@amaster.ai/employee-runtime-connector 0.1.0-beta.31 → 0.1.0-beta.33

package/dist/amaster-runtime-daemon.mjs

@@ -2,10 +2,10 @@
 // MirrorX runtime connector daemon bundle.
 
 // src/amaster-runtime-daemon.mjs
-import { createHash as createHash6 } from "node:crypto";
-import { chmodSync as chmodSync3, copyFileSync as copyFileSync2, existsSync as existsSync9, lstatSync as lstatSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync7, readdirSync as readdirSync6, realpathSync as realpathSync3, renameSync as renameSync3, rmSync as rmSync5, statSync as statSync7, symlinkSync as symlinkSync2, unlinkSync, writeFileSync as writeFileSync5 } from "node:fs";
+import { createHash as createHash8 } from "node:crypto";
+import { chmodSync as chmodSync5, copyFileSync as copyFileSync3, existsSync as existsSync10, lstatSync as lstatSync6, mkdirSync as mkdirSync6, readFileSync as readFileSync8, readdirSync as readdirSync8, realpathSync as realpathSync3, renameSync as renameSync3, rmSync as rmSync6, statSync as statSync7, symlinkSync as symlinkSync3, unlinkSync, writeFileSync as writeFileSync6 } from "node:fs";
 import { arch as arch3, homedir as homedir3, hostname as hostname2, platform as platform3 } from "node:os";
-import { basename as basename6, delimiter as delimiter2, dirname as dirname6, extname as extname2, isAbsolute as isAbsolute6, join as join10, relative as relative6, resolve as resolve8 } from "node:path";
+import { basename as basename6, delimiter as delimiter2, dirname as dirname7, extname as extname2, isAbsolute as isAbsolute7, join as join11, relative as relative7, resolve as resolve10 } from "node:path";
 import { spawn, spawnSync as spawnSync5 } from "node:child_process";
 
 // src/amaster-runtime-daemon/common.mjs
@@ -388,7 +388,7 @@ function skipVoid(str, ptr, banNewLines, banComments) {
   }
   return ptr;
 }
-function skipUntil(str, ptr, sep, end, banNewLines = false) {
+function skipUntil(str, ptr, sep2, end, banNewLines = false) {
   if (!end) {
     ptr = indexOfNewline(str, ptr);
     return ptr < 0 ? str.length : ptr;
@@ -397,7 +397,7 @@ function skipUntil(str, ptr, sep, end, banNewLines = false) {
     let c = str[i];
     if (c === "#") {
       i = indexOfNewline(str, i);
-    } else if (c === sep) {
+    } else if (c === sep2) {
       return i + 1;
     } else if (c === end || banNewLines && (c === "\n" || c === "\r" && str[i + 1] === "\n")) {
       return i;
@@ -1572,6 +1572,17 @@ var piManagedMcpProfileApi = (() => {
   const SUPPORTED_SERVER_NAME2 = "amaster";
   const MINIMUM_PI_VERSION = [0, 73, 1];
   const MINIMUM_MCP_ADAPTER_VERSION = [2, 6, 1];
+  const MANAGED_BROWSER_USE_PACKAGE = "@amaster.ai/pi-browser-use";
+  const MANAGED_BROWSER_USE_PLUGIN = "browser-use";
+  const MANAGED_BROWSER_USE_BOOLEAN_SETTINGS = [
+    "headless",
+    "categoryNetwork",
+    "categoryEmulation",
+    "categoryPerformance",
+    "experimentalVision",
+    "experimentalScreencast",
+    "experimentalMemory"
+  ];
   const REQUIRED_AUTHORITY_HEADERS2 = [
     "x-amaster-company-id",
     "x-amaster-agent-id",
@@ -1637,14 +1648,20 @@ var piManagedMcpProfileApi = (() => {
   const PROFILE_MARKER2 = ".amaster-managed-pi-profile.json";
   const SESSION_ROLLOUT_MARKER2 = ".amaster-pi-session-rollout.json";
   const DEFAULT_SESSION_ROLLOUT_TTL_MS2 = 24 * 60 * 60 * 1e3;
-  function record2(value) {
+  function record3(value) {
     return value && typeof value === "object" && !Array.isArray(value) ? value : {};
   }
+  function npmPackageName(source) {
+    if (typeof source !== "string" || !source.startsWith("npm:")) return null;
+    const spec = source.slice("npm:".length);
+    const versionSeparator = spec.startsWith("@") ? spec.indexOf("@", 1) : spec.indexOf("@");
+    return (versionSeparator === -1 ? spec : spec.slice(0, versionSeparator)) || null;
+  }
   function nonEmpty2(value, label) {
     if (typeof value !== "string" || value.trim() === "") throw new Error(`pi_managed_mcp_invalid: ${label} is required`);
     return value.trim();
   }
-  function within2(candidate, root) {
+  function within3(candidate, root) {
     const rel = relative2(root, candidate);
     return rel === "" || !rel.startsWith("..") && !isAbsolute2(rel);
   }
@@ -1687,7 +1704,7 @@ var piManagedMcpProfileApi = (() => {
     return matches[0];
   }
   function restoreManagedPiSessionRollout(input, sessionsRoot, runDir, executorHome, authority) {
-    const session = record2(input.nativeSession);
+    const session = record3(input.nativeSession);
     if (session.mode !== "governed_action_approval" || session.required !== true) return null;
     const sessionId = nonEmpty2(session.sessionId, "nativeSession.sessionId");
     const sourceRunId = nonEmpty2(session.sourceRunId, "nativeSession.sourceRunId");
@@ -1711,11 +1728,11 @@ var piManagedMcpProfileApi = (() => {
       throw new Error("pi_managed_mcp_session_rollout_authority_mismatch: source rollout does not match the approved continuation");
     }
     const sourceRollout = resolve2(cacheRoot, nonEmpty2(marker.rolloutRelativePath, "rolloutRelativePath"));
-    if (!within2(sourceRollout, cacheRoot) || lstatSync2(sourceRollout).isSymbolicLink() || !lstatSync2(sourceRollout).isFile()) {
+    if (!within3(sourceRollout, cacheRoot) || lstatSync2(sourceRollout).isSymbolicLink() || !lstatSync2(sourceRollout).isFile()) {
       throw new Error("pi_managed_mcp_session_rollout_unsafe: source rollout path is invalid");
     }
     const targetRollout = resolve2(sessionsRoot, marker.rolloutRelativePath);
-    if (!within2(targetRollout, sessionsRoot)) {
+    if (!within3(targetRollout, sessionsRoot)) {
       throw new Error("pi_managed_mcp_session_rollout_unsafe: target rollout path is invalid");
     }
     mkdirSync2(dirname2(targetRollout), { recursive: true, mode: 448 });
@@ -1737,8 +1754,8 @@ var piManagedMcpProfileApi = (() => {
     return tuple.join(".");
   }
   function validateAuthority2(input) {
-    const runtimeAuth = record2(input.runtimeAuth);
-    const gateway = record2(runtimeAuth.governedMcp);
+    const runtimeAuth = record3(input.runtimeAuth);
+    const gateway = record3(runtimeAuth.governedMcp);
     const runId = nonEmpty2(input.runId, "runId");
     if (runtimeAuth.runId !== runId) throw new Error("pi_managed_mcp_owner_mismatch: command runId does not match runtime authority");
     if (gateway.schemaVersion !== SUPPORTED_SCHEMA_VERSION2) throw new Error("pi_managed_mcp_invalid: unsupported schema version");
@@ -1754,7 +1771,7 @@ var piManagedMcpProfileApi = (() => {
     if (!Number.isFinite(expiresAt) || expiresAt <= Date.now() + 3e4) {
       throw new Error("pi_managed_mcp_session_expired: Gateway session must remain valid through spawn preflight");
     }
-    const headers = record2(gateway.headers);
+    const headers = record3(gateway.headers);
     for (const name of REQUIRED_AUTHORITY_HEADERS2) nonEmpty2(headers[name], `headers.${name}`);
     const allowedHeaderNames = /* @__PURE__ */ new Set([...REQUIRED_AUTHORITY_HEADERS2, ...runtimeAuth.issueId ? ["x-amaster-issue-id"] : []]);
     if (Object.keys(headers).some((name) => !allowedHeaderNames.has(name)) || Object.keys(headers).length !== allowedHeaderNames.size) {
@@ -1783,7 +1800,7 @@ var piManagedMcpProfileApi = (() => {
     return output;
   }
   function assertInvocationIsolation2(input) {
-    for (const name of Object.keys(record2(input.commandEnv))) {
+    for (const name of Object.keys(record3(input.commandEnv))) {
       if (FORBIDDEN_COMMAND_ENV2.has(name)) throw new Error(`pi_managed_mcp_env_override_blocked: ${name}`);
       if (!ALLOWED_COMMAND_ENV2.has(name)) throw new Error(`pi_managed_mcp_env_injection_blocked: ${name}`);
     }
@@ -1815,7 +1832,7 @@ var piManagedMcpProfileApi = (() => {
       const value = safeProxyValue2(baseEnv?.[name], name);
       if (value) env[name] = value;
     }
-    return { ...env, ...record2(commandEnv) };
+    return { ...env, ...record3(commandEnv) };
   }
   function projectMcpConfigHasContent(filePath) {
     if (!existsSync2(filePath)) return false;
@@ -1825,14 +1842,14 @@ var piManagedMcpProfileApi = (() => {
     } catch {
       return true;
     }
-    const config = record2(parsed);
-    return Object.keys(record2(config.mcpServers)).length > 0 || Object.keys(record2(config.servers)).length > 0 || Array.isArray(config.imports) && config.imports.length > 0;
+    const config = record3(parsed);
+    return Object.keys(record3(config.mcpServers)).length > 0 || Object.keys(record3(config.servers)).length > 0 || Array.isArray(config.imports) && config.imports.length > 0;
   }
   function assertNoProjectMcpOverride(cwd, runDir) {
     let cursor = resolve2(cwd);
     const boundary = resolve2(runDir);
-    if (!within2(cursor, boundary)) throw new Error("pi_managed_mcp_owner_mismatch: cwd is outside the managed run");
-    while (within2(cursor, boundary)) {
+    if (!within3(cursor, boundary)) throw new Error("pi_managed_mcp_owner_mismatch: cwd is outside the managed run");
+    while (within3(cursor, boundary)) {
       for (const relativePath of [".mcp.json", join3(".pi", "mcp.json")]) {
         const configPath = join3(cursor, relativePath);
         if (projectMcpConfigHasContent(configPath)) throw new Error(`pi_managed_mcp_project_override_blocked: ${configPath}`);
@@ -1841,6 +1858,50 @@ var piManagedMcpProfileApi = (() => {
       cursor = dirname2(cursor);
     }
   }
+  function selectManagedBrowserUse(sourceSettings, npmSource) {
+    const plugin = record3(record3(sourceSettings.plugins)[MANAGED_BROWSER_USE_PLUGIN]);
+    if (plugin.enabled !== true || plugin.package !== MANAGED_BROWSER_USE_PACKAGE) return null;
+    const packageSpec = Array.isArray(sourceSettings.packages) ? sourceSettings.packages.find((entry) => npmPackageName(entry) === MANAGED_BROWSER_USE_PACKAGE) : null;
+    if (typeof packageSpec !== "string") return null;
+    const packagePath = join3(npmSource, "node_modules", ...MANAGED_BROWSER_USE_PACKAGE.split("/"), "package.json");
+    if (!existsSync2(packagePath) || lstatSync2(packagePath).isSymbolicLink() || !lstatSync2(packagePath).isFile()) {
+      throw new Error(`pi_managed_mcp_attestation_failed: enabled ${MANAGED_BROWSER_USE_PACKAGE} package is unavailable`);
+    }
+    let packageMetadata;
+    try {
+      packageMetadata = JSON.parse(readFileSync2(packagePath, "utf8"));
+    } catch {
+      throw new Error(`pi_managed_mcp_attestation_failed: enabled ${MANAGED_BROWSER_USE_PACKAGE} package metadata is invalid`);
+    }
+    if (packageMetadata.name !== MANAGED_BROWSER_USE_PACKAGE) {
+      throw new Error(`pi_managed_mcp_attestation_failed: enabled ${MANAGED_BROWSER_USE_PACKAGE} package identity mismatch`);
+    }
+    const sourceConfig = record3(sourceSettings["pi-browser-use"]);
+    const config = {};
+    for (const key of MANAGED_BROWSER_USE_BOOLEAN_SETTINGS) {
+      if (typeof sourceConfig[key] === "boolean") config[key] = sourceConfig[key];
+    }
+    if (typeof sourceConfig.viewport === "string" && /^\d{2,5}x\d{2,5}$/.test(sourceConfig.viewport)) {
+      config.viewport = sourceConfig.viewport;
+    }
+    if (typeof sourceConfig.channel === "string" && ["stable", "beta", "dev", "canary"].includes(sourceConfig.channel)) {
+      config.channel = sourceConfig.channel;
+    }
+    return {
+      packageSpec,
+      plugin: {
+        enabled: true,
+        package: MANAGED_BROWSER_USE_PACKAGE
+      },
+      config: {
+        ...config,
+        categoryExtensions: false,
+        usageStatistics: false,
+        performanceCrux: false,
+        redactNetworkHeaders: true
+      }
+    };
+  }
   function seedPiRuntime(sourceHome, agentDir) {
     const source = resolve2(nonEmpty2(sourceHome, "sourcePiHome"));
     const npmSource = join3(source, "npm");
@@ -1859,15 +1920,22 @@ var piManagedMcpProfileApi = (() => {
     let sourceSettings = {};
     if (existsSync2(settingsSource)) {
       try {
-        sourceSettings = record2(JSON.parse(readFileSync2(settingsSource, "utf8")));
+        sourceSettings = record3(JSON.parse(readFileSync2(settingsSource, "utf8")));
       } catch {
         throw new Error("pi_managed_mcp_attestation_failed: source Pi settings are invalid");
       }
     }
+    const browserUse = selectManagedBrowserUse(sourceSettings, npmSource);
     const settings = {
       ...typeof sourceSettings.defaultProvider === "string" ? { defaultProvider: sourceSettings.defaultProvider } : {},
       ...typeof sourceSettings.defaultModel === "string" ? { defaultModel: sourceSettings.defaultModel } : {},
-      packages: ["npm:pi-mcp-adapter"]
+      packages: ["npm:pi-mcp-adapter", ...browserUse ? [browserUse.packageSpec] : []],
+      ...browserUse ? {
+        plugins: {
+          [MANAGED_BROWSER_USE_PLUGIN]: browserUse.plugin
+        },
+        "pi-browser-use": browserUse.config
+      } : {}
     };
     writePrivateFile2(join3(agentDir, "settings.json"), `${JSON.stringify(settings, null, 2)}
 `);
@@ -1915,7 +1983,7 @@ ${result2.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
     const { gateway, gatewayUrl, sessionToken, headers, runId } = validateAuthority2(input);
     const runDir = resolve2(nonEmpty2(input.runDir, "runDir"));
     const executorHome = resolve2(nonEmpty2(input.executorHome, "executorHome"));
-    if (!within2(executorHome, join3(runDir, "executors"))) throw new Error("pi_managed_mcp_owner_mismatch: executorHome is outside the managed run");
+    if (!within3(executorHome, join3(runDir, "executors"))) throw new Error("pi_managed_mcp_owner_mismatch: executorHome is outside the managed run");
     assertNoProjectMcpOverride(nonEmpty2(input.cwd, "cwd"), runDir);
     const profileRoot = join3(executorHome, "managed-mcp");
     if (existsSync2(profileRoot)) throw new Error(`pi_managed_mcp_profile_exists: ${profileRoot}`);
@@ -1930,7 +1998,7 @@ ${result2.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
       const owner = Object.freeze({ commandId: input.commandId, runId });
       writePrivateFile2(markerPath, `${JSON.stringify({ version: 1, ...owner, profileRoot })}
 `);
-      const runtimeAuth = record2(input.runtimeAuth);
+      const runtimeAuth = record3(input.runtimeAuth);
       const authority = Object.freeze({
         companyId: nonEmpty2(runtimeAuth.companyId, "runtimeAuth.companyId"),
         agentId: nonEmpty2(runtimeAuth.agentId, "runtimeAuth.agentId"),
@@ -2084,7 +2152,7 @@ ${result2.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
       const profileRoot = dirname2(markerPath);
       try {
         const marker = JSON.parse(readFileSync2(markerPath, "utf8"));
-        if (!within2(profileRoot, root) || marker?.profileRoot !== profileRoot) throw new Error("ownership marker root mismatch");
+        if (!within3(profileRoot, root) || marker?.profileRoot !== profileRoot) throw new Error("ownership marker root mismatch");
         cleanupManagedPiMcpProfile2({ profileRoot }, { commandId: marker.commandId, runId: marker.runId });
         removedProfiles += 1;
       } catch (error) {
@@ -2099,7 +2167,7 @@ ${result2.stderr ?? ""}`, "Pi", MINIMUM_PI_VERSION);
         const markerStat = lstatSync2(markerPath);
         const cacheStat = lstatSync2(cacheRoot);
         const marker = JSON.parse(readFileSync2(markerPath, "utf8"));
-        if (!within2(cacheRoot, root) || basename2(cacheRoot) !== "session-rollout" || markerStat.isSymbolicLink() || !markerStat.isFile() || cacheStat.isSymbolicLink() || !cacheStat.isDirectory() || marker?.version !== 1 || typeof marker?.companyId !== "string" || typeof marker?.agentId !== "string" || typeof marker?.sourceRunId !== "string" || typeof marker?.sourceCommandId !== "string" || typeof marker?.sessionId !== "string" || marker?.cacheRoot !== cacheRoot) throw new Error("session rollout ownership marker mismatch");
+        if (!within3(cacheRoot, root) || basename2(cacheRoot) !== "session-rollout" || markerStat.isSymbolicLink() || !markerStat.isFile() || cacheStat.isSymbolicLink() || !cacheStat.isDirectory() || marker?.version !== 1 || typeof marker?.companyId !== "string" || typeof marker?.agentId !== "string" || typeof marker?.sourceRunId !== "string" || typeof marker?.sourceCommandId !== "string" || typeof marker?.sessionId !== "string" || marker?.cacheRoot !== cacheRoot) throw new Error("session rollout ownership marker mismatch");
         const preservedAtMs = typeof marker.preservedAt === "string" ? Date.parse(marker.preservedAt) : Number.NaN;
         const markerAgeMs = nowMs - (Number.isFinite(preservedAtMs) ? preservedAtMs : markerStat.mtimeMs);
         if (markerAgeMs < rolloutTtlMs) continue;
@@ -2193,8 +2261,8 @@ function resultOutboxFileName(commandId, now = Date.now()) {
   return `${now}-${safeCommandId}.json`;
 }
 function isValidResultOutboxEntry(entry) {
-  const record2 = asRecord(entry);
-  return record2.version === 1 && Boolean(readString(record2.path)) && Object.keys(asRecord(record2.payload)).length > 0;
+  const record3 = asRecord(entry);
+  return record3.version === 1 && Boolean(readString(record3.path)) && Object.keys(asRecord(record3.payload)).length > 0;
 }
 function resultOutboxEntryAgeMs(entry, nowMs) {
   const createdAt = Date.parse(readString(entry.createdAt) ?? "");
@@ -2272,8 +2340,8 @@ function governedReadSection(context) {
   const reads = Array.isArray(context.governedReadResults) ? context.governedReadResults : [];
   if (reads.length === 0) return { content: "", provenance: [] };
   const normalized = reads.map((entry, index) => {
-    const record2 = asRecord(entry);
-    const receipt = asRecord(record2.receipt);
+    const record3 = asRecord(entry);
+    const receipt = asRecord(record3.receipt);
     const provider = readString(receipt.provider) ?? readString(receipt.transport);
     const operation = readString(receipt.operation);
     const observedAt = readString(receipt.retrievedAt) ?? readString(receipt.observedAt);
@@ -2283,7 +2351,7 @@ function governedReadSection(context) {
       throw new Error(`governed_read_context_provenance_invalid: entry ${index} requires provider, operation, observedAt, and source`);
     }
     return {
-      content: record2.content,
+      content: record3.content,
       receipt: {
         provider,
         operation,
@@ -2311,6 +2379,7 @@ function fixedRules(input, includeIssueLine) {
     "## AMaster Runtime Connector Task",
     "You are executing a task dispatched by MirrorX from the central control plane.",
     "Work only inside the declared workspace. Make concrete progress and finish with a concise result summary.",
+    "Before changing the task status to done, audit every explicit requirement in the task against the final evidence. A successful tool or document write proves delivery, not acceptance: inspect the delivered content for required sections, diagrams, tables, and factual constraints. Do not leave stale in-progress wording such as \u201Ccurrent run\u201D in a terminal deliverable; rewrite it to the final observed state. Do not list finalization itself as remaining or next work in a terminal deliverable. If any requirement is missing or cannot be verified, do not mark done. To request review, use create_interaction with kind request_confirmation and payload.resolutionMode review; never call update_parent with status in_review. Otherwise keep the issue todo or blocked with the exact gap and next owner.",
     "Do not install operating-system or user-global packages, and do not use host package managers such as brew, apt, yum, or global pip/npm installs. Use tools already available or workspace-local dependencies or virtual environments. If a required renderer or evaluator is unavailable, keep the source artifact, record the exact verification gap, and do not mutate the host.",
     `- command id: ${input.commandId}`,
     `- run id: ${input.runId ?? "unknown"}`,
@@ -2731,6 +2800,23 @@ function buildConfig(env = process.env, flags = {}) {
       flags.executorMaxRssMb ?? env.AMASTER_EXECUTOR_MAX_RSS_MB,
       0
     ),
+    piChildUidBase: parseNonNegativeInteger(
+      flags.piChildUidBase ?? env.AMASTER_PI_CHILD_UID_BASE,
+      0
+    ),
+    piChildUidSpan: parsePositiveInteger(
+      flags.piChildUidSpan ?? env.AMASTER_PI_CHILD_UID_SPAN,
+      3e4
+    ),
+    piRuntimeSeedRoot: String(
+      flags.piRuntimeSeedRoot ?? env.PI_RUNTIME_SEED_DIR ?? ""
+    ).trim(),
+    piRuntimeOverlayRoot: String(
+      flags.piRuntimeOverlayRoot ?? env.AMASTER_PI_RUNTIME_OVERLAY_DIR ?? ""
+    ).trim(),
+    piRuntimeEffectivePolicyFile: String(
+      flags.piRuntimeEffectivePolicyFile ?? env.AMASTER_PI_RUNTIME_EFFECTIVE_POLICY_FILE ?? ""
+    ).trim(),
     artifactVerifierCommands: splitList(
       flags.artifactVerifierCommands ?? env.AMASTER_ARTIFACT_VERIFIER_COMMANDS ?? ""
     ),
@@ -2805,10 +2891,10 @@ function compactExecutorJsonlForTranscript(event) {
     const text = JSON.stringify(compactExecutorJsonValue(event, stringMaxChars));
     if (text.length <= 15e3) return text;
   }
-  const record2 = tcAsRecord(event);
-  const item = tcAsRecord(record2.item);
+  const record3 = tcAsRecord(event);
+  const item = tcAsRecord(record3.item);
   return JSON.stringify({
-    type: tcReadString(record2.type) ?? "executor.event",
+    type: tcReadString(record3.type) ?? "executor.event",
     item: item.type ? {
       id: tcReadString(item.id),
       type: tcReadString(item.type),
@@ -2821,10 +2907,10 @@ function compactExecutorJsonlForTranscript(event) {
   });
 }
 function summarizeTokenUsage(usage) {
-  const record2 = tcAsRecord(usage);
-  const inputTokens = tcReadNumber(record2.input_tokens ?? record2.inputTokens, 0);
-  const cachedInputTokens = tcReadNumber(record2.cached_input_tokens ?? record2.cachedInputTokens, 0);
-  const outputTokens = tcReadNumber(record2.output_tokens ?? record2.outputTokens, 0);
+  const record3 = tcAsRecord(usage);
+  const inputTokens = tcReadNumber(record3.input_tokens ?? record3.inputTokens, 0);
+  const cachedInputTokens = tcReadNumber(record3.cached_input_tokens ?? record3.cachedInputTokens, 0);
+  const outputTokens = tcReadNumber(record3.output_tokens ?? record3.outputTokens, 0);
   const parts = [];
   if (inputTokens > 0) parts.push(`\u8F93\u5165 ${inputTokens}`);
   if (cachedInputTokens > 0) parts.push(`\u7F13\u5B58 ${cachedInputTokens}`);
@@ -3079,8 +3165,8 @@ function summarizeClaudeEvent(event) {
   return null;
 }
 function tcPiMessageText(message) {
-  const record2 = tcAsRecord(message);
-  const content = record2.content;
+  const record3 = tcAsRecord(message);
+  const content = record3.content;
   if (typeof content === "string" && content.trim().length > 0) return content.trim();
   if (!Array.isArray(content)) return "";
   return content.map((entry) => {
@@ -3094,14 +3180,14 @@ function tcPiAssistantMessageEventText(assistantMessageEvent) {
   return tcReadString(event.content) ?? "";
 }
 function tcPiMessageStopReason(message) {
-  const record2 = tcAsRecord(message);
-  return tcReadString(record2.stopReason ?? record2.stop_reason);
+  const record3 = tcAsRecord(message);
+  return tcReadString(record3.stopReason ?? record3.stop_reason);
 }
 function tcPiMessageErrorText(message) {
-  const record2 = tcAsRecord(message);
-  const explicitError = tcReadString(record2.errorMessage ?? record2.error_message)?.trim();
+  const record3 = tcAsRecord(message);
+  const explicitError = tcReadString(record3.errorMessage ?? record3.error_message)?.trim();
   if (explicitError) return explicitError;
-  const stopReason = tcPiMessageStopReason(record2);
+  const stopReason = tcPiMessageStopReason(record3);
   if (stopReason === "error" || stopReason === "failed" || stopReason === "exception") {
     return `Pi Agent message ended with stopReason=${stopReason}`;
   }
@@ -3521,13 +3607,13 @@ function parseClaudeStreamJson(stdout) {
 }
 function openCodeErrorText(value) {
   if (typeof value === "string") return value;
-  const record2 = asRecord(value);
-  const message = readString(record2.message);
+  const record3 = asRecord(value);
+  const message = readString(record3.message);
   if (message) return message;
-  const data = asRecord(record2.data);
+  const data = asRecord(record3.data);
   const nestedMessage = readString(data.message);
   if (nestedMessage) return nestedMessage;
-  return readString(record2.name) ?? readString(record2.code) ?? "";
+  return readString(record3.name) ?? readString(record3.code) ?? "";
 }
 function parseOpenCodeJsonl(stdout) {
   let sessionId = null;
@@ -3565,8 +3651,8 @@ function parseOpenCodeJsonl(stdout) {
   return { sessionId, summary, usage, errorMessage };
 }
 function piMessageText(message) {
-  const record2 = asRecord(message);
-  const content = record2.content;
+  const record3 = asRecord(message);
+  const content = record3.content;
   if (typeof content === "string") return content.trim();
   if (!Array.isArray(content)) return "";
   return content.map((entry) => {
@@ -3591,10 +3677,10 @@ function piTextValue(value) {
   return typeof value === "string" && value.length > 0 ? value : "";
 }
 function piAssistantEventText(assistantEvent) {
-  const record2 = asRecord(assistantEvent);
-  const type = readString(record2.type);
-  if (type === "text_delta") return piTextValue(record2.delta);
-  if (type === "text_end") return piTextValue(record2.content);
+  const record3 = asRecord(assistantEvent);
+  const type = readString(record3.type);
+  if (type === "text_delta") return piTextValue(record3.delta);
+  if (type === "text_end") return piTextValue(record3.content);
   return "";
 }
 function piMessageUsage(message) {
@@ -3615,14 +3701,14 @@ function assignPiUsage(target, source) {
   if (source.costUsd > 0) target.costUsd = source.costUsd;
 }
 function piMessageStopReason(message) {
-  const record2 = asRecord(message);
-  return readString(record2.stopReason ?? record2.stop_reason);
+  const record3 = asRecord(message);
+  return readString(record3.stopReason ?? record3.stop_reason);
 }
 function piMessageErrorText(message) {
-  const record2 = asRecord(message);
-  const explicitError = readString(record2.errorMessage ?? record2.error_message)?.trim();
+  const record3 = asRecord(message);
+  const explicitError = readString(record3.errorMessage ?? record3.error_message)?.trim();
   if (explicitError) return explicitError;
-  const stopReason = piMessageStopReason(record2);
+  const stopReason = piMessageStopReason(record3);
   if (stopReason === "error" || stopReason === "failed" || stopReason === "exception") {
     return `Pi Agent message ended with stopReason=${stopReason}`;
   }
@@ -3889,7 +3975,7 @@ async function postRuntimeConnectorJsonWithRetry(config, path, payload, options
     } catch (error) {
       lastError = error;
       if (attempt >= maxAttempts || !retryableRuntimeConnectorPost(error)) throw error;
-      if (delayMs > 0) await new Promise((resolve9) => setTimeout(resolve9, delayMs));
+      if (delayMs > 0) await new Promise((resolve11) => setTimeout(resolve11, delayMs));
     }
   }
   throw lastError;
@@ -4475,11 +4561,574 @@ function summarizeAmasterRuntimeVersionDrift(input = {}) {
   };
 }
 
+// src/amaster-runtime-daemon/pi-child-isolation.mjs
+import { createHash as createHash5 } from "node:crypto";
+import {
+  chmodSync as chmodSync3,
+  chownSync,
+  lchownSync,
+  lstatSync as lstatSync4,
+  readdirSync as readdirSync5
+} from "node:fs";
+import { resolve as resolve7, sep } from "node:path";
+function defaultHashRunId(runId) {
+  return Number.parseInt(createHash5("sha256").update(runId).digest("hex").slice(0, 8), 16);
+}
+function positiveInteger(value, label) {
+  if (!Number.isSafeInteger(value) || value <= 0) {
+    throw new Error(`pi_child_isolation_invalid_${label}`);
+  }
+  return value;
+}
+function isWithin(path, root) {
+  const normalizedPath = resolve7(path);
+  const normalizedRoot = resolve7(root);
+  return normalizedPath === normalizedRoot || normalizedPath.startsWith(`${normalizedRoot}${sep}`);
+}
+function isolatePiChildPath(path, uid, gid) {
+  const resolvedPath = resolve7(path);
+  const visit = (entryPath) => {
+    const stat = lstatSync4(entryPath);
+    if (stat.isSymbolicLink()) {
+      lchownSync(entryPath, uid, gid);
+      return;
+    }
+    chownSync(entryPath, uid, gid);
+    if (stat.isDirectory()) {
+      chmodSync3(entryPath, 448);
+      for (const entry of readdirSync5(entryPath)) {
+        visit(resolve7(entryPath, entry));
+      }
+      return;
+    }
+    chmodSync3(entryPath, 384 | stat.mode & 73);
+  };
+  visit(resolvedPath);
+}
+function createPiChildIdentityAllocator(input = {}) {
+  const uidBase = positiveInteger(input.uidBase ?? 2e4, "uid_base");
+  const uidSpan = positiveInteger(input.uidSpan ?? 3e4, "uid_span");
+  const hashRunId = input.hashRunId ?? defaultHashRunId;
+  const runAssignments = /* @__PURE__ */ new Map();
+  const uidAssignments = /* @__PURE__ */ new Map();
+  return {
+    acquire(runId) {
+      if (typeof runId !== "string" || runId.trim().length === 0) {
+        throw new Error("pi_child_isolation_run_id_required");
+      }
+      const normalizedRunId = runId.trim();
+      const existing = runAssignments.get(normalizedRunId);
+      if (existing) return { ...existing };
+      const initialOffset = Math.abs(hashRunId(normalizedRunId)) % uidSpan;
+      for (let attempt = 0; attempt < uidSpan; attempt += 1) {
+        const uid = uidBase + (initialOffset + attempt) % uidSpan;
+        if (uidAssignments.has(uid)) continue;
+        const assignment = { uid, gid: uid };
+        runAssignments.set(normalizedRunId, assignment);
+        uidAssignments.set(uid, normalizedRunId);
+        return { ...assignment };
+      }
+      throw new Error("pi_child_isolation_uid_pool_exhausted");
+    },
+    release(runId) {
+      const assignment = runAssignments.get(runId);
+      if (!assignment) return false;
+      runAssignments.delete(runId);
+      uidAssignments.delete(assignment.uid);
+      return true;
+    },
+    activeAssignments() {
+      return Array.from(runAssignments, ([runId, assignment]) => ({ runId, ...assignment }));
+    }
+  };
+}
+function piChildIsolationProfileRoot(input) {
+  const managedProfileRoot = input.managedMcpProfile?.profileRoot;
+  if (typeof managedProfileRoot === "string" && managedProfileRoot.trim() !== "") {
+    return managedProfileRoot;
+  }
+  return input.executorHome;
+}
+function requireTrustedPiChildAllocator(allocator, trustedRuntimeEnabled) {
+  if (trustedRuntimeEnabled && !allocator) {
+    throw new Error("pi_trusted_runtime_child_isolation_required");
+  }
+  return allocator;
+}
+function preparePiChildIsolation(input) {
+  if (input.effectiveUid !== 0) {
+    throw new Error("pi_child_isolation_root_parent_required");
+  }
+  if (!isWithin(input.profileRoot, input.allowedRoot) || !isWithin(input.workspaceRoot, input.allowedRoot)) {
+    throw new Error("pi_child_isolation_path_outside_run_root");
+  }
+  const assignment = input.allocator.acquire(input.runId);
+  const isolatePath = input.isolatePath ?? isolatePiChildPath;
+  try {
+    for (const path of [resolve7(input.profileRoot), resolve7(input.workspaceRoot)]) {
+      isolatePath(path, assignment.uid, assignment.gid);
+    }
+  } catch (error) {
+    input.allocator.release(input.runId);
+    throw error;
+  }
+  return {
+    spawn: { uid: assignment.uid, gid: assignment.gid },
+    attestation: {
+      schemaVersion: "amaster.pi-child-isolation.v1",
+      commandId: input.commandId,
+      runId: input.runId,
+      identity: `dynamic-uid:${assignment.uid}`,
+      profileRoot: resolve7(input.profileRoot),
+      workspaceRoot: resolve7(input.workspaceRoot)
+    },
+    release: () => input.allocator.release(input.runId)
+  };
+}
+
+// src/amaster-runtime-daemon/pi-trusted-runtime-profile.mjs
+import { createHash as createHash6 } from "node:crypto";
+import {
+  chmodSync as chmodSync4,
+  copyFileSync as copyFileSync2,
+  existsSync as existsSync8,
+  lstatSync as lstatSync5,
+  mkdirSync as mkdirSync5,
+  readFileSync as readFileSync6,
+  readdirSync as readdirSync6,
+  rmSync as rmSync5,
+  symlinkSync as symlinkSync2,
+  writeFileSync as writeFileSync5
+} from "node:fs";
+import { dirname as dirname6, isAbsolute as isAbsolute5, join as join9, relative as relative5, resolve as resolve8 } from "node:path";
+var ASSERTION_VERSION = "2026-07-25.v1";
+var SHA256 = /^[a-f0-9]{64}$/;
+var COPY_ENTRIES = ["SYSTEM.md", "policy", "skills", "agents", "bundles", "extensions"];
+var JSON_ENTRIES = ["settings.json", "models.json"];
+var SECRET_KEY = /(authorization|cookie|api[_-]?key|password|secret|token)$/i;
+var SECRET_VALUE = /(?:authorization|cookie|api[_-]?key|password|secret|token)\s*[:=]\s*(?:bearer\s+)?[^\s"',;]+|bearer\s+[^\s"',;]+/i;
+var MAX_AUDIT_BYTES = 1024 * 1024;
+var MAX_AUDIT_EVENTS = 2e3;
+function requiredString2(value, field) {
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new Error(`pi_trusted_runtime_assertion_invalid:${field}`);
+  }
+  return value.trim();
+}
+function requiredDigest(value, field) {
+  const digest = requiredString2(value, field);
+  if (!SHA256.test(digest)) throw new Error(`pi_trusted_runtime_assertion_invalid:${field}`);
+  return digest;
+}
+function sha256File(path, label) {
+  const stat = lstatSync5(path);
+  if (!stat.isFile() || stat.isSymbolicLink()) {
+    throw new Error(`pi_trusted_runtime_source_unsafe:${label}`);
+  }
+  return createHash6("sha256").update(readFileSync6(path)).digest("hex");
+}
+function verifyDeclaredFiles(manifest, root, label, ignoredPaths = [], enforceComplete = true) {
+  if (!Array.isArray(manifest.files) || manifest.files.length === 0) {
+    throw new Error(`pi_trusted_runtime_source_invalid:${label}_files`);
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of manifest.files) {
+    const relativePath = requiredString2(entry?.path, `${label}.files.path`);
+    const expectedDigest = requiredDigest(entry?.sha256, `${label}.files.sha256`);
+    const filePath = resolve8(root, relativePath);
+    if (!within2(filePath, root) || seen.has(relativePath)) {
+      throw new Error(`pi_trusted_runtime_source_invalid:${label}_files`);
+    }
+    seen.add(relativePath);
+    if (sha256File(filePath, `${label}_file`) !== expectedDigest) {
+      throw new Error(`pi_trusted_runtime_source_digest_mismatch:${label}:${relativePath}`);
+    }
+  }
+  if (!enforceComplete) return;
+  const ignored = new Set(ignoredPaths);
+  const visit = (directory) => {
+    for (const entry of readdirSync6(directory)) {
+      const filePath = join9(directory, entry);
+      const relativePath = relative5(root, filePath);
+      if (ignored.has(relativePath)) continue;
+      const stat = lstatSync5(filePath);
+      if (stat.isSymbolicLink()) {
+        throw new Error(`pi_trusted_runtime_source_unsafe:${label}_file`);
+      }
+      if (stat.isDirectory()) {
+        visit(filePath);
+      } else if (!stat.isFile() || !seen.has(relativePath)) {
+        throw new Error(`pi_trusted_runtime_source_invalid:${label}_files`);
+      }
+    }
+  };
+  visit(root);
+}
+function record2(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function within2(candidate, root) {
+  const rel = relative5(root, candidate);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute5(rel);
+}
+function readJsonFile(path, label, fallback = {}) {
+  if (!existsSync8(path)) return fallback;
+  const stat = lstatSync5(path);
+  if (!stat.isFile() || stat.isSymbolicLink()) {
+    throw new Error(`pi_trusted_runtime_source_unsafe:${label}`);
+  }
+  try {
+    return JSON.parse(readFileSync6(path, "utf8"));
+  } catch {
+    throw new Error(`pi_trusted_runtime_source_invalid:${label}`);
+  }
+}
+function deepMerge(base, overlay) {
+  if (!base || typeof base !== "object" || Array.isArray(base)) return structuredClone(overlay);
+  if (!overlay || typeof overlay !== "object" || Array.isArray(overlay)) return structuredClone(overlay);
+  const merged = { ...structuredClone(base) };
+  for (const [key, value] of Object.entries(overlay)) {
+    merged[key] = key in merged ? deepMerge(merged[key], value) : structuredClone(value);
+  }
+  return merged;
+}
+function assertNoPersistentSecrets(value, path = []) {
+  if (Array.isArray(value)) {
+    value.forEach((entry, index) => assertNoPersistentSecrets(entry, [...path, String(index)]));
+    return;
+  }
+  if (!value || typeof value !== "object") return;
+  for (const [key, entry] of Object.entries(value)) {
+    if (SECRET_KEY.test(key) && typeof entry === "string" && entry.length > 0 && !/^\$\{[A-Z_][A-Z0-9_]*\}$/.test(entry)) {
+      throw new Error(`pi_trusted_runtime_persistent_secret_blocked:${[...path, key].join(".")}`);
+    }
+    assertNoPersistentSecrets(entry, [...path, key]);
+  }
+}
+function copyTreeNoLinks(source, target) {
+  const stat = lstatSync5(source);
+  if (stat.isSymbolicLink()) throw new Error("pi_trusted_runtime_source_symlink_blocked");
+  if (stat.isDirectory()) {
+    mkdirSync5(target, { recursive: true, mode: 448 });
+    chmodSync4(target, 448);
+    for (const entry of readdirSync6(source)) {
+      copyTreeNoLinks(join9(source, entry), join9(target, entry));
+    }
+    return;
+  }
+  if (!stat.isFile()) throw new Error("pi_trusted_runtime_source_type_blocked");
+  mkdirSync5(dirname6(target), { recursive: true, mode: 448 });
+  copyFileSync2(source, target);
+  chmodSync4(target, 384 | stat.mode & 73);
+}
+function mergeMcp(seedRoot, overlayRoot, governedConfig) {
+  const seed = record2(readJsonFile(join9(seedRoot, "mcp.json"), "seed_mcp", { mcpServers: {} }));
+  const overlay = record2(readJsonFile(join9(overlayRoot, "mcp.json"), "overlay_mcp", { mcpServers: {} }));
+  assertNoPersistentSecrets(seed, ["seed", "mcp.json"]);
+  assertNoPersistentSecrets(overlay, ["overlay", "mcp.json"]);
+  const seedServers = record2(seed.mcpServers);
+  const overlayServers = record2(overlay.mcpServers);
+  if ("amaster" in seedServers || "amaster" in overlayServers) {
+    throw new Error("pi_trusted_runtime_reserved_mcp_override:amaster");
+  }
+  const governed = record2(record2(governedConfig).mcpServers).amaster;
+  if (!governed) throw new Error("pi_trusted_runtime_governed_mcp_missing");
+  return {
+    ...deepMerge(seed, overlay),
+    mcpServers: {
+      ...deepMerge(seedServers, overlayServers),
+      amaster: governed
+    }
+  };
+}
+function packageName(spec) {
+  if (typeof spec !== "string" || !spec.startsWith("npm:")) return null;
+  const value = spec.slice(4);
+  const separator = value.startsWith("@") ? value.indexOf("@", 1) : value.indexOf("@");
+  return separator < 0 ? value : value.slice(0, separator);
+}
+function assertEnabledPackagesAvailable(settings, npmRoot) {
+  const requiredNames = new Set(
+    (Array.isArray(settings.packages) ? settings.packages : []).map(packageName).filter(Boolean)
+  );
+  for (const plugin of Object.values(record2(settings.plugins))) {
+    const config = record2(plugin);
+    if (config.enabled === true && typeof config.package === "string") {
+      requiredNames.add(config.package);
+    }
+  }
+  for (const name of requiredNames) {
+    const metadataPath = join9(npmRoot, "node_modules", ...name.split("/"), "package.json");
+    const metadata = readJsonFile(metadataPath, `package:${name}`, null);
+    if (!metadata || metadata.name !== name) {
+      throw new Error(`pi_trusted_runtime_package_unavailable:${name}`);
+    }
+  }
+}
+function materializeTrustedPiRuntimeProfile(input) {
+  const seedRoot = resolve8(requiredString2(input.seedRoot, "seedRoot"));
+  const overlayRoot = resolve8(requiredString2(input.overlayRoot, "overlayRoot"));
+  const profileRoot = resolve8(requiredString2(input.profileRoot, "profileRoot"));
+  const agentDir = resolve8(requiredString2(input.agentDir, "agentDir"));
+  if (!within2(agentDir, profileRoot)) throw new Error("pi_trusted_runtime_profile_path_escape");
+  for (const [root, label] of [[seedRoot, "seed_root"], [overlayRoot, "overlay_root"]]) {
+    const stat = lstatSync5(root);
+    if (!stat.isDirectory() || stat.isSymbolicLink()) {
+      throw new Error(`pi_trusted_runtime_source_unsafe:${label}`);
+    }
+  }
+  for (const entry of COPY_ENTRIES) {
+    const target = join9(agentDir, entry);
+    rmSync5(target, { recursive: true, force: true });
+    for (const sourceRoot of [seedRoot, overlayRoot]) {
+      const source = join9(sourceRoot, entry);
+      if (existsSync8(source)) copyTreeNoLinks(source, target);
+    }
+  }
+  const mergedJson = {};
+  for (const entry of JSON_ENTRIES) {
+    const seed = readJsonFile(join9(seedRoot, entry), `seed_${entry}`, {});
+    const overlay = readJsonFile(join9(overlayRoot, entry), `overlay_${entry}`, {});
+    const merged = deepMerge(seed, overlay);
+    if (entry === "settings.json") {
+      merged["pi-security"] = {
+        ...record2(merged["pi-security"]),
+        enabled: true,
+        approvals: {
+          ...record2(record2(merged["pi-security"]).approvals),
+          allowSessionGrants: false
+        }
+      };
+    }
+    assertNoPersistentSecrets(merged, [entry]);
+    writeFileSync5(join9(agentDir, entry), `${JSON.stringify(merged, null, 2)}
+`, {
+      mode: 384
+    });
+    chmodSync4(join9(agentDir, entry), 384);
+    mergedJson[entry] = merged;
+  }
+  const governedConfig = readJsonFile(input.governedMcpConfigPath, "governed_mcp");
+  const mcp = mergeMcp(seedRoot, overlayRoot, governedConfig);
+  writeFileSync5(input.governedMcpConfigPath, `${JSON.stringify(mcp, null, 2)}
+`, { mode: 384 });
+  chmodSync4(input.governedMcpConfigPath, 384);
+  const npmRoot = join9(seedRoot, "npm");
+  assertEnabledPackagesAvailable(mergedJson["settings.json"], npmRoot);
+  const npmTarget = join9(agentDir, "npm");
+  rmSync5(npmTarget, { recursive: true, force: true });
+  const npmStat = lstatSync5(npmRoot);
+  if (!npmStat.isDirectory() || npmStat.isSymbolicLink()) {
+    throw new Error("pi_trusted_runtime_source_unsafe:seed_npm");
+  }
+  symlinkSync2(npmRoot, npmTarget, "dir");
+  const facts = {
+    schemaVersion: "amaster.trusted-pi-profile.v1",
+    seedManifestDigest: input.verifiedAssertion.digests.seedManifestDigest,
+    runtimeOverlayDigest: input.verifiedAssertion.digests.runtimeOverlayDigest,
+    effectivePolicyDigest: input.verifiedAssertion.digests.effectivePolicyDigest,
+    runtimeEnforcementDigest: input.verifiedAssertion.digests.runtimeEnforcementDigest,
+    unknownToolMode: input.verifiedAssertion.unknownToolMode,
+    directToolBudget: input.verifiedAssertion.directToolBudget,
+    inheritedEntries: [...COPY_ENTRIES, ...JSON_ENTRIES, "mcp.json", "npm"]
+  };
+  return {
+    facts,
+    attestationId: createHash6("sha256").update(JSON.stringify(facts)).digest("hex")
+  };
+}
+function assertAuditArgsRedacted(value) {
+  if (Array.isArray(value)) {
+    value.forEach(assertAuditArgsRedacted);
+    return;
+  }
+  if (typeof value === "string") {
+    if (SECRET_VALUE.test(value)) {
+      throw new Error("pi_trusted_runtime_audit_secret_not_redacted");
+    }
+    return;
+  }
+  if (!value || typeof value !== "object") return;
+  for (const [key, entry] of Object.entries(value)) {
+    if (SECRET_KEY.test(key) && entry !== "[redacted]") {
+      throw new Error("pi_trusted_runtime_audit_secret_not_redacted");
+    }
+    assertAuditArgsRedacted(entry);
+  }
+}
+function readTrustedPiRuntimeAudit(input) {
+  const profileRoot = resolve8(requiredString2(input.profileRoot, "profileRoot"));
+  const auditFile = resolve8(requiredString2(input.auditFile, "auditFile"));
+  if (!within2(auditFile, profileRoot)) throw new Error("pi_trusted_runtime_audit_path_escape");
+  if (!existsSync8(auditFile)) throw new Error("pi_trusted_runtime_audit_startup_missing");
+  const stat = lstatSync5(auditFile);
+  if (!stat.isFile() || stat.isSymbolicLink()) {
+    throw new Error("pi_trusted_runtime_audit_unsafe");
+  }
+  if (stat.size > MAX_AUDIT_BYTES) throw new Error("pi_trusted_runtime_audit_too_large");
+  const lines = readFileSync6(auditFile, "utf8").split("\n").filter(Boolean);
+  if (lines.length === 0 || lines.length > MAX_AUDIT_EVENTS) {
+    throw new Error("pi_trusted_runtime_audit_event_count_invalid");
+  }
+  let decisions = 0;
+  let outcomes = 0;
+  let startupSeen = false;
+  const decisionBySequence = /* @__PURE__ */ new Map();
+  const outcomeSequences = /* @__PURE__ */ new Set();
+  const events = lines.map((line) => {
+    let event;
+    try {
+      event = JSON.parse(line);
+    } catch {
+      throw new Error("pi_trusted_runtime_audit_invalid_json");
+    }
+    if (event?.schemaVersion !== "amaster.managed-runtime-audit.v1" || event.commandId !== input.commandId || event.runId !== input.runId || !Number.isInteger(event.sequence) || event.sequence < 0) throw new Error("pi_trusted_runtime_audit_binding_mismatch");
+    if (event.event === "decision") {
+      decisions += 1;
+      if (event.sequence !== decisions || decisionBySequence.has(event.sequence) || typeof event.toolCallId !== "string" || event.toolCallId === "" || typeof event.toolName !== "string" || event.toolName === "" || !["allow", "deny"].includes(event.decision)) {
+        throw new Error("pi_trusted_runtime_audit_sequence_invalid");
+      }
+      decisionBySequence.set(event.sequence, event);
+      assertAuditArgsRedacted(event.args);
+    } else if (event.event === "outcome") {
+      outcomes += 1;
+      const decision = decisionBySequence.get(event.sequence);
+      if (!decision || decision.decision !== "allow" || outcomeSequences.has(event.sequence) || event.toolCallId !== decision.toolCallId || event.toolName !== decision.toolName || !["success", "error"].includes(event.outcome)) {
+        throw new Error("pi_trusted_runtime_audit_outcome_without_decision");
+      }
+      outcomeSequences.add(event.sequence);
+    } else if (event.event !== "startup" || startupSeen || event.sequence !== 0 || event.assertionValid !== true || event.runtimeEnforcementDigest !== input.runtimeEnforcementDigest) {
+      throw new Error("pi_trusted_runtime_audit_startup_invalid");
+    }
+    if (event.event === "startup") startupSeen = true;
+    return event;
+  });
+  if (events[0]?.event !== "startup") throw new Error("pi_trusted_runtime_audit_startup_missing");
+  return {
+    schemaVersion: "amaster.managed-runtime-audit-summary.v1",
+    decisionCount: decisions,
+    outcomeCount: outcomes,
+    deniedCount: events.filter((event) => event.event === "decision" && event.decision === "deny").length,
+    maxSequence: decisions,
+    events
+  };
+}
+function readTrustedPiRuntimeLocalDigests(input) {
+  const seedRoot = resolve8(requiredString2(input.seedRoot, "seedRoot"));
+  const overlayRoot = resolve8(requiredString2(input.overlayRoot, "overlayRoot"));
+  const policyFile = resolve8(requiredString2(input.policyFile, "policyFile"));
+  for (const [path, label] of [[seedRoot, "seed_root"], [overlayRoot, "overlay_root"]]) {
+    const stat = lstatSync5(path);
+    if (!stat.isDirectory() || stat.isSymbolicLink()) {
+      throw new Error(`pi_trusted_runtime_source_unsafe:${label}`);
+    }
+  }
+  const seedManifestFile = join9(seedRoot, "seed-manifest.json");
+  const overlayManifestFile = join9(overlayRoot, "runtime-overlay-manifest.json");
+  const seedManifest = JSON.parse(readFileSync6(seedManifestFile, "utf8"));
+  const overlayManifest = JSON.parse(readFileSync6(overlayManifestFile, "utf8"));
+  const policyManifest = JSON.parse(readFileSync6(policyFile, "utf8"));
+  verifyDeclaredFiles(seedManifest, seedRoot, "seed", ["seed-manifest.json"]);
+  verifyDeclaredFiles(overlayManifest, overlayRoot, "overlay", ["runtime-overlay-manifest.json"]);
+  verifyDeclaredFiles(
+    policyManifest,
+    dirname6(policyFile),
+    "policy",
+    [relative5(dirname6(policyFile), policyFile)],
+    false
+  );
+  return {
+    seedManifestDigest: sha256File(seedManifestFile, "seed_manifest"),
+    runtimeOverlayDigest: sha256File(overlayManifestFile, "runtime_overlay_manifest"),
+    effectivePolicyDigest: sha256File(policyFile, "effective_policy"),
+    runtimeEnforcementDigest: requiredDigest(
+      seedManifest.runtimeEnforcementDigest,
+      "runtimeEnforcementDigest"
+    )
+  };
+}
+function createTrustedPiRuntimeProvenanceCache(input = {}) {
+  const readDigests = input.readDigests ?? readTrustedPiRuntimeLocalDigests;
+  let cachedKey = null;
+  let cachedDigests = null;
+  return {
+    read(paths) {
+      const key = JSON.stringify([
+        paths.seedRoot,
+        paths.overlayRoot,
+        paths.policyFile
+      ]);
+      if (cachedDigests && cachedKey === key) return cachedDigests;
+      cachedDigests = readDigests(paths);
+      cachedKey = key;
+      return cachedDigests;
+    }
+  };
+}
+function verifyTrustedPiRuntimeAssertion(input) {
+  const assertion = input.assertion;
+  if (!assertion || typeof assertion !== "object" || Array.isArray(assertion)) {
+    throw new Error("pi_trusted_runtime_assertion_missing");
+  }
+  if (assertion.version !== ASSERTION_VERSION) {
+    throw new Error("pi_trusted_runtime_assertion_invalid:version");
+  }
+  const bindings = {
+    connectorId: input.connectorId,
+    commandId: input.commandId,
+    runId: input.runId,
+    leaseId: input.leaseId,
+    executorKind: input.executorKind
+  };
+  requiredString2(assertion.attestationId, "attestationId");
+  for (const [field, expected] of Object.entries(bindings)) {
+    if (requiredString2(assertion[field], field) !== expected) {
+      throw new Error(`pi_trusted_runtime_assertion_binding_mismatch:${field}`);
+    }
+  }
+  if (assertion.executorKind !== "pi") {
+    throw new Error("pi_trusted_runtime_assertion_binding_mismatch:executorKind");
+  }
+  const expiresAt = Date.parse(requiredString2(assertion.expiresAt, "expiresAt"));
+  const now = input.now instanceof Date ? input.now : new Date(input.now ?? Date.now());
+  if (!Number.isFinite(expiresAt) || input.verifyExpiry !== false && expiresAt <= now.getTime()) {
+    throw new Error("pi_trusted_runtime_assertion_expired");
+  }
+  for (const field of [
+    "seedManifestDigest",
+    "runtimeOverlayDigest",
+    "effectivePolicyDigest",
+    "runtimeEnforcementDigest"
+  ]) {
+    const asserted = requiredDigest(assertion[field], field);
+    if (asserted !== requiredDigest(input.localDigests?.[field], field)) {
+      throw new Error(`pi_trusted_runtime_digest_mismatch:${field}`);
+    }
+  }
+  if (!["deny", "allow_audited_bounded"].includes(assertion.unknownToolMode)) {
+    throw new Error("pi_trusted_runtime_assertion_invalid:unknownToolMode");
+  }
+  const maxCalls = assertion.directToolBudget?.maxCalls;
+  if (!Number.isInteger(maxCalls) || maxCalls < 0) {
+    throw new Error("pi_trusted_runtime_assertion_invalid:directToolBudget.maxCalls");
+  }
+  if (assertion.unknownToolMode === "allow_audited_bounded" && maxCalls < 1) {
+    throw new Error("pi_trusted_runtime_assertion_invalid:directToolBudget.maxCalls");
+  }
+  return {
+    attestationId: assertion.attestationId,
+    unknownToolMode: assertion.unknownToolMode,
+    directToolBudget: { maxCalls },
+    expiresAt: assertion.expiresAt,
+    digests: { ...input.localDigests }
+  };
+}
+
 // src/amaster-runtime-daemon/workspace-status.mjs
 import { spawnSync as spawnSync4 } from "node:child_process";
-import { createHash as createHash5 } from "node:crypto";
-import { existsSync as existsSync8, readdirSync as readdirSync5, readFileSync as readFileSync6, statSync as statSync6 } from "node:fs";
-import { basename as basename5, extname, isAbsolute as isAbsolute5, join as join9, relative as relative5, resolve as resolve7 } from "node:path";
+import { createHash as createHash7 } from "node:crypto";
+import { existsSync as existsSync9, readdirSync as readdirSync7, readFileSync as readFileSync7, statSync as statSync6 } from "node:fs";
+import { basename as basename5, extname, isAbsolute as isAbsolute6, join as join10, relative as relative6, resolve as resolve9 } from "node:path";
 var WORKSPACE_RUNTIME_SERVICES_FILENAME = ".amaster-runtime-services.json";
 var ARTIFACT_EXTENSIONS = /* @__PURE__ */ new Map([
   [".md", "markdown"],
@@ -4524,11 +5173,11 @@ var SAFE_RUNTIME_SERVICE_STATUSES = /* @__PURE__ */ new Set(["starting", "runnin
 var SAFE_RUNTIME_SERVICE_HEALTH_STATUSES = /* @__PURE__ */ new Set(["unknown", "healthy", "unhealthy"]);
 var SAFE_RUNTIME_SERVICE_LIFECYCLES = /* @__PURE__ */ new Set(["shared", "ephemeral"]);
 function statusPathWithin(candidate, root) {
-  const rel = relative5(root, candidate);
-  return rel === "" || !rel.startsWith("..") && !isAbsolute5(rel);
+  const rel = relative6(root, candidate);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute6(rel);
 }
 function normalizeRelativePath(root, filePath) {
-  return relative5(root, filePath).split(/[\\/]+/).join("/");
+  return relative6(root, filePath).split(/[\\/]+/).join("/");
 }
 function isSafeRelativePath(value) {
   const text = String(value ?? "").trim().split(/[\\/]+/).join("/");
@@ -4547,8 +5196,8 @@ function sanitizeTrackedChange(line) {
   if (path === WORKSPACE_RUNTIME_SERVICES_FILENAME) return null;
   return isSafeRelativePath(path) ? line : null;
 }
-function sha256File(filePath) {
-  return createHash5("sha256").update(readFileSync6(filePath)).digest("hex");
+function sha256File2(filePath) {
+  return createHash7("sha256").update(readFileSync7(filePath)).digest("hex");
 }
 function artifactHashCacheKey(relativePath, stat) {
   return `${relativePath}\0${stat.size}\0${stat.mtimeMs}`;
@@ -4562,7 +5211,7 @@ function artifactSha256(filePath, relativePath, stat, opts = {}) {
     cache.set(key, cached);
     return cached;
   }
-  const hashFile = typeof opts.hashFile === "function" ? opts.hashFile : sha256File;
+  const hashFile = typeof opts.hashFile === "function" ? opts.hashFile : sha256File2;
   const hash = hashFile(filePath);
   if (cache) {
     cache.set(key, hash);
@@ -4576,7 +5225,7 @@ function artifactSha256(filePath, relativePath, stat, opts = {}) {
   return hash;
 }
 function scanArtifactCandidates(cwd, opts = {}) {
-  const root = resolve7(cwd);
+  const root = resolve9(cwd);
   const maxCandidates = opts.maxCandidates ?? MAX_CANDIDATES;
   const maxEntries = opts.maxEntries ?? MAX_SCAN_ENTRIES;
   const candidates = [];
@@ -4586,7 +5235,7 @@ function scanArtifactCandidates(cwd, opts = {}) {
     const current = stack.pop();
     let entries;
     try {
-      entries = readdirSync5(current, { withFileTypes: true });
+      entries = readdirSync7(current, { withFileTypes: true });
     } catch {
       continue;
     }
@@ -4597,7 +5246,7 @@ function scanArtifactCandidates(cwd, opts = {}) {
       if (entry.name.startsWith(".") && entry.name !== ".amaster-runtime.json") {
         if (entry.name === ".git") continue;
       }
-      const fullPath = join9(current, entry.name);
+      const fullPath = join10(current, entry.name);
       const relativePath = normalizeRelativePath(root, fullPath);
       if (!isSafeRelativePath(relativePath)) continue;
       if (basename5(relativePath) === ".amaster-runtime.json") continue;
@@ -4616,7 +5265,7 @@ function scanArtifactCandidates(cwd, opts = {}) {
       } catch {
         continue;
       }
-      if (!statusPathWithin(resolve7(fullPath), root) || stat.size > MAX_HASH_BYTES) continue;
+      if (!statusPathWithin(resolve9(fullPath), root) || stat.size > MAX_HASH_BYTES) continue;
       candidates.push({
         relativePath,
         name: basename5(fullPath),
@@ -4676,10 +5325,10 @@ function sanitizeRuntimeService(entry) {
   };
 }
 function readRuntimeServicesSnapshot(cwd) {
-  const snapshotPath = join9(resolve7(cwd), WORKSPACE_RUNTIME_SERVICES_FILENAME);
-  if (!existsSync8(snapshotPath)) return [];
+  const snapshotPath = join10(resolve9(cwd), WORKSPACE_RUNTIME_SERVICES_FILENAME);
+  if (!existsSync9(snapshotPath)) return [];
   try {
-    const parsed = JSON.parse(readFileSync6(snapshotPath, "utf8"));
+    const parsed = JSON.parse(readFileSync7(snapshotPath, "utf8"));
     const rawServices = Array.isArray(parsed) ? parsed : Array.isArray(parsed?.services) ? parsed.services : [];
     return rawServices.map((entry) => sanitizeRuntimeService(entry)).filter((entry) => entry !== null).slice(0, 50);
   } catch {
@@ -4750,7 +5399,7 @@ function readWorkspaceStatus(cwd, opts = {}) {
 }
 
 // src/amaster-runtime-daemon.mjs
-var CONNECTOR_VERSION = "0.1.0-beta.31";
+var CONNECTOR_VERSION = "0.1.0-beta.33";
 var CONNECTOR_CONTRACT_VERSION = "2026-06-04.v1";
 var MAX_CHECKPOINT_BYTES = 20 * 1024 * 1024;
 var CHECKPOINT_TTL_MS = 24 * 60 * 60 * 1e3;
@@ -4771,6 +5420,25 @@ var processGroupRssSampleCache = null;
 var lastOrphanReaperRunAtMs = 0;
 var lastOrphanReaperSummary = null;
 var activeRunManifestOutputFlusher = createManifestOutputFlusher({ updateWorkspaceManifest });
+var piChildIdentityAllocator = null;
+var piChildIdentityAllocatorKey = null;
+var trustedPiRuntimeProvenanceCache = createTrustedPiRuntimeProvenanceCache();
+var lastPartialTrustedPiRuntimeSourceWarningKey = null;
+function configuredPiChildIdentityAllocator(config) {
+  if (!(config.piChildUidBase > 0)) return null;
+  const key = `${config.piChildUidBase}:${config.piChildUidSpan}`;
+  if (!piChildIdentityAllocator || piChildIdentityAllocatorKey !== key) {
+    if (piChildIdentityAllocator?.activeAssignments().length > 0) {
+      throw new Error("pi_child_isolation_config_changed_with_active_runs");
+    }
+    piChildIdentityAllocator = createPiChildIdentityAllocator({
+      uidBase: config.piChildUidBase,
+      uidSpan: config.piChildUidSpan
+    });
+    piChildIdentityAllocatorKey = key;
+  }
+  return piChildIdentityAllocator;
+}
 function mergeActiveRunManifestPatch(commandId, patch = {}) {
   return activeRunManifestOutputFlusher.mergePendingPatch(commandId, patch);
 }
@@ -4779,11 +5447,11 @@ function updateActiveRunWorkspaceManifest(commandId, manifestPath, patch = {}) {
 }
 function resultOutboxPendingCount(config) {
   const dir = resultOutboxDir(config);
-  if (!existsSync9(dir)) return 0;
+  if (!existsSync10(dir)) return 0;
   try {
     let pending = 0;
-    for (const file of readdirSync6(dir).filter((name) => name.endsWith(".json"))) {
-      if (readValidResultOutboxEntryOrQuarantine(config, file, join10(dir, file))) {
+    for (const file of readdirSync8(dir).filter((name) => name.endsWith(".json"))) {
+      if (readValidResultOutboxEntryOrQuarantine(config, file, join11(dir, file))) {
         pending += 1;
       }
     }
@@ -4799,11 +5467,11 @@ function piCompletionOutputType(event) {
 }
 function resultOutboxActiveRunCommands(config) {
   const dir = resultOutboxDir(config);
-  if (!existsSync9(dir)) return [];
+  if (!existsSync10(dir)) return [];
   const outboxPending = resultOutboxPendingCount(config);
   const entries = [];
-  for (const file of readdirSync6(dir).filter((name) => name.endsWith(".json")).sort()) {
-    const entry = readValidResultOutboxEntryOrQuarantine(config, file, join10(dir, file));
+  for (const file of readdirSync8(dir).filter((name) => name.endsWith(".json")).sort()) {
+    const entry = readValidResultOutboxEntryOrQuarantine(config, file, join11(dir, file));
     if (!entry) continue;
     const activeRun = asRecord(entry.activeRun);
     const commandId = readString(activeRun.commandId) ?? readString(entry.commandId);
@@ -4833,12 +5501,12 @@ function resultOutboxActiveRunCommands(config) {
 }
 function resultOutboxFailedRunCommands(config) {
   const dir = resultOutboxInvalidDir(config);
-  if (!existsSync9(dir)) return [];
+  if (!existsSync10(dir)) return [];
   const entries = [];
-  for (const file of readdirSync6(dir).filter((name) => name.endsWith(".json")).sort().slice(-100)) {
+  for (const file of readdirSync8(dir).filter((name) => name.endsWith(".json")).sort().slice(-100)) {
     let entry;
     try {
-      entry = asRecord(JSON.parse(readFileSync7(join10(dir, file), "utf8")));
+      entry = asRecord(JSON.parse(readFileSync8(join11(dir, file), "utf8")));
     } catch {
       continue;
     }
@@ -4898,11 +5566,11 @@ function piExtraArgsDiagnostics(value) {
 }
 function safeExpandPath(value) {
   const text = readString(value);
-  return text ? resolve8(expandHomePath(text)) : null;
+  return text ? resolve10(expandHomePath(text)) : null;
 }
 function safeJsonObjectFromFile(filePath) {
   try {
-    const parsed = JSON.parse(readFileSync7(filePath, "utf8"));
+    const parsed = JSON.parse(readFileSync8(filePath, "utf8"));
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
   } catch {
     return null;
@@ -4919,7 +5587,7 @@ function safeDirectorySummary(pathValue) {
     }
     let entryCount = 0;
     let truncated = false;
-    for (const name of readdirSync6(pathValue)) {
+    for (const name of readdirSync8(pathValue)) {
       if (name.startsWith(".")) continue;
       entryCount += 1;
       if (entryCount >= MAX_PI_CAPABILITY_SOURCE_ENTRIES) {
@@ -4943,12 +5611,12 @@ function safeSkillRootSummary(kind, source, pathValue) {
   let truncated = false;
   if (directory.available && pathValue) {
     try {
-      for (const name of readdirSync6(pathValue)) {
+      for (const name of readdirSync8(pathValue)) {
         if (name.startsWith(".")) continue;
-        const skillDir = join10(pathValue, name);
+        const skillDir = join11(pathValue, name);
         try {
           if (!statSync7(skillDir).isDirectory()) continue;
-          if (!existsSync9(join10(skillDir, "SKILL.md"))) continue;
+          if (!existsSync10(join11(skillDir, "SKILL.md"))) continue;
           skillCount += 1;
           if (skillCount >= MAX_PI_CAPABILITY_SOURCE_ENTRIES) {
             truncated = true;
@@ -4999,7 +5667,7 @@ function objectKeyCount(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? Object.keys(value).length : 0;
 }
 function defaultPiCodingAgentDir() {
-  return join10(homedir3(), ".pi", "agent");
+  return join11(homedir3(), ".pi", "agent");
 }
 function piCapabilitySourcesDiagnostics() {
   const configuredPiCodingAgentDir = safeExpandPath(process.env.PI_CODING_AGENT_DIR);
@@ -5008,11 +5676,11 @@ function piCapabilitySourcesDiagnostics() {
   const configuredPiAgentHome = safeExpandPath(process.env.PI_AGENT_HOME);
   const piAgentHome = configuredPiAgentHome ?? piCodingAgentDir;
   const piAgentHomeSource = configuredPiAgentHome ? "PI_AGENT_HOME" : piCodingAgentDirSource;
-  const userSkillsPath = piAgentHome ? join10(piAgentHome, "skills") : null;
-  const marketplaceSkillsPath = safeExpandPath(process.env.PI_AGENT_MARKETPLACE_SKILLS_DIR) ?? (piAgentHome ? join10(piAgentHome, "marketplace", "skills") : null);
+  const userSkillsPath = piAgentHome ? join11(piAgentHome, "skills") : null;
+  const marketplaceSkillsPath = safeExpandPath(process.env.PI_AGENT_MARKETPLACE_SKILLS_DIR) ?? (piAgentHome ? join11(piAgentHome, "marketplace", "skills") : null);
   const builtinSkillsPath = safeExpandPath(process.env.PI_AGENT_BUILTIN_SKILLS_DIR) ?? safeExpandPath(process.env.AMASTER_BUILTIN_SKILLS);
-  const mcpConfigPath = safeExpandPath(process.env.PI_AGENT_MCP_SERVERS_FILE) ?? (piAgentHome ? join10(piAgentHome, "mcp.json") : null);
-  const settingsConfigPath = piCodingAgentDir ? join10(piCodingAgentDir, "settings.json") : null;
+  const mcpConfigPath = safeExpandPath(process.env.PI_AGENT_MCP_SERVERS_FILE) ?? (piAgentHome ? join11(piAgentHome, "mcp.json") : null);
+  const settingsConfigPath = piCodingAgentDir ? join11(piCodingAgentDir, "settings.json") : null;
   const skillRoots = [
     safeSkillRootSummary("user", `${piAgentHomeSource}/skills`, userSkillsPath),
     safeSkillRootSummary(
@@ -5127,6 +5795,31 @@ function executorReadinessFor(config, executor) {
 function buildExecutorReadiness(config) {
   return config.executors.filter((executor) => executor.kind === "codex" || executor.kind === "pi").map((executor) => executorReadinessFor(config, executor));
 }
+function trustedPiRuntimeProvenancePayload(config) {
+  const configuredSources = [
+    Boolean(config.piRuntimeSeedRoot),
+    Boolean(config.piRuntimeOverlayRoot),
+    Boolean(config.piRuntimeEffectivePolicyFile)
+  ];
+  const configured = configuredSources.filter(Boolean).length;
+  if (configured === 0) {
+    lastPartialTrustedPiRuntimeSourceWarningKey = null;
+    return {};
+  }
+  if (configured !== 3) {
+    const warningKey = configuredSources.map((value) => value ? "1" : "0").join("");
+    if (warningKey !== lastPartialTrustedPiRuntimeSourceWarningKey) {
+      process.stderr.write(
+        `AMaster daemon warning pi_trusted_runtime_source_config_partial: configured=${configured} required=3; ordinary heartbeat continues without trusted runtime provenance.
+`
+      );
+      lastPartialTrustedPiRuntimeSourceWarningKey = warningKey;
+    }
+    return {};
+  }
+  lastPartialTrustedPiRuntimeSourceWarningKey = null;
+  return trustedPiRuntimeProvenanceCache.read(trustedPiRuntimeSources(config));
+}
 function buildRegisterPayload(config) {
   const buildCommit = readString(process.env.AMASTER_RUNTIME_BUILD_COMMIT ?? process.env.AMASTER_SOURCE_COMMIT);
   return {
@@ -5190,6 +5883,7 @@ function buildHeartbeatPayload(config, options = {}) {
     contractVersion: CONNECTOR_CONTRACT_VERSION,
     platform: process.platform,
     arch: process.arch,
+    ...trustedPiRuntimeProvenancePayload(config),
     runtimeStatus: {
       daemon: "running",
       pid: process.pid,
@@ -5217,13 +5911,13 @@ function piAgentLocalPlatformRunnerEnabled(config) {
 }
 function piAgentSystemDataDir(config) {
   const configured = readString(config.AMASTER_PI_AGENT_SYSTEM_DATA_DIR ?? process.env.AMASTER_PI_AGENT_SYSTEM_DATA_DIR);
-  return configured ? resolve8(expandHomePath(configured)) : null;
+  return configured ? resolve10(expandHomePath(configured)) : null;
 }
 function readPiAgentLocalPlatformCredential(credentialsDir) {
-  const pointer = readJsonFile(join10(credentialsDir, "latest.json"));
+  const pointer = readJsonFile2(join11(credentialsDir, "latest.json"));
   const credentialRef = readString(pointer.credentialRef);
   if (!credentialRef || !/^[a-f0-9]{64}$/i.test(credentialRef)) return null;
-  const credential = readJsonFile(join10(credentialsDir, `${credentialRef}.json`));
+  const credential = readJsonFile2(join11(credentialsDir, `${credentialRef}.json`));
   const organizationId = readString(credential.organizationId);
   const apiKey = readString(credential.apiKey);
   if (credential.version !== 1 || !organizationId || !apiKey) return null;
@@ -5239,17 +5933,17 @@ function piAgentLocalPlatformCredentials(config) {
   if (!piAgentLocalPlatformRunnerEnabled(config)) return [];
   const systemDataDir = piAgentSystemDataDir(config);
   if (!systemDataDir) return [];
-  const companiesDir = join10(systemDataDir, "companies");
+  const companiesDir = join11(systemDataDir, "companies");
   let entries = [];
   try {
-    entries = readdirSync6(companiesDir, { withFileTypes: true });
+    entries = readdirSync8(companiesDir, { withFileTypes: true });
   } catch {
     return [];
   }
   const credentialsByOrganizationId = /* @__PURE__ */ new Map();
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const credential = readPiAgentLocalPlatformCredential(join10(companiesDir, entry.name, "model-credentials"));
+    const credential = readPiAgentLocalPlatformCredential(join11(companiesDir, entry.name, "model-credentials"));
     if (credential) credentialsByOrganizationId.set(credential.organizationId, credential);
   }
   return [...credentialsByOrganizationId.values()];
@@ -5423,7 +6117,7 @@ AMASTER_WORKSPACE_ALLOWLIST=${quoteShell(config.workspaceBindings.join(","))}
 AMASTER_EXECUTORS=${quoteShell(executorEnv)}
 AMASTER_CAPABILITIES=${quoteShell(config.capabilities.join(","))}
 AMASTER_NETWORK_DOMAINS=${quoteShell(config.networkDomains.join(","))}
-AMASTER_DAEMON_STATE_FILE=${quoteShell(join10(homedir3(), ".amaster-employee", "runtime-connector-state.json"))}
+AMASTER_DAEMON_STATE_FILE=${quoteShell(join11(homedir3(), ".amaster-employee", "runtime-connector-state.json"))}
 EOF
 
 set -a
@@ -5611,10 +6305,10 @@ function buildActiveRunCommandStatus(config, entry) {
   const base = {
     ...entry,
     phase: readString(entry.phase) ?? "executing",
-    managedWorkdirPresent: entry.workspacePath ? existsSync9(entry.workspacePath) : false,
+    managedWorkdirPresent: entry.workspacePath ? existsSync10(entry.workspacePath) : false,
     outboxPending: resultOutboxPendingCount(config)
   };
-  if (!entry.workspacePath || !existsSync9(entry.workspacePath)) return base;
+  if (!entry.workspacePath || !existsSync10(entry.workspacePath)) return base;
   const manifestPath = entry.manifestPath ?? workspaceManifestPath(entry.workspacePath);
   const status = readWorkspaceStatus(entry.workspacePath, { hashCache: workspaceStatusHashCache });
   const artifactCandidates = status.artifacts.slice(0, 20);
@@ -5778,18 +6472,33 @@ function commandExecutorEnv(command) {
     ...normalizeExecutorEnvValue(command.executorEnv)
   };
 }
-function readJsonFile(filePath) {
+function commandTrustedPiRuntimeAssertion(command) {
+  const topLevel = asRecord(command.trustedPiRuntime);
+  if (Object.keys(topLevel).length > 0) return topLevel;
+  return asRecord(asRecord(command.payload).trustedPiRuntime);
+}
+function trustedPiRuntimeSources(config) {
+  if (!config.piRuntimeSeedRoot || !config.piRuntimeOverlayRoot || !config.piRuntimeEffectivePolicyFile) {
+    throw new Error("pi_trusted_runtime_source_config_missing");
+  }
+  return {
+    seedRoot: config.piRuntimeSeedRoot,
+    overlayRoot: config.piRuntimeOverlayRoot,
+    policyFile: config.piRuntimeEffectivePolicyFile
+  };
+}
+function readJsonFile2(filePath) {
   try {
-    const parsed = JSON.parse(readFileSync7(filePath, "utf8"));
+    const parsed = JSON.parse(readFileSync8(filePath, "utf8"));
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
   } catch {
     return {};
   }
 }
 function writeJsonFileAtomic(filePath, value) {
-  mkdirSync5(dirname6(filePath), { recursive: true });
+  mkdirSync6(dirname7(filePath), { recursive: true });
   const tmpPath = `${filePath}.tmp.${process.pid}.${Date.now()}`;
-  writeFileSync5(tmpPath, `${JSON.stringify(value, null, 2)}
+  writeFileSync6(tmpPath, `${JSON.stringify(value, null, 2)}
 `, { mode: 384 });
   renameSync3(tmpPath, filePath);
 }
@@ -5835,8 +6544,8 @@ function ensureAmasterProviderModel(models, modelId, flash) {
 function syncAmasterProviderModels(agentDir, executorEnv) {
   const apiKey = readString(executorEnv.AMASTER_API_KEY);
   if (!apiKey) return false;
-  const modelsPath = join10(agentDir, "models.json");
-  const config = readJsonFile(modelsPath);
+  const modelsPath = join11(agentDir, "models.json");
+  const config = readJsonFile2(modelsPath);
   const providers = asRecord(config.providers);
   const amaster = { ...asRecord(providers.amaster) };
   amaster.apiKey = apiKey;
@@ -5859,9 +6568,9 @@ function syncAmasterProviderModels(agentDir, executorEnv) {
 function syncAmasterProviderSettings(agentDir, executorEnv) {
   const apiKey = readString(executorEnv.AMASTER_API_KEY);
   if (!apiKey) return false;
-  const settingsPath = join10(agentDir, "settings.json");
-  if (!existsSync9(settingsPath)) return false;
-  const settings = readJsonFile(settingsPath);
+  const settingsPath = join11(agentDir, "settings.json");
+  if (!existsSync10(settingsPath)) return false;
+  const settings = readJsonFile2(settingsPath);
   const baseUrl = readString(executorEnv.AMASTER_PROVIDER_BASE_URL);
   const defaultModel = readString(executorEnv.AMASTER_PROVIDER_DEFAULT_MODEL);
   const imageGenBaseUrl = imageGenBaseUrlFromProviderBaseUrl(baseUrl);
@@ -5987,11 +6696,11 @@ function safeAgentInstructionMaterializationTarget(workspace, filePath) {
   const raw = readString(filePath);
   if (!raw || raw.includes("\0")) return null;
   const normalized = raw.replace(/\\/g, "/");
-  if (isAbsolute6(normalized)) return null;
+  if (isAbsolute7(normalized)) return null;
   const segments = normalized.split("/").filter(Boolean);
   if (segments.length === 0 || segments.some((segment) => segment === "." || segment === "..")) return null;
   const relativePath = segments.join("/");
-  const targetPath = resolve8(workspace.cwd, relativePath);
+  const targetPath = resolve10(workspace.cwd, relativePath);
   if (!pathWithin2(targetPath, workspace.cwd)) return null;
   return { relativePath, targetPath };
 }
@@ -6005,8 +6714,8 @@ async function materializeAgentInstructionsBundle(config, command, workspace) {
     if (!content) continue;
     const target = safeAgentInstructionMaterializationTarget(workspace, filePath);
     if (!target) continue;
-    mkdirSync5(dirname6(target.targetPath), { recursive: true });
-    writeFileSync5(target.targetPath, content, "utf8");
+    mkdirSync6(dirname7(target.targetPath), { recursive: true });
+    writeFileSync6(target.targetPath, content, "utf8");
     materialized.push({
       path: target.relativePath,
       byteSize: Buffer.byteLength(content, "utf8")
@@ -6075,20 +6784,20 @@ function safeCompanyPiHomeSegment(companyId) {
   if (!raw) return null;
   if (/^[A-Za-z0-9][A-Za-z0-9._-]{0,119}$/.test(raw)) return raw;
   const normalized = raw.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^[._-]+|[._-]+$/g, "").slice(0, 80);
-  const hash = createHash6("sha256").update(raw).digest("hex").slice(0, 12);
+  const hash = createHash8("sha256").update(raw).digest("hex").slice(0, 12);
   return normalized ? `${normalized}-${hash}` : `company-${hash}`;
 }
 function companyPiHomeRoot(baseEnv) {
   const explicitRoot = readString(baseEnv.AMASTER_COMPANY_PI_HOME_ROOT);
-  if (explicitRoot) return resolve8(expandHomePath(explicitRoot));
+  if (explicitRoot) return resolve10(expandHomePath(explicitRoot));
   const configuredPiHome = readString(baseEnv.PI_AGENT_HOME) ?? readString(baseEnv.PI_CODING_AGENT_DIR);
-  if (configuredPiHome) return join10(dirname6(resolve8(expandHomePath(configuredPiHome))), "companies");
-  return join10(homedir3(), ".amaster-employee", "companies");
+  if (configuredPiHome) return join11(dirname7(resolve10(expandHomePath(configuredPiHome))), "companies");
+  return join11(homedir3(), ".amaster-employee", "companies");
 }
 function companyPiAgentHome(baseEnv, companyId) {
   const segment = safeCompanyPiHomeSegment(companyId);
   if (!segment) return null;
-  return join10(companyPiHomeRoot(baseEnv), segment, ".pi");
+  return join11(companyPiHomeRoot(baseEnv), segment, ".pi");
 }
 function commandUsesPiExecutor(command) {
   return readString(asRecord(command.payload).executorKind) === "pi";
@@ -6157,7 +6866,7 @@ function resolveNativeSessionRequest(command, workspace) {
     try {
       cwdMatched = realpathSync3(requestedCwd) === realpathSync3(sourceWorkspacePath);
     } catch {
-      cwdMatched = resolve8(requestedCwd) === resolve8(sourceWorkspacePath);
+      cwdMatched = resolve10(requestedCwd) === resolve10(sourceWorkspacePath);
     }
   }
   const used = Boolean(enabled && requested && sessionId && requestedCwd && cwdMatched);
@@ -6584,10 +7293,10 @@ function realOrResolvedPath(value) {
   try {
     return realpathSync3(value);
   } catch {
-    return resolve8(value);
+    return resolve10(value);
   }
 }
-var LSOF_COMMAND = process.platform === "darwin" && existsSync9("/usr/sbin/lsof") ? "/usr/sbin/lsof" : "lsof";
+var LSOF_COMMAND = process.platform === "darwin" && existsSync10("/usr/sbin/lsof") ? "/usr/sbin/lsof" : "lsof";
 function processCwdForPid(pid) {
   if (process.platform === "linux") {
     try {
@@ -6613,7 +7322,7 @@ function allProcessCwdsByPid() {
   if (process.platform === "linux") {
     const procEntries = (() => {
       try {
-        return readdirSync6("/proc", { withFileTypes: true });
+        return readdirSync8("/proc", { withFileTypes: true });
       } catch {
         return [];
       }
@@ -6709,21 +7418,21 @@ function killWorkspaceResidentProcesses(cwd, processGroupId, options = {}) {
 }
 function walkManagedWorkdirs(root) {
   const workdirs = [];
-  if (!root || !existsSync9(root)) return workdirs;
+  if (!root || !existsSync10(root)) return workdirs;
   const stack = [root];
   while (stack.length > 0) {
     const current = stack.pop();
     if (!current) continue;
     let entries = [];
     try {
-      entries = readdirSync6(current, { withFileTypes: true });
+      entries = readdirSync8(current, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const fullPath = join10(current, entry.name);
-      if (entry.name === "workdir" && existsSync9(workspaceManifestPath(fullPath))) {
+      const fullPath = join11(current, entry.name);
+      if (entry.name === "workdir" && existsSync10(workspaceManifestPath(fullPath))) {
         workdirs.push(fullPath);
         continue;
       }
@@ -6761,8 +7470,8 @@ function manifestMatchesActiveRuntimeRef(manifest, refs, workdir = null) {
 }
 function buildOrphanReaperSample(root, workdir, manifest, residents) {
   const relativeWorkdir = (() => {
-    const value = relative6(root, workdir);
-    return value && !value.startsWith("..") && !isAbsolute6(value) ? value : basename6(workdir);
+    const value = relative7(root, workdir);
+    return value && !value.startsWith("..") && !isAbsolute7(value) ? value : basename6(workdir);
   })();
   return {
     workdir: relativeWorkdir,
@@ -6869,7 +7578,8 @@ function runExecutor(command, args, options) {
       cwd: options.cwd,
       env: options.env,
       detached: process.platform !== "win32",
-      stdio: ["pipe", "pipe", "pipe"]
+      stdio: options.managedInput ? ["pipe", "pipe", "pipe", "pipe"] : ["pipe", "pipe", "pipe"],
+      ...options.spawnIdentity ?? {}
     });
     const processGroupId = processGroupIdForChild(child);
     const finish = (result2) => {
@@ -6904,6 +7614,13 @@ function runExecutor(command, args, options) {
       signalExecutorProcess(child, "SIGTERM", processGroupId);
       scheduleStopKill();
     };
+    if (options.managedInput) {
+      child.stdio[3].once("error", (error) => {
+        spawnError = `managed_runtime_assertion_delivery_failed: ${error.message}`;
+        requestStop("managed_runtime_assertion_delivery_failed");
+      });
+      child.stdio[3].end(options.managedInput);
+    }
     const reapStoppedWorkspaceResidents = () => {
       if (settled || !stopReason || stopReason === "completion_cleanup") return;
       const residents = listWorkspaceResidentProcesses(options.cwd, processGroupId, {
@@ -7146,12 +7863,16 @@ async function ingestRuntimeArtifacts(config, command, cwd, mcpToolResults) {
   const receipts = [];
   for (const upload of uploads) {
     const path = `/api/amaster/runtime-connectors/${connectorId}/artifact-intents/${encodeURIComponent(upload.intentId)}/ingest`;
+    const sourcePathHeaders = /^[\x20-\x7e]+$/.test(upload.sourceRelativePath) ? { "x-amaster-artifact-source-path": upload.sourceRelativePath } : {
+      "x-amaster-artifact-source-path": encodeURIComponent(upload.sourceRelativePath),
+      "x-amaster-artifact-source-path-encoding": "uri-component"
+    };
     try {
       const receipt = asRecord(await postRuntimeConnectorBytes(config, path, upload.body, {
         "x-amaster-command-id": command.commandId,
         "x-amaster-run-id": runId,
         "x-amaster-artifact-manifest-id": upload.manifestId,
-        "x-amaster-artifact-source-path": upload.sourceRelativePath
+        ...sourcePathHeaders
       }));
       if (readString(receipt.intentId) !== upload.intentId || readString(receipt.status) !== "finalized") {
         throw new Error(`Runtime Artifact ${upload.intentId} was not finalized: ${JSON.stringify(receipt)}`);
@@ -7234,15 +7955,15 @@ async function completeCommand(config, command, status, result2, error) {
 }
 function resultOutboxDir(config) {
   const explicit = readString(process.env.AMASTER_RESULT_OUTBOX_DIR);
-  if (explicit) return resolve8(expandHomePath(explicit));
-  return join10(dirname6(stateFilePath(process.env)), "result-outbox");
+  if (explicit) return resolve10(expandHomePath(explicit));
+  return join11(dirname7(stateFilePath(process.env)), "result-outbox");
 }
 function resultOutboxInvalidDir(config) {
-  return join10(resultOutboxDir(config), "invalid");
+  return join11(resultOutboxDir(config), "invalid");
 }
 function writeResultOutboxEntry(config, entry) {
   const dir = resultOutboxDir(config);
-  mkdirSync5(dir, { recursive: true });
+  mkdirSync6(dir, { recursive: true });
   const body = {
     version: 1,
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -7250,18 +7971,18 @@ function writeResultOutboxEntry(config, entry) {
     lastAttemptAt: null,
     ...entry
   };
-  writeFileSync5(join10(dir, resultOutboxFileName(entry.commandId)), `${JSON.stringify(body, null, 2)}
+  writeFileSync6(join11(dir, resultOutboxFileName(entry.commandId)), `${JSON.stringify(body, null, 2)}
 `, { mode: 384 });
 }
 function moveResultOutboxEntryToInvalid(config, file, fullPath, reason, detail, original) {
   const invalidDir = resultOutboxInvalidDir(config);
-  mkdirSync5(invalidDir, { recursive: true });
-  const invalidPath = join10(invalidDir, file);
+  mkdirSync6(invalidDir, { recursive: true });
+  const invalidPath = join11(invalidDir, file);
   if (original === void 0) {
     try {
       renameSync3(fullPath, invalidPath);
     } catch {
-      copyFileSync2(fullPath, invalidPath);
+      copyFileSync3(fullPath, invalidPath);
       unlinkSync(fullPath);
     }
     return;
@@ -7272,14 +7993,14 @@ function moveResultOutboxEntryToInvalid(config, file, fullPath, reason, detail,
     ...detail ? { detail: truncateText(detail, 1e3) } : {},
     original
   };
-  writeFileSync5(invalidPath, `${JSON.stringify(evidence, null, 2)}
+  writeFileSync6(invalidPath, `${JSON.stringify(evidence, null, 2)}
 `, { mode: 384 });
   unlinkSync(fullPath);
 }
 function readValidResultOutboxEntryOrQuarantine(config, file, fullPath) {
   let entry;
   try {
-    entry = JSON.parse(readFileSync7(fullPath, "utf8"));
+    entry = JSON.parse(readFileSync8(fullPath, "utf8"));
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     moveResultOutboxEntryToInvalid(config, file, fullPath, "malformed_result_outbox_json", message);
@@ -7309,13 +8030,13 @@ function updateResultOutboxAttempt(fullPath, entry, err) {
     ...typeof err?.httpStatus === "number" ? { httpStatus: err.httpStatus } : {},
     lastError: truncateText(err instanceof Error ? err.message : String(err), 1e3)
   };
-  writeFileSync5(fullPath, `${JSON.stringify(next, null, 2)}
+  writeFileSync6(fullPath, `${JSON.stringify(next, null, 2)}
 `, { mode: 384 });
   return next;
 }
 function quarantineResultOutboxEntry(config, fullPath, file, entry, reason, err) {
   const invalidDir = resultOutboxInvalidDir(config);
-  mkdirSync5(invalidDir, { recursive: true });
+  mkdirSync6(invalidDir, { recursive: true });
   const body = {
     ...entry,
     invalidReason: reason,
@@ -7323,8 +8044,8 @@ function quarantineResultOutboxEntry(config, fullPath, file, entry, reason, err)
     ...typeof err?.httpStatus === "number" ? { httpStatus: err.httpStatus } : {},
     lastError: truncateText(err instanceof Error ? err.message : String(err), 1e3)
   };
-  const invalidPath = join10(invalidDir, file);
-  writeFileSync5(invalidPath, `${JSON.stringify(body, null, 2)}
+  const invalidPath = join11(invalidDir, file);
+  writeFileSync6(invalidPath, `${JSON.stringify(body, null, 2)}
 `, { mode: 384 });
   try {
     unlinkSync(fullPath);
@@ -7337,11 +8058,11 @@ function quarantineResultOutboxEntry(config, fullPath, file, entry, reason, err)
 }
 async function flushResultOutbox(config) {
   const dir = resultOutboxDir(config);
-  if (!existsSync9(dir)) return { attempted: 0, completed: 0 };
-  const files = readdirSync6(dir).filter((name) => name.endsWith(".json")).sort();
+  if (!existsSync10(dir)) return { attempted: 0, completed: 0 };
+  const files = readdirSync8(dir).filter((name) => name.endsWith(".json")).sort();
   let completed = 0;
   for (const file of files) {
-    const fullPath = join10(dir, file);
+    const fullPath = join11(dir, file);
     const entry = readValidResultOutboxEntryOrQuarantine(config, file, fullPath);
     if (!entry) continue;
     try {
@@ -7538,8 +8259,8 @@ async function materializeIssueAttachments(config, command, workspace) {
     runtimeAuth,
     issueId
   );
-  const targetDir = join10(workspace.cwd, "input-attachments");
-  mkdirSync5(targetDir, { recursive: true });
+  const targetDir = join11(workspace.cwd, "input-attachments");
+  mkdirSync6(targetDir, { recursive: true });
   const usedFilenames = /* @__PURE__ */ new Set();
   const materialized = [];
   for (const [index, rawAttachment] of attachments.entries()) {
@@ -7553,11 +8274,11 @@ async function materializeIssueAttachments(config, command, workspace) {
       filename = `${stem}-${index + 1}${ext}`;
     }
     usedFilenames.add(filename);
-    const targetPath = join10(targetDir, filename);
+    const targetPath = join11(targetDir, filename);
     const body = await runtimeApiBuffer(runtimeAuth, contentPath);
-    writeFileSync5(targetPath, body);
+    writeFileSync6(targetPath, body);
     const attachmentId = readString(attachment.id);
-    const actualSha256 = createHash6("sha256").update(body).digest("hex");
+    const actualSha256 = createHash8("sha256").update(body).digest("hex");
     const lineageCandidates = lineageCandidatesByAttachmentId.get(attachmentId) ?? [];
     const lineage = selectAttachmentLineage(lineageCandidates, actualSha256);
     if (lineageCandidates.length > 0 && !lineage) {
@@ -7580,7 +8301,7 @@ async function materializeIssueAttachments(config, command, workspace) {
       id: attachmentId,
       name: readString(attachment.originalFilename) ?? filename,
       path: targetPath,
-      relativePath: relative6(workspace.cwd, targetPath),
+      relativePath: relative7(workspace.cwd, targetPath),
       contentType: readString(attachment.contentType),
       byteSize: body.byteLength,
       contentPath,
@@ -7629,9 +8350,9 @@ async function materializeRequiredArtifactInputs(config, command, workspace) {
   if (manifest.version !== 1 || !Array.isArray(manifest.entries)) {
     throw new Error("artifact_input_manifest_invalid: expected version 1 entries array");
   }
-  const targetRoot = join10(workspace.cwd, "input-artifacts");
-  rmSync5(targetRoot, { recursive: true, force: true });
-  mkdirSync5(targetRoot, { recursive: true });
+  const targetRoot = join11(workspace.cwd, "input-artifacts");
+  rmSync6(targetRoot, { recursive: true, force: true });
+  mkdirSync6(targetRoot, { recursive: true });
   const usedPaths = /* @__PURE__ */ new Set();
   const materialized = [];
   for (const [index, rawEntry] of manifest.entries.entries()) {
@@ -7649,7 +8370,7 @@ async function materializeRequiredArtifactInputs(config, command, workspace) {
       throw new Error(`artifact_input_manifest_invalid: entry ${index} contentPath does not match attachmentId`);
     }
     const body = await runtimeApiBuffer(runtimeAuth, contentPath);
-    const actualSha256 = createHash6("sha256").update(body).digest("hex");
+    const actualSha256 = createHash8("sha256").update(body).digest("hex");
     if (body.byteLength !== byteSize || actualSha256 !== sha256) {
       throw new Error(
         `artifact_input_integrity_mismatch: workProductId=${workProductId} expectedBytes=${byteSize} actualBytes=${body.byteLength} expectedSha256=${sha256} actualSha256=${actualSha256}`
@@ -7660,18 +8381,18 @@ async function materializeRequiredArtifactInputs(config, command, workspace) {
       id: attachmentId,
       originalFilename: readString(entry.originalFilename)
     }, index);
-    let relativePath = join10("input-artifacts", sourceDir, filename).split(/[\\/]+/).join("/");
+    let relativePath = join11("input-artifacts", sourceDir, filename).split(/[\\/]+/).join("/");
     if (usedPaths.has(relativePath)) {
       const ext = extname2(filename);
       const stem = ext ? filename.slice(0, -ext.length) : filename;
       filename = `${stem}-${index + 1}${ext}`;
-      relativePath = join10("input-artifacts", sourceDir, filename).split(/[\\/]+/).join("/");
+      relativePath = join11("input-artifacts", sourceDir, filename).split(/[\\/]+/).join("/");
     }
     usedPaths.add(relativePath);
-    const targetPath = join10(workspace.cwd, relativePath);
-    mkdirSync5(dirname6(targetPath), { recursive: true });
-    writeFileSync5(targetPath, body);
-    chmodSync3(targetPath, 292);
+    const targetPath = join11(workspace.cwd, relativePath);
+    mkdirSync6(dirname7(targetPath), { recursive: true });
+    writeFileSync6(targetPath, body);
+    chmodSync5(targetPath, 292);
     materialized.push({
       id: attachmentId,
       workProductId,
@@ -7690,9 +8411,9 @@ async function materializeRequiredArtifactInputs(config, command, workspace) {
     version: 1,
     entries: materialized.map(({ path: _path, relativePath, ...entry }) => ({ ...entry, path: relativePath }))
   };
-  const manifestPath = join10(targetRoot, "artifact-input-manifest.json");
-  writeFileSync5(manifestPath, JSON.stringify(localManifest, null, 2) + "\n");
-  chmodSync3(manifestPath, 292);
+  const manifestPath = join11(targetRoot, "artifact-input-manifest.json");
+  writeFileSync6(manifestPath, JSON.stringify(localManifest, null, 2) + "\n");
+  chmodSync5(manifestPath, 292);
   updateWorkspaceManifest(workspaceManifestPath(workspace), { artifactInputManifest: localManifest });
   await ingestLog(config, command, "system", "info", `Materialized ${materialized.length} required artifact input(s) into the execution workspace`, {
     artifactInputCount: materialized.length,
@@ -7701,46 +8422,46 @@ async function materializeRequiredArtifactInputs(config, command, workspace) {
   return materialized;
 }
 function issueCheckpointDir(workspace) {
-  return join10(dirname6(workspace.runDir), "checkpoint");
+  return join11(dirname7(workspace.runDir), "checkpoint");
 }
 async function clearIssueCheckpoint(config, command, workspace, reason) {
   const checkpointDir = issueCheckpointDir(workspace);
-  if (!existsSync9(checkpointDir)) return false;
-  rmSync5(checkpointDir, { recursive: true, force: true });
+  if (!existsSync10(checkpointDir)) return false;
+  rmSync6(checkpointDir, { recursive: true, force: true });
   await ingestLog(config, command, "system", "info", "Cleared issue continuation checkpoint", { reason });
   return true;
 }
 function safeCheckpointRelativePath(rawPath) {
   const raw = String(rawPath ?? "").trim();
-  if (isAbsolute6(raw) || /^[A-Za-z]:[\\/]/.test(raw)) return null;
+  if (isAbsolute7(raw) || /^[A-Za-z]:[\\/]/.test(raw)) return null;
   const normalized = raw.split(/[\\/]+/).filter(Boolean).join("/");
   if (!normalized || normalized.startsWith("../") || normalized.split("/").some((segment) => segment.startsWith("."))) return null;
   if (normalized.startsWith("input-attachments/") || isRuntimeMetadataArtifactPath(normalized)) return null;
   return normalized;
 }
 function hashFileSha256(filePath) {
-  return createHash6("sha256").update(readFileSync7(filePath)).digest("hex");
+  return createHash8("sha256").update(readFileSync8(filePath)).digest("hex");
 }
 async function materializeIssueCheckpoint(config, command, workspace) {
   const checkpointDir = issueCheckpointDir(workspace);
-  const manifestPath = join10(checkpointDir, "manifest.json");
-  if (!existsSync9(manifestPath)) return [];
+  const manifestPath = join11(checkpointDir, "manifest.json");
+  if (!existsSync10(manifestPath)) return [];
   let manifest;
   try {
-    manifest = asRecord(JSON.parse(readFileSync7(manifestPath, "utf8")));
+    manifest = asRecord(JSON.parse(readFileSync8(manifestPath, "utf8")));
   } catch (err) {
-    rmSync5(checkpointDir, { recursive: true, force: true });
+    rmSync6(checkpointDir, { recursive: true, force: true });
     throw new Error(`invalid issue checkpoint manifest: ${err instanceof Error ? err.message : String(err)}`);
   }
   const expiresAt = Date.parse(readString(manifest.expiresAt) ?? "");
   if (!Number.isFinite(expiresAt) || expiresAt <= Date.now() || readString(manifest.issueId) !== commandIssueId(command)) {
-    rmSync5(checkpointDir, { recursive: true, force: true });
+    rmSync6(checkpointDir, { recursive: true, force: true });
     return [];
   }
   try {
     const files = Array.isArray(manifest.files) ? manifest.files : [];
     if (files.length > 20) throw new Error("issue checkpoint manifest exceeds the limit of 20 files");
-    const filesRoot = realpathSync3(join10(checkpointDir, "files"));
+    const filesRoot = realpathSync3(join11(checkpointDir, "files"));
     const workspaceRoot = realpathSync3(workspace.cwd);
     const validated = [];
     let totalBytes = 0;
@@ -7748,12 +8469,12 @@ async function materializeIssueCheckpoint(config, command, workspace) {
       const file = asRecord(rawFile);
       const relativePath = safeCheckpointRelativePath(readString(file.path));
       if (!relativePath) throw new Error("issue checkpoint manifest contains an invalid file path");
-      const sourceCandidate = resolve8(filesRoot, relativePath);
-      const target = resolve8(workspaceRoot, relativePath);
+      const sourceCandidate = resolve10(filesRoot, relativePath);
+      const target = resolve10(workspaceRoot, relativePath);
       if (!pathWithin2(sourceCandidate, filesRoot) || !pathWithin2(target, workspaceRoot)) {
         throw new Error(`issue checkpoint path escapes its workspace: ${relativePath}`);
       }
-      if (!existsSync9(sourceCandidate)) throw new Error(`issue checkpoint file is missing: ${relativePath}`);
+      if (!existsSync10(sourceCandidate)) throw new Error(`issue checkpoint file is missing: ${relativePath}`);
       const source = realpathSync3(sourceCandidate);
       if (!pathWithin2(source, filesRoot) || !statSync7(source).isFile()) {
         throw new Error(`issue checkpoint source escapes its storage root: ${relativePath}`);
@@ -7773,17 +8494,17 @@ async function materializeIssueCheckpoint(config, command, workspace) {
     const materialized = [];
     for (const { relativePath, source, target } of validated) {
       try {
-        lstatSync4(target);
+        lstatSync6(target);
         continue;
       } catch (err) {
         if (err?.code !== "ENOENT") throw err;
       }
-      mkdirSync5(dirname6(target), { recursive: true });
-      const targetParent = realpathSync3(dirname6(target));
+      mkdirSync6(dirname7(target), { recursive: true });
+      const targetParent = realpathSync3(dirname7(target));
       if (!pathWithin2(targetParent, workspaceRoot)) {
         throw new Error(`issue checkpoint target escapes its workspace: ${relativePath}`);
       }
-      copyFileSync2(source, target);
+      copyFileSync3(source, target);
       materialized.push(relativePath);
     }
     if (materialized.length > 0) {
@@ -7807,31 +8528,31 @@ async function materializeIssueCheckpoint(config, command, workspace) {
 }
 async function saveIssueCheckpoint(config, command, workspace, candidates) {
   const checkpointDir = issueCheckpointDir(workspace);
-  const filesDir = join10(checkpointDir, "files");
-  rmSync5(checkpointDir, { recursive: true, force: true });
-  mkdirSync5(filesDir, { recursive: true });
+  const filesDir = join11(checkpointDir, "files");
+  rmSync6(checkpointDir, { recursive: true, force: true });
+  mkdirSync6(filesDir, { recursive: true });
   const files = [];
   let totalBytes = 0;
   const workspaceRoot = realpathSync3(workspace.cwd);
   for (const candidate of candidates.slice(0, 20)) {
     const relativePath = safeCheckpointRelativePath(candidate.rawPath);
     const source = readString(candidate.filePath);
-    if (!relativePath || !source || !existsSync9(source) || !statSync7(source).isFile()) continue;
+    if (!relativePath || !source || !existsSync10(source) || !statSync7(source).isFile()) continue;
     const ownedSource = realpathSync3(source);
     if (!pathWithin2(ownedSource, workspaceRoot)) {
       throw new Error(`issue checkpoint source escapes its execution workspace: ${relativePath}`);
     }
     const byteSize = statSync7(ownedSource).size;
     if (byteSize <= 0 || totalBytes + byteSize > MAX_CHECKPOINT_BYTES) continue;
-    const target = resolve8(filesDir, relativePath);
+    const target = resolve10(filesDir, relativePath);
     if (!pathWithin2(target, filesDir)) continue;
-    mkdirSync5(dirname6(target), { recursive: true });
-    copyFileSync2(ownedSource, target);
+    mkdirSync6(dirname7(target), { recursive: true });
+    copyFileSync3(ownedSource, target);
     totalBytes += byteSize;
     files.push({ path: relativePath, byteSize, sha256: hashFileSha256(ownedSource) });
   }
   if (files.length === 0) {
-    rmSync5(checkpointDir, { recursive: true, force: true });
+    rmSync6(checkpointDir, { recursive: true, force: true });
     return null;
   }
   const manifest = {
@@ -7843,7 +8564,7 @@ async function saveIssueCheckpoint(config, command, workspace, candidates) {
     totalBytes,
     files
   };
-  writeFileSync5(join10(checkpointDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
+  writeFileSync6(join11(checkpointDir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}
 `);
   await ingestLog(config, command, "system", "warn", `Saved ${files.length} required deliverable(s) for continuation recovery`, manifest);
   return manifest;
@@ -7915,6 +8636,11 @@ async function executeRunCommand(config, command) {
   let managedMcpProfile = null;
   let managedMcpCleanup = null;
   let cleanupManagedMcpProfile = null;
+  let piChildIsolation = null;
+  let trustedPiRuntime = null;
+  let trustedPiRuntimeSourcePaths = null;
+  let trustedPiRuntimeProfile = null;
+  let trustedPiRuntimeAudit = null;
   if (executor.kind === "codex" && Object.keys(governedMcp).length > 0) {
     managedMcpProfile = prepareManagedCodexMcpProfile({
       commandId: command.commandId,
@@ -7987,6 +8713,92 @@ async function executeRunCommand(config, command) {
       ...managedMcpProfile.attestation
     });
   }
+  const piChildAllocator = executor.kind === "pi" ? configuredPiChildIdentityAllocator(config) : null;
+  const trustedPiRuntimeAssertion = commandTrustedPiRuntimeAssertion(command);
+  if (Object.keys(trustedPiRuntimeAssertion).length > 0) {
+    try {
+      if (executor.kind !== "pi") {
+        throw new Error("pi_trusted_runtime_assertion_binding_mismatch:executorKind");
+      }
+      trustedPiRuntimeSourcePaths = trustedPiRuntimeSources(config);
+      trustedPiRuntime = verifyTrustedPiRuntimeAssertion({
+        assertion: trustedPiRuntimeAssertion,
+        connectorId: requireConnectorId(config),
+        commandId: command.commandId,
+        runId: commandRunId(command),
+        leaseId: command.leaseId,
+        executorKind: executor.kind,
+        localDigests: readTrustedPiRuntimeLocalDigests(trustedPiRuntimeSourcePaths)
+      });
+      if (!managedMcpProfile) {
+        throw new Error("pi_trusted_runtime_governed_profile_required");
+      }
+      requireTrustedPiChildAllocator(piChildAllocator, true);
+      trustedPiRuntimeProfile = materializeTrustedPiRuntimeProfile({
+        seedRoot: trustedPiRuntimeSourcePaths.seedRoot,
+        overlayRoot: trustedPiRuntimeSourcePaths.overlayRoot,
+        profileRoot: managedMcpProfile.profileRoot,
+        agentDir: managedMcpProfile.env.PI_CODING_AGENT_DIR,
+        governedMcpConfigPath: managedMcpProfile.configPath,
+        verifiedAssertion: trustedPiRuntime
+      });
+      executorEnv = {
+        ...executorEnv,
+        AMASTER_MANAGED_RUNTIME_ASSERTION_FD: "3",
+        AMASTER_MANAGED_RUNTIME_AUDIT_FILE: join11(
+          managedMcpProfile.env.HOME,
+          ".amaster-managed-runtime-audit.jsonl"
+        ),
+        AMASTER_RUNTIME_LEASE_ID: command.leaseId
+      };
+    } catch (error) {
+      if (managedMcpProfile) {
+        cleanupManagedMcpProfile(managedMcpProfile, {
+          commandId: command.commandId,
+          runId: commandRunId(command)
+        });
+      }
+      throw error;
+    }
+    await ingestLog(config, command, "system", "info", "Verified trusted Pi runtime provenance", {
+      presentationKind: "trusted_pi_runtime_attestation",
+      attestationId: trustedPiRuntime.attestationId,
+      unknownToolMode: trustedPiRuntime.unknownToolMode,
+      directToolBudget: trustedPiRuntime.directToolBudget,
+      digests: trustedPiRuntime.digests,
+      profileAttestationId: trustedPiRuntimeProfile.attestationId,
+      inheritedEntries: trustedPiRuntimeProfile.facts.inheritedEntries
+    });
+  }
+  if (piChildAllocator) {
+    try {
+      const profileRoot = piChildIsolationProfileRoot({
+        managedMcpProfile,
+        executorHome: workspace.executorHome
+      });
+      piChildIsolation = preparePiChildIsolation({
+        allocator: piChildAllocator,
+        effectiveUid: typeof process.geteuid === "function" ? process.geteuid() : null,
+        commandId: command.commandId,
+        runId: commandRunId(command),
+        profileRoot,
+        workspaceRoot: cwd,
+        allowedRoot: config.runtimeWorkspacesRoot
+      });
+    } catch (error) {
+      if (managedMcpProfile) {
+        cleanupManagedMcpProfile(managedMcpProfile, {
+          commandId: command.commandId,
+          runId: commandRunId(command)
+        });
+      }
+      throw error;
+    }
+    await ingestLog(config, command, "system", "info", "Prepared isolated Pi child identity", {
+      presentationKind: "pi_child_isolation_attestation",
+      ...piChildIsolation.attestation
+    });
+  }
   await ingestLog(config, command, "system", "info", `Compiled ${contextManifest.mode} prompt using ${contextManifest.budget.usedChars}/${contextManifest.budget.totalChars} characters`, {
     presentationKind: "context_manifest",
     contextManifest
@@ -8033,11 +8845,35 @@ async function executeRunCommand(config, command) {
         maxRssMb: config.executorMaxRssMb,
         signal: abortController.signal,
         executorKind: executor.kind,
+        ...piChildIsolation ? { spawnIdentity: piChildIsolation.spawn } : {},
+        ...trustedPiRuntime ? {
+          managedInput: `${JSON.stringify(trustedPiRuntimeAssertion)}
+`
+        } : {},
         onOutput: (stream, chunk, rawBytes) => {
           noteActiveRunOutput(command, stream, chunk, rawBytes);
           liveOutputLogger.write(stream, chunk);
         }
       });
+      if (trustedPiRuntime) {
+        verifyTrustedPiRuntimeAssertion({
+          assertion: trustedPiRuntimeAssertion,
+          connectorId: requireConnectorId(config),
+          commandId: command.commandId,
+          runId: commandRunId(command),
+          leaseId: command.leaseId,
+          executorKind: executor.kind,
+          localDigests: readTrustedPiRuntimeLocalDigests(trustedPiRuntimeSourcePaths),
+          verifyExpiry: false
+        });
+        trustedPiRuntimeAudit = readTrustedPiRuntimeAudit({
+          profileRoot: managedMcpProfile.profileRoot,
+          auditFile: executorEnv.AMASTER_MANAGED_RUNTIME_AUDIT_FILE,
+          commandId: command.commandId,
+          runId: commandRunId(command),
+          runtimeEnforcementDigest: trustedPiRuntime.digests.runtimeEnforcementDigest
+        });
+      }
     } finally {
       await liveOutputLogger.flush();
     }
@@ -8121,7 +8957,7 @@ async function executeRunCommand(config, command) {
           workspace,
           workspaceStatus.artifacts.map((artifact) => ({
             rawPath: artifact.relativePath,
-            filePath: resolve8(cwd, artifact.relativePath)
+            filePath: resolve10(cwd, artifact.relativePath)
           }))
         );
         nativeSessionRollout = {
@@ -8265,6 +9101,17 @@ async function executeRunCommand(config, command) {
           attestation: managedMcpProfile.attestation,
           cleanup: managedMcpCleanup
         }
+      } : {},
+      ...piChildIsolation ? {
+        piChildIsolation: piChildIsolation.attestation
+      } : {},
+      ...trustedPiRuntimeProfile ? {
+        trustedPiRuntime: {
+          attestationId: trustedPiRuntime.attestationId,
+          profileAttestationId: trustedPiRuntimeProfile.attestationId,
+          ...trustedPiRuntimeProfile.facts,
+          audit: trustedPiRuntimeAudit
+        }
       } : {}
     };
     const completion = await completeCommand(config, command, cancelled ? "cancelled" : succeeded ? "succeeded" : "failed", result2, error ?? void 0);
@@ -8287,6 +9134,7 @@ async function executeRunCommand(config, command) {
         runId: commandRunId(command)
       });
     }
+    piChildIsolation?.release();
     stopActiveRunHeartbeats();
     forgetActiveRunCommand();
   }
@@ -8489,7 +9337,7 @@ async function runLoop(config) {
 ${message}
 `);
     }
-    await new Promise((resolve9) => setTimeout(resolve9, config.pollIntervalSeconds * 1e3));
+    await new Promise((resolve11) => setTimeout(resolve11, config.pollIntervalSeconds * 1e3));
   }
 }
 function help() {