pwn 0.5.784 → 0.5.787

data/spec/lib/pwn/ai/agent/loop_spec.rb

@@ -5,17 +5,76 @@ require 'tmpdir'
 require 'fileutils'
 
 describe PWN::AI::Agent::Loop do # rubocop:disable Metrics/BlockLength
+  around do |example|
+    Dir.mktmpdir('loop-controller-') do |control|
+      @runtime_control = control
+      example.run
+    end
+  end
+
+  before do
+    FileUtils.mkdir_p(File.join(@runtime_control, 'sessions'))
+    allow(PWN::Sessions).to receive(:sessions_dir).and_return(File.join(@runtime_control, 'sessions'))
+  end
+
   describe 'runtime execution boundaries' do
     include_context 'pwn tmp sandbox'
 
     before do
       allow(Dir).to receive(:home).and_return(@tmp)
+      @work = File.join(@tmp, 'work')
+      FileUtils.mkdir_p(@work)
       stub_const('PWN::AI::Agent::OpenGoal::GOAL_FILE', File.join(@tmp, 'open_goal.json'))
       allow(PWN::AI::Agent::TaskSummarizer).to receive(:enabled?).and_return(false)
       allow(described_class).to receive(:should_auto_introspect?).and_return(false)
       @agent_cfg[:plan_first] = false
     end
 
+    it 'finishes the offline PDF flow after cumulative combined and separate host observations' do
+      FileUtils.mkdir_p(File.join(@tmp, 'output'))
+      pdf = File.join(@tmp, 'output', 'container_pentest-PWN.pdf')
+      note = File.join(@tmp, 'output', 'notes.txt')
+      request = "Generate a report, i.e. a PDF; save #{pdf} and #{note}"
+      runtime = PWN::AI::Agent::RequestRuntime.new(request: request, session_id: 'pdf-replay', engine: :openai, artifact_root: @runtime_control, trace: false)
+      code = "PWN::Reports::PDF.generate(path: #{pdf.inspect}, title: 'Offline pentest fixture', findings: []); File.read(#{pdf.inspect}, 8)"
+      turns = [
+        { role: 'assistant', tool_calls: [{ id: 'pdf-write', type: 'function', function: { name: 'pwn_eval', arguments: { code: code }.to_json } }] },
+        { role: 'assistant', tool_calls: [{ id: 'note-write', type: 'function', function: { name: 'shell', arguments: { command: "printf verified > #{note}", timeout: 10 }.to_json } }] },
+        { role: 'assistant', tool_calls: [{ id: 'readback', type: 'function', function: { name: 'shell', arguments: { command: "stat #{pdf}; sha256sum #{pdf}; cat #{note}", timeout: 10 }.to_json } }] },
+        { role: 'assistant', content: 'The PDF and notes are written and verified.' }
+      ]
+      hops = 0
+      allow(PWN::AI::OpenAI).to receive(:chat_with_tools) do
+        hops += 1
+        raise 'unexpected completion bounce' if turns.empty?
+
+        { choices: [{ message: turns.shift }] }
+      end
+      tool_results = []
+      result = described_class.run(request: request, session_id: 'pdf-replay', runtime: runtime, system_role_content: 'offline fixture', on_tool: ->(*row) { tool_results << row })
+      expect(result).to eq('The PDF and notes are written and verified.'), tool_results.inspect
+      expect(hops).to eq(4)
+      expect(runtime.contract[:required_artifacts]).to contain_exactly(pdf, note)
+      expect(runtime.outcome[:status]).to eq('complete')
+      expect(runtime.observations.keys).to contain_exactly(pdf, note)
+      expect(File.binread(pdf)).to start_with('%PDF-1.4')
+      expect(File.binread(pdf)).to include('%%EOF')
+      expect(runtime.observations[pdf][:sha256]).to eq(Digest::SHA256.file(pdf).hexdigest)
+    end
+
+    it 'returns a precise blocked outcome instead of bouncing uncertain effects forever' do
+      runtime = PWN::AI::Agent::RequestRuntime.new(request: 'Perform the fixture mutation', session_id: 'uncertain-replay', engine: :openai, artifact_root: @runtime_control, trace: false)
+      expect do
+        runtime.execute_tool(name: 'fixture_write', args: { target: 'exact-target' }, effect: :write, action_id: 'uncertain-call') { raise Timeout::Error }
+      end.to raise_error(Timeout::Error)
+      allow(PWN::AI::OpenAI).to receive(:chat_with_tools).and_return(choices: [{ message: { role: 'assistant', content: 'Done.' } }])
+      result = described_class.run(request: runtime.request, session_id: runtime.session_id, runtime: runtime, system_role_content: 'offline fixture')
+      expect(result).to include('blocked:', 'uncertain-call', 'operator-approved reconciliation')
+      expect(runtime.outcome[:status]).to eq('blocked')
+      expect(runtime.unmet).to eq(['uncertain_side_effect'])
+      expect(PWN::AI::OpenAI).to have_received(:chat_with_tools).once
+    end
+
     it 'verifies an exact HTTP target at the actual Loop finalization boundary' do
       require 'socket'
       server = TCPServer.new('127.0.0.1', 0)
@@ -30,7 +89,7 @@ describe PWN::AI::Agent::Loop do # rubocop:disable Metrics/BlockLength
         client.close
       end
       sid = PWN::Sessions.create(title: 'http verifier fixture')[:id]
-      runtime = PWN::AI::Agent::RequestRuntime.new(request: request, session_id: sid, engine: :openai, artifact_root: @tmp, trace: false)
+      runtime = PWN::AI::Agent::RequestRuntime.new(request: request, session_id: sid, engine: :openai, artifact_root: @runtime_control, trace: false)
       allow(PWN::AI::OpenAI).to receive(:chat_with_tools).and_return(choices: [{ message: { role: 'assistant', content: 'Checked.' } }])
       contract = { root: @tmp, requirements: [request], allowed_urls: [url], checks: [{ requirement: request, kind: :http, url: url, expected: 'ok' }] }
       result = described_class.run(request: request, session_id: sid, runtime: runtime, verification_contract: contract, enabled_toolsets: [], system_role_content: 'fixture')
@@ -113,16 +172,17 @@ describe PWN::AI::Agent::Loop do # rubocop:disable Metrics/BlockLength
     end
 
     it 'cancels a real mutation in Loop and denies its replay after checkpoint restore' do
-      counter = File.join(@tmp, 'cancel-counter')
+      counter = File.join(@work, 'cancel-counter.txt')
       cancelled = false
-      options = { request: 'Run the fixture mutation', session_id: 'tool-cancel', request_id: 'same', engine: :openai,
-                  artifact_root: @tmp, trace: false, cancel: -> { cancelled } }
+      options = { request: "Run the fixture mutation and write #{counter}", session_id: 'tool-cancel', request_id: 'same', engine: :openai,
+                  artifact_root: @runtime_control, trace: false, cancel: -> { cancelled } }
       runtime = PWN::AI::Agent::RequestRuntime.new(options)
       args = { command: "printf 'once\\n' >> #{counter}; sleep 30", timeout: 180 }
       reply = { role: 'assistant', tool_calls: [{ id: 'mutation', type: 'function', function: { name: 'shell', arguments: args.to_json } }] }
       allow(PWN::AI::OpenAI).to receive(:chat_with_tools).and_return(choices: [{ message: reply }])
       canceller = Thread.new do
-        deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + 5
+        # Wait for the actual mutation, including cold kernel-policy inventory.
+        deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + 60
         sleep 0.01 until File.exist?(counter) || Process.clock_gettime(Process::CLOCK_MONOTONIC) >= deadline
         cancelled = true
       end
@@ -163,18 +223,30 @@ describe PWN::AI::Agent::Loop do # rubocop:disable Metrics/BlockLength
     end
 
     it 'overlaps independent reads while preserving real write barriers and start/end order' do
-      left = File.join(@tmp, 'left.txt')
-      right = File.join(@tmp, 'right.txt')
-      output = File.join(@tmp, 'out.txt')
+      left = File.join(@work, 'left.txt')
+      right = File.join(@work, 'right.txt')
+      output = File.join(@work, 'out.txt')
       File.write(left, 'left')
       File.write(right, 'right')
-      timings = []
-      lock = Mutex.new
+      timing_path = File.join(@work, 'timings.jsonl')
       allow(PWN::Plugins::ArtifactRegistry).to receive(:read_page).and_wrap_original do |original, options|
         start = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-        sleep 0.05
+        rendezvous = "#{timing_path}.#{File.exist?(output) ? 'after' : 'before'}"
+        File.open(rendezvous, 'a') do |file|
+          file.flock(File::LOCK_EX)
+          file.puts('started')
+        end
+        deadline = start + 10
+        until File.readlines(rendezvous).length == 2
+          raise 'parallel reads did not rendezvous' if Process.clock_gettime(Process::CLOCK_MONOTONIC) >= deadline
+
+          sleep 0.005
+        end
         value = original.call(options)
-        lock.synchronize { timings << [start, Process.clock_gettime(Process::CLOCK_MONOTONIC)] }
+        File.open(timing_path, 'a') do |file|
+          file.flock(File::LOCK_EX)
+          file.puts(JSON.generate([start, Process.clock_gettime(Process::CLOCK_MONOTONIC)]))
+        end
         value
       end
       calls = [left, right].each_with_index.map { |path, index| { id: "read#{index}", type: 'function', function: { name: 'artifact_read', arguments: { path: path }.to_json } } }
@@ -183,8 +255,9 @@ describe PWN::AI::Agent::Loop do # rubocop:disable Metrics/BlockLength
       calls.concat([left, right].each_with_index.map { |path, index| { id: "after#{index}", type: 'function', function: { name: 'artifact_read', arguments: { path: path }.to_json } } })
       replies = [{ role: 'assistant', tool_calls: calls }, { role: 'assistant', content: 'Verified.' }]
       allow(PWN::AI::OpenAI).to receive(:chat_with_tools) { { choices: [{ message: replies.shift || raise('unexpected provider call') }] } }
-      runtime = PWN::AI::Agent::RequestRuntime.new(request: "Write #{output}", session_id: 'parallel', engine: :openai, trace: false, artifact_root: @tmp)
+      runtime = PWN::AI::Agent::RequestRuntime.new(request: "Write #{output}", session_id: 'parallel', engine: :openai, trace: false, artifact_root: @runtime_control)
       expect(described_class.run(request: runtime.request, runtime: runtime, session_id: 'parallel', system_role_content: 'fixture')).to eq('Verified.')
+      timings = File.readlines(timing_path).map { |line| JSON.parse(line) }
       expect(timings.length).to eq(4)
       expect(timings[0][0]).to be < timings[1][1]
       expect(timings[1][0]).to be < timings[0][1]
@@ -205,6 +278,8 @@ describe PWN::AI::Agent::Loop do # rubocop:disable Metrics/BlockLength
 
     before do
       allow(Dir).to receive(:home).and_return(@tmp)
+      @work = File.join(@tmp, 'work')
+      FileUtils.mkdir_p(@work)
       stub_const('PWN::AI::Agent::OpenGoal::GOAL_FILE', File.join(@tmp, 'open_goal.json'))
       allow(PWN::AI::Agent::TaskSummarizer).to receive(:enabled?).and_return(false)
       allow(described_class).to receive(:should_auto_introspect?).and_return(false)
@@ -212,7 +287,7 @@ describe PWN::AI::Agent::Loop do # rubocop:disable Metrics/BlockLength
     end
 
     it 'accepts Verification complete after an actual write without wording-dependent retries' do
-      path = File.join(@tmp, 'answer.txt')
+      path = File.join(@work, 'answer.txt')
       replies = [
         { role: 'assistant', tool_calls: [{ id: 'write', type: 'function', function: { name: 'shell', arguments: { command: "printf verified > #{path}" }.to_json } }] },
         { role: 'assistant', content: 'Verification complete.' }
@@ -240,7 +315,7 @@ describe PWN::AI::Agent::Loop do # rubocop:disable Metrics/BlockLength
     end
 
     it 'automatically restores the session checkpoint identity for continue' do
-      runtime = PWN::AI::Agent::RequestRuntime.new(request: "Write #{@tmp}/resume.txt", session_id: 'resume', request_id: 'original', artifact_root: @tmp, trace: false)
+      runtime = PWN::AI::Agent::RequestRuntime.new(request: "Write #{@tmp}/resume.txt", session_id: 'resume', request_id: 'original', artifact_root: @runtime_control, trace: false)
       Thread.current[:pwn_request_runtime] = runtime
       PWN::AI::Agent::OpenGoal.begin!(request: runtime.request, session_id: 'resume')
       runtime.finish!(status: 'incomplete')
@@ -259,7 +334,7 @@ describe PWN::AI::Agent::Loop do # rubocop:disable Metrics/BlockLength
 
     it 'drives the actual runtime/provider adapter boundary and harmless Dispatch write' do
       PWN::Env[:ai][:active] = :openai
-      path = File.join(@tmp, 'provider.txt')
+      path = File.join(@work, 'provider.txt')
       replies = [
         { role: 'assistant', tool_calls: [{ id: 'write', type: 'function', function: { name: 'shell', arguments: { command: "printf provider > #{path}" }.to_json } }] },
         { role: 'assistant', content: 'Verification complete.' }
@@ -274,8 +349,8 @@ describe PWN::AI::Agent::Loop do # rubocop:disable Metrics/BlockLength
     end
 
     it 'retains completion evidence after all tool messages are evicted' do
-      path = File.join(@tmp, 'compacted.txt')
-      runtime = PWN::AI::Agent::RequestRuntime.new(request: "Write #{path}", session_id: 'compact', artifact_root: @tmp, trace: false)
+      path = File.join(@work, 'compacted.txt')
+      runtime = PWN::AI::Agent::RequestRuntime.new(request: "Write #{path}", session_id: 'compact', artifact_root: @runtime_control, trace: false)
       replies = [
         { role: 'assistant', tool_calls: [{ id: 'write', type: 'function', function: { name: 'shell', arguments: { command: "printf compacted > #{path}" }.to_json } }] },
         { role: 'assistant', content: 'Verification complete.' }
@@ -354,7 +429,7 @@ describe PWN::AI::Agent::Loop do # rubocop:disable Metrics/BlockLength
 
     it 'terminates checker errors with a durable verification_error outcome, not a success' do
       request = "Write #{File.join(@tmp, 'error.txt')}"
-      runtime = PWN::AI::Agent::RequestRuntime.new(request: request, session_id: 'error', artifact_root: @tmp, trace: false)
+      runtime = PWN::AI::Agent::RequestRuntime.new(request: request, session_id: 'error', artifact_root: @runtime_control, trace: false)
       allow(PWN::AI::Agent::TurnFinalizer).to receive(:arbitrate).and_raise(IOError, 'checker unavailable')
       allow(described_class).to receive(:call_engine).and_return(role: 'assistant', content: 'Done.')
       expect(described_class).to receive(:call_engine).once
@@ -363,10 +438,10 @@ describe PWN::AI::Agent::Loop do # rubocop:disable Metrics/BlockLength
     end
 
     it 'rejects a failed explicit content check before publishing a successful final' do
-      path = File.join(@tmp, 'checked.txt')
+      path = File.join(@work, 'checked.txt')
       request = "Write #{path} containing correct"
       sid = PWN::Sessions.create(title: 'verification fixture')[:id]
-      runtime = PWN::AI::Agent::RequestRuntime.new(request: request, session_id: sid, artifact_root: @tmp, trace: false)
+      runtime = PWN::AI::Agent::RequestRuntime.new(request: request, session_id: sid, artifact_root: @runtime_control, trace: false)
       replies = [
         { role: 'assistant', tool_calls: [{ id: 'write', type: 'function', function: { name: 'shell', arguments: { command: "printf wrong > #{path}" }.to_json } }] },
         { role: 'assistant', content: 'Done.' }
@@ -379,13 +454,13 @@ describe PWN::AI::Agent::Loop do # rubocop:disable Metrics/BlockLength
     end
 
     it 'keeps completed evidence and original destinations through additive steering at the real entry' do
-      first = File.join(@tmp, 'first.txt')
-      second = File.join(@tmp, 'second.txt')
+      first = File.join(@work, 'first.txt')
+      second = File.join(@work, 'second.txt')
       input, writer = IO.pipe
       control = described_class::Steering.new(input: input, output: StringIO.new)
       request = "Write #{first}"
       sid = PWN::Sessions.create(title: 'amendment verification')[:id]
-      runtime = PWN::AI::Agent::RequestRuntime.new(request: request, session_id: sid, artifact_root: @tmp, trace: false)
+      runtime = PWN::AI::Agent::RequestRuntime.new(request: request, session_id: sid, artifact_root: @runtime_control, trace: false)
       count = 0
       allow(described_class).to receive(:call_engine) do
         count += 1
@@ -418,7 +493,7 @@ describe PWN::AI::Agent::Loop do # rubocop:disable Metrics/BlockLength
     it 'persists cancellation and restores the runtime binding without a provider restart' do
       input, writer = IO.pipe
       control = described_class::Steering.new(input: input, output: StringIO.new)
-      runtime = PWN::AI::Agent::RequestRuntime.new(request: 'What color is a lemon?', session_id: 'cancel', artifact_root: @tmp, trace: false)
+      runtime = PWN::AI::Agent::RequestRuntime.new(request: 'What color is a lemon?', session_id: 'cancel', artifact_root: @runtime_control, trace: false)
       control.submit('cancel')
       expect(described_class).not_to receive(:call_engine)
       result = described_class.run(request: runtime.request, runtime: runtime, session_id: 'cancel', steering: control,
@@ -451,7 +526,7 @@ describe PWN::AI::Agent::Loop do # rubocop:disable Metrics/BlockLength
 
     it 'does not reuse a previous terminal success when the resumed provider returns nothing' do
       request = 'What color is a lemon?'
-      runtime = PWN::AI::Agent::RequestRuntime.new(request: request, session_id: 'resume', artifact_root: @tmp, trace: false)
+      runtime = PWN::AI::Agent::RequestRuntime.new(request: request, session_id: 'resume', artifact_root: @runtime_control, trace: false)
       runtime.finish!(status: 'complete')
       allow(described_class).to receive(:call_engine).and_return(nil)
       described_class.run(request: request, runtime: runtime, session_id: 'resume', enabled_toolsets: [], system_role_content: 'fixture')
@@ -516,7 +591,7 @@ describe PWN::AI::Agent::Loop do # rubocop:disable Metrics/BlockLength
         described_class.send(:wait_trace_step!, label: 'engine')
         'done'
       end
-      expect(PWN::Plugins::REPL.pwn_ai_run_steerable(input: input, output: StringIO.new, request: 'test')).to eq('done')
+      expect(PWN::Plugins::REPL.pwn_ai_run_steerable_child(input: input, output: StringIO.new, request: 'test')).to eq('done')
       expect(Thread.current[:pwn_steering_input]).to be_nil
     ensure
       input&.close
@@ -659,7 +734,7 @@ describe PWN::AI::Agent::Loop do # rubocop:disable Metrics/BlockLength
         queued.pop
         writer.puts('tool answer')
       end
-      result = PWN::Plugins::REPL.pwn_ai_run_steerable(
+      result = PWN::Plugins::REPL.pwn_ai_run_steerable_child(
         input: input, output: output, request: old_request,
         session_id: sid, system_role_content: 'test system', enabled_toolsets: [], on_tool: on_tool
       )
@@ -701,7 +776,7 @@ describe PWN::AI::Agent::Loop do # rubocop:disable Metrics/BlockLength
         entered.pop
         writer.puts('/steer what color is a lemon?')
       end
-      result = PWN::Plugins::REPL.pwn_ai_run_steerable(
+      result = PWN::Plugins::REPL.pwn_ai_run_steerable_child(
         input: input, output: output, request: 'what color is a passion fruit?',
         session_id: sid, system_role_content: 'test system', enabled_toolsets: []
       )

data/spec/lib/pwn/ai/agent/mission_namespace_spec.rb

@@ -0,0 +1,138 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'tmpdir'
+
+RSpec.describe 'PWN::AI::Agent::MissionNamespace compiler-free process ownership' do
+  around do |example|
+    previous = PWN::AI::Agent::MissionNamespace.force_exec
+    PWN::AI::Agent::MissionNamespace.force_exec = true
+    example.run
+  ensure
+    PWN::AI::Agent::MissionNamespace.force_exec = previous
+  end
+
+  it 'loads through root and direct requires without suppressing sibling autoloads' do
+    %w[pwn pwn/ai/agent/mission_namespace].each do |entry|
+      code = <<~RUBY
+        require ARGV.fetch(0)
+        owner = PWN::AI::Agent::MissionNamespace
+        abort 'wrong owner' unless owner.name == 'PWN::AI::Agent::MissionNamespace'
+        abort 'root alias' if PWN.const_defined?(:MissionNamespace, false)
+        abort 'missing context' unless PWN::AI::Context.respond_to?(:help)
+        abort 'missing runtime' unless PWN::AI::Agent::RequestRuntime.respond_to?(:help)
+        puts owner.name
+      RUBY
+      stdout, stderr, status = Open3.capture3(RbConfig.ruby, '-I', File.expand_path('../../../../../lib', __dir__), '-e', code, entry)
+      expect(status.success?).to be(true), stderr
+      expect(stdout.strip).to eq('PWN::AI::Agent::MissionNamespace')
+    end
+  end
+
+  it 'preserves permitted YAML dates, timestamps, symbols and binary strings in snapshots' do
+    value = { date: Date.new(2026, 10, 29), time: Time.at(123, 456, :nanosecond).getlocal('+09:00'), bytes: "\xFF".b, route: :openai }
+    restored = PWN::AI::Agent::MissionNamespace.decode(PWN::AI::Agent::MissionNamespace.encode(value))
+    expect(restored).to eq(value)
+    expect(restored[:time].utc_offset).to eq(value[:time].utc_offset)
+  end
+
+  it 'preserves the exit status of a failed mission' do
+    mission = PWN::AI::Agent::MissionNamespace.new(descriptor: { operation: :command, argv: [RbConfig.ruby, '-e', 'exit! 73'] })
+    mission.wait
+    expect(mission.status.exitstatus).to eq(73)
+  ensure
+    mission&.close
+  end
+
+  it 'terminates owned descendants when the controller dies' do
+    Dir.mktmpdir('mission-owner-') do |root|
+      ready = File.join(root, 'ready')
+      late = File.join(root, 'late')
+      owner = fork do
+        code = "Process.setsid; File.write(ARGV[0], 'ready'); sleep 1; File.write(ARGV[1], 'late')"
+        mission = PWN::AI::Agent::MissionNamespace.new(descriptor: { operation: :command, argv: [RbConfig.ruby, '-e', code, ready, late] })
+        sleep 30
+      ensure
+        mission&.close
+        exit!
+      end
+      Timeout.timeout(10) { sleep 0.01 until File.exist?(ready) }
+      Process.kill('KILL', owner)
+      Process.wait(owner)
+      owner = nil
+      sleep 1.2
+      expect(File.exist?(late)).to be(false)
+    ensure
+      if owner
+        Process.kill('KILL', owner)
+        Process.wait(owner)
+      end
+    end
+  end
+
+  it 'rejects cyclic snapshots before attempting a launch' do
+    value = {}
+    value[:self] = value
+    expect { PWN::AI::Agent::MissionNamespace.encode(value) }.to raise_error(ArgumentError, /snapshot.*deep/)
+  end
+
+  it 'allows cancellation while another thread waits for completion' do
+    mission = PWN::AI::Agent::MissionNamespace.new(descriptor: { operation: :command, argv: ['/bin/sleep', '30'] })
+    waiter = Thread.new { mission.wait }
+    sleep 0.05
+    Timeout.timeout(5) do
+      mission.close
+      waiter.join
+    end
+    expect(waiter.value).to eq(:reaped)
+  ensure
+    mission&.close
+    waiter&.kill&.join
+  end
+
+  it 'enforces the filesystem boundary through a fresh descriptor worker' do
+    Dir.mktmpdir('mission-source-') do |root|
+      source = File.join(root, 'source')
+      work = File.join(root, 'work')
+      FileUtils.mkdir_p([source, work])
+      File.write(File.join(source, 'keep'), 'original')
+      result = PWN::Plugins::AISandbox.protect_call(roots: [source], workspace: work, write_roots: [work],
+                                                    handler: { name: 'shell', args: { command: "printf allowed > result; printf bad > #{source}/keep", timeout: 5 } })
+      expect(result[:stderr]).to include('Permission denied')
+      expect(File.read(File.join(source, 'keep'))).to eq('original')
+      expect(File.read(File.join(work, 'result'))).to eq('allowed')
+    end
+  end
+
+  it 'executes a console slash descriptor after a fresh exec' do
+    reader, writer = IO.pipe
+    input, sender = IO.pipe
+    mission = PWN::AI::Agent::MissionNamespace.new(descriptor: { operation: :slash, request: '/help', generation: 'test', config: {}, baseline_ai: JSON.generate(PWN::Env[:ai]) }, fds: { 4 => writer, 5 => input })
+    writer.close
+    rows = Timeout.timeout(10) { reader.readlines.map { |line| JSON.parse(line) } }
+    mission.wait
+    expect(rows.map { |row| row[1] }).to include('command_state')
+    expect(rows.none? { |row| row[1] == 'warning' }).to be(true)
+  ensure
+    mission&.close
+    [reader, writer, input, sender].compact.each { |io| io.close unless io.closed? }
+  end
+
+  it 'executes a descriptor and reaps detached descendants without an extension' do
+    Dir.mktmpdir('mission-ruby-') do |root|
+      ready = File.join(root, 'ready')
+      late = File.join(root, 'late')
+      code = "fork { Process.setsid; File.write(ARGV[0], 'ready'); sleep 1; File.write(ARGV[1], 'late') }; sleep 30"
+      mission = PWN::AI::Agent::MissionNamespace.new(descriptor: { operation: :command, argv: [RbConfig.ruby, '-e', code, ready, late] })
+      Timeout.timeout(10) { sleep 0.01 until File.exist?(ready) }
+      mission.close
+      sleep 1.1
+      expect(File.exist?(late)).to be(false)
+      next_mission = PWN::AI::Agent::MissionNamespace.new(descriptor: { operation: :command, argv: ['/bin/true'] })
+      expect(next_mission.wait).to eq(:reaped)
+    ensure
+      mission&.close
+      next_mission&.close
+    end
+  end
+end

data/spec/lib/pwn/ai/agent/policy_evaluation_spec.rb

@@ -60,14 +60,9 @@ describe 'PWN::AI::Agent::PolicyEvaluation' do
     expect(second[:isolation][:environment_keys]).to eq(%w[HOME LANG TMPDIR])
   end
 
-  it 'exports learned snapshots and repeated independent reports only on explicit benchmark opt-in' do
-    output, error, status = Open3.capture3(
-      { 'HOME' => @root, 'LANG' => 'C.UTF-8' },
-      RbConfig.ruby, File.expand_path('../../../../../scripts/benchmark_policy.rb', __dir__),
-      '--heldout', '--snapshot-dir', File.join(@root, 'snapshots'), unsetenv_others: true
-    )
-    expect(status.success?).to be(true), error
-    report = JSON.parse(output, symbolize_names: true)
+  it 'exports learned snapshots through PolicyEvaluation without a standalone script' do
+    evaluator = PWN::AI::Agent::PolicyEvaluation
+    report = evaluator.export_training(dir: File.join(@root, 'snapshots'))
     expect(report[:heldout].map { |row| row[:seed] }).to eq([0, 1])
     expect(File.file?(File.join(@root, 'snapshots', 'on.json'))).to be(true)
     report[:heldout].each do |row|
@@ -75,6 +70,7 @@ describe 'PWN::AI::Agent::PolicyEvaluation' do
       expect(row[:arms][:candidate][:evaluation][:completed]).to be > row[:arms][:baseline][:evaluation][:completed]
     end
     expect(report).not_to have_key(:promoted)
+    expect(File).not_to exist(File.expand_path('../../../../../scripts/benchmark_policy.rb', __dir__))
   end
 
   it 'requires opt-in and promotes a replay-verified candidate with a byte-exact rollback snapshot' do
@@ -83,13 +79,8 @@ describe 'PWN::AI::Agent::PolicyEvaluation' do
     live = File.join(@root, 'live.json')
     File.write(live, File.read(@baseline))
     expect(evaluator.promote(live_path: live)).to include(promoted: false, reason: 'disabled')
-    output, error, status = Open3.capture3(
-      { 'HOME' => @root, 'LANG' => 'C.UTF-8' }, RbConfig.ruby,
-      File.expand_path('../../../../../scripts/benchmark_policy.rb', __dir__),
-      '--heldout', '--snapshot-dir', File.join(@root, 'snapshots'), unsetenv_others: true
-    )
-    expect(status.success?).to be(true), error
-    reports = JSON.parse(output, symbolize_names: true)[:heldout]
+    report = evaluator.export_training(dir: File.join(@root, 'snapshots'))
+    reports = report[:heldout]
     baseline = File.join(@root, 'snapshots', 'off.json')
     candidate = File.join(@root, 'snapshots', 'on.json')
     File.write(live, File.read(baseline))
@@ -214,13 +205,9 @@ describe 'PWN::AI::Agent::PolicyEvaluation' do
     end.to raise_error(ArgumentError, /regular file/)
   end
 
-  it 'exercises the snapshot worker as part of the standalone script self-check' do
-    output, error, status = Open3.capture3(
-      { 'HOME' => @root, 'LANG' => 'C.UTF-8' }, RbConfig.ruby,
-      File.expand_path('../../../../../scripts/benchmark_policy.rb', __dir__),
-      '--self-check', unsetenv_others: true
-    )
-    expect(status.success?).to be(true), error
-    expect(output).to include('Snapshot self-checks passed', 'Self-checks passed')
+  it 'does not keep a standalone benchmark script' do
+    expect(File).not_to exist(File.expand_path('../../../../../scripts/benchmark_policy.rb', __dir__))
+    source = File.read(PWN::AI::Agent::PolicyEvaluation.method(:evaluate).source_location.first)
+    expect(source).not_to include('scripts/benchmark_policy.rb')
   end
 end

data/spec/lib/pwn/ai/agent/request_runtime_spec.rb

@@ -6,6 +6,54 @@ require 'pwn/ai/agent/request_runtime'
 describe PWN::AI::Agent::RequestRuntime do
   include_context 'pwn tmp sandbox'
 
+  it 'runs arbitrary runtime dispatch handlers behind the mandatory source boundary' do
+    registry = PWN::AI::Agent::Registry
+    entries = registry.instance_variable_get(:@entries).dup
+    discovered = registry.instance_variable_get(:@discovered)
+    protected = File.join(@tmp, 'checkout')
+    FileUtils.mkdir_p(protected)
+    target = File.join(protected, 'keep')
+    File.write(target, 'original')
+    allow(PWN::Plugins::AISandbox).to receive(:protected_roots).and_return([protected])
+    runtime = described_class.new(request: 'Write a report', session_id: 'protected', artifact_root: @tmp, trace: false)
+    Thread.current[:pwn_request_runtime] = runtime
+    PWN::AI::Agent::Registry.register(name: 'boundary_fixture', toolset: 'test', schema: { name: 'boundary_fixture', parameters: { type: 'object' } }, handler: ->(_args) { File.write(target, 'bad') })
+    response = JSON.parse(PWN::AI::Agent::Dispatch.call(tool_call: { id: 'protected', function: { name: 'boundary_fixture', arguments: '{}' } }))
+    expect(File.read(target)).to eq('original')
+    expect(response['success']).to be false
+  ensure
+    registry.instance_variable_set(:@entries, entries)
+    registry.instance_variable_set(:@discovered, discovered)
+    Thread.current[:pwn_request_runtime] = nil
+  end
+
+  it 'accumulates host artifact receipts from successful eval writes without transcript claims' do
+    first = File.join(@tmp, 'first.pdf')
+    second = File.join(@tmp, 'second.txt')
+    runtime = described_class.new(request: "Write #{first} and #{second}", session_id: 'cumulative', artifact_root: @tmp, trace: false)
+    Thread.current[:pwn_request_runtime] = runtime
+    Thread.current[:pwn_artifact_contract] = runtime.contract
+    runtime.execute_tool(name: 'fixture', args: { file: first }, effect: :eval, action_id: 'one') do
+      File.write(first, '%PDF-1.4 fixture')
+      { value: 'written' }
+    end
+    runtime.execute_tool(name: 'fixture', args: { file: second }, effect: :eval, action_id: 'two') do
+      File.write(second, 'verified')
+      { value: 'written' }
+    end
+    runtime.execute_tool(name: 'fixture', args: { file: second }, effect: :read, action_id: 'three') do
+      File.read(second)
+      { value: 'read' }
+    end
+    expect(runtime.observations.keys).to contain_exactly(first, second)
+    expect(PWN::AI::Agent::TurnFinalizer.arbitrate(request: runtime.request)[:complete]).to be true
+    File.write(first, 'stale')
+    expect(PWN::AI::Agent::TurnFinalizer.arbitrate(request: runtime.request)[:complete]).to be false
+  ensure
+    Thread.current[:pwn_request_runtime] = nil
+    Thread.current[:pwn_artifact_contract] = nil
+  end
+
   it 'accepts a binary-tagged request without raising JSON::GeneratorError' do
     request = "status \u2022 ok".b
     expect(request.encoding).to eq(Encoding::ASCII_8BIT)

data/spec/lib/pwn/ai/agent/shell_search_effect_spec.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'pwn/ai/agent/request_runtime'
+
+describe 'finished shell searches do not block the answer' do
+  include_context 'pwn tmp sandbox'
+
+  it 'keeps a non-zero search exit as a failed observation' do
+    runtime = PWN::AI::Agent::RequestRuntime.new(request: 'how does pwn-ai use tools configured with openwebUi?', session_id: 'search-exit', artifact_root: @tmp, trace: false)
+    result = runtime.execute_tool(name: 'shell', args: { command: 'rg openwebui' }, effect: :exclusive, action_id: 'search') do
+      { stdout: 'open_web_ui.rb', stderr: '', exit: 1 }
+    end
+    expect(result[:exit]).to eq(1)
+    expect(runtime.events.last[:state]).to eq('failed')
+    expect(runtime.blocker).to be_nil
+    expect(runtime.unmet).to be_empty
+    again = runtime.execute_tool(name: 'shell', args: { command: 'rg openwebui' }, effect: :exclusive, action_id: 'search-again') do
+      { stdout: 'open_web_ui.rb', stderr: '', exit: 1 }
+    end
+    expect(again[:exit]).to eq(1)
+  end
+
+  it 'does not demand reconciliation for an interrupted non-write shell command' do
+    runtime = PWN::AI::Agent::RequestRuntime.new(request: 'how does pwn-ai use tools configured with openwebUi?', session_id: 'search-interrupt', artifact_root: @tmp, trace: false)
+    call = { name: 'shell', args: { command: 'rg openwebui' }, effect: :exclusive, action_id: 'search' }
+    expect { runtime.execute_tool(call) { raise Timeout::Error } }.to raise_error(Timeout::Error)
+    expect(runtime.blocker).to be_nil
+    expect(runtime.unmet).to be_empty
+    denied = runtime.execute_tool(call.merge(action_id: 'replay')) { raise 'replayed' }
+    expect(denied[:error]).to eq('uncertain_side_effect')
+  end
+
+  it 'does not block the answer when a classified write returns permission denied' do
+    runtime = PWN::AI::Agent::RequestRuntime.new(request: 'how does pwn-ai use tools configured with openwebUi?', session_id: 'write-denied', artifact_root: @tmp, trace: false)
+    result = runtime.execute_tool(name: 'shell', args: { command: "python -c 'open(\"/tmp/server_tools.rb\",\"w\")'" }, effect: :write, action_id: 'denied-write') do
+      { stdout: '', stderr: 'PermissionError: Permission denied: /tmp/server_tools.rb', exit: 1 }
+    end
+    expect(result[:exit]).to eq(1)
+    expect(runtime.events.last[:state]).to eq('failed')
+    expect(runtime.blocker).to be_nil
+    expect(runtime.unmet).to be_empty
+  end
+end

data/spec/lib/pwn/ai/agent/solve_spec.rb

@@ -50,7 +50,7 @@ RSpec.describe 'Swarm solve' do # rubocop:disable Metrics/BlockLength -- end-to-
     PWN::Env[:ai][:active] = :openai
     PWN::Env[:ai][:openai] = { key: 'offline-fixture-key' }
     @agent_cfg[:plan_first] = false
-    runtime = PWN::AI::Agent::RequestRuntime.new(request: 'Enclosing request', session_id: 'enclosing', artifact_root: @tmp, trace: false)
+    runtime = PWN::AI::Agent::RequestRuntime.new(request: 'Enclosing request', session_id: 'enclosing', artifact_root: File.join(@tmp, 'controller'), trace: false)
     expect(runtime).not_to receive(:call)
     Thread.current[:pwn_request_runtime] = runtime
     allow(PWN::AI::OpenAI).to receive(:chat_with_tools) do |opts|
@@ -78,7 +78,8 @@ RSpec.describe 'Swarm solve' do # rubocop:disable Metrics/BlockLength -- end-to-
     console.instance_variable_set(:@mission_options, { workspace: @workspace, worktree: true, rounds: 1, verification_timeout: 60 })
     out = Timeout.timeout(15) do
       console.submit('/swarm mission Write hello to greeting.txt')
-      controller.send(:workers).last.value
+      controller.send(:workers).last.join
+      controller.snapshot[:jobs].last[:team]
     end
     expect(out).to include(status: 'accepted')
     expect(out[:evidence].first).to include(stdout: 'hello', exitstatus: 0)
@@ -95,6 +96,7 @@ RSpec.describe 'Swarm solve' do # rubocop:disable Metrics/BlockLength -- end-to-
     expect(File.read(File.join(@workspace, 'greeting.txt'))).to eq('hello')
     expect(JSON.parse(File.read(out[:record_path])).dig('application', 'status')).to eq('applied')
   ensure
+    Thread.current[:pwn_request_runtime] = nil
     console&.send(:stop_worker)
     controller&.close
     if out && out[:worktree]
@@ -620,8 +622,8 @@ RSpec.describe 'Swarm solve' do # rubocop:disable Metrics/BlockLength -- end-to-
   end
 
   it 'pauses dispatch, resumes, and cancels through the coordinator command entry' do
-    entered = Queue.new
-    release = Queue.new
+    entered = PWNTestPipeQueue.new
+    release = PWNTestPipeQueue.new
     @hook = lambda do |handoff, _answer|
       if handoff[:phase] == 'assess'
         entered << true