfd = IO.new(self.class.checked(self.class.native('pidfd_open', [Fiddle::TYPE_INT, Fiddle::TYPE_INT]).call(message.fetch('pid'), 0), 'pidfd_open'))
+          gate.write('1')
+        ensure
+          [ready, announce, release, gate].compact.each { |io| io.close unless io.closed? }
+        end
+
+        def reap
+          _pid, @status = Process.wait2(@pid) if @pid
+          @pid = nil
+          @channel&.close unless @channel&.closed?
+          @pidfd&.close unless @pidfd&.closed?
+          :reaped
+        end
+      end
+    end
+  end
+end

data/lib/pwn/ai/agent/policy.rb

@@ -4,6 +4,7 @@ require 'json'
 require 'fileutils'
 require 'time'
 require 'digest'
+require_relative '../../memory'
 
 module PWN
   module AI
@@ -696,6 +697,8 @@ module PWN
 
         public_class_method def self.lean!(opts = {})
           dry = opts[:dry_run] ? true : false
+          return PWN::Memory.transaction(path: TRAJECTORY_FILE) { lean!(opts) } unless dry || PWN::Memory.transaction_owned?(path: TRAJECTORY_FILE)
+
           return { skipped: true } unless File.exist?(TRAJECTORY_FILE)
 
           rows = File.readlines(TRAJECTORY_FILE)
@@ -1385,6 +1388,8 @@ module PWN
         end
 
         private_class_method def self.persist_episode!(opts = {})
+          return PWN::Memory.transaction(path: TRAJECTORY_FILE) { persist_episode!(opts) } unless PWN::Memory.transaction_owned?(path: TRAJECTORY_FILE)
+
           ep = opts[:episode]
           return unless ep.is_a?(Hash)
 

data/lib/pwn/ai/agent/policy_evaluation.rb

@@ -59,6 +59,8 @@ module PWN
         # Explicit operator action only; never called from Policy.finish/Loop.
         public_class_method def self.promote(opts = {})
           return { promoted: false, reason: 'disabled' } unless opts[:enabled] == true
+          return PWN::Backups.transaction { promote(opts) } unless PWN::Backups.active?
+
           raise ArgumentError, 'stop all policy writers and set quiescent: true' unless opts[:quiescent] == true
 
           baseline = read_snapshot(path: opts.fetch(:baseline))
@@ -80,12 +82,7 @@ module PWN
           raise ArgumentError, 'snapshot changed during evaluation' unless replayed.all? { |r| r[:snapshot_sha256] == { baseline: prior_digest, candidate: candidate_digest } }
           raise ArgumentError, 'live policy is not the evaluated baseline' unless read_snapshot(path: live) == baseline
 
-          backup = "#{live}.rollback-#{prior_digest}.json"
-          if File.exist?(backup)
-            raise ArgumentError, 'rollback snapshot differs' unless read_snapshot(path: backup) == baseline
-          else
-            File.open(backup, File::WRONLY | File::CREAT | File::EXCL, 0o600) { |file| file.write(baseline) }
-          end
+          backup = PWN::Backups.capture(path: live, label: 'policy-evaluation', pin: true)
           replace(path: live, bytes: candidate)
           { promoted: true, receipt_version: 1, change_kind: 'routing_policy',
             acceptance_sha256: Digest::SHA256.hexdigest(JSON.generate(deterministic(value: replayed))),
@@ -97,6 +94,8 @@ module PWN
 
         public_class_method def self.rollback(opts = {})
           return { rolled_back: false, reason: 'disabled' } unless opts[:enabled] == true
+          return PWN::Backups.transaction { rollback(opts) } unless PWN::Backups.active?
+
           raise ArgumentError, 'stop all policy writers and set quiescent: true' unless opts[:quiescent] == true
 
           receipt = opts.fetch(:receipt)
@@ -106,8 +105,9 @@ module PWN
           prior_digest = receipt.fetch(:baseline_sha256)
           raise ArgumentError, 'invalid rollback digest' unless prior_digest.is_a?(String) && prior_digest.match?(/\A[0-9a-f]{64}\z/)
 
-          backup = "#{live}.rollback-#{prior_digest}.json"
-          raise ArgumentError, 'rollback target mismatch' unless receipt[:live_path] == live && receipt[:rollback_path] == backup
+          backup = File.expand_path(receipt.fetch(:rollback_path))
+          root = Thread.current[:pwn_backup_transaction][:root]
+          raise ArgumentError, 'rollback target mismatch' unless receipt[:live_path] == live && backup.start_with?("#{root}/") && File.realpath(backup) == backup
 
           bytes = read_snapshot(path: backup)
           raise ArgumentError, 'rollback snapshot digest mismatch' unless Digest::SHA256.hexdigest(bytes) == prior_digest