@agfpd/iapeer 0.4.110 → 0.4.111

package/CHANGELOG.md

@@ -12,6 +12,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- **Hosted hard teardown reclaims PTY-owned subprocesses, not only the runtime root.**
+  `self-fresh`, stop and reap snapshot ancestry before killing the runtime, including stdio MCP
+  launchers in separate process groups. Start-token and controlling-terminal checks exclude reused
+  PIDs, unrelated processes and detached/shared daemon branches. An isolated real-Codex proof and
+  hermetic regressions cover old-tree exit, fresh MCP calls and sentinel survival. Already-orphaned
+  processes and shared-backend thread shutdown remain outside this bounded cleanup.
+
+- **macOS executable signatures are checked before activation.** Runtime packages
+  must strictly verify compiled and copied staged binaries, repair invalid trusted
+  build artifacts with ad-hoc signing, and re-verify before binary/manifest publication.
+  A lightweight `@agfpd/iapeer/install-signature` helper implements the gate. Foundation
+  install and rollback now sign/verify the staged inode before replacing the binary;
+  runtime install/update also verify installed launchers before provisioning/restart,
+  even when the package/version is already current. Foundation update also verifies
+  its installed binary before activation, including same-version stale-daemon healing.
+  Valid signatures are preserved;
+  failed repair never licenses activation of invalid code.
+
 - **IAP attachments now transfer ownership instead of forwarding fragile source paths.**
   Every `send_to_peer`, `iapeer send`, and Fleet API send copies regular-file sources
   into the target peer's durable, content-addressed foundation inbox before an

package/docs/04-lifecycle-and-daemon.md

@@ -98,4 +98,15 @@ So `stop`, `start`, `new` refuse to touch foreign launchd peers — for those th
 - **`iapeer interrupt`** — interrupt the current turn (Escape) without losing context.
 - **`iapeer self-fresh` / `self-done`** — an agent's self-calls: mark itself for a fresh restart, or quietly finish (for ephemeral workers).
 
+### Process ownership at teardown
+
+Closing a hosted session is a **hard teardown**, not the MCP client's graceful stdin/EOF shutdown.
+Before killing the runtime, the supervisor snapshots its descendants and kills those still attached
+to its controlling PTY, including stdio MCP launchers in separate process groups. Each PID's start
+token and terminal are re-checked before signalling; unrelated processes and detached daemon branches
+are excluded. This also applies to `self-fresh`: finish work and persist the handoff before calling it.
+Processes already orphaned before the snapshot, a concurrent fork/exit race, an unreadable process
+table, and shared-backend threads outside the PTY are not covered by this cleanup. A shared runtime
+daemon needs its own per-thread shutdown protocol; ancestry alone does not authorize killing it.
+
 Behavior by runtime class — [08 — Peer management](08-peer-management.md); ephemeral workers — [10 — Messaging](10-messaging.md).

package/docs/07-install-and-update.md

@@ -60,7 +60,7 @@ On a fresh macOS host the first install → onboard → peer launch surfaces a h
 **Three things you do (these cannot be automated):**
 
 1. **Log in to the runtimes — before onboard.** Sign in to Claude Code and Codex first. Their login screen is a browser OAuth flow that no headless peer can drive, so iapeer deliberately does **not** auto-answer it; a runtime that is installed but not signed in makes a peer fail its first wake loudly. `iapeer onboard` warns when it finds an unauthenticated runtime.
-2. **Login keychain password — once, during install.** The install code-signs the binary with a stable local identity so Full Disk Access survives updates; macOS asks for your login keychain password the one time that identity is created. It is expected (the installer announces it). If declined, the binary still works — TCC prompts would just recur on updates.
+2. **Login keychain password — once, during install.** The install code-signs the staged binary with a stable local identity so Full Disk Access survives updates; macOS asks for your login keychain password the one time that identity is created. It is expected (the installer announces it). If declined, install may use a verified ad-hoc signature (TCC prompts may recur). Signature verification itself is mandatory: an unrepairable build aborts before replacing the installed binary.
 3. **Full Disk Access — a manual grant, no prompt.** macOS TCC cannot be set by any flag, env var, or script. Without it, a peer reading or writing a TCC-protected path (an iCloud Obsidian vault, Desktop, Documents, Downloads) silently fails with EPERM — no prompt, no hang. Grant it in **System Settings → Privacy & Security → Full Disk Access** (`~/.iapeer` itself is under `$HOME` and needs nothing); onboard prints the reminder.
 
 Gatekeeper does not gate the locally-built CLI run from a terminal (no quarantine attribute). Verified live on a truly-virgin Claude config (claude 2.1.183): the theme picker, folder-trust, the bypass-permissions accept (cursor stepped to "Yes"), and the project MCP-server approval all auto-clear in sequence, the peer reaches its input prompt, and a second launch on the same config is dialog-free; the Codex folder-trust / update auto-clearing likewise (an owner's clean-machine install + an isolated first-boot test).
@@ -78,7 +78,7 @@ A bare `iapeer update` updates the **whole host stack** in one command — the c
 
 **1. Core (foundation)** — and it ABORTS the cascade on a hard failure (never update runtimes onto a broken core):
 
-1. Learns the target version from npm. If the installed one already matches and there's no `--force` — it does nothing.
+1. Learns the target version from npm. If the installed one already matches and there's no `--force`, it verifies the installed executable signature without repairing it; a valid, version-consistent daemon needs no restart. An invalid binary is refused, including before recovery of a stale live daemon.
 2. Downloads and builds the new binary via `npm pack`, not `npx` (the binary doesn't rebuild itself).
 3. Restarts the daemon onto the new binary.
 4. Restarts the infrastructure launchd jobs the core owns (`com.iapeer.*` — the `timer`, `watcher`, Telegram routers), moving them onto the just-replaced binary. It's the JOBS that restart, not the runtimes' package code — that's the next step. If the daemon didn't come up in step 3, this is skipped.
@@ -90,7 +90,7 @@ A bare `iapeer update` updates the **whole host stack** in one command — the c
 
 Runtimes and memory are **best-effort**: a component failure is reported and the rest still run; the command exits non-zero if anything failed. Agentic peers (Claude/Codex) pick up new core doctrine lazily on their next wake.
 
-`iapeer update --foundation-only` does just step 1 (the narrow case). A pinned `iapeer update <version>` is **core-only** by design — a version pin is core-specific (downgrade, or pin a proven version, deeper than one rollback step).
+`iapeer update --foundation-only` does just the foundation leg, including infrastructure-job re-registration when the binary/daemon changes; it narrows package updates, not process restarts. A pinned `iapeer update <version>` has the same **core-only** scope — a version pin is core-specific (downgrade, or pin a proven version, deeper than one rollback step).
 
 > **Upgrading from before the cascade (< 0.4.2).** The cascade is driven by the *installed* binary, so the very first `iapeer update` from a pre-cascade version runs the OLD (foundation-only) logic: it upgrades the core to the cascade-capable binary but does not yet cascade runtimes + memory. Run `iapeer update` once more — now the new binary cascades the rest. This is a one-time bootstrap; from 0.4.2 onward it is a single command. (A fresh install lands on a cascade-capable binary directly, so it never needs the double run.)
 

package/docs/13-architecture-and-contract.md

@@ -83,6 +83,49 @@ Commands like `prepare`, `interface`, `bot`, `doctor` are the package's own inte
 - **`install-runtime <runtime>`** determines the npm package (from the built-in registry or the `--package` flag), installs it via `npx`, then provisions the declared peer set.
 - **`update-runtime <runtime>`** compares the manifest version with npm; when behind, it reinstalls, re-provisions, and restarts the runtime's peers with the standard `stop`/`start`.
 
+### Executable signature before activation (macOS)
+
+A successful Bun compile or executable copy does not guarantee a valid Mach-O
+signature. Each package owns this gate on **every** self-install path (compile and
+copy-self), including direct `npx` installs outside the foundation:
+
+1. Build/copy to a sibling temporary file and set its executable permissions.
+2. Run `/usr/bin/codesign --verify --deep --strict <tmp>`. Preserve a valid signature
+   unchanged, including certificate-backed signatures used for stable TCC grants.
+3. For an invalid/unsigned **installer-owned build artifact**, repair with
+   `/usr/bin/codesign --force --sign - <tmp>` and repeat strict verification.
+4. Only after verification succeeds, atomically rename the file over the installed
+   binary and publish the new manifest. On failure, remove the temporary file, exit
+   non-zero, and leave the previous binary and manifest unchanged.
+
+The optional lightweight helper `ensureExecutableSignature` is exported from
+`@agfpd/iapeer/install-signature`; a package may implement the same contract locally.
+It throws on verification/repair failure, skips shebang script launchers and non-macOS
+hosts, and supports injected command runners for hermetic tests. Its repair mode is
+for trusted installer artifacts, **not** a general authenticity check or a way to
+trust arbitrary modified installed code. Stable certificate signing for TCC is a
+separate concern; signature validity is fail-closed even if stable signing is soft.
+
+The foundation additionally verifies installed runtime launchers before provisioning
+or restart, including already-installed/already-latest paths. This secondary gate
+is verify-only: it reports invalid signatures rather than re-signing live binaries.
+It cannot replace the package's pre-rename gate, since launchd may reopen a binary
+as soon as the package publishes it.
+
+Foundation install and rollback apply the same staged validity gate before binary
+replacement. Stable local-certificate signing happens on the staged inode; a
+certificate-signing failure can fall back to a verified ad-hoc signature, but an
+unrepairable executable is never activated. Repair is not guaranteed for malformed
+Bun output: a strict-validation failure aborts safely and requires a working build.
+The update orchestrator also verify-only checks the installed foundation binary before
+daemon activation, including the same-version stale-daemon recovery path.
+
+The shipped `scripts/proof-install-signature.ts` exercises the actual package CLI
+installer and native codesign in disposable paths (requires the existing local signing
+identity). It includes refusal/state preservation, verify-only runtime gates and
+rollback. Update lifecycle calls are injected: this proof never restarts the host daemon
+and is not a deployed-health acceptance.
+
 ## The capability-plugin standard
 
 A capability plugin adds an ability to a peer without being a runtime. The distinction is clear: a runtime is a peer's mode of presence, a plugin is an ability on top of a runtime.

package/docs/ru/04-/320/266/320/270/320/267/320/275/320/265/320/275/320/275/321/213/320/271-/321/206/320/270/320/272/320/273-/320/270-/320/264/320/265/320/274/320/276/320/275.md

@@ -98,4 +98,15 @@
 - **`iapeer interrupt`** — прервать текущий ход (Escape), не теряя контекст.
 - **`iapeer self-fresh` / `self-done`** — самовызовы агента: пометить себя на свежий перезапуск или тихо завершиться (для эфемерных воркеров).
 
+### Владение процессами при закрытии сессии
+
+Закрытие управляемой сессии — **жёсткое завершение**, а не протокол мягкого закрытия stdin/EOF
+клиентом MCP. До остановки рантайма супервизор снимает дерево его потомков и завершает тех,
+кто ещё принадлежит его управляющему PTY, включая stdio MCP в отдельных группах процессов.
+Перед сигналом повторно проверяются время рождения PID и терминал; чужие процессы и ветви
+отсоединённых демонов исключены. Это относится и к `self-fresh`: работу и хендофф завершают до самовызова.
+Уже осиротевшие до снимка процессы, гонка параллельного порождения/выхода, недоступная таблица
+процессов и потоки общего бэкенда вне PTY этой очисткой не покрываются. Общему демону рантайма
+нужен собственный протокол закрытия отдельного потока; одно лишь родство не разрешает убивать его.
+
 Поведение по классам рантаймов — [08 — Управление пирами](08-управление-пирами.md); эфемерные воркеры — [10 — Обмен сообщениями](10-обмен-сообщениями.md).

package/docs/ru/07-/321/203/321/201/321/202/320/260/320/275/320/276/320/262/320/272/320/260-/320/270-/320/276/320/261/320/275/320/276/320/262/320/273/320/265/320/275/320/270/320/265.md

@@ -60,7 +60,7 @@ iapeer status
 **Три пункта на тебе (автоматизировать нельзя):**
 
 1. **Залогинься в рантаймы — ДО onboard.** Войди в Claude Code и Codex заранее. Их экран логина — браузерный OAuth, который headless-пир не пройдёт, поэтому iapeer НАМЕРЕННО его не авто-отвечает; установленный, но не залогиненный рантайм роняет первый wake пира громко. `iapeer onboard` предупреждает, если найдёт неаутентифицированный рантайм.
-2. **Пароль логин-связки — один раз, при install.** Install подписывает бинарь стабильной локальной идентичностью, чтобы Full Disk Access пережил обновления; macOS один раз спросит пароль логин-связки при создании этой идентичности. Это ожидаемо (инсталлер анонсирует). При отказе бинарь всё равно работает — просто TCC-промпты будут повторяться на апдейтах.
+2. **Пароль логин-связки — один раз, при install.** Install подписывает временный бинарь стабильной локальной идентичностью, чтобы Full Disk Access пережил обновления; macOS один раз спросит пароль логин-связки при создании этой идентичности. Это ожидаемо (инсталлер анонсирует). При отказе возможна проверенная ad-hoc-подпись (TCC-промпты могут повторяться). Проверка валидности обязательна: неисправимая сборка прерывает установку до замены установленного бинаря.
 3. **Full Disk Access — ручной грант, без промпта.** macOS TCC нельзя выставить ни флагом, ни env, ни скриптом. Без него пир, читающий/пишущий TCC-защищённый путь (iCloud Obsidian vault, Desktop, Documents, Downloads), тихо падает с EPERM — без промпта, без зависания. Выдай в **System Settings → Privacy & Security → Full Disk Access** (`~/.iapeer` сам под `$HOME` и ничего не требует); onboard напомнит.
 
 Gatekeeper не гейтит локально собранный CLI, запускаемый из терминала (нет quarantine-атрибута). Проверено живьём на по-настоящему виргин-конфиге Claude (claude 2.1.183): theme-picker, folder-trust, принятие bypass-permissions (курсор шагнут на «Yes») и аппрув проектных MCP-серверов авто-снимаются по очереди, пир доходит до строки ввода, а повторный запуск на том же конфиге — уже без диалогов; codex folder-trust / update — аналогично (clean-install владельца + изолированный first-boot тест).
@@ -78,7 +78,7 @@ iapeer update --force           # переустановить, даже есл
 
 **1. Ядро (фундамент)** — и оно ПРЕРЫВАЕТ каскад при жёсткой ошибке (не обновлять рантаймы на сломанное ядро):
 
-1. Узнаёт нужную версию из npm. Если установленная уже совпадает и нет `--force` — ничего не делает.
+1. Узнаёт нужную версию из npm. Если установленная уже совпадает и нет `--force`, проверяет подпись установленного бинарника без переподписания; валидный демон с актуальной версией не требует рестарта. Невалидный бинарник отклоняется, в том числе до восстановления демона со старой версией.
 2. Скачивает и собирает новый бинарь через `npm pack`, а не `npx` (бинарь не пересобирает себя сам).
 3. Перезапускает демон на новый бинарь.
 4. Перезапускает launchd-джобы инфраструктуры, которыми владеет ядро (`com.iapeer.*` — роутеры `timer`, `watcher`, Telegram), переводя их на заменённый бинарь. Перезапускаются именно ДЖОБЫ, а не пакетный код рантаймов — это следующий шаг. Если демон на шаге 3 не поднялся, шаг пропускается.
@@ -90,7 +90,7 @@ iapeer update --force           # переустановить, даже есл
 
 Рантаймы и память — **best-effort**: ошибка компонента сообщается, остальные всё равно отрабатывают; код возврата ненулевой, если что-то упало. Агентские пиры (Claude/Codex) подхватывают новую доктрину ядра лениво на следующем пробуждении.
 
-`iapeer update --foundation-only` делает только шаг 1 (узкий случай). Запиненный `iapeer update <версия>` — **только ядро** by design: пин версии специфичен для ядра (откат глубже одного шага или фиксация проверенной версии).
+`iapeer update --foundation-only` выполняет только foundation-плечо, включая перерегистрацию инфраструктурных jobs при изменении бинарника/демона: сужается обновление пакетов, а не область рестартов процессов. Запиненный `iapeer update <версия>` имеет ту же область **только ядро**: пин версии специфичен для ядра (откат глубже одного шага или фиксация проверенной версии).
 
 > **Обновление с версии до каскада (< 0.4.2).** Каскад исполняет *установленный* бинарь, поэтому самый первый `iapeer update` со старой версии работает по СТАРОЙ (foundation-only) логике: он поднимает ядро до каскад-способного бинаря, но рантаймы + память пока не каскадит. Запусти `iapeer update` ещё раз — теперь новый бинарь докаскадит остальное. Это разовый bootstrap; начиная с 0.4.2 — одна команда. (Свежая установка сразу ставит каскад-способный бинарь, поэтому двойной прогон ей не нужен.)
 

package/docs/ru/13-/320/260/321/200/321/205/320/270/321/202/320/265/320/272/321/202/321/203/321/200/320/260-/320/270-/320/272/320/276/320/275/321/202/321/200/320/260/320/272/321/202.md

@@ -83,6 +83,51 @@
 - **`install-runtime <рантайм>`** определяет npm-пакет (по встроенному реестру или флагу `--package`), ставит его через `npx`, затем разворачивает объявленный набор пиров.
 - **`update-runtime <рантайм>`** сверяет версию манифеста с npm; при отставании переустанавливает, заново провизионирует и перезапускает пиров рантайма штатными `stop`/`start`.
 
+### Подпись исполняемого файла до активации (macOS)
+
+Успешная компиляция Bun или копирование исполняемого файла не гарантирует валидную
+Mach-O-подпись. Пакет проверяет её на **каждом** пути self-install (compile и
+copy-self), включая прямую установку через `npx` вне ядра:
+
+1. Собрать/скопировать файл во временный соседний файл, установить права исполнения.
+2. Выполнить `/usr/bin/codesign --verify --deep --strict <tmp>`. Валидную подпись
+   сохранить без изменений, включая сертификатную подпись для стабильных TCC-грантов.
+3. Для невалидного/неподписанного **артефакта сборки, принадлежащего установщику**
+   выполнить `/usr/bin/codesign --force --sign - <tmp>` и повторить строгую проверку.
+4. Только после успешной проверки атомарно заменить установленный бинарь и записать
+   новый манифест. При ошибке удалить временный файл, завершиться ненулевым кодом и
+   оставить прежние бинарь и манифест неизменными.
+
+Необязательный лёгкий helper `ensureExecutableSignature` экспортирован из
+`@agfpd/iapeer/install-signature`; пакет может реализовать тот же контракт локально.
+Он бросает исключение при неуспехе проверки/исправления, пропускает скриптовые лаунчеры с shebang
+и хосты вне macOS, поддерживает внедряемый runner для герметичных тестов. Исправление
+предназначено для доверенных артефактов установщика, **не** для проверки подлинности
+или легитимации произвольно изменённого установленного кода. Стабильная сертификатная
+подпись для TCC — отдельный вопрос; валидность подписи проверяется fail-closed даже
+при мягком отказе стабильного подписания.
+
+Ядро дополнительно проверяет установленные лаунчеры рантайма перед провижном или
+рестартом, включая ветки уже установленного пакета и актуальной версии. Вторичный
+гейт только проверяет: он сообщает о невалидной подписи, не переподписывая живые
+бинарники. Он не заменяет проверку пакетом до rename: launchd может открыть бинарь
+сразу после его публикации установщиком.
+
+Установка и откат ядра применяют тот же гейт к staged-файлу до замены бинаря.
+Стабильное подписывание локальным сертификатом выполняется на временном inode;
+его отказ допускает переход к проверенной ad-hoc-подписи, но неисправимый файл
+никогда не активируется. Исправление произвольно дефектного вывода Bun не
+гарантируется: ошибка строгой валидации безопасно прерывает установку и требует
+рабочей сборки. Оркестратор update также проверяет установленный бинарник ядра без
+переподписания перед активацией демона, включая восстановление старого демона при
+совпадающей версии бинарника.
+
+Поставляемый `scripts/proof-install-signature.ts` проверяет штатный CLI-установщик
+самого пакета и настоящий codesign в одноразовых каталогах (нужна существующая локальная
+подписывающая идентичность). Он покрывает отказ и сохранение состояния, вторичные гейты
+рантаймов и rollback. Lifecycle-вызовы update заменены изолированными зависимостями:
+проверка не перезапускает демон хоста и не является приёмкой здоровья после выкатки.
+
 ## Стандарт capability-плагина
 
 Capability-плагин добавляет пиру способность, не будучи рантаймом. Отличие чёткое: рантайм — способ присутствия пира, плагин — способность поверх рантайма.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.110",
+  "version": "0.4.111",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",
@@ -34,6 +34,7 @@
     "src",
     "bin",
     "docs",
+    "scripts/proof-install-signature.ts",
     "CHANGELOG.md",
     "tsconfig.json",
     "!src/**/*.test.ts",
@@ -45,7 +46,8 @@
     "./storage": "./src/storage/index.ts",
     "./identity": "./src/identity/index.ts",
     "./registry": "./src/registry/index.ts",
-    "./codec": "./src/codec/index.ts"
+    "./codec": "./src/codec/index.ts",
+    "./install-signature": "./src/install/signature.ts"
   },
   "scripts": {
     "test": "IAPEER_TEST_SANDBOX=1 bun test",

package/scripts/proof-install-signature.ts

@@ -0,0 +1,189 @@
+// Native artifact acceptance, NOT a host deploy. Run from the unpacked npm package:
+// bun scripts/proof-install-signature.ts [package-root]
+// Real CLI installer/compiler/codesign; launchd update seams are explicitly isolated.
+import { createHash } from 'crypto'
+import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'fs'
+import { homedir, tmpdir } from 'os'
+import { join, resolve } from 'path'
+import { spawnSync } from 'child_process'
+import { pathToFileURL } from 'url'
+
+if (process.platform !== 'darwin') throw new Error('native signature proof requires macOS')
+if (process.env.IAPEER_TEST_SANDBOX === '1') throw new Error('native proof must execute real codesign; run outside bun test')
+const identity = spawnSync('/usr/bin/security', ['find-identity', '-p', 'codesigning'], { encoding: 'utf8' })
+if (identity.status !== 0 || !identity.stdout.includes('"iapeer Local Codesign"')) {
+  throw new Error('proof requires the EXISTING local identity; it does not create one')
+}
+
+const pkg = resolve(process.argv[2] ?? join(import.meta.dir, '..'))
+const fromPackage = (path: string) => import(pathToFileURL(join(pkg, path)).href)
+const { installIapeer, rollbackIapeer, stampBinaryHealthy } = await fromPackage('src/install/index.ts')
+const { ensureExecutableSignature } = await fromPackage('src/install/signature.ts')
+const { updateIapeer } = await fromPackage('src/update/index.ts')
+const { installRuntimePackage } = await fromPackage('src/runtime/deploy.ts')
+const { updateRuntime } = await fromPackage('src/runtime/update.ts')
+const { writeRuntimeManifest, runtimeManifestPath } = await fromPackage('src/runtime/index.ts')
+const expectedVersion = JSON.parse(readFileSync(join(pkg, 'package.json'), 'utf8')).version
+const root = mkdtempSync(join(tmpdir(), 'iapeer-native-signature-'))
+const tools = join(root, 'tools')
+const faultyTools = join(root, 'faulty-tools')
+const tray = join(root, 'tray')
+for (const dir of [tools, faultyTools, tray, join(root, 'home')]) mkdirSync(dir, { recursive: true })
+const env = {
+  ...process.env,
+  HOME: join(root, 'home'),
+  IAPEER_ROOT: join(root, 'state'),
+  IAPEER_BIN_DIR: join(root, 'bin'),
+  IAPEER_LAUNCHAGENTS_DIR: join(root, 'LaunchAgents'),
+  IAPEER_SOCK_DIR: join(root, 'sockets'),
+  IAPEER_PROOF_SWIFTBAR_DIR: tray,
+  PATH: `${tools}:${process.env.PATH ?? ''}`,
+}
+// SwiftBar preferences are host-global even with HOME overridden. The stock install
+// discovers a pre-existing plugin dir through this isolated read-only defaults shim.
+writeFileSync(join(tools, 'defaults'), '#!/bin/sh\nif [ "$1" = read ]; then printf "%s\\n" "$IAPEER_PROOF_SWIFTBAR_DIR"; else echo "proof refuses defaults write" >&2; exit 71; fi\n', { mode: 0o755 })
+const quote = (s: string) => `'${s.replaceAll("'", "'\\''")}'`
+// A disposable HOME otherwise hides the existing login keychain from security.
+// Permit its read/sign operations on our staged files, but refuse identity imports.
+const hostHome = process.env.HOME || homedir()
+writeFileSync(join(tools, 'security'), `#!/bin/sh
+if [ "$1" != find-identity ]; then echo 'proof refuses keychain mutation' >&2; exit 71; fi
+export HOME=${quote(hostHome)}
+exec /usr/bin/security "$@"
+`, { mode: 0o755 })
+writeFileSync(join(tools, 'codesign'), `#!/bin/sh
+export HOME=${quote(hostHome)}
+exec /usr/bin/codesign "$@"
+`, { mode: 0o755 })
+// Fault only the compiler's OUTPUT, not signing or the installer. CLI execution is
+// forwarded to the real Bun; a build exits zero with a malformed staged Mach-O.
+writeFileSync(join(faultyTools, 'bun'), `#!/bin/sh
+if [ "$1" = build ]; then
+  while [ "$#" -gt 0 ]; do
+    if [ "$1" = --outfile ]; then shift; dd if="$IAPEER_BIN_DIR/iapeer" of="$1" bs=4096 count=1 2>/dev/null; chmod +x "$1"; exit 0; fi
+    shift
+  done
+  exit 72
+fi
+exec ${quote(process.execPath)} "$@"
+`, { mode: 0o755 })
+const faultyEnv = { ...env, PATH: `${faultyTools}:${env.PATH}` }
+const checks: string[] = []
+const check = (ok: boolean, label: string) => {
+  if (!ok) throw new Error(`FAIL: ${label}`)
+  checks.push(label)
+  console.log(`PASS: ${label}`)
+}
+const hash = (path: string) => createHash('sha256').update(readFileSync(path)).digest('hex')
+const installCli = (passedEnv = env) => {
+  const result = spawnSync('/bin/bash', [join(pkg, 'bin/iapeer'), 'install'], {
+    encoding: 'utf8', env: passedEnv, cwd: pkg, timeout: 180_000,
+  })
+  console.log(result.stdout)
+  if (result.stderr) console.log(result.stderr)
+  return result
+}
+const bin = join(env.IAPEER_BIN_DIR, 'iapeer')
+const execute = () => {
+  const result = spawnSync(bin, ['version'], { encoding: 'utf8', env, timeout: 30_000 })
+  check(result.status === 0 && result.stdout.trim() === expectedVersion, 'compiled binary executes expected version')
+}
+try {
+  let result = installCli()
+  check(result.status === 0 && result.stdout.includes('signing: signed'), 'stock CLI full-payload install succeeds with existing stable identity')
+  check(ensureExecutableSignature(bin, { env, repair: false }).state === 'verified', 'installed inode strictly verifies')
+  execute()
+  check(stampBinaryHealthy(env), 'isolated healthy stamp')
+  result = installCli()
+  check(result.status === 0, 'stock CLI reinstall succeeds')
+  check(stampBinaryHealthy(env), 'isolated healthy stamp after reinstall')
+  // Foundation has no runtime manifest; its binary/config pair is binary + daemon
+  // plist. Include rollback bytes and healthy stamp in every refusal comparison.
+  const paths = [bin, `${bin}.prev`, `${bin}.healthy`, join(env.IAPEER_LAUNCHAGENTS_DIR, 'com.agfpd.iapeer.plist')]
+  const snapshot = () => paths.map(hash)
+  const unchanged = (before: string[], label: string) => {
+    check(snapshot().every((v, i) => v === before[i]), label)
+    check(!existsSync(`${bin}.tmp`), 'rejected staged file removed')
+    execute()
+  }
+  const beforeRefusal = snapshot()
+  result = installCli(faultyEnv)
+  check(result.status !== null && result.status !== 0 && `${result.stdout}${result.stderr}`.includes('executable signature'), 'stock CLI rejects compiler output through REAL codesign')
+  unchanged(beforeRefusal, 'CLI refusal preserves binary/.prev/.healthy/daemon-plist byte-for-byte')
+
+  let restarted = 0
+  let recycled = 0
+  const update = (passedEnv: typeof env) => updateIapeer({
+    env: passedEnv, currentVersion: expectedVersion, force: true,
+    resolveVersion: () => expectedVersion,
+    runInstall: () => installCli(passedEnv).status === 0,
+    // No launchctl commands or real daemon health claims in native artifact proof.
+    restartDaemon: () => { restarted++; return { state: 'restarted' } },
+    waitHealthy: async () => ({ healthy: true }),
+    recycleInfraJobs: () => { recycled++; return [] },
+    stampHealthy: () => stampBinaryHealthy(env),
+  })
+  const failedUpdate = await update(faultyEnv)
+  check(failedUpdate.status === 'failed' && restarted === 0 && recycled === 0, 'update install refusal prevents ALL lifecycle activation calls')
+  unchanged(beforeRefusal, 'update refusal preserves binary/config/rollback pair')
+  const successfulUpdate = await update(env)
+  check(successfulUpdate.status === 'updated' && restarted === 1 && recycled === 1, 'real successful installer passes update activation gate (lifecycle seams isolated)')
+  check(ensureExecutableSignature(bin, { env, repair: false }).state === 'verified', 'updated inode strictly verifies')
+  execute()
+
+  const sameVersionEnv = { ...env, IAPEER_BIN_DIR: join(root, 'same-version-bin') }
+  mkdirSync(sameVersionEnv.IAPEER_BIN_DIR)
+  const sameVersionBin = join(sameVersionEnv.IAPEER_BIN_DIR, 'iapeer')
+  copyFileSync(bin, sameVersionBin)
+  const sameVersion = () => updateIapeer({
+    env: sameVersionEnv, currentVersion: expectedVersion, resolveVersion: () => expectedVersion,
+    liveDaemonVersion: () => expectedVersion,
+  })
+  check((await sameVersion()).status === 'already-latest', 'same-version foundation update passes REAL verify-only gate')
+  writeFileSync(sameVersionBin, Buffer.from([0xcf, 0xfa, 0xed, 0xfe]))
+  const invalidBefore = hash(sameVersionBin)
+  const invalidSameVersion = await updateIapeer({
+    env: sameVersionEnv, currentVersion: expectedVersion, resolveVersion: () => expectedVersion,
+    liveDaemonVersion: () => '0.0.0',
+    restartDaemon: () => { throw new Error('unexpected stale-daemon activation') },
+  })
+  check(invalidSameVersion.status === 'failed' && invalidSameVersion.reason.includes('signature'), 'invalid same-version foundation cannot activate stale-daemon recovery')
+  check(hash(sameVersionBin) === invalidBefore, 'foundation verify-only gate leaves installed bytes unchanged')
+
+  const tiny = join(root, 'tiny.ts')
+  writeFileSync(tiny, 'console.log("tiny-signature-proof")\n')
+  const beforeTiny = snapshot()
+  let tinyError: unknown
+  try { installIapeer(tiny, env) } catch (e) { tinyError = e }
+  if (tinyError) {
+    console.log(`INFO: real tiny-source build rejected: ${String(tinyError)}`)
+    unchanged(beforeTiny, 'real tiny-source refusal preserves binary/config/rollback pair')
+  } else {
+    console.log('INFO: tiny-source output is signable on this compiler; restoring full CLI')
+    check(installCli().status === 0, 'restore full CLI after signable tiny-source build')
+    check(stampBinaryHealthy(env), 'restored healthy stamp')
+  }
+
+  // Secondary core gate: real installed launcher signature, no provisioning or
+  // restart. A custom manifest also exercises package resolution outside the map.
+  const launcher = join(env.IAPEER_BIN_DIR, 'proof-runtime')
+  copyFileSync(bin, launcher)
+  writeRuntimeManifest({ runtime: 'proof', package: '@proof/runtime', version: '1.0.0', peers: [] }, { env })
+  const unexpected = () => { throw new Error('unexpected runtime install/restart') }
+  const runtimeEnv = { ...env, PATH: `${env.IAPEER_BIN_DIR}:${env.PATH}` }
+  check(installRuntimePackage({ runtime: 'proof', env: runtimeEnv, runNpx: unexpected }).state === 'skipped', 'already-installed runtime passes REAL verify-only gate')
+  check((await updateRuntime({ runtime: 'proof', env: runtimeEnv, npmVersion: () => '1.0.0', restartPeer: unexpected, runNpx: unexpected })).state === 'already-latest', 'already-latest runtime passes REAL verify-only gate')
+  const manifestPath = runtimeManifestPath('proof', { env })
+  writeFileSync(launcher, Buffer.from([0xcf, 0xfa, 0xed, 0xfe]))
+  const rejectedPair = [hash(launcher), hash(manifestPath)]
+  check(installRuntimePackage({ runtime: 'proof', env: runtimeEnv, runNpx: unexpected }).state === 'failed', 'already-installed runtime rejects invalid launcher')
+  check((await updateRuntime({ runtime: 'proof', env: runtimeEnv, npmVersion: () => '1.0.0', restartPeer: unexpected, runNpx: unexpected })).state === 'install-failed', 'already-latest runtime rejects invalid launcher before restart')
+  check(hash(launcher) === rejectedPair[0] && hash(manifestPath) === rejectedPair[1], 'verify-only runtime gate preserves supplied binary/manifest without repair')
+
+  check(rollbackIapeer(env).status === 'rolled-back', 'isolated foundation rollback succeeds')
+  check(ensureExecutableSignature(bin, { env, repair: false }).state === 'verified', 'rollback inode strictly verifies')
+  execute()
+  console.log(JSON.stringify({ version: expectedVersion, bun: Bun.version, platform: process.platform, packageRoot: pkg, checks, lifecycle: 'injected: no live restart or daemon-health claim' }, null, 2))
+} finally {
+  rmSync(root, { recursive: true, force: true })
+}

package/src/cli/index.ts

@@ -1935,8 +1935,8 @@ export async function runCli(argv: string[], env: NodeJS.ProcessEnv = process.en
       case 'update-runtime': {
         // §(г) runtime-package update: version-gate (npm vs the manifest stamp) →
         // forced re-npx → idempotent re-provision (same path as install-runtime) →
-        // restart the runtime's peers via the regular stop/start. The core's own
-        // `update` stays foundation-only — this is the runtimes' counterpart.
+        // restart the runtime's peers via the regular stop/start. A bare `update`
+        // calls the same updater as its runtime cascade leg.
         const all = flags.all === true
         if (!all && !positionals[0]) return argErr(errOut, 'update-runtime needs a runtime or --all — usage: iapeer update-runtime <runtime> | --all')
         const { updateRuntime, updateAllRuntimes } = await import('../runtime/update.ts')

package/src/install/index.ts

@@ -20,6 +20,9 @@ import { basename, join, relative, sep } from 'path'
 import { spawnSync } from 'child_process'
 import { resolveGlobalRoot } from '../storage/index.ts'
 import { signInstalledBinary, type SigningOutcome } from './signing.ts'
+import { ensureExecutableSignature } from './signature.ts'
+export { ensureExecutableSignature } from './signature.ts'
+export type { ExecutableSignatureOptions, ExecutableSignatureOutcome, SignatureRunner } from './signature.ts'
 
 /** The stable host-wide install path of the `iapeer` binary. Standard user-bin (no
  *  admin, not tied to a node/bun version), ON $PATH. The launchd plists reference
@@ -42,8 +45,8 @@ export interface InstallResult {
   prevKept?: { reason: string }
   /** Bytes of the installed binary. */
   size?: number
-  /** Stable-identity re-sign outcome (TCC grants survive updates). Soft: a signing
-   *  hiccup never fails the install — the binary works ad-hoc-signed. */
+  /** Stable-identity re-sign outcome (TCC grants survive updates). Soft failure
+   *  is allowed only when the separate executable-signature gate succeeds. */
   signing?: SigningOutcome
 }
 
@@ -132,16 +135,38 @@ function assertInstallSandboxIsolated(binPath: string, env: NodeJS.ProcessEnv):
   }
 }
 
-export function installIapeer(cliEntrypoint: string, env: NodeJS.ProcessEnv = process.env): InstallResult {
+/** Hermetic install seams. Paths remain resolved from the caller's env. */
+export interface InstallIapeerDeps {
+  build?: (entry: string, tmp: string) => void
+  signStable?: typeof signInstalledBinary
+  verifySignature?: typeof ensureExecutableSignature
+}
+
+export function installIapeer(cliEntrypoint: string, env: NodeJS.ProcessEnv = process.env, deps: InstallIapeerDeps = {}): InstallResult {
   const binPath = iapeerBinPath(env)
   assertInstallSandboxIsolated(binPath, env)
   mkdirSync(join(binPath, '..'), { recursive: true })
   const tmp = `${binPath}.tmp`
-  const build = spawnSync('bun', ['build', '--compile', cliEntrypoint, '--outfile', tmp], {
-    encoding: 'utf8',
-  })
-  if (build.status !== 0 || !existsSync(tmp)) {
-    throw new Error(`iapeer build failed: ${(build.stderr ?? '').trim() || `exit ${build.status}`}`)
+  let signing: SigningOutcome
+  try {
+    if (deps.build) {
+      deps.build(cliEntrypoint, tmp)
+    } else {
+      const build = spawnSync('bun', ['build', '--compile', cliEntrypoint, '--outfile', tmp], {
+        encoding: 'utf8',
+      })
+      if (build.status !== 0 || !existsSync(tmp)) {
+        throw new Error(`iapeer build failed: ${(build.stderr ?? '').trim() || `exit ${build.status}`}`)
+      }
+    }
+    // Sign the STAGED inode, then verify before ANY activation/.prev/stamp change.
+    // Stable TCC signing remains soft; invalid executable signatures are hard.
+    signing = (deps.signStable ?? signInstalledBinary)(tmp, env)
+    const verifySignature = deps.verifySignature ?? ensureExecutableSignature
+    verifySignature(tmp, { env })
+  } catch (e) {
+    rmSync(tmp, { force: true })
+    throw e
   }
   let prevPath: string | undefined
   let prevKept: InstallResult['prevKept']
@@ -168,9 +193,7 @@ export function installIapeer(cliEntrypoint: string, env: NodeJS.ProcessEnv = pr
   } catch {
     /* absent — fine */
   }
-  // Stable-identity re-sign (TCC grants survive updates). AFTER the rename: the
-  // signature belongs to the final inode at the final path. Soft-fail by design.
-  const signing = signInstalledBinary(binPath, env)
+  // rename preserves the already-verified inode and its stable requirement.
   let size: number | undefined
   try {
     size = statSync(binPath).size
@@ -257,7 +280,7 @@ export interface RollbackResult {
  * rename over the binary), so the binary is never absent. The CALLER restarts the
  * daemon afterwards (cycleDaemon) — rollback only swaps the bytes. Sandbox-guarded.
  */
-export function rollbackIapeer(env: NodeJS.ProcessEnv = process.env): RollbackResult {
+export function rollbackIapeer(env: NodeJS.ProcessEnv = process.env, deps: Pick<InstallIapeerDeps, 'signStable' | 'verifySignature'> = {}): RollbackResult {
   const binPath = iapeerBinPath(env)
   assertInstallSandboxIsolated(binPath, env)
   const prev = iapeerPrevBinPath(env)
@@ -267,13 +290,15 @@ export function rollbackIapeer(env: NodeJS.ProcessEnv = process.env): RollbackRe
   const tmp = `${binPath}.rollback.tmp`
   try {
     copyFileSync(prev, tmp)
+    // Same staged gate as install: never publish an invalid rollback target.
+    const signStable = deps.signStable ?? signInstalledBinary
+    const verifySignature = deps.verifySignature ?? ensureExecutableSignature
+    signStable(tmp, env)
+    verifySignature(tmp, { env })
     renameSync(tmp, binPath)
-    // Keep the stable requirement on the restored bytes too (a .prev taken before
-    // the signing era is ad-hoc — re-signing it heals that). Soft by design.
-    signInstalledBinary(binPath, env)
   } catch (e) {
     try {
-      if (existsSync(tmp)) renameSync(tmp, `${tmp}.discard`) // never leave a half-written tmp on the path
+      rmSync(tmp, { force: true })
     } catch {
       /* best-effort */
     }

package/src/install/signature.ts

@@ -0,0 +1,94 @@
+// Lightweight package-facing activation gate. No keychain/TCC identity creation:
+// preserve a valid signature; repair only a trusted, installer-owned staged file.
+import { closeSync, fstatSync, openSync, readSync } from 'fs'
+import { spawnSync } from 'child_process'
+
+export interface SignatureRunner {
+  (command: string, args: string[], env: NodeJS.ProcessEnv): {
+    status: number | null
+    stdout?: string
+    stderr?: string
+  }
+}
+
+export interface ExecutableSignatureOptions {
+  env?: NodeJS.ProcessEnv
+  /** Default true for staged build artifacts. Use false for installed binaries. */
+  repair?: boolean
+  /** Test seams: injected runners may run under the sandbox; real codesign cannot. */
+  run?: SignatureRunner
+  platform?: NodeJS.Platform
+}
+
+export interface ExecutableSignatureOutcome {
+  state: 'verified' | 'repaired' | 'skipped-platform' | 'skipped-non-macho' | 'skipped-sandbox'
+}
+
+const MACH_O_MAGIC = new Set([
+  0xfeedface, 0xcefaedfe, 0xfeedfacf, 0xcffaedfe, // thin, 32/64-bit, either endianness
+  0xcafebabe, 0xbebafeca, 0xcafebabf, 0xbfbafeca, // universal, 32/64-bit
+])
+
+function executableKind(path: string): 'macho' | 'script' | 'unknown' {
+  const fd = openSync(path, 'r') // missing/unreadable artifact is a hard failure
+  try {
+    const magic = Buffer.alloc(4)
+    const length = readSync(fd, magic, 0, 4, 0)
+    if (length === 4 && MACH_O_MAGIC.has(magic.readUInt32BE(0))) {
+      const value = magic.readUInt32BE(0)
+      const headerSize = value === 0xfeedface || value === 0xcefaedfe ? 28
+        : value === 0xfeedfacf || value === 0xcffaedfe ? 32 : 8
+      // codesign can sign a magic-only stub as generic data using xattrs. That
+      // success is not evidence of a Mach-O executable: require its full header.
+      return fstatSync(fd).size >= headerSize ? 'macho' : 'unknown'
+    }
+    if (length >= 2 && magic[0] === 0x23 && magic[1] === 0x21) return 'script'
+    return 'unknown'
+  } finally {
+    closeSync(fd)
+  }
+}
+
+const defaultRunner: SignatureRunner = (command, args, env) => {
+  const r = spawnSync(command, args, { encoding: 'utf8', env, timeout: 30_000 })
+  return { status: r.error ? null : r.status, stdout: r.stdout ?? '', stderr: r.error?.message ?? r.stderr ?? '' }
+}
+
+/**
+ * macOS: strict verify → (if invalid and repair allowed) ad-hoc sign → strict verify.
+ * Throws on failure. Call AFTER compile/copy/chmod and BEFORE rename/manifest.
+ * Valid certificate-backed signatures stay byte-identical. Repair establishes
+ * signature validity, not provenance: never use it to trust arbitrary modified code.
+ */
+export function ensureExecutableSignature(
+  path: string,
+  opts: ExecutableSignatureOptions = {},
+): ExecutableSignatureOutcome {
+  if ((opts.platform ?? process.platform) !== 'darwin') return { state: 'skipped-platform' }
+  const env = opts.env ?? process.env
+  // Both flags count, so a caller cannot accidentally re-enable real commands by
+  // passing a sparse env. DI tests use their own runner, never the production one.
+  if (!opts.run && (env.IAPEER_TEST_SANDBOX === '1' || process.env.IAPEER_TEST_SANDBOX === '1')) {
+    return { state: 'skipped-sandbox' }
+  }
+  const kind = executableKind(path)
+  if (kind === 'script') return { state: 'skipped-non-macho' }
+  if (kind === 'unknown') throw new Error(`executable signature verification failed for ${path}: not a Mach-O executable or shebang launcher`)
+  const run = opts.run ?? defaultRunner
+  const verify = (): ReturnType<SignatureRunner> => run('/usr/bin/codesign', ['--verify', '--deep', '--strict', path], env)
+  const fail = (step: string, result: ReturnType<SignatureRunner>): never => {
+    const detail = result.stderr?.trim() || result.stdout?.trim() || `exit ${result.status}`
+    throw new Error(`executable signature ${step} failed for ${path}: ${detail}`)
+  }
+  const initial = verify()
+  if (initial.status === 0) return { state: 'verified' }
+  // A timeout/spawn error/signal is not evidence of an invalid signature. Do not
+  // rewrite code when the verification tool itself could not run to completion.
+  if (initial.status === null) fail('verification', initial)
+  if (opts.repair === false) fail('verification', initial)
+  const signed = run('/usr/bin/codesign', ['--force', '--sign', '-', path], env)
+  if (signed.status !== 0) fail('repair', signed)
+  const final = verify()
+  if (final.status !== 0) fail('verification after repair', final)
+  return { state: 'repaired' }
+}

package/src/install/signing.ts

@@ -16,9 +16,9 @@
 // bytes. Trust of the cert chain is NOT needed: codesign signs with an untrusted
 // (CSSMERR_TP_NOT_TRUSTED) identity fine, and TCC matches the requirement.
 //
-// Failure policy: SOFT. The binary works ad-hoc-signed exactly as before; a
-// signing hiccup must never break install/update. It is reported loud (the
-// operator learns TCC prompts will re-appear) but the install succeeds.
+// Stable-identity failure policy: SOFT. Executable signature validity is a
+// separate HARD gate (signature.ts) before activation; invalid Bun linker
+// signatures cannot be assumed runnable after a stable-signing failure.
 
 import { mkdtempSync, rmSync } from 'fs'
 import { tmpdir } from 'os'
@@ -63,7 +63,7 @@ export interface SigningOutcome {
     | 'signed' // re-signed with the existing identity
     | 'signed-new-identity' // identity created this run (the ONE install-time event), then signed
     | 'skipped-sandbox' // tests never touch the real keychain
-    | 'failed-soft' // signing failed — binary stays ad-hoc (works; TCC prompts return)
+    | 'failed-soft' // stable signing failed; the activation gate still decides executability
   detail?: string
 }
 
@@ -113,7 +113,7 @@ function createIdentity(run: SigningRunner): { ok: boolean; detail?: string } {
 
 /**
  * Re-sign the installed binary with the stable local identity (creating the
- * identity on first use). Called by installIapeer after the atomic rename —
+ * identity on first use). Called by installIapeer BEFORE the atomic rename —
  * i.e. on EVERY install/update path, so the designated requirement (and with it
  * every TCC grant) stays constant while the bytes change.
  */
@@ -131,7 +131,7 @@ export function signInstalledBinary(
   if (!identityPresent(run)) {
     const c = createIdentity(run)
     if (!c.ok) {
-      return { state: 'failed-soft', detail: `${c.detail} — binary stays ad-hoc-signed (works, but TCC prompts will re-appear after updates)` }
+      return { state: 'failed-soft', detail: `${c.detail} — stable TCC signing unavailable; executable signature must pass the activation gate (TCC prompts may re-appear after updates)` }
     }
     created = true
   }
@@ -139,7 +139,7 @@ export function signInstalledBinary(
   if (sign.status !== 0) {
     return {
       state: 'failed-soft',
-      detail: `codesign failed: ${sign.stderr.trim().split('\n')[0] ?? `exit ${sign.status}`} — binary stays ad-hoc-signed (works, but TCC prompts will re-appear after updates)`,
+      detail: `codesign failed: ${sign.stderr.trim().split('\n')[0] ?? `exit ${sign.status}`} — stable TCC signing unavailable; executable signature must pass the activation gate (TCC prompts may re-appear after updates)`,
     }
   }
   return created ? { state: 'signed-new-identity' } : { state: 'signed' }

package/src/launch/adapters/claude.ts

@@ -366,6 +366,13 @@ export const claudeAdapter: RuntimeAdapter = {
     if (pane.includes('Resume from summary') || pane.includes('Bypass Permissions mode')) {
       return /❯\s*2\./.test(pane) ? ['Enter'] : ['Down']
     }
+    // Folder-trust: older claude defaulted the cursor to "1. Yes, proceed", but 2.1.30x
+    // renders "❯ No, exit" / "Yes, I trust this folder" with the DEFAULT on exit — a bare
+    // Enter cleanly exits the peer (live: claude-boris child-exit 5s after first wake,
+    // 2026-10-17). Same discipline as Bypass: Enter only once the cursor is SEEN on Yes.
+    if (pane.includes('trust this folder') && /No,\s*exit/.test(pane)) {
+      return /❯\s*(?:\d\.\s*)?Yes\b/.test(pane) ? ['Enter'] : ['Down']
+    }
     if (
       pane.includes('trust this folder') ||
       pane.includes('Allow external CLAUDE.md file imports?') ||

package/src/launch/launchdRun.ts

@@ -162,7 +162,7 @@ export async function runAlwaysOn(personality: string, runtime: string, cwd: str
     interrupt = null
   }
   // Signal-initiated stop (bootout / shutdown / kickstart -k) tears the session down WITH this watcher —
-  // kill the supervisor daemon (killPtyHost: SIGTERM → it SIGKILLs the child + cleans up sock/pid/serve)
+  // kill the supervisor daemon (SIGTERM → hard teardown of its PTY-owned tree + sock/pid/serve cleanup)
   // so the detached child does not outlive bootout holding stale in-memory state. A NATURAL death
   // (stop=false) skips this: nothing to tear down, exit 0 → KeepAlive respawns a fresh bring-up.
   if (stop) killPtyHost(identity, env)

package/src/launch/ptyHost.ts

@@ -45,7 +45,7 @@ export function hostSessionAlive(identity: string, env: NodeJS.ProcessEnv = proc
   return hostDaemonAlive(hostRunDir(env), identity)
 }
 
-/** Reap a hosted session: SIGTERM the supervisor daemon (its shutdown SIGKILLs the child + cleans up).
+/** Reap a hosted session: SIGTERM the supervisor daemon (hard-kills its PTY-owned tree + cleans up).
  *  env sandboxes the run-dir: a test with an injected root must NEVER SIGTERM a real fleet peer. */
 export function killPtyHost(identity: string, env: NodeJS.ProcessEnv = process.env): void {
   killSupervisorSession(hostRunDir(env), identity)

package/src/lifecycle/index.ts

@@ -1257,7 +1257,7 @@ export async function wakeOrSpawn(args: WakeArgs, deps: WakeDeps = {}): Promise<
 // ─────────────────────────────────────────────────────────────────────────────
 
 export function killSession(_sock: string, identity: string, env: NodeJS.ProcessEnv = process.env): void {
-  // pty-only: SIGTERM the supervisor daemon — its shutdown SIGKILLs the child and removes the
+  // pty-only: SIGTERM the supervisor daemon — its shutdown kills the PTY-owned tree and removes the
   // sock/pid/serve-spec/markers. Idempotent if the session is already gone. (`_sock` retained for
   // call-site compatibility; no tmux sockets exist.) env sandboxes the run-dir — a test with an
   // injected root must NEVER SIGTERM a real fleet peer's supervisor.

package/src/runtime/deploy.ts

@@ -22,6 +22,7 @@ import { type Runtime } from '../core/constants.ts'
 import { IapError } from '../core/errors.ts'
 import { createPeer, type CreatePeerResult } from '../create/index.ts'
 import { readRuntimeManifest, writeRuntimeManifest, type RuntimeManifest, type RuntimePeerDecl } from './index.ts'
+import { verifyRuntimeSignatures, type RuntimeSignatureVerifier } from './signature.ts'
 
 // ─────────────────────────────────────────────────────────────────────────────
 // Built-in runtime → npm package registry (§6): onboard AUTO-resolves
@@ -52,6 +53,7 @@ export interface DeployRuntimeOptions {
   bootstrap?: boolean
   env?: NodeJS.ProcessEnv
   warn?: (message: string) => void
+  verifySignatures?: RuntimeSignatureVerifier
 }
 
 export interface DeployedPeer {
@@ -90,6 +92,8 @@ export async function deployRuntime(opts: DeployRuntimeOptions): Promise<DeployR
     )
   }
   const declared = opts.peers ?? manifest.peers ?? []
+  const verifySignatures = opts.verifySignatures ?? verifyRuntimeSignatures
+  verifySignatures(opts.runtime, env, { ...manifest, peers: declared })
   const peers: DeployedPeer[] = []
   for (const decl of declared) {
     const result = await createPeer({
@@ -164,6 +168,8 @@ export interface InstallRuntimePackageOptions {
   env?: NodeJS.ProcessEnv
   /** Injected npx runner (tests / sandbox proof). */
   runNpx?: NpxRunner
+  /** Verify-only activation gate; injected in hermetic orchestration tests. */
+  verifySignatures?: RuntimeSignatureVerifier
 }
 
 /**
@@ -183,6 +189,11 @@ export function installRuntimePackage(opts: InstallRuntimePackageOptions): Insta
   const existing = readRuntimeManifest(opts.runtime, { env })
   const pkg = resolveRuntimePackage(opts.runtime, opts.package ?? existing?.package)
   if (existing && !opts.force) {
+    try {
+      (opts.verifySignatures ?? verifyRuntimeSignatures)(opts.runtime, env)
+    } catch (e) {
+      return { runtime: opts.runtime, package: pkg, state: 'failed', detail: e instanceof Error ? e.message : String(e) }
+    }
     return { runtime: opts.runtime, package: pkg, state: 'skipped' }
   }
   if (!pkg) {
@@ -194,6 +205,13 @@ export function installRuntimePackage(opts: InstallRuntimePackageOptions): Insta
   if (!r.ok) {
     return { runtime: opts.runtime, package: pkg, state: 'failed', detail: r.detail }
   }
+  // Verification is not version-gated and precedes manifest stamping/provision.
+  // Never repair an installed launcher here: the package owns staged repair.
+  try {
+    (opts.verifySignatures ?? verifyRuntimeSignatures)(opts.runtime, env)
+  } catch (e) {
+    return { runtime: opts.runtime, package: pkg, state: 'failed', detail: e instanceof Error ? e.message : String(e) }
+  }
   // В52 — stamp the delivering package into the fresh manifest (best-effort: a
   // missing manifest is the package's own contract breach, surfaced elsewhere).
   try {
@@ -212,6 +230,7 @@ export interface OnboardRuntimeOptions extends DeployRuntimeOptions {
   npx?: boolean
   /** Injected npx runner (tests / sandbox proof). */
   runNpx?: NpxRunner
+  verifySignatures?: RuntimeSignatureVerifier
 }
 
 export interface OnboardRuntimeResult {
@@ -235,6 +254,7 @@ export async function onboardRuntime(opts: OnboardRuntimeOptions): Promise<Onboa
     force: opts.npx,
     env,
     runNpx: opts.runNpx,
+    verifySignatures: opts.verifySignatures,
   })
   if (install.state === 'failed') {
     throw new IapError(`npx install of runtime "${opts.runtime}" package ${install.package} failed: ${install.detail ?? ''}`)
@@ -250,6 +270,7 @@ export async function onboardRuntime(opts: OnboardRuntimeOptions): Promise<Onboa
     bootstrap: opts.bootstrap,
     env,
     warn: opts.warn,
+    verifySignatures: opts.verifySignatures,
   })
   return { install, deploy }
 }

package/src/runtime/signature.ts

@@ -0,0 +1,35 @@
+// Secondary, verify-only gate. The package must verify its staged inode BEFORE
+// publishing it; the foundation refuses provisioning/restart of invalid code.
+import { ensureExecutableSignature, type ExecutableSignatureOptions } from '../install/signature.ts'
+import { resolveExecutable } from '../launch/launchd.ts'
+import { type Runtime } from '../core/constants.ts'
+import { readRuntimeManifest, type RuntimeManifest } from './index.ts'
+
+export type RuntimeSignatureVerifier = (runtime: Runtime, env: NodeJS.ProcessEnv, manifest?: RuntimeManifest) => void
+
+export function verifyRuntimeSignatures(
+  runtime: Runtime,
+  env: NodeJS.ProcessEnv,
+  suppliedManifest?: RuntimeManifest,
+  opts: Pick<ExecutableSignatureOptions, 'run' | 'platform'> = {},
+): void {
+  if ((opts.platform ?? process.platform) !== 'darwin') return
+  if (!opts.run && (env.IAPEER_TEST_SANDBOX === '1' || process.env.IAPEER_TEST_SANDBOX === '1')) return
+  const manifest = suppliedManifest ?? readRuntimeManifest(runtime, { env })
+  const names = new Set<string>()
+  const declared = manifest?.peers ?? []
+  // The same default launcher the core's provisioning/launch scheme uses. A
+  // fully explicit declared-set needs only its explicitly declared launchers.
+  if (!declared.length || declared.some(p => !p.runtimeBin)) names.add(`${runtime}-runtime`)
+  for (const peer of declared) if (peer.runtimeBin) names.add(peer.runtimeBin)
+  const hook = manifest?.selfConfig
+  if (hook) names.add(typeof hook === 'string' ? hook : hook.command)
+  const checked = new Set<string>()
+  for (const name of names) {
+    const path = resolveExecutable(name, env)
+    if (!path) throw new Error(`runtime "${runtime}" launcher not executable or not found: ${name}`)
+    if (checked.has(path)) continue
+    checked.add(path)
+    ensureExecutableSignature(path, { ...opts, env, repair: false })
+  }
+}

package/src/runtime/update.ts

@@ -10,8 +10,8 @@
 //   version with a new blurb/self-doc leaves stale descriptions) → restart the
 //   runtime's infra peers via the REGULAR stop/start verbs.
 //
-// The core's own `iapeer update` deliberately does NOT touch runtimes (foundation-
-// only — the standing contract; the symmetry is conscious).
+// The CLI's bare `iapeer update` invokes this runtime updater in its cascade;
+// --foundation-only and a foundation version pin omit the runtime leg.
 //
 // Version-gate honesty: the installed version comes from the manifest's `version`
 // stamp (the owners' self-install obligation, telegram 10.06). A manifest WITHOUT
@@ -24,6 +24,7 @@ import { isRuntime, type Runtime } from '../core/constants.ts'
 import { readPeersIndex } from '../registry/index.ts'
 import { resolveGlobalRoot } from '../storage/index.ts'
 import { readRuntimeManifest } from './index.ts'
+import { verifyRuntimeSignatures, type RuntimeSignatureVerifier } from './signature.ts'
 import {
   deployRuntime,
   installRuntimePackage,
@@ -71,6 +72,7 @@ export interface UpdateRuntimeOptions {
   force?: boolean
   env?: NodeJS.ProcessEnv
   runNpx?: NpxRunner
+  verifySignatures?: RuntimeSignatureVerifier
   npmVersion?: NpmVersionFn
   /** Injectable restart (tests). Default: the regular stop→start verbs, strictly
    *  sequential per peer. */
@@ -124,12 +126,17 @@ export async function updateRuntime(opts: UpdateRuntimeOptions): Promise<UpdateR
   }
   const installed = manifest.version
   if (installed && installed === latest && !opts.force) {
+    try {
+      (opts.verifySignatures ?? verifyRuntimeSignatures)(runtime, env)
+    } catch (e) {
+      return { runtime, package: pkg, state: 'install-failed', from: installed, to: latest, peers: [], restarted: [], detail: e instanceof Error ? e.message : String(e) }
+    }
     return { runtime, package: pkg, state: 'already-latest', from: installed, to: latest, peers: [], restarted: [] }
   }
 
   // Re-install, PINNED to the version the gate resolved (В51 — an unpinned npx can
   // serve a stale cached/propagating build while we report "updated → latest").
-  const install = installRuntimePackage({ runtime, package: manifest.package, version: latest, force: true, env, runNpx: opts.runNpx })
+  const install = installRuntimePackage({ runtime, package: manifest.package, version: latest, force: true, env, runNpx: opts.runNpx, verifySignatures: opts.verifySignatures })
   if (install.state !== 'ran') {
     return { runtime, package: pkg, state: 'install-failed', from: installed, to: latest, peers: [], restarted: [], detail: install.detail ?? install.state }
   }
@@ -157,7 +164,7 @@ export async function updateRuntime(opts: UpdateRuntimeOptions): Promise<UpdateR
   // peers — the deploy is an empty pass, by design.
   let peers: DeployedPeer[]
   try {
-    const d = await deployRuntime({ runtime, env, warn: opts.warn })
+    const d = await deployRuntime({ runtime, env, warn: opts.warn, verifySignatures: opts.verifySignatures })
     peers = d.peers
   } catch (e) {
     return { runtime, package: pkg, state: 'deploy-failed', from: installed, to: latest, peers: [], restarted: [], detail: e instanceof Error ? e.message : String(e) }

package/src/supervisor/daemon.ts

@@ -26,13 +26,14 @@ import {
   stripQueries,
 } from './protocol.ts'
 import { formatEventLine } from '../storage/rotatelog.ts'
-import { attachedPath, geometryPath, pidPath, servePath, sockPath, writeGeometry, writePidFile } from './paths.ts'
+import { attachedPath, geometryPath, pidPath, pidStartToken, servePath, sockPath, writeGeometry, writePidFile } from './paths.ts'
 import { newStabilityGate, nagSignature, nextBootAction, nextNagAction, signatureStable, type BootPredicates, type NagPredicate } from './boot.ts'
 import { modelToPlainText } from './render.ts'
 import { codexAdapter } from '../launch/adapters/codex.ts'
 import { claudeAdapter } from '../launch/adapters/claude.ts'
 import { approvalModeOf, readPeerProfile, type ApprovalMode } from '../identity/index.ts'
 import { routeCircuitBreaker } from './approvalRoute.ts'
+import { killPtyDescendants } from './processTree.ts'
 
 /** Resolve a runtime launcher from the host AT CALL TIME — env override (IAPEER_<RT>_BIN, the same
  *  knob the rest of the foundation uses) → PATH lookup — never a baked machine-specific path. Returns
@@ -110,6 +111,7 @@ const SIGWINCH_REDRAW_WAIT_MS = 300
 
 // Bun-native PTY (Bun ≥1.3.5) is not yet in @types/bun — type the slice we use.
 interface PtyChild {
+  pid: number
   terminal: { write(d: Uint8Array | string): void; resize(cols: number, rows: number): void }
   kill(sig?: number | string): void
 }
@@ -385,6 +387,7 @@ export function runSupervisorDaemon(opts: SupervisorDaemonOptions): void {
       },
     },
   } as unknown as Parameters<typeof Bun.spawn>[1]) as unknown as PtyChild
+  const childToken = pidStartToken(child.pid)
   xterm.onData(resp => child.terminal.write(resp)) // @xterm auto-answers DA1/DSR → back to child
 
   /** Catch up a (re)attaching client to the current screen + history ONCE by sending a SNAPSHOT of the
@@ -602,6 +605,14 @@ export function runSupervisorDaemon(opts: SupervisorDaemonOptions): void {
       } catch {
         /* */
       }
+    try {
+      // self-fresh/stop/reap owns the PTY's descendants, not just its TUI root. Snapshot BEFORE
+      // killing the runtime; exclude detached/shared daemons even if they are descendants.
+      const cleaned = killPtyDescendants(child.pid, childToken)
+      if (cleaned.killed || cleaned.skipped) appendExitEvent({ ev: 'session-tree', identity: session, ...cleaned })
+    } catch (e) {
+      appendExitEvent({ ev: 'session-tree', identity: session, error: (e as Error).message })
+    }
     try {
       child.kill('SIGKILL')
     } catch {

package/src/supervisor/fixtures/owned-stdio.ts

@@ -0,0 +1,57 @@
+// Deterministic stdio process tree: peer -> launcher -> MCP server.
+// No accounts, external services, or installed runtime binaries are used.
+import { spawn } from 'node:child_process'
+import { appendFileSync, writeFileSync } from 'node:fs'
+import { createInterface } from 'node:readline'
+
+const [mode, dir, cli] = process.argv.slice(2)
+const self = import.meta.path
+const record = (event: string, extra = {}) => appendFileSync(`${dir}/events.jsonl`, JSON.stringify({ event, pid: process.pid, ppid: process.ppid, ...extra }) + '\n')
+record(mode)
+
+if (mode === 'server') {
+  // Keep-alive handles after EOF model a server that cannot shut down by EOF alone.
+  // The supervisor's hard session teardown must reclaim it, not rely on compliance.
+  setInterval(() => {}, 1000)
+  process.on('SIGHUP', () => record('server-hup-ignored'))
+  process.on('SIGTERM', () => record('server-term-ignored'))
+  const input = createInterface({ input: process.stdin })
+  input.on('close', () => record('server-eof'))
+  input.on('line', line => {
+    const req = JSON.parse(line)
+    record(req.method)
+    if (req.id === undefined) return
+    const result = req.method === 'initialize'
+      ? { protocolVersion: req.params.protocolVersion, capabilities: { tools: {} }, serverInfo: { name: 'owned-stdio', version: '1' } }
+      : req.method === 'tools/list'
+        ? { tools: [{ name: 'ping', description: 'Return the serving process ID', inputSchema: { type: 'object', properties: {} } }] }
+        : { content: [{ type: 'text', text: `pong:${process.pid}` }] }
+    process.stdout.write(JSON.stringify({ jsonrpc: '2.0', id: req.id, result }) + '\n')
+  })
+} else if (mode === 'wrapper') {
+  const server = spawn(process.execPath, [self, 'server', dir], { stdio: 'inherit' })
+  process.on('SIGTERM', () => record('wrapper-term-ignored'))
+  process.on('SIGHUP', () => record('wrapper-hup-ignored'))
+  server.on('exit', () => process.exit(0))
+} else if (mode === 'peer') {
+  const sentinel = spawn('sleep', ['60'], { detached: true, stdio: 'ignore' })
+  sentinel.unref()
+  record('detached-sentinel', { pid: sentinel.pid })
+  const wrapper = spawn(process.execPath, [self, 'wrapper', dir], { stdio: ['pipe', 'pipe', 'inherit'] })
+  const input = createInterface({ input: wrapper.stdout })
+  const send = (id: number, method: string, params: unknown = {}) => wrapper.stdin.write(JSON.stringify({ jsonrpc: '2.0', id, method, params }) + '\n')
+  input.on('line', line => {
+    const response = JSON.parse(line)
+    if (response.id === 1) send(2, 'tools/list')
+    if (response.id === 2) send(3, 'tools/call', { name: 'ping', arguments: {} })
+    if (response.id === 3) {
+      writeFileSync(`${dir}/ready.json`, JSON.stringify({ peer: process.pid, wrapper: wrapper.pid, result: response.result }))
+      console.log('› ready')
+    }
+  })
+  send(1, 'initialize', { protocolVersion: '2025-11-25', capabilities: {}, clientInfo: { name: 'test-peer', version: '1' } })
+  // This is an actual child self-call to the source CLI, not killSession in disguise.
+  createInterface({ input: process.stdin }).on('line', line => {
+    if (line.replace(/\x1b\[20[01]~/g, '').trim() === 'fresh') spawn(process.execPath, [cli, 'self-fresh'], { stdio: 'inherit', env: process.env })
+  })
+}

package/src/supervisor/processTree.ts

@@ -0,0 +1,71 @@
+import { spawnSync } from 'node:child_process'
+
+export interface ProcessRecord { pid: number; ppid: number; tty: string; token: string }
+
+/** No argv/env in this snapshot: ancestry + controlling PTY, not names or groups, own cleanup. */
+export function parseProcessTable(table: string): ProcessRecord[] {
+  return table.split('\n').flatMap(line => {
+    const m = /^\s*(\d+)\s+(\d+)\s+(\S+)\s+(.+?)\s*$/.exec(line)
+    if (!m || Number(m[1]) <= 0) return []
+    return [{ pid: Number(m[1]), ppid: Number(m[2]), tty: m[3], token: m[4] }]
+  })
+}
+
+function processTable(pid?: number): ProcessRecord[] {
+  const args = pid === undefined ? ['-axo', 'pid=,ppid=,tty=,lstart='] : ['-o', 'pid=,ppid=,tty=,lstart=', '-p', String(pid)]
+  const r = spawnSync('/bin/ps', args, { encoding: 'utf8', env: { ...process.env, LC_ALL: 'C' } })
+  if (r.error || r.status !== 0) throw new Error('could not read process ancestry for session teardown')
+  return parseProcessTable(r.stdout)
+}
+
+/** Capture BEFORE killing the runtime: afterwards stdio launchers may already have PPID 1.
+ * The controlling PTY is the ownership boundary: separate process groups (Codex stdio MCP) remain
+ * inside it, whereas setsid/detached services (possibly shared with other clients) leave it. Prune
+ * those entire branches. Never signal a whole group: only proven PTY descendants whose start token
+ * still matches are ours. This preserves the existing HARD session teardown semantics; it is not
+ * a replacement for an MCP client's graceful EOF protocol.
+ * Already-reparented children and children racing the snapshot are outside this ancestry snapshot. */
+export function killPtyDescendants(root: number, rootToken: string | null, deps: {
+  table?: () => ProcessRecord[]
+  identity?: (pid: number) => Pick<ProcessRecord, 'token' | 'tty'> | null
+  signal?: (pid: number) => void
+} = {}): { killed: number; skipped: number } {
+  if (!Number.isInteger(root) || root <= 1 || root === process.pid) throw new Error('invalid hosted runtime pid')
+  const rows = (deps.table ?? processTable)()
+  // The root may already have died (terminal.exit), even before this snapshot. Do not
+  // adopt an unrelated tree on PID reuse; a missing root needs no ancestry cleanup.
+  const currentRoot = rows.find(r => r.pid === root)
+  if (!currentRoot) return { killed: 0, skipped: 0 }
+  if (!rootToken || currentRoot.token !== rootToken) return { killed: 0, skipped: 1 }
+  if (['', '-', '??', '?'].includes(currentRoot.tty)) return { killed: 0, skipped: 1 }
+  const children = new Map<number, ProcessRecord[]>()
+  for (const row of rows) {
+    if (!children.has(row.ppid)) children.set(row.ppid, [])
+    children.get(row.ppid)!.push(row)
+  }
+  const seen = new Set([root, process.pid])
+  const owned: ProcessRecord[] = []
+  const visit = (parent: number) => {
+    for (const row of children.get(parent) ?? []) {
+      if (seen.has(row.pid)) continue
+      if (row.tty !== currentRoot.tty) continue // detached daemon and everything it owns are not this PTY's
+      seen.add(row.pid)
+      visit(row.pid)
+      owned.push(row) // leaves first, while ancestry is still available
+    }
+  }
+  visit(root)
+  let killed = 0, skipped = 0
+  for (const row of owned) {
+    // Unlike killing the root by its Bun subprocess handle, a descendant is a ps-derived PID.
+    // An unreadable token is NOT permission to signal it; fail closed on reuse / uncertainty.
+    let current: Pick<ProcessRecord, 'token' | 'tty'> | null
+    try { current = (deps.identity ?? (pid => processTable(pid)[0] ?? null))(row.pid) } catch { current = null }
+    if (current?.token !== row.token || current.tty !== row.tty) { skipped++; continue }
+    try {
+      (deps.signal ?? (pid => process.kill(pid, 'SIGKILL')))(row.pid)
+      killed++
+    } catch { /* exited between verification and signal */ }
+  }
+  return { killed, skipped }
+}

package/src/update/index.ts

@@ -36,7 +36,8 @@ import { join } from 'path'
 import { isInfraRuntime } from '../core/constants.ts'
 import { IapError } from '../core/errors.ts'
 import { IAPEER_VERSION } from '../core/version.ts'
-import { stampBinaryHealthy } from '../install/index.ts'
+import { iapeerBinPath, stampBinaryHealthy } from '../install/index.ts'
+import { ensureExecutableSignature } from '../install/signature.ts'
 import { readPeersIndex } from '../registry/index.ts'
 import {
   cycleDaemon,
@@ -71,6 +72,9 @@ export interface UpdateDeps {
   /** Pull + rebuild the binary for `version` (default: npm pack → extract → source install).
    *  Returns true on success. */
   runInstall?: (version: string, env: NodeJS.ProcessEnv) => boolean
+  /** Verify-only installed-binary gate, including same-version stale-daemon heal.
+   *  Never repair a live binary. The package installer owns staged repair. */
+  verifyInstalledSignature?: (env: NodeJS.ProcessEnv) => void
   /** Restart the daemon onto the new binary (default: cycleDaemon — bootout+bootstrap, the LWCR-safe cycle). */
   restartDaemon?: (env: NodeJS.ProcessEnv) => DaemonRestartResult
   /** Re-register loaded foundation-owned infra launchd jobs whose plists run the
@@ -345,7 +349,20 @@ export async function updateIapeer(deps: UpdateDeps = {}): Promise<UpdateResult>
         : `could not resolve the latest ${IAPEER_PACKAGE} version from npm (offline / registry error)`,
     }
   }
+  const verifyInstalled = (): string | undefined => {
+    try {
+      if (deps.verifyInstalledSignature) deps.verifyInstalledSignature(env)
+      else ensureExecutableSignature(iapeerBinPath(env), { env, repair: false })
+      return undefined
+    } catch (e) {
+      return `installed foundation signature is invalid; no restart attempted: ${e instanceof Error ? e.message : String(e)}`
+    }
+  }
   if (desired === from && !deps.force) {
+    // Same-version heal is an activation path too: a valid running inode/version
+    // does not prove the current on-disk binary is safe to restart.
+    const signatureFailure = verifyInstalled()
+    if (signatureFailure) return { status: 'failed', from, latest: desired, reason: signatureFailure }
     // В53 — the binary is at the target, but is the LIVE daemon running it? A prior
     // update that swapped the binary and then died before/inside cycleDaemon leaves
     // the fleet on the old core FOREVER while every retry says "already-latest".
@@ -384,6 +401,9 @@ export async function updateIapeer(deps: UpdateDeps = {}): Promise<UpdateResult>
     }
   }
 
+  const signatureFailure = verifyInstalled()
+  if (signatureFailure) return { status: 'failed', from, latest: desired, reason: signatureFailure }
+
   const d = (deps.restartDaemon ?? cycleDaemon)(env)
   const settled = await settleDaemon(d, env, deps)
   return {