@abelxiaoxing/cadence 1.0.14 → 1.1.0

package/src/candidate-preflight.ts

@@ -1,1618 +0,0 @@
-import { type ChildProcessWithoutNullStreams, spawn } from "node:child_process";
-import { createHash } from "node:crypto";
-import {
-  chmodSync,
-  copyFileSync,
-  existsSync,
-  lstatSync,
-  mkdirSync,
-  mkdtempSync,
-  readdirSync,
-  readFileSync,
-  realpathSync,
-  rmSync,
-  writeFileSync,
-} from "node:fs";
-import path from "node:path";
-import {
-  type AtomicVerificationContract,
-  type CandidateFailure,
-  diffWritePaths,
-  isValidRelativePath,
-  type StructuredVerificationContract,
-  type VerificationContract,
-  validateVerificationContract,
-  verificationInputPaths,
-  verificationSteps,
-} from "./contracts.ts";
-import {
-  type Bound,
-  type DirBound,
-  type FileBound,
-  isCurrent,
-  snapshotDirManifest,
-} from "./file-snapshot.ts";
-import {
-  type VerificationRunnerBinding,
-  validateVerificationCapability,
-} from "./verification-capability.ts";
-
-export type { VerificationContract } from "./contracts.ts";
-
-export interface BaselineEntry {
-  path: string;
-  kind: "file" | "deleted";
-  sha256?: string;
-  bytes?: number;
-  executable?: boolean;
-}
-
-export interface CandidatePreflightInput {
-  root: string;
-  diff: Buffer;
-  writeSet: string[];
-  approvedDependencies: string[];
-  snapshot: Bound;
-  baseline: BaselineEntry[];
-  verification: VerificationContract;
-  packageManifest: FileBound;
-  lockfile: FileBound;
-  dependencyTarget: FileBound | DirBound;
-  candidateOutputsAvailable?: (checkoutRoot: string) => boolean;
-  signal?: AbortSignal;
-}
-
-type PreflightCandidateFailure = Exclude<
-  CandidateFailure,
-  { kind: "result-limit" }
->;
-type PreflightFailureKind = PreflightCandidateFailure["kind"];
-type PreflightFailureFor<Kind extends PreflightFailureKind> = Extract<
-  PreflightCandidateFailure,
-  { kind: Kind }
->;
-
-export type CandidatePreflightResult =
-  | {
-      ok: true;
-      classification: VerificationContract["classification"];
-      targets: string[];
-      commandId: string;
-      exitCode: number;
-      testCount: number;
-      identityMatch: boolean;
-      checkoutRemoved: true;
-    }
-  | (PreflightCandidateFailure & {
-      ok: false;
-      commandId?: string;
-      exitCode?: number;
-      testCount?: number;
-      identityMatch?: boolean;
-      checkoutRemoved: boolean;
-      excerpt?: string;
-    });
-
-export interface CandidatePreflightDependencies {
-  mkdtemp: typeof mkdtempSync;
-  remove: typeof rmSync;
-  spawn: (
-    command: string,
-    args: string[],
-    options: CommandOptions,
-  ) => CommandResult | Promise<CommandResult>;
-  realpath: typeof realpathSync;
-  bwrapPath: string;
-}
-
-interface CommandResult {
-  status: number | null;
-  stdout: string;
-  stderr: string;
-  error?: Error;
-}
-
-interface CommandOptions {
-  cwd: string;
-  shell: false;
-  encoding: "utf8";
-  maxBuffer: number;
-  timeout: number;
-  input?: Buffer;
-  signal?: AbortSignal;
-}
-
-interface FailureDetails {
-  commandId?: string;
-  exitCode?: number;
-  testCount?: number;
-  identityMatch?: boolean;
-  excerpt?: string;
-}
-
-class PreflightFailure extends Error {
-  constructor(
-    readonly failure: PreflightCandidateFailure,
-    readonly details: FailureDetails = {},
-  ) {
-    super(failure.code);
-  }
-}
-
-const SHA256 = /^[0-9a-f]{64}$/;
-const PACKAGE_NAME = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/iu;
-const LOCKFILES = [
-  "bun.lock",
-  "bun.lockb",
-  "package-lock.json",
-  "pnpm-lock.yaml",
-  "yarn.lock",
-] as const;
-const LOAD_FAILURE =
-  /(?:syntaxerror|parse error|failed to load|cannot find (?:module|package)|no test files|tests?\s+no tests|error ts\d+)/iu;
-const COMMAND_TIMEOUT_MS = 10 * 60 * 1000;
-const SANDBOX_BUN_TARGET = "/usr/bin/bun";
-const SANDBOX_REPORT_TARGET = "/tmp/cadence-verification-report.json";
-const MAX_REPORT_BYTES = 2 * 1024 * 1024;
-
-const defaultDependencies: CandidatePreflightDependencies = {
-  mkdtemp: mkdtempSync,
-  remove: rmSync,
-  spawn: spawnCommand,
-  realpath: realpathSync,
-  bwrapPath: "/usr/bin/bwrap",
-};
-
-function spawnCommand(
-  command: string,
-  args: string[],
-  options: CommandOptions,
-): Promise<CommandResult> {
-  return new Promise((resolve) => {
-    const stdout: Buffer[] = [];
-    const stderr: Buffer[] = [];
-    let buffered = 0;
-    let commandError: Error | undefined;
-    let settled = false;
-    let child: ChildProcessWithoutNullStreams;
-    let timeout: ReturnType<typeof setTimeout> | undefined;
-    const finish = (status: number | null) => {
-      if (settled) return;
-      settled = true;
-      if (timeout) clearTimeout(timeout);
-      resolve({
-        status,
-        stdout: Buffer.concat(stdout).toString("utf8"),
-        stderr: Buffer.concat(stderr).toString("utf8"),
-        ...(commandError ? { error: commandError } : {}),
-      });
-    };
-    const collect = (target: Buffer[], chunk: Buffer) => {
-      buffered += chunk.length;
-      if (buffered > options.maxBuffer) {
-        commandError ??= new Error("preflight command output exceeded limit");
-        child.kill("SIGKILL");
-        return;
-      }
-      target.push(chunk);
-    };
-    try {
-      child = spawn(command, args, {
-        cwd: options.cwd,
-        shell: false,
-        stdio: ["pipe", "pipe", "pipe"],
-        ...(options.signal ? { signal: options.signal } : {}),
-      }) as ChildProcessWithoutNullStreams;
-    } catch (error) {
-      commandError = error as Error;
-      resolve({ status: null, stdout: "", stderr: "", error: commandError });
-      return;
-    }
-    timeout = setTimeout(() => {
-      commandError ??= new Error("preflight command timed out");
-      child.kill("SIGKILL");
-    }, options.timeout);
-    timeout.unref();
-    child.stdout.on("data", (chunk: Buffer) => collect(stdout, chunk));
-    child.stderr.on("data", (chunk: Buffer) => collect(stderr, chunk));
-    child.on("error", (error) => {
-      commandError ??= error;
-    });
-    child.on("close", (status) => finish(status));
-    child.stdin.on("error", () => undefined);
-    child.stdin.end(options.input);
-  });
-}
-
-function typedFailure<Kind extends PreflightFailureKind>(
-  kind: Kind,
-  code: PreflightFailureFor<Kind>["code"],
-): PreflightFailureFor<Kind> {
-  return { kind, code } as PreflightFailureFor<Kind>;
-}
-
-function reject<Kind extends PreflightFailureKind>(
-  kind: Kind,
-  code: PreflightFailureFor<Kind>["code"],
-  details: FailureDetails = {},
-): never {
-  throw new PreflightFailure(typedFailure(kind, code), details);
-}
-
-function failed<Kind extends PreflightFailureKind>(
-  kind: Kind,
-  code: PreflightFailureFor<Kind>["code"],
-  details: FailureDetails = {},
-  checkoutRemoved = true,
-): CandidatePreflightResult {
-  return {
-    ok: false,
-    ...typedFailure(kind, code),
-    ...details,
-    checkoutRemoved,
-  } as CandidatePreflightResult;
-}
-
-function removeCheckout(
-  temp: string,
-  dependencies: CandidatePreflightDependencies,
-): { failed: boolean; removed: boolean } {
-  let cleanupFailed = false;
-  for (let attempt = 0; attempt < 2; attempt++) {
-    try {
-      dependencies.remove(temp, { recursive: true, force: true });
-    } catch {
-      cleanupFailed = true;
-    }
-    let removed = false;
-    try {
-      removed = lstatSync(temp, { throwIfNoEntry: false }) === undefined;
-    } catch {
-      cleanupFailed = true;
-    }
-    if (removed) return { failed: cleanupFailed, removed: true };
-    cleanupFailed = true;
-  }
-  return { failed: true, removed: false };
-}
-
-function sha256(bytes: Buffer): string {
-  return createHash("sha256").update(bytes).digest("hex");
-}
-
-function safePath(root: string, relative: string): string {
-  if (
-    !isValidRelativePath(relative) ||
-    relative.trim() !== relative ||
-    /[\r\n\t]/u.test(relative)
-  ) {
-    reject("artifact", "noncanonical-path");
-  }
-  const absolute = path.resolve(root, relative);
-  if (absolute === root || !absolute.startsWith(`${root}${path.sep}`)) {
-    reject("artifact", "escaping-path");
-  }
-  return absolute;
-}
-
-function sameDirBound(actual: DirBound | null, expected: DirBound): boolean {
-  return (
-    actual !== null &&
-    actual.kind === "dir" &&
-    actual.manifest === expected.manifest
-  );
-}
-
-function validSnapshot(snapshot: Bound): boolean {
-  if (
-    snapshot === null ||
-    typeof snapshot !== "object" ||
-    Array.isArray(snapshot)
-  ) {
-    return false;
-  }
-  for (const [relative, value] of Object.entries(snapshot)) {
-    if (!isValidRelativePath(relative) || !value || typeof value !== "object")
-      return false;
-    if (value.kind === "file") {
-      if (
-        !SHA256.test(value.sha256) ||
-        !Number.isSafeInteger(value.bytes) ||
-        value.bytes < 0
-      )
-        return false;
-    } else if (value.kind === "dir") {
-      if (!SHA256.test(value.manifest)) return false;
-    } else if (value.kind === "absent") {
-      if (value.absent !== true) return false;
-    } else {
-      return false;
-    }
-  }
-  return true;
-}
-
-async function run(
-  dependencies: CandidatePreflightDependencies,
-  cwd: string,
-  command: string,
-  args: string[],
-  input?: Buffer,
-  signal?: AbortSignal,
-): Promise<CommandResult> {
-  const options: CommandOptions = {
-    cwd,
-    shell: false,
-    encoding: "utf8",
-    maxBuffer: 2 * 1024 * 1024,
-    timeout: COMMAND_TIMEOUT_MS,
-    ...(input === undefined ? {} : { input }),
-    ...(signal === undefined ? {} : { signal }),
-  };
-  const result = await dependencies.spawn(command, args, options);
-  return {
-    status: result.status,
-    stdout: result.stdout ?? "",
-    stderr: result.stderr ?? "",
-    ...(result.error === undefined ? {} : { error: result.error }),
-  };
-}
-
-function commandExcerpt(
-  result: Pick<CommandResult, "stdout" | "stderr">,
-  secrets: string[],
-): string {
-  let text = `${result.stdout}\n${result.stderr}`;
-  for (const secret of secrets) {
-    if (secret) text = text.replaceAll(secret, "<path>");
-  }
-  return [...text]
-    .map((character) =>
-      character === "\n" ||
-      ((character.codePointAt(0) ?? 0) >= 0x20 &&
-        (character.codePointAt(0) ?? 0) <= 0x7e)
-        ? character
-        : "?",
-    )
-    .join("")
-    .slice(-1024);
-}
-
-function requireCurrentHost(input: CandidatePreflightInput): void {
-  if (!isCurrent(input.root, input.snapshot)) reject("stale", "stale-snapshot");
-}
-
-function validateInput(input: CandidatePreflightInput): {
-  targets: string[];
-  lockPath: string;
-  dependencyPath: string;
-  verification: StructuredVerificationContract;
-} {
-  if (!Buffer.isBuffer(input.diff) || input.diff.length === 0)
-    reject("artifact", "invalid-diff-bytes");
-  if (!validSnapshot(input.snapshot)) reject("artifact", "invalid-snapshot");
-  const verification = validateVerificationContract(input.verification);
-  if (!verification.ok) reject("artifact", "invalid-verification-contract");
-  if (
-    !Array.isArray(input.approvedDependencies) ||
-    input.approvedDependencies.some(
-      (dependency) => typeof dependency !== "string" || dependency.length === 0,
-    ) ||
-    new Set(input.approvedDependencies).size !==
-      input.approvedDependencies.length
-  ) {
-    reject("artifact", "invalid-approved-dependencies");
-  }
-
-  let targets: string[];
-  try {
-    targets = diffWritePaths(input.diff.toString("utf8")).paths;
-  } catch (error) {
-    reject("artifact", "invalid-diff", {
-      excerpt: String((error as Error).message).slice(0, 256),
-    });
-  }
-
-  const writeSet = [...new Set(input.writeSet)];
-  if (
-    writeSet.length !== input.writeSet.length ||
-    writeSet.some((relative) => !isValidRelativePath(relative)) ||
-    targets.some((target) => !writeSet.includes(target))
-  ) {
-    reject("artifact", "write-set-mismatch");
-  }
-
-  const packageBound = input.snapshot["package.json"];
-  if (
-    packageBound?.kind !== "file" ||
-    packageBound.sha256 !== input.packageManifest.sha256 ||
-    packageBound.bytes !== input.packageManifest.bytes
-  ) {
-    reject("artifact", "package-bound-mismatch");
-  }
-  const lockPath = LOCKFILES.find((candidate) => {
-    const bound = input.snapshot[candidate];
-    return (
-      bound?.kind === "file" &&
-      bound.sha256 === input.lockfile.sha256 &&
-      bound.bytes === input.lockfile.bytes
-    );
-  });
-  if (!lockPath) reject("artifact", "lockfile-bound-mismatch");
-
-  const dependencyPath = "node_modules";
-  const dependencyBound = input.snapshot[dependencyPath];
-  if (
-    !dependencyBound ||
-    dependencyBound.kind !== input.dependencyTarget.kind ||
-    (dependencyBound.kind === "file" &&
-      input.dependencyTarget.kind === "file" &&
-      (dependencyBound.sha256 !== input.dependencyTarget.sha256 ||
-        dependencyBound.bytes !== input.dependencyTarget.bytes)) ||
-    (dependencyBound.kind === "dir" &&
-      input.dependencyTarget.kind === "dir" &&
-      dependencyBound.manifest !== input.dependencyTarget.manifest)
-  ) {
-    reject("artifact", "dependency-bound-mismatch");
-  }
-
-  const entries = new Map<string, BaselineEntry>();
-  for (const entry of input.baseline) {
-    if (!entry || !isValidRelativePath(entry.path) || entries.has(entry.path)) {
-      reject("artifact", "baseline-shape");
-    }
-    if (entry.kind === "file") {
-      if (
-        !SHA256.test(entry.sha256 ?? "") ||
-        !Number.isSafeInteger(entry.bytes) ||
-        (entry.bytes ?? -1) < 0 ||
-        typeof entry.executable !== "boolean"
-      ) {
-        reject("artifact", "baseline-shape");
-      }
-      const bound = input.snapshot[entry.path];
-      if (
-        bound?.kind !== "file" ||
-        bound.sha256 !== entry.sha256 ||
-        bound.bytes !== entry.bytes
-      ) {
-        reject("artifact", "baseline-bound-mismatch");
-      }
-    } else if (
-      entry.kind !== "deleted" ||
-      entry.sha256 !== undefined ||
-      entry.bytes !== undefined ||
-      entry.executable !== undefined ||
-      input.snapshot[entry.path]?.kind !== "absent"
-    ) {
-      reject("artifact", "baseline-shape");
-    }
-    entries.set(entry.path, entry);
-  }
-  for (const [relative, bound] of Object.entries(input.snapshot)) {
-    if (
-      (bound.kind === "file" || bound.kind === "absent") &&
-      !entries.has(relative)
-    ) {
-      reject("artifact", "incomplete-baseline");
-    }
-  }
-  if (targets.some((target) => !entries.has(target)))
-    reject("artifact", "target-baseline-missing");
-  for (const verificationPath of verificationInputPaths(verification.value)) {
-    if (!entries.has(verificationPath))
-      reject("artifact", "verification-baseline-missing");
-  }
-  return {
-    targets,
-    lockPath,
-    dependencyPath,
-    verification: verification.value,
-  };
-}
-
-function verifyBaselineAt(root: string, baseline: BaselineEntry[]): void {
-  for (const entry of baseline) {
-    const absolute = safePath(root, entry.path);
-    const stat = lstatSync(absolute, { throwIfNoEntry: false });
-    if (entry.kind === "deleted") {
-      if (stat) reject("stale", "baseline-deletion-drift");
-      continue;
-    }
-    if (!stat?.isFile() || stat.isSymbolicLink())
-      reject("artifact", "baseline-file-kind");
-    const bytes = readFileSync(absolute);
-    if (
-      bytes.length !== entry.bytes ||
-      sha256(bytes) !== entry.sha256 ||
-      Boolean(stat.mode & 0o111) !== entry.executable
-    ) {
-      reject("stale", "baseline-file-drift");
-    }
-  }
-}
-
-function scanCheckout(checkout: string): void {
-  const visit = (directory: string): void => {
-    for (const entry of readdirSync(directory, { withFileTypes: true })) {
-      if (directory === checkout && entry.name === ".git") continue;
-      const absolute = path.join(directory, entry.name);
-      const stat = lstatSync(absolute);
-      if (stat.isSymbolicLink()) reject("artifact", "checkout-symlink");
-      if (stat.isDirectory()) visit(absolute);
-      else if (!stat.isFile()) reject("artifact", "checkout-special-file");
-    }
-  };
-  visit(checkout);
-}
-
-function resolveBunExecutable(
-  dependencies: CandidatePreflightDependencies,
-): string {
-  const candidates = [
-    ...(process.versions.bun ? [process.execPath] : []),
-    ...(process.env.PATH ?? "")
-      .split(path.delimiter)
-      .filter(Boolean)
-      .map((entry) => path.join(entry, "bun")),
-  ];
-  for (const candidate of candidates) {
-    try {
-      const executable = dependencies.realpath(candidate);
-      const stat = lstatSync(executable);
-      if (stat.isFile() && (stat.mode & 0o111) !== 0) return executable;
-    } catch {}
-  }
-  reject("environment", "bun-executable-unavailable");
-}
-
-async function requireRegularGitModes(
-  dependencies: CandidatePreflightDependencies,
-  checkout: string,
-  signal?: AbortSignal,
-): Promise<void> {
-  const result = await run(
-    dependencies,
-    checkout,
-    "git",
-    ["ls-files", "--stage", "-z"],
-    undefined,
-    signal,
-  );
-  if (signal?.aborted) reject("cancelled", "cancelled");
-  if (result.error || result.status !== 0)
-    reject("environment", "git-index-unavailable");
-  for (const record of result.stdout.split("\0").filter(Boolean)) {
-    const mode = record.slice(0, 6);
-    if (mode !== "100644" && mode !== "100755")
-      reject("artifact", mode === "160000" ? "submodule" : "nonregular-mode");
-  }
-}
-
-function reconstructBaseline(
-  input: CandidatePreflightInput,
-  checkout: string,
-): void {
-  for (const entry of input.baseline) {
-    const source = safePath(input.root, entry.path);
-    const target = safePath(checkout, entry.path);
-    if (entry.kind === "deleted") {
-      const stat = lstatSync(target, { throwIfNoEntry: false });
-      if (stat?.isDirectory()) reject("artifact", "baseline-deletion-kind");
-      rmSync(target, { force: true });
-      continue;
-    }
-    mkdirSync(path.dirname(target), { recursive: true });
-    copyFileSync(source, target);
-    const stat = lstatSync(target);
-    const mode = entry.executable ? 0o755 : 0o644;
-    if ((stat.mode & 0o777) !== mode) {
-      chmodSync(target, mode);
-    }
-  }
-  verifyBaselineAt(checkout, input.baseline);
-}
-
-function copySafeDirectory(source: string, target: string): void {
-  const directory = lstatSync(source, { throwIfNoEntry: false });
-  if (!directory?.isDirectory() || directory.isSymbolicLink())
-    reject("artifact", "baseline-directory-kind");
-  mkdirSync(target, { recursive: true });
-  chmodSync(target, directory.mode & 0o777);
-  for (const name of readdirSync(source).sort()) {
-    const sourceEntry = path.join(source, name);
-    const targetEntry = path.join(target, name);
-    const stat = lstatSync(sourceEntry);
-    if (stat.isSymbolicLink()) reject("artifact", "baseline-directory-symlink");
-    if (stat.isDirectory()) {
-      copySafeDirectory(sourceEntry, targetEntry);
-      continue;
-    }
-    if (!stat.isFile()) reject("artifact", "baseline-directory-special-file");
-    copyFileSync(sourceEntry, targetEntry);
-    chmodSync(targetEntry, stat.mode & 0o777);
-  }
-}
-
-function reconstructBoundDirectories(
-  input: CandidatePreflightInput,
-  checkout: string,
-  dependencyPath: string,
-): void {
-  const directories = Object.entries(input.snapshot)
-    .filter(
-      (entry): entry is [string, DirBound] =>
-        entry[1].kind === "dir" && entry[0] !== dependencyPath,
-    )
-    .sort(([left], [right]) => left.localeCompare(right));
-  const roots = directories.filter(
-    ([relative], index) =>
-      !directories.some(
-        ([parent], parentIndex) =>
-          parentIndex !== index && relative.startsWith(`${parent}/`),
-      ),
-  );
-  for (const [relative, expected] of roots) {
-    const source = safePath(input.root, relative);
-    const target = safePath(checkout, relative);
-    rmSync(target, { recursive: true, force: true });
-    copySafeDirectory(source, target);
-    if (!sameDirBound(snapshotDirManifest(checkout, relative), expected)) {
-      if (!sameDirBound(snapshotDirManifest(input.root, relative), expected))
-        reject("stale", "baseline-directory-drift");
-      reject("artifact", "baseline-directory-mismatch");
-    }
-  }
-}
-
-function sandboxArgs(
-  checkout: string,
-  dependencySource: string,
-  dependencyIsDirectory: boolean,
-  bunExecutable: string | undefined,
-  runnerPlan: SandboxRunnerPlan,
-  invocation: string[],
-  reportSource?: string,
-): string[] {
-  const candidate = "/candidate";
-  const sandboxPath = [
-    ...runnerPlan.pathEntries,
-    "/usr/bin",
-    "/usr/local/bin",
-    "/bin",
-  ].join(":");
-  const args = [
-    "--unshare-net",
-    "--unshare-pid",
-    "--die-with-parent",
-    "--new-session",
-    "--proc",
-    "/proc",
-    "--dev",
-    "/dev",
-    "--tmpfs",
-    "/tmp",
-    "--clearenv",
-    "--setenv",
-    "PATH",
-    sandboxPath,
-    "--setenv",
-    "HOME",
-    "/nonexistent",
-    "--setenv",
-    "CI",
-    "1",
-  ];
-  for (const systemPath of ["/usr", "/bin", "/lib", "/lib64", "/etc"]) {
-    if (existsSync(systemPath)) args.push("--ro-bind", systemPath, systemPath);
-  }
-  if (bunExecutable) {
-    args.push("--ro-bind", bunExecutable, SANDBOX_BUN_TARGET);
-  }
-  if (runnerPlan.mounts.length > 0) {
-    args.push("--dir", "/cadence", "--dir", "/cadence/runners");
-    for (const mount of runnerPlan.mounts) {
-      args.push("--dir", mount.target, "--ro-bind", mount.source, mount.target);
-    }
-  }
-  const dependencyDestination = path.posix.join(candidate, "node_modules");
-  const localDependency = path.join(checkout, "node_modules");
-  rmSync(localDependency, { recursive: true, force: true });
-  if (dependencyIsDirectory) {
-    mkdirSync(localDependency, { recursive: true });
-  } else {
-    writeFileSync(localDependency, "");
-  }
-  args.push(
-    "--dir",
-    candidate,
-    "--bind",
-    checkout,
-    candidate,
-    "--ro-bind",
-    dependencySource,
-    dependencyDestination,
-    ...(reportSource ? ["--bind", reportSource, SANDBOX_REPORT_TARGET] : []),
-    "--chdir",
-    candidate,
-    "--",
-    ...invocation,
-  );
-  return args;
-}
-
-interface SandboxRunnerPlan {
-  mounts: Array<{ source: string; target: string }>;
-  pathEntries: string[];
-}
-
-function pathWithin(root: string, candidate: string): boolean {
-  return candidate === root || candidate.startsWith(`${root}${path.sep}`);
-}
-
-function sandboxRunnerPlan(
-  bindings: readonly VerificationRunnerBinding[],
-): SandboxRunnerPlan {
-  const relevant = bindings.filter((binding) => binding.command !== "bun");
-  const sources = [
-    ...new Set(
-      relevant.flatMap((binding) =>
-        binding.mountSource ? [binding.mountSource] : [],
-      ),
-    ),
-  ]
-    .sort(
-      (left, right) => left.length - right.length || left.localeCompare(right),
-    )
-    .filter(
-      (source, index, all) =>
-        !all.some(
-          (candidate, candidateIndex) =>
-            candidateIndex !== index &&
-            candidate.length < source.length &&
-            pathWithin(candidate, source),
-        ),
-    );
-  const mounts = sources.map((source, index) => ({
-    source,
-    target: `/cadence/runners/${index}`,
-  }));
-  const pathEntries = relevant.map((binding) => {
-    if (!binding.mountSource) return path.dirname(binding.executablePath);
-    const mount = mounts.find((candidate) =>
-      pathWithin(candidate.source, binding.executablePath),
-    );
-    if (!mount) throw new Error("verification runner mount plan is incomplete");
-    const relative = path.relative(
-      mount.source,
-      path.dirname(binding.executablePath),
-    );
-    return relative
-      ? path.posix.join(mount.target, ...relative.split(path.sep))
-      : mount.target;
-  });
-  return { mounts, pathEntries: [...new Set(pathEntries)] };
-}
-
-interface StructuredTestReport {
-  total: number;
-  failed: number;
-  success: boolean;
-  failedAssertions: string[];
-  fileErrors: string[];
-}
-
-function structuredTestReport(reportPath: string): StructuredTestReport {
-  const stat = lstatSync(reportPath, { throwIfNoEntry: false });
-  if (
-    !stat?.isFile() ||
-    stat.isSymbolicLink() ||
-    stat.size === 0 ||
-    stat.size > MAX_REPORT_BYTES
-  ) {
-    reject("artifact", "verification-report-missing");
-  }
-  let value: unknown;
-  try {
-    value = JSON.parse(readFileSync(reportPath, "utf8"));
-  } catch {
-    reject("artifact", "verification-report-invalid");
-  }
-  if (!value || typeof value !== "object" || Array.isArray(value))
-    reject("artifact", "verification-report-invalid");
-  const report = value as Record<string, unknown>;
-  const total = report.numTotalTests;
-  const failed = report.numFailedTests;
-  if (
-    !Number.isSafeInteger(total) ||
-    (total as number) < 0 ||
-    !Number.isSafeInteger(failed) ||
-    (failed as number) < 0 ||
-    (failed as number) > (total as number) ||
-    typeof report.success !== "boolean" ||
-    !Array.isArray(report.testResults)
-  ) {
-    reject("artifact", "verification-report-invalid");
-  }
-  const failedAssertions: string[] = [];
-  const fileErrors: string[] = [];
-  let failedRecords = 0;
-  for (const file of report.testResults) {
-    if (!file || typeof file !== "object" || Array.isArray(file))
-      reject("artifact", "verification-report-invalid");
-    const fileRecord = file as Record<string, unknown>;
-    const assertions = fileRecord.assertionResults;
-    if (!Array.isArray(assertions) || typeof fileRecord.message !== "string")
-      reject("artifact", "verification-report-invalid");
-    if (fileRecord.message) fileErrors.push(fileRecord.message);
-    for (const assertion of assertions) {
-      if (
-        !assertion ||
-        typeof assertion !== "object" ||
-        Array.isArray(assertion)
-      )
-        reject("artifact", "verification-report-invalid");
-      const record = assertion as Record<string, unknown>;
-      if (record.status !== "failed") continue;
-      if (
-        typeof record.fullName !== "string" ||
-        typeof record.title !== "string" ||
-        !Array.isArray(record.failureMessages) ||
-        record.failureMessages.some((message) => typeof message !== "string")
-      ) {
-        reject("artifact", "verification-report-invalid");
-      }
-      failedRecords++;
-      failedAssertions.push(
-        record.fullName,
-        record.title,
-        ...(record.failureMessages as string[]),
-      );
-    }
-  }
-  if (failedRecords !== failed)
-    reject("artifact", "verification-report-invalid");
-  return {
-    total: total as number,
-    failed: failed as number,
-    success: report.success,
-    failedAssertions,
-    fileErrors,
-  };
-}
-
-interface DependencyContractEntry {
-  value: string;
-  names: string[];
-}
-
-function canonicalJson(value: unknown): string {
-  if (Array.isArray(value)) {
-    return `[${value.map(canonicalJson).join(",")}]`;
-  }
-  if (value && typeof value === "object") {
-    return `{${Object.entries(value as Record<string, unknown>)
-      .sort(([left], [right]) => left.localeCompare(right))
-      .map(([key, entry]) => `${JSON.stringify(key)}:${canonicalJson(entry)}`)
-      .join(",")}}`;
-  }
-  return JSON.stringify(value);
-}
-
-function dependencyName(selector: string): string | null {
-  const scoped = /(@[a-z0-9][a-z0-9._-]*\/[a-z0-9][a-z0-9._-]*)/iu.exec(
-    selector,
-  )?.[1];
-  if (scoped) return scoped;
-  const segment = selector.split("/").at(-1) ?? "";
-  const name = segment.replace(/@.*$/u, "");
-  return /^[a-z0-9][a-z0-9._-]*$/iu.test(name) ? name : null;
-}
-
-function addResolutionEntries(
-  result: Map<string, DependencyContractEntry>,
-  section: string,
-  value: unknown,
-  path: string[] = [],
-  names: string[] = [],
-): void {
-  if (value && typeof value === "object" && !Array.isArray(value)) {
-    for (const [key, entry] of Object.entries(
-      value as Record<string, unknown>,
-    )) {
-      const name = dependencyName(key);
-      addResolutionEntries(
-        result,
-        section,
-        entry,
-        [...path, key],
-        name && key !== "." ? [...new Set([...names, name])] : names,
-      );
-    }
-    return;
-  }
-  result.set(`${section}:${path.join(":")}`, {
-    value: canonicalJson(value),
-    names,
-  });
-}
-
-function addPackageListPolicy(
-  result: Map<string, DependencyContractEntry>,
-  section: string,
-  value: unknown,
-): void {
-  if (value === undefined) return;
-  if (
-    !Array.isArray(value) ||
-    value.some(
-      (name) => typeof name !== "string" || !PACKAGE_NAME.test(name),
-    ) ||
-    new Set(value).size !== value.length
-  ) {
-    reject("artifact", "package-manifest-invalid");
-  }
-  result.set(section, {
-    value: canonicalJson([...value].sort()),
-    names: [],
-  });
-}
-
-function addPatchedDependencies(
-  result: Map<string, DependencyContractEntry>,
-  section: string,
-  value: unknown,
-): void {
-  if (value === undefined) return;
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    reject("artifact", "package-manifest-invalid");
-  }
-  for (const [selector, patchPath] of Object.entries(value)) {
-    if (
-      !dependencyName(selector) ||
-      typeof patchPath !== "string" ||
-      !isValidRelativePath(patchPath)
-    ) {
-      reject("artifact", "package-manifest-invalid");
-    }
-  }
-  result.set(section, { value: canonicalJson(value), names: [] });
-}
-
-function dependencyContract(
-  manifestPath: string,
-): Map<string, DependencyContractEntry> {
-  let manifest: unknown;
-  try {
-    manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
-  } catch {
-    reject("artifact", "package-manifest-invalid");
-  }
-  if (!manifest || typeof manifest !== "object" || Array.isArray(manifest)) {
-    reject("artifact", "package-manifest-invalid");
-  }
-  const record = manifest as Record<string, unknown>;
-  const result = new Map<string, DependencyContractEntry>();
-  for (const section of [
-    "dependencies",
-    "devDependencies",
-    "peerDependencies",
-    "optionalDependencies",
-  ]) {
-    const dependencies = record[section];
-    if (dependencies === undefined) continue;
-    if (
-      !dependencies ||
-      typeof dependencies !== "object" ||
-      Array.isArray(dependencies)
-    ) {
-      reject("artifact", "package-manifest-invalid");
-    }
-    for (const [name, version] of Object.entries(dependencies)) {
-      if (typeof version !== "string")
-        reject("artifact", "package-manifest-invalid");
-      result.set(`${section}:${name}`, { value: version, names: [name] });
-    }
-  }
-  for (const section of [
-    "overrides",
-    "resolutions",
-    "dependenciesMeta",
-    "peerDependenciesMeta",
-  ]) {
-    if (record[section] !== undefined) {
-      addResolutionEntries(result, section, record[section]);
-    }
-  }
-  for (const section of ["workspaces", "catalog", "catalogs"] as const) {
-    if (record[section] !== undefined) {
-      result.set(section, {
-        value: canonicalJson(record[section]),
-        names: [],
-      });
-    }
-  }
-  addPackageListPolicy(
-    result,
-    "trustedDependencies",
-    record.trustedDependencies,
-  );
-  addPackageListPolicy(
-    result,
-    "blockedDependencies",
-    record.blockedDependencies,
-  );
-  addPackageListPolicy(
-    result,
-    "bundledDependencies",
-    record.bundledDependencies,
-  );
-  addPackageListPolicy(result, "bundleDependencies", record.bundleDependencies);
-  addPatchedDependencies(
-    result,
-    "patchedDependencies",
-    record.patchedDependencies,
-  );
-  const pnpm = record.pnpm;
-  if (pnpm !== undefined) {
-    if (!pnpm || typeof pnpm !== "object" || Array.isArray(pnpm)) {
-      reject("artifact", "package-manifest-invalid");
-    }
-    const pnpmRecord = pnpm as Record<string, unknown>;
-    const resolutionSections = [
-      "overrides",
-      "packageExtensions",
-      "peerDependencyRules",
-      "allowedDeprecatedVersions",
-    ] as const;
-    for (const section of resolutionSections) {
-      const value = pnpmRecord[section];
-      if (value !== undefined) {
-        addResolutionEntries(result, `pnpm.${section}`, value);
-      }
-    }
-    addPatchedDependencies(
-      result,
-      "pnpm.patchedDependencies",
-      pnpmRecord.patchedDependencies,
-    );
-    const tracked = new Set<string>([
-      ...resolutionSections,
-      "patchedDependencies",
-    ]);
-    const policy = Object.fromEntries(
-      Object.entries(pnpmRecord).filter(([key]) => !tracked.has(key)),
-    );
-    if (Object.keys(policy).length > 0) {
-      result.set("pnpm.policy", { value: canonicalJson(policy), names: [] });
-    }
-  }
-  return result;
-}
-
-function rejectUnapprovedDependencies(
-  before: Map<string, DependencyContractEntry>,
-  after: Map<string, DependencyContractEntry>,
-  approved: string[],
-  lockfileChanged: boolean,
-): boolean {
-  const approvedNames = new Set(approved);
-  const keys = new Set([...before.keys(), ...after.keys()]);
-  let manifestChanged = false;
-  for (const key of keys) {
-    const previous = before.get(key);
-    const next = after.get(key);
-    if (previous?.value === next?.value) continue;
-    manifestChanged = true;
-    const names = new Set([...(previous?.names ?? []), ...(next?.names ?? [])]);
-    if (
-      names.size === 0 ||
-      [...names].some((name) => !approvedNames.has(name))
-    ) {
-      reject("approval-boundary", "unapproved-dependency-change");
-    }
-  }
-  if (lockfileChanged) {
-    reject("approval-boundary", "unapproved-dependency-change");
-  }
-  return manifestChanged;
-}
-
-function normalizeTarget(
-  verification: AtomicVerificationContract,
-  result: CommandResult,
-  secrets: string[],
-  report?: StructuredTestReport,
-): CandidatePreflightResult {
-  const vitest = verification.kind === "vitest";
-  const output = `${result.stdout}\n${result.stderr}`;
-  const count = vitest ? (report?.total ?? 0) : 0;
-  const identityMatch =
-    verification.classification !== "expected-red" ||
-    (vitest
-      ? (report?.failedAssertions.some((failure) =>
-          failure.includes(verification.expectedFailure ?? ""),
-        ) ?? false)
-      : output.includes(verification.expectedFailure ?? ""));
-  const loadable =
-    !vitest ||
-    ((report?.fileErrors.length ?? 0) === 0 && !LOAD_FAILURE.test(output));
-  const enoughTests = !vitest || count >= verification.minTests;
-  const accepted =
-    verification.classification === "expected-red"
-      ? result.status !== 0 &&
-        (!vitest || (report?.failed ?? 0) > 0) &&
-        enoughTests &&
-        identityMatch &&
-        loadable
-      : result.status === 0 &&
-        (!vitest || report?.success === true) &&
-        enoughTests &&
-        loadable;
-  const details = {
-    commandId: verification.id,
-    exitCode: result.status ?? 1,
-    testCount: count,
-    identityMatch,
-  };
-  if (
-    verification.classification === "expected-red" &&
-    result.status === 0 &&
-    enoughTests &&
-    loadable
-  ) {
-    return failed("artifact", "red-not-witnessed", {
-      ...details,
-      excerpt: commandExcerpt(result, secrets),
-    });
-  }
-  if (!accepted) {
-    return failed("artifact", "verification-rejected", {
-      ...details,
-      excerpt: commandExcerpt(result, secrets),
-    });
-  }
-  return {
-    ok: true,
-    classification: verification.classification,
-    targets: [],
-    ...details,
-    checkoutRemoved: true,
-  };
-}
-
-function packageScriptInvocation(
-  packageManager: string,
-  script: string,
-  args: string[],
-): string[] {
-  switch (packageManager) {
-    case "npm":
-    case "pnpm":
-      return [packageManager, "run", script, "--", ...args];
-    case "yarn":
-      return [packageManager, "run", script, ...args];
-    default:
-      return ["bun", "run", script, ...args];
-  }
-}
-
-function executableInvocation(
-  runner: Exclude<
-    AtomicVerificationContract,
-    { kind: "package-script" }
-  >["runner"],
-  args: string[],
-): string[] {
-  switch (runner.kind) {
-    case "package-script":
-      return packageScriptInvocation(
-        runner.packageManager,
-        runner.script,
-        args,
-      );
-    case "local-binary":
-      return [
-        path.posix.join("/candidate/node_modules/.bin", runner.executable),
-        ...args,
-      ];
-    case "npx":
-      return ["npx", "--no-install", runner.executable, ...args];
-    case "node":
-      return ["node", runner.script, ...args];
-  }
-}
-
-function verificationInvocation(
-  verification: AtomicVerificationContract,
-  report: boolean,
-): string[] {
-  const reporter = report
-    ? ["--reporter=json", `--outputFile=${SANDBOX_REPORT_TARGET}`]
-    : [];
-  if (verification.kind === "package-script") {
-    return packageScriptInvocation(
-      verification.packageManager,
-      verification.script,
-      verification.args,
-    );
-  }
-  const args =
-    verification.kind === "vitest"
-      ? [...verification.testFiles, ...verification.args, ...reporter]
-      : verification.args;
-  return executableInvocation(verification.runner, args);
-}
-
-function resolveDependencySource(
-  dependencies: CandidatePreflightDependencies,
-  root: string,
-  dependencyPath: string,
-): string {
-  const unresolved = safePath(root, dependencyPath);
-  let stat: ReturnType<typeof lstatSync> | undefined;
-  try {
-    stat = lstatSync(unresolved, { throwIfNoEntry: false });
-  } catch {
-    reject("environment", "dependency-path-unsafe");
-  }
-  if (!stat || stat.isSymbolicLink())
-    reject("environment", "dependency-path-unsafe");
-  let canonical: string;
-  try {
-    canonical = dependencies.realpath(unresolved);
-  } catch {
-    reject("environment", "dependency-path-unsafe");
-  }
-  if (canonical === root || !canonical.startsWith(`${root}${path.sep}`))
-    reject("environment", "dependency-path-unsafe");
-  return canonical;
-}
-
-export async function preflightCandidate(
-  input: CandidatePreflightInput,
-  dependencies: CandidatePreflightDependencies = defaultDependencies,
-): Promise<CandidatePreflightResult> {
-  let temp: string | undefined;
-  let checkout: string | undefined;
-  let targets: string[] = [];
-  let outcome: CandidatePreflightResult | undefined;
-  let unknownError: unknown;
-  let hasUnknownError = false;
-  try {
-    if (input.signal?.aborted) reject("cancelled", "cancelled");
-    if (!validSnapshot(input.snapshot)) reject("artifact", "invalid-snapshot");
-    let root: string;
-    try {
-      root = dependencies.realpath(input.root);
-    } catch {
-      reject("environment", "root-unavailable");
-    }
-    const dependencySource = resolveDependencySource(
-      dependencies,
-      root,
-      "node_modules",
-    );
-    requireCurrentHost(input);
-    const validated = validateInput(input);
-    targets = validated.targets;
-    verifyBaselineAt(input.root, input.baseline);
-    const prefix = path.join(
-      path.dirname(root),
-      `.${path.basename(root)}-candidate-`,
-    );
-    temp = dependencies.mkdtemp(prefix);
-    checkout = path.join(temp, "candidate");
-
-    const bundle = path.join(temp, "source.bundle");
-    const transportLockdown = [
-      "-c",
-      "protocol.allow=never",
-      "-c",
-      "protocol.file.allow=never",
-      "-c",
-      "protocol.ext.allow=never",
-    ];
-    let result = await run(
-      dependencies,
-      root,
-      "git",
-      [...transportLockdown, "bundle", "create", bundle, "HEAD"],
-      undefined,
-      input.signal,
-    );
-    if (input.signal?.aborted) reject("cancelled", "cancelled");
-    if (result.error || result.status !== 0)
-      reject("environment", "clone-failed");
-    result = await run(
-      dependencies,
-      temp,
-      "git",
-      ["init", "-q", checkout],
-      undefined,
-      input.signal,
-    );
-    if (input.signal?.aborted) reject("cancelled", "cancelled");
-    if (result.error || result.status !== 0)
-      reject("environment", "clone-failed");
-    result = await run(
-      dependencies,
-      checkout,
-      "git",
-      [
-        ...transportLockdown,
-        "-c",
-        "protocol.file.allow=always",
-        "fetch",
-        "-q",
-        "--no-tags",
-        "--no-recurse-submodules",
-        bundle,
-        "HEAD",
-      ],
-      undefined,
-      input.signal,
-    );
-    if (input.signal?.aborted) reject("cancelled", "cancelled");
-    if (result.error || result.status !== 0)
-      reject("environment", "clone-failed");
-    result = await run(
-      dependencies,
-      checkout,
-      "git",
-      ["checkout", "-q", "--detach", "FETCH_HEAD"],
-      undefined,
-      input.signal,
-    );
-    if (input.signal?.aborted) reject("cancelled", "cancelled");
-    if (result.error || result.status !== 0)
-      reject("environment", "checkout-failed");
-    if (
-      existsSync(path.join(checkout, ".git", "objects", "info", "alternates"))
-    ) {
-      reject("environment", "clone-alternates");
-    }
-
-    await requireRegularGitModes(dependencies, checkout, input.signal);
-    scanCheckout(checkout);
-    for (const entry of input.baseline) {
-      const ignored = await run(
-        dependencies,
-        root,
-        "git",
-        ["check-ignore", "-q", "--", entry.path],
-        undefined,
-        input.signal,
-      );
-      if (input.signal?.aborted) reject("cancelled", "cancelled");
-      if (ignored.error || ignored.status === null || ignored.status > 1)
-        reject("environment", "git-ignore-check-failed");
-      if (ignored.status === 0) reject("artifact", "ignored-baseline-input");
-    }
-    reconstructBoundDirectories(input, checkout, validated.dependencyPath);
-    reconstructBaseline(input, checkout);
-    scanCheckout(checkout);
-    const dependenciesBefore = dependencyContract(
-      path.join(checkout, "package.json"),
-    );
-
-    result = await run(
-      dependencies,
-      checkout,
-      "git",
-      ["apply", "--check", "--recount", "--whitespace=nowarn", "-"],
-      input.diff,
-      input.signal,
-    );
-    if (input.signal?.aborted) reject("cancelled", "cancelled");
-    if (result.error) reject("environment", "git-apply-check-unavailable");
-    if (result.status !== 0)
-      reject("artifact", "git-apply-check-failed", {
-        excerpt: commandExcerpt(result, [root, checkout]),
-      });
-    result = await run(
-      dependencies,
-      checkout,
-      "git",
-      ["apply", "--recount", "--whitespace=nowarn", "-"],
-      input.diff,
-      input.signal,
-    );
-    if (input.signal?.aborted) reject("cancelled", "cancelled");
-    if (result.error) reject("environment", "git-apply-unavailable");
-    if (result.status !== 0) reject("artifact", "git-apply-failed");
-    const dependencyManifestChanged = rejectUnapprovedDependencies(
-      dependenciesBefore,
-      dependencyContract(path.join(checkout, "package.json")),
-      input.approvedDependencies,
-      validated.targets.some((target) =>
-        (LOCKFILES as readonly string[]).includes(target),
-      ),
-    );
-    await requireRegularGitModes(dependencies, checkout, input.signal);
-    scanCheckout(checkout);
-    if (input.candidateOutputsAvailable?.(checkout) === false) {
-      reject("artifact", "producer-output-unavailable");
-    }
-
-    for (const verificationPath of verificationInputPaths(
-      validated.verification,
-    )) {
-      const stat = lstatSync(safePath(checkout, verificationPath), {
-        throwIfNoEntry: false,
-      });
-      if (!stat?.isFile() || stat.isSymbolicLink())
-        reject("artifact", "verification-input-unavailable");
-    }
-
-    const capability = validateVerificationCapability(
-      checkout,
-      validated.verification,
-      { dependencyOwner: root },
-    );
-    if (!capability.ok) {
-      if (capability.diagnostic.kind === "verification-adapter") {
-        reject("verification-adapter", capability.diagnostic.code);
-      }
-      reject("artifact", "invalid-verification-contract");
-    }
-
-    let bwrap: string;
-    try {
-      bwrap = dependencies.realpath(dependencies.bwrapPath);
-    } catch {
-      reject("environment", "bubblewrap-or-dependency-unavailable");
-    }
-    const runnerPlan = sandboxRunnerPlan(capability.runnerBindings);
-    const sandboxSecrets = [
-      root,
-      checkout,
-      ...runnerPlan.mounts.map((mount) => mount.source),
-    ];
-    let bunExecutable =
-      capability.runnerBindings.some((binding) => binding.command === "bun") ||
-      dependencyManifestChanged
-        ? resolveBunExecutable(dependencies)
-        : undefined;
-
-    const probeArgs = sandboxArgs(
-      checkout,
-      dependencySource,
-      input.dependencyTarget.kind === "dir",
-      bunExecutable,
-      runnerPlan,
-      ["/bin/true"],
-    );
-    result = await run(
-      dependencies,
-      checkout,
-      bwrap,
-      probeArgs,
-      undefined,
-      input.signal,
-    );
-    if (input.signal?.aborted) reject("cancelled", "cancelled");
-    if (result.error || result.status !== 0)
-      reject("environment", "sandbox-runtime-unavailable", {
-        exitCode: result.status ?? 1,
-        excerpt: commandExcerpt(result, sandboxSecrets),
-      });
-
-    if (dependencyManifestChanged) {
-      bunExecutable ??= resolveBunExecutable(dependencies);
-      const dependencyArgs = sandboxArgs(
-        checkout,
-        dependencySource,
-        input.dependencyTarget.kind === "dir",
-        bunExecutable,
-        runnerPlan,
-        [
-          "bun",
-          "install",
-          "--frozen-lockfile",
-          "--dry-run",
-          "--ignore-scripts",
-          "--no-progress",
-        ],
-      );
-      result = await run(
-        dependencies,
-        checkout,
-        bwrap,
-        dependencyArgs,
-        undefined,
-        input.signal,
-      );
-      if (input.signal?.aborted) reject("cancelled", "cancelled");
-      if (result.error || result.status === null)
-        reject("environment", "bubblewrap-launch-failed", {
-          excerpt: commandExcerpt(result, sandboxSecrets),
-        });
-      if (result.status !== 0) {
-        reject("approval-boundary", "unapproved-dependency-change");
-      }
-    }
-
-    const steps = verificationSteps(validated.verification);
-    for (const [index, step] of steps.entries()) {
-      const structuredReportPath =
-        step.kind === "vitest"
-          ? path.join(temp, `verification-report-${index}.json`)
-          : undefined;
-      if (structuredReportPath) {
-        writeFileSync(structuredReportPath, "", { mode: 0o600 });
-      }
-      const targetArgs = sandboxArgs(
-        checkout,
-        dependencySource,
-        input.dependencyTarget.kind === "dir",
-        bunExecutable,
-        runnerPlan,
-        verificationInvocation(step, structuredReportPath !== undefined),
-        structuredReportPath,
-      );
-      result = await run(
-        dependencies,
-        checkout,
-        bwrap,
-        targetArgs,
-        undefined,
-        input.signal,
-      );
-      if (input.signal?.aborted) reject("cancelled", "cancelled");
-      requireCurrentHost(input);
-      if (result.error || result.status === null) {
-        reject("environment", "bubblewrap-launch-failed", {
-          excerpt: commandExcerpt(result, sandboxSecrets),
-        });
-      }
-      const report = structuredReportPath
-        ? structuredTestReport(structuredReportPath)
-        : undefined;
-      const normalized = normalizeTarget(step, result, sandboxSecrets, report);
-      if (!normalized.ok) {
-        outcome =
-          index < steps.length - 1
-            ? failed("artifact", "candidate-check-failed", {
-                commandId: step.id,
-                exitCode: normalized.exitCode,
-                testCount: normalized.testCount,
-                identityMatch: normalized.identityMatch,
-                excerpt: normalized.excerpt,
-              })
-            : normalized;
-        break;
-      }
-      if (index === steps.length - 1) {
-        outcome = { ...normalized, targets };
-      }
-    }
-  } catch (error) {
-    if (input.signal?.aborted) outcome = failed("cancelled", "cancelled");
-    else if (error instanceof PreflightFailure)
-      outcome = {
-        ok: false,
-        ...error.failure,
-        ...error.details,
-        checkoutRemoved: true,
-      } as CandidatePreflightResult;
-    else {
-      unknownError = error;
-      hasUnknownError = true;
-    }
-  }
-  if (temp !== undefined) {
-    const cleanup = removeCheckout(temp, dependencies);
-    if (cleanup.failed && !hasUnknownError)
-      return failed(
-        "environment",
-        "checkout-cleanup-failed",
-        {},
-        cleanup.removed,
-      );
-  }
-  if (hasUnknownError) throw unknownError;
-  if (outcome === undefined)
-    throw new Error("candidate preflight outcome unavailable");
-  return outcome;
-}