@amaster.ai/employee-runtime-connector 0.1.1-beta.20 → 0.1.1-beta.21

package/dist/amaster-runtime-daemon.mjs

@@ -2,7 +2,7 @@
 // MirrorX runtime connector daemon bundle.
 
 // src/amaster-runtime-daemon.mjs
-import { createHash as createHash13 } from "node:crypto";
+import { createHash as createHash14 } from "node:crypto";
 import { chmodSync as chmodSync6, copyFileSync as copyFileSync3, existsSync as existsSync14, lstatSync as lstatSync7, mkdirSync as mkdirSync9, mkdtempSync, readFileSync as readFileSync11, readdirSync as readdirSync9, realpathSync as realpathSync5, renameSync as renameSync6, rmSync as rmSync7, statSync as statSync8, symlinkSync as symlinkSync4, unlinkSync as unlinkSync2, writeFileSync as writeFileSync9 } from "node:fs";
 import { arch as arch3, homedir as homedir3, hostname as hostname2, platform as platform3, tmpdir } from "node:os";
 import { basename as basename6, delimiter as delimiter3, dirname as dirname9, extname as extname2, isAbsolute as isAbsolute8, join as join15, relative as relative9, resolve as resolve12 } from "node:path";
@@ -4116,6 +4116,144 @@ function retainedSourceExecutorEntry(entry, executorKind) {
   };
 }
 
+// src/amaster-runtime-daemon/current-run-contract.mjs
+import { createHash as createHash4 } from "node:crypto";
+var CONTRACT_VERSION = "mirrorx.current-run-contract.v1";
+var REQUIRED_ACTIONS = [
+  "amaster.read_issue_delivery",
+  "amaster.read_issue",
+  "amaster.read_issue_document",
+  "publish_delivery_manifest"
+];
+var FORBIDDEN_ACTIONS = [
+  "upsert_document",
+  "upsert_document_revision",
+  "create_interaction:request_confirmation:review",
+  "update_parent:done"
+];
+var TERMINAL_DISPOSITION = "end_after_successful_manifest_publication";
+var OFFSET_DATETIME_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/u;
+function exactKeys(value, expected) {
+  const keys = Object.keys(asRecord(value)).sort();
+  const sortedExpected = [...expected].sort();
+  return keys.length === sortedExpected.length && keys.every((key, index) => key === sortedExpected[index]);
+}
+function exactStringArray(value, expected) {
+  return Array.isArray(value) && value.length === expected.length && value.every((entry, index) => entry === expected[index]);
+}
+function canonicalJson(value) {
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  if (value === void 0) return "null";
+  if (!value || typeof value !== "object") return JSON.stringify(value) ?? "null";
+  return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(",")}}`;
+}
+function semanticHash(contract) {
+  const { contractHash: _contractHash, compiledAt: _compiledAt, ...semantic } = contract;
+  return `sha256:${createHash4("sha256").update(canonicalJson(semantic)).digest("hex")}`;
+}
+function validateBlockingGaps(value) {
+  return Array.isArray(value) && value.length === 0;
+}
+function validateAuthorityRefs(value) {
+  if (!Array.isArray(value) || value.length === 0 || value.length > 100) return false;
+  if (value.some((ref) => typeof ref !== "string" || ref.trim().length === 0 || ref.length > 500)) {
+    return false;
+  }
+  const canonical = [...new Set(value)].sort();
+  return canonical.length === value.length && canonical.every((ref, index) => ref === value[index]);
+}
+function validateContract(value) {
+  if (value === void 0 || value === null) return { kind: "missing" };
+  const contract = asRecord(value);
+  const authority = asRecord(contract.authority);
+  const execution = asRecord(contract.execution);
+  const errors = [];
+  if (!exactKeys(contract, [
+    "schemaVersion",
+    "rolloutMode",
+    "contractHash",
+    "compiledAt",
+    "authority",
+    "execution"
+  ])) errors.push("shape_invalid");
+  if (contract.schemaVersion !== CONTRACT_VERSION) errors.push("schema_version_invalid");
+  if (contract.rolloutMode !== "shadow") errors.push("rollout_mode_invalid");
+  if (!/^sha256:[a-f0-9]{64}$/u.test(readString(contract.contractHash) ?? "")) errors.push("contract_hash_invalid");
+  const compiledAt = readString(contract.compiledAt);
+  if (!compiledAt || !OFFSET_DATETIME_PATTERN.test(compiledAt) || Number.isNaN(Date.parse(compiledAt))) {
+    errors.push("compiled_at_invalid");
+  }
+  if (!exactKeys(authority, ["sourceRefs"]) || !validateAuthorityRefs(authority.sourceRefs)) {
+    errors.push("authority_invalid");
+  }
+  if (!exactKeys(execution, [
+    "mode",
+    "requiredActions",
+    "forbiddenActions",
+    "terminalDisposition",
+    "blockingGaps"
+  ]) || execution.mode !== "manifest_refresh_only" || !exactStringArray(execution.requiredActions, REQUIRED_ACTIONS) || !exactStringArray(execution.forbiddenActions, FORBIDDEN_ACTIONS) || execution.terminalDisposition !== TERMINAL_DISPOSITION || !validateBlockingGaps(execution.blockingGaps)) {
+    errors.push("execution_invalid");
+  }
+  if (errors.length === 0 && semanticHash(contract) !== contract.contractHash) {
+    errors.push("contract_hash_mismatch");
+  }
+  return errors.length > 0 ? { kind: "invalid", errors: [...new Set(errors)] } : { kind: "valid", contract };
+}
+function legacyManifestRefreshOnly(context) {
+  const readiness = asRecord(asRecord(context).paperclipDeliveryReadiness);
+  const currentManifest = asRecord(readiness.currentManifest);
+  const findings = (Array.isArray(readiness.findings) ? readiness.findings : []).map((entry) => asRecord(entry)).filter((entry) => readString(entry.code));
+  const manifestRefs = [
+    currentManifest.primaryRef,
+    ...Array.isArray(currentManifest.supportingRefs) ? currentManifest.supportingRefs : []
+  ].map((entry) => asRecord(entry));
+  const documentRefIds = new Set(manifestRefs.filter((ref) => readString(ref.kind) === "document").map((ref) => readString(ref.refId)).filter(Boolean));
+  return readString(readiness.mode) === "required" && Number.isInteger(currentManifest.revision) && readString(currentManifest.requirementRevision) === readString(readiness.requirementRevision) && findings.length > 0 && findings.every((entry) => readString(entry.code) === "deliverable_ref_stale" && documentRefIds.has(readString(entry.refId)));
+}
+function auditCurrentRunContractShadow(value, context) {
+  const expected = legacyManifestRefreshOnly(context);
+  const validation = validateContract(value);
+  const base = {
+    schemaVersion: "mirrorx.current-run-contract-shadow-audit.v1",
+    expectedMode: expected ? "manifest_refresh_only" : "none"
+  };
+  if (validation.kind === "missing") {
+    return {
+      ...base,
+      status: expected ? "missing" : "match",
+      receivedMode: "none",
+      contractHash: null,
+      validationErrors: []
+    };
+  }
+  if (validation.kind === "invalid") {
+    return {
+      ...base,
+      status: "invalid",
+      receivedMode: "invalid",
+      contractHash: readString(asRecord(value).contractHash) ?? null,
+      validationErrors: validation.errors
+    };
+  }
+  return {
+    ...base,
+    status: expected ? "match" : "unexpected",
+    receivedMode: "manifest_refresh_only",
+    contractHash: validation.contract.contractHash,
+    validationErrors: []
+  };
+}
+function attachCurrentRunContractShadowAudit(compilation, value, context) {
+  return {
+    ...compilation,
+    manifest: {
+      ...asRecord(compilation).manifest,
+      currentRunContractShadow: auditCurrentRunContractShadow(value, context)
+    }
+  };
+}
+
 // src/amaster-runtime-daemon/task-context-policy.mjs
 var TASK_CONTEXT_MANIFEST_VERSION = "task-context-v1";
 function resolveTaskContextMemoryPolicy(context) {
@@ -4828,17 +4966,6 @@ Runtime Action continuation is unavailable: managed Pi MCP tool mode is not prox
   return `${heading}
 Runtime Action continuation is unavailable: executor kind does not support a governed Runtime Action continuation. Do not guess a tool call.`;
 }
-function isManifestRefreshOnly(context) {
-  const readiness = asRecord(context.paperclipDeliveryReadiness);
-  const currentManifest = asRecord(readiness.currentManifest);
-  const findings = (Array.isArray(readiness.findings) ? readiness.findings : []).map((entry) => asRecord(entry)).filter((entry) => readString(entry.code));
-  const manifestRefs = [
-    currentManifest.primaryRef,
-    ...Array.isArray(currentManifest.supportingRefs) ? currentManifest.supportingRefs : []
-  ].map((entry) => asRecord(entry));
-  const documentRefIds = new Set(manifestRefs.filter((ref) => readString(ref.kind) === "document").map((ref) => readString(ref.refId)).filter(Boolean));
-  return readString(readiness.mode) === "required" && Number.isInteger(currentManifest.revision) && readString(currentManifest.requirementRevision) === readString(readiness.requirementRevision) && findings.length > 0 && findings.every((entry) => readString(entry.code) === "deliverable_ref_stale" && documentRefIds.has(readString(entry.refId)));
-}
 function runtimeAuthorizationText(context, mode, { suppressOrdinaryCompletionContract = false } = {}) {
   const envelope = asRecord(context.authorizationEnvelope);
   const allowed = new Set(
@@ -4856,7 +4983,7 @@ function runtimeAuthorizationText(context, mode, { suppressOrdinaryCompletionCon
   const businessOutcome = asRecord(requirements.businessOutcome);
   const completionRole = readString(completion.role);
   const completionDeliverable = readString(completion.deliverable);
-  const manifestRefreshOnly = isManifestRefreshOnly(context);
+  const manifestRefreshOnly = legacyManifestRefreshOnly(context);
   const firstDocumentCheckpoint = completionDeliverable === "document_or_artifact" ? manifestRefreshOnly ? "The current deliverable content already exists and this run is limited to refreshing stale immutable Manifest refs. Do not create or revise a document unless a fresh Delivery readiness read proves a content or acceptance gap beyond stale refs." : mode === "cold" ? "Before the first external browse, search, or research action, call upsert_document with a stable key. Create a checkpoint skeleton containing the acceptance criteria, a source table, and known unknowns; update the same document with each piece of verified evidence instead of waiting until broad research is complete. Immediately after upsert_document, call update_parent with status: in_progress and a concrete next action; complete both control-plane writes before the first external browse, search, or research action." : "Before the first external browse, search, or research action, read the existing stable-key document. Preserve all still-valid verified rows, source URLs, conclusions, and known unknowns; do not replace a populated document with a blank skeleton or less-informative fallback. Only when the document does not exist may you create a checkpoint skeleton. Then call update_parent with status: in_progress and a concrete next action before the first external browse, search, or research action. Update the same document with each piece of verified evidence." : "";
   const completionContract = !suppressOrdinaryCompletionContract && completionRole && completionDeliverable ? [
     "Before ending this run, persist durable progress through Runtime Actions and record one explicit task disposition. Browser and tool history alone are not durable progress.",
@@ -4936,7 +5063,7 @@ function runtimeDeliveryReadinessText(context, input) {
   })).filter((entry) => entry.code);
   const manifestRequirementRevision = readString(currentManifest.requirementRevision);
   const requirementRevision = readString(readiness.requirementRevision);
-  const manifestRefreshOnly = isManifestRefreshOnly(context);
+  const manifestRefreshOnly = legacyManifestRefreshOnly(context);
   const refSummary = (value) => {
     const ref = asRecord(value);
     return {
@@ -5323,6 +5450,68 @@ ${resolvedDependencies.details.content}` : ""
   return { prompt, manifest };
 }
 
+// src/amaster-runtime-daemon/agent-instruction-delivery.mjs
+var AUTO_LOAD_EXECUTOR_KINDS = /* @__PURE__ */ new Set(["codex", "pi"]);
+function resolveAgentInstructionDelivery(executorKind, options = {}) {
+  const normalizedExecutorKind = typeof executorKind === "string" && executorKind.trim() ? executorKind.trim().toLowerCase() : "unknown";
+  const runnerKind = typeof options.runnerKind === "string" && options.runnerKind.trim() ? options.runnerKind.trim().toLowerCase() : "unknown";
+  const materializedFiles = Array.isArray(options.materializedFiles) ? [...new Set(options.materializedFiles.filter((path) => typeof path === "string" && path.trim()))].sort() : [];
+  const suppliedFiles = Array.isArray(options.suppliedFiles) ? [...new Set(options.suppliedFiles.filter((path) => typeof path === "string" && path.trim()))].sort() : materializedFiles;
+  const executorSupportsAutoLoad = AUTO_LOAD_EXECUTOR_KINDS.has(normalizedExecutorKind);
+  const instructionsSupplied = suppliedFiles.length > 0;
+  const entryFileSupplied = suppliedFiles.includes("AGENTS.md");
+  const entryFileMaterialized = materializedFiles.includes("AGENTS.md");
+  const autoLoaded = executorSupportsAutoLoad && entryFileSupplied && entryFileMaterialized;
+  return {
+    version: 1,
+    runnerKind,
+    executorKind: normalizedExecutorKind,
+    mode: autoLoaded ? "executor_auto_load" : instructionsSupplied ? "explicit_read_required" : "not_applicable",
+    channel: autoLoaded ? "workspace_project_instructions" : instructionsSupplied ? "user_prompt_pointer" : null,
+    attestedBy: "runtime_executor_contract",
+    reason: autoLoaded ? "executor_contract_and_materialization_attested" : !instructionsSupplied ? "agent_instructions_not_supplied" : !entryFileSupplied ? "agents_entry_not_supplied" : executorSupportsAutoLoad ? "agents_entry_not_materialized" : "executor_auto_load_not_supported",
+    entryFileSupplied,
+    entryFileMaterialized,
+    materializedFileCount: materializedFiles.length,
+    materializedFiles
+  };
+}
+function agentInstructionFileNames(bundle) {
+  const files = bundle && typeof bundle === "object" && bundle.files && typeof bundle.files === "object" ? bundle.files : {};
+  return Object.keys(files).filter((path) => typeof files[path] === "string" && files[path].trim()).sort((left, right) => left === right ? 0 : left === "AGENTS.md" ? -1 : right === "AGENTS.md" ? 1 : left.localeCompare(right));
+}
+function renderAgentInstructionsBundle(bundle, delivery) {
+  const names = agentInstructionFileNames(bundle);
+  if (names.length === 0) return "";
+  const resolvedDelivery = delivery ?? resolveAgentInstructionDelivery("unknown");
+  const materialized = `Current agent instructions are materialized in the execution workspace as: ${names.map((name) => `./${name}`).join(", ")}.`;
+  if (!names.includes("AGENTS.md")) {
+    return [
+      materialized,
+      "No ./AGENTS.md entry is present. Read the listed instruction files before acting and follow them for the whole run."
+    ].join("\n");
+  }
+  if (resolvedDelivery.mode === "executor_auto_load") {
+    return [
+      materialized,
+      "This executor has already loaded ./AGENTS.md through its project-instruction channel. Follow it for the whole run; do not read it again merely to initialize. Read sibling instruction files only when ./AGENTS.md references them or the current task requires them."
+    ].join("\n");
+  }
+  return [
+    materialized,
+    "Automatic project-instruction loading is not attested for this executor. Read ./AGENTS.md first and follow it (including any sibling files it references) for the whole run."
+  ].join("\n");
+}
+function agentInstructionDeliveryAudit(bundle, delivery) {
+  const files = agentInstructionFileNames(bundle);
+  return {
+    ...delivery ?? resolveAgentInstructionDelivery("unknown"),
+    entryFile: files.includes("AGENTS.md") ? "AGENTS.md" : null,
+    suppliedFileCount: files.length,
+    suppliedFiles: files
+  };
+}
+
 // src/amaster-runtime-daemon/config-state.mjs
 import { existsSync as existsSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync5, renameSync as renameSync3, rmSync as rmSync3, writeFileSync as writeFileSync5 } from "node:fs";
 import { homedir as homedir2, hostname } from "node:os";
@@ -7202,7 +7391,7 @@ var postJsonWithRetry = postRuntimeConnectorJsonWithRetry;
 var bestEffortPostJson = bestEffortPostRuntimeConnectorJson;
 
 // src/amaster-runtime-daemon/runtime-artifact-upload.mjs
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 import { closeSync, constants, fstatSync, lstatSync as lstatSync3, openSync, readFileSync as readFileSync6, realpathSync as realpathSync3 } from "node:fs";
 import { isAbsolute as isAbsolute3, relative as relative3, resolve as resolve3 } from "node:path";
 var SHA256_PATTERN = /^[a-f0-9]{64}$/;
@@ -7292,7 +7481,7 @@ function prepareRuntimeArtifactUploads(cwd, mcpToolResults) {
       `Runtime Artifact ${intentId}`,
       { expectedByteSize }
     );
-    const actualSha256 = createHash4("sha256").update(body).digest("hex");
+    const actualSha256 = createHash5("sha256").update(body).digest("hex");
     if (body.length !== expectedByteSize || actualSha256 !== expectedSha256) {
       throw new Error(`Runtime Artifact ${intentId} bytes do not match the governed ownership manifest`);
     }
@@ -7309,7 +7498,7 @@ function prepareRuntimeArtifactUploads(cwd, mcpToolResults) {
 }
 
 // src/amaster-runtime-daemon/runtime-document-upload.mjs
-import { createHash as createHash5 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 
 // src/amaster-runtime-daemon/workspace-sensitive-path.mjs
 var SENSITIVE_PATH_SEGMENTS = /* @__PURE__ */ new Set([
@@ -7384,7 +7573,7 @@ function prepareRuntimeDocumentUploads(cwd, mcpToolResults) {
         maxByteSize: MAX_WORKSPACE_DOCUMENT_BYTES
       }
     );
-    const actualSha256 = createHash5("sha256").update(body).digest("hex");
+    const actualSha256 = createHash6("sha256").update(body).digest("hex");
     if (body.length !== expectedByteSize || actualSha256 !== expectedSha256) {
       throw new Error(`Runtime Document ${callId} bytes do not match the governed ownership manifest`);
     }
@@ -7510,7 +7699,7 @@ function createRuntimeArtifactIngestQueue({ ingest, onError }) {
 }
 
 // src/amaster-runtime-daemon/workspace-guard.mjs
-import { createHash as createHash6 } from "node:crypto";
+import { createHash as createHash7 } from "node:crypto";
 import { existsSync as existsSync7, mkdirSync as mkdirSync6, realpathSync as realpathSync4, statSync as statSync4 } from "node:fs";
 import { basename as basename4, join as join8, isAbsolute as isAbsolute4, relative as relative4, resolve as resolve4 } from "node:path";
 
@@ -7636,7 +7825,7 @@ function resolveWorkspaceCwd(config, command) {
   return cwd;
 }
 function shortHash(value, length = 12) {
-  return createHash6("sha256").update(String(value)).digest("hex").slice(0, length);
+  return createHash7("sha256").update(String(value)).digest("hex").slice(0, length);
 }
 function safeSegment(value, fallback) {
   const raw = String(value ?? "").trim();
@@ -8080,7 +8269,7 @@ function summarizeAmasterRuntimeVersionDrift(input = {}) {
 }
 
 // src/amaster-runtime-daemon/pi-child-isolation.mjs
-import { createHash as createHash7 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 import {
   chmodSync as chmodSync3,
   chownSync as chownSync2,
@@ -8091,7 +8280,7 @@ import {
 import { resolve as resolve7, sep } from "node:path";
 var defaultFs = { chmodSync: chmodSync3, chownSync: chownSync2, lchownSync, lstatSync: lstatSync4, readdirSync: readdirSync6 };
 function defaultHashRunId(runId) {
-  return Number.parseInt(createHash7("sha256").update(runId).digest("hex").slice(0, 8), 16);
+  return Number.parseInt(createHash8("sha256").update(runId).digest("hex").slice(0, 8), 16);
 }
 function positiveInteger(value, label) {
   if (!Number.isSafeInteger(value) || value <= 0) {
@@ -8215,7 +8404,7 @@ function preparePiChildIsolation(input) {
 }
 
 // src/amaster-runtime-daemon/pi-company-memory.mjs
-import { createHash as createHash8 } from "node:crypto";
+import { createHash as createHash9 } from "node:crypto";
 import {
   chmodSync as chmodSync4,
   chownSync as chownSync3,
@@ -8301,7 +8490,7 @@ function safeCompanyPiHomeSegment(companyId) {
   const raw = requiredString3(companyId, "companyId");
   if (/^[A-Za-z0-9][A-Za-z0-9._-]{0,119}$/.test(raw)) return raw;
   const normalized = raw.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^[._-]+|[._-]+$/g, "").slice(0, 80);
-  const hash = createHash8("sha256").update(raw).digest("hex").slice(0, 12);
+  const hash = createHash9("sha256").update(raw).digest("hex").slice(0, 12);
   return normalized ? `${normalized}-${hash}` : `company-${hash}`;
 }
 function ensureMemoryRoot(root, fs) {
@@ -8340,7 +8529,7 @@ function allocateCompanyGid(root, companyId, input, fs) {
   if (groups[companyId]) return groups[companyId];
   const used = new Set(Object.values(groups));
   const initialOffset = Number.parseInt(
-    createHash8("sha256").update(companyId).digest("hex").slice(0, 12),
+    createHash9("sha256").update(companyId).digest("hex").slice(0, 12),
     16
   ) % gidSpan;
   let gid = null;
@@ -8442,7 +8631,7 @@ function prepareCompanyPiMemory(input, fs = defaultFs2) {
 }
 
 // src/amaster-runtime-daemon/pi-trusted-runtime-profile.mjs
-import { createHash as createHash9 } from "node:crypto";
+import { createHash as createHash10 } from "node:crypto";
 import {
   chmodSync as chmodSync5,
   copyFileSync as copyFileSync2,
@@ -8482,7 +8671,7 @@ function sha256File(path, label) {
   if (!stat.isFile() || stat.isSymbolicLink()) {
     throw new Error(`pi_trusted_runtime_source_unsafe:${label}`);
   }
-  return createHash9("sha256").update(readFileSync9(path)).digest("hex");
+  return createHash10("sha256").update(readFileSync9(path)).digest("hex");
 }
 function verifyDeclaredFiles(manifest, root, label, ignoredPaths = [], enforceComplete = true) {
   if (!Array.isArray(manifest.files) || manifest.files.length === 0) {
@@ -8750,12 +8939,12 @@ function materializeTrustedPiRuntimeProfile(input) {
     // bundle skills were enabled. Absent profile => main skills only.
     ...skillProfile ? {
       skillProfile,
-      enabledSkillsDigest: createHash9("sha256").update(JSON.stringify(enabledSkills)).digest("hex")
+      enabledSkillsDigest: createHash10("sha256").update(JSON.stringify(enabledSkills)).digest("hex")
     } : {}
   };
   return {
     facts,
-    attestationId: createHash9("sha256").update(JSON.stringify(facts)).digest("hex")
+    attestationId: createHash10("sha256").update(JSON.stringify(facts)).digest("hex")
   };
 }
 function assertAuditArgsRedacted(value) {
@@ -8951,7 +9140,7 @@ function verifyTrustedPiRuntimeAssertion(input) {
   if (hasSourceAssertion) {
     const exactTools = Array.isArray(record7(sourceProfile.tools).exactAllowlist) ? record7(sourceProfile.tools).exactAllowlist : [];
     const exactActions = Array.isArray(record7(sourceProfile.actions).exactAllowlist) ? record7(sourceProfile.actions).exactAllowlist : [];
-    const profileHash = createHash9("sha256").update(JSON.stringify(sourceProfile)).digest("hex");
+    const profileHash = createHash10("sha256").update(JSON.stringify(sourceProfile)).digest("hex");
     if (assertion.unknownToolMode !== "deny" || maxCalls !== 0 || sourceAssertion.profileVersion !== sourceProfile.purpose || sourceAssertion.profileHash !== profileHash || sourceAssertion.retentionVersion !== sourceProfile.retention || JSON.stringify(sourceAssertion.exactTools) !== JSON.stringify(exactTools) || JSON.stringify(sourceAssertion.exactActions) !== JSON.stringify(exactActions) || sourceAssertion.sourceId !== sourceProfile.sourceId || sourceAssertion.sourceRevisionId !== sourceProfile.sourceRevisionId || sourceAssertion.sourceRevision !== sourceProfile.sourceRevision || sourceAssertion.attemptId !== sourceProfile.attemptId || sourceAssertion.epoch !== sourceProfile.epoch) {
       throw new Error("pi_trusted_runtime_assertion_binding_mismatch:sourceAcquisition");
     }
@@ -8980,7 +9169,7 @@ function verifyTrustedPiRuntimeAssertion(input) {
 
 // src/amaster-runtime-daemon/workspace-status.mjs
 import { spawnSync as spawnSync4 } from "node:child_process";
-import { createHash as createHash10 } from "node:crypto";
+import { createHash as createHash11 } from "node:crypto";
 import { existsSync as existsSync12, readdirSync as readdirSync8, readFileSync as readFileSync10, statSync as statSync7 } from "node:fs";
 import { basename as basename5, extname, isAbsolute as isAbsolute7, join as join13, relative as relative7, resolve as resolve10 } from "node:path";
 var WORKSPACE_RUNTIME_SERVICES_FILENAME = ".amaster-runtime-services.json";
@@ -9051,7 +9240,7 @@ function sanitizeTrackedChange(line) {
   return isSafeRelativePath(path) ? line : null;
 }
 function sha256File2(filePath) {
-  return createHash10("sha256").update(readFileSync10(filePath)).digest("hex");
+  return createHash11("sha256").update(readFileSync10(filePath)).digest("hex");
 }
 function artifactHashCacheKey(relativePath, stat) {
   return `${relativePath}\0${stat.size}\0${stat.mtimeMs}`;
@@ -9252,7 +9441,7 @@ function readWorkspaceStatus(cwd, opts = {}) {
 }
 
 // src/amaster-runtime-daemon/pi-browser-session-adapter.mjs
-import { createHash as createHash11 } from "node:crypto";
+import { createHash as createHash12 } from "node:crypto";
 import { spawn, spawnSync as spawnSync5 } from "node:child_process";
 import { existsSync as existsSync13 } from "node:fs";
 import {
@@ -9375,7 +9564,7 @@ function fail(code) {
   throw Object.assign(new Error(code), { code });
 }
 function profileName(identity2) {
-  return createHash11("sha256").update(`${identity2.companyId}\0${identity2.bindingId}\0${identity2.localOpaqueRef}`).digest("hex");
+  return createHash12("sha256").update(`${identity2.companyId}\0${identity2.bindingId}\0${identity2.localOpaqueRef}`).digest("hex");
 }
 function expectedMarker(identity2) {
   return {
@@ -9774,7 +9963,7 @@ async function executeBrowserSessionCommand(command, dependencies = {}) {
 }
 
 // src/amaster-runtime-daemon/source-acquisition-invocation.mjs
-import { createHash as createHash12 } from "node:crypto";
+import { createHash as createHash13 } from "node:crypto";
 var SOURCE_ACQUISITION_PUBLIC_TOOLS = Object.freeze([
   "source_open",
   "source_snapshot",
@@ -9811,7 +10000,7 @@ function serializeSourceAcquisitionProfile(profile) {
   const input = Buffer.from(JSON.stringify(profile), "utf8");
   return {
     input,
-    sha256: createHash12("sha256").update(input).digest("hex")
+    sha256: createHash13("sha256").update(input).digest("hex")
   };
 }
 function sourceAcquisitionManagedInputs(options) {
@@ -9847,7 +10036,7 @@ function assertSourceAcquisitionRuntimeAuthority({
 }
 
 // src/amaster-runtime-daemon.mjs
-var CONNECTOR_VERSION = "0.1.1-beta.20";
+var CONNECTOR_VERSION = "0.1.1-beta.21";
 var CONNECTOR_CONTRACT_VERSION = "2026-06-04.v1";
 var SOURCE_ACQUISITION_CAPABILITY = "source_acquisition_v1";
 var SOURCE_ACQUISITION_PROFILE_VERSION = "source_acquisition_v1";
@@ -11123,15 +11312,6 @@ ${body}${truncatedNote}`;
 function renderTaskMarkdown(context) {
   return readString(context.paperclipTaskMarkdown);
 }
-function renderAgentInstructionsBundle(bundle) {
-  const files = asRecord(asRecord(bundle).files);
-  const names = Object.keys(files).filter((path) => readString(files[path])).sort((left, right) => left === right ? 0 : left === "AGENTS.md" ? -1 : right === "AGENTS.md" ? 1 : left.localeCompare(right));
-  if (names.length === 0) return "";
-  return [
-    `Current agent instructions are materialized in the execution workspace as: ${names.map((name) => `./${name}`).join(", ")}.`,
-    "They are authoritative for this run and are not inlined here. Read ./AGENTS.md first and follow it (including any sibling files it references) for the whole run."
-  ].join("\n");
-}
 function commandRuntimeAuth(command) {
   const topLevel = asRecord(command.runtimeAuth);
   if (readString(topLevel.apiUrl) && readString(topLevel.apiKey)) return topLevel;
@@ -11190,7 +11370,7 @@ function sourceAcquisitionRuntimeProfile(config, command) {
   if (!companyId || !bindingId || !/^profile_[a-z0-9]{16,64}$/i.test(localOpaqueRef ?? "")) {
     throw new Error("source_acquisition_profile_invalid");
   }
-  const profileName2 = createHash13("sha256").update(`${companyId}\0${bindingId}\0${localOpaqueRef}`).digest("hex");
+  const profileName2 = createHash14("sha256").update(`${companyId}\0${bindingId}\0${localOpaqueRef}`).digest("hex");
   const stateRoot = resolve12(config.browserSessionStateRoot);
   const userDataDir = resolve12(stateRoot, profileName2);
   if (!pathWithin2(userDataDir, stateRoot)) throw new Error("source_acquisition_browser_profile_invalid");
@@ -11354,7 +11534,13 @@ function buildCommandPrompt(command, workspace, materializedAttachments = [], op
     }
   );
   const taskMarkdown = renderTaskMarkdown(context);
-  const agentInstructions = renderAgentInstructionsBundle(asRecord(payload.agentInstructionsBundle));
+  const agentInstructionsBundle = asRecord(payload.agentInstructionsBundle);
+  const agentInstructionDelivery = resolveAgentInstructionDelivery(options.executorKind, {
+    runnerKind: options.runnerKind,
+    materializedFiles: options.materializedAgentInstructionFiles,
+    suppliedFiles: agentInstructionFileNames(agentInstructionsBundle)
+  });
+  const agentInstructions = renderAgentInstructionsBundle(agentInstructionsBundle, agentInstructionDelivery);
   const runtimeAuth = commandRuntimeAuth(command);
   const hasGovernedMcp = Object.keys(asRecord(runtimeAuth.governedMcp)).length > 0;
   const attachmentsText = materializedAttachments.length > 0 ? [
@@ -11374,7 +11560,7 @@ function buildCommandPrompt(command, workspace, materializedAttachments = [], op
       return `- ${details}`;
     })
   ].join("\n") : "";
-  return compileCommandPromptWithManifest({
+  const compilation = compileCommandPromptWithManifest({
     commandId: command.commandId,
     runId: commandRunId(command),
     issueId: commandIssueId(command),
@@ -11399,6 +11585,21 @@ function buildCommandPrompt(command, workspace, materializedAttachments = [], op
       treePath: wikiTreePathForCommand(command, options.workspaceBindings)
     }
   });
+  const auditedCompilation = attachCurrentRunContractShadowAudit(
+    compilation,
+    payload.currentRunContract,
+    context
+  );
+  return {
+    ...auditedCompilation,
+    manifest: {
+      ...auditedCompilation.manifest,
+      agentInstructionDelivery: agentInstructionDeliveryAudit(
+        agentInstructionsBundle,
+        agentInstructionDelivery
+      )
+    }
+  };
 }
 function companyPiHomeRoot(baseEnv) {
   const explicitRoot = readString(baseEnv.AMASTER_COMPANY_PI_HOME_ROOT);
@@ -14001,7 +14202,7 @@ async function materializeIssueAttachments(config, command, workspace) {
     const body = await runtimeApiBuffer(runtimeAuth, contentPath);
     writeFileSync9(targetPath, body);
     const attachmentId = readString(attachment.id);
-    const actualSha256 = createHash13("sha256").update(body).digest("hex");
+    const actualSha256 = createHash14("sha256").update(body).digest("hex");
     const lineageCandidates = lineageCandidatesByAttachmentId.get(attachmentId) ?? [];
     const lineage = selectAttachmentLineage(lineageCandidates, actualSha256);
     if (lineageCandidates.length > 0 && !lineage) {
@@ -14093,7 +14294,7 @@ async function materializeRequiredArtifactInputs(config, command, workspace) {
       throw new Error(`artifact_input_manifest_invalid: entry ${index} contentPath does not match attachmentId`);
     }
     const body = await runtimeApiBuffer(runtimeAuth, contentPath);
-    const actualSha256 = createHash13("sha256").update(body).digest("hex");
+    const actualSha256 = createHash14("sha256").update(body).digest("hex");
     if (body.byteLength !== byteSize || actualSha256 !== sha256) {
       throw new Error(
         `artifact_input_integrity_mismatch: workProductId=${workProductId} expectedBytes=${byteSize} actualBytes=${body.byteLength} expectedSha256=${sha256} actualSha256=${actualSha256}`
@@ -14163,7 +14364,7 @@ function safeCheckpointRelativePath(rawPath) {
   return normalized;
 }
 function hashFileSha256(filePath) {
-  return createHash13("sha256").update(readFileSync11(filePath)).digest("hex");
+  return createHash14("sha256").update(readFileSync11(filePath)).digest("hex");
 }
 async function materializeIssueCheckpoint(config, command, workspace) {
   const checkpointDir = issueCheckpointDir(workspace);
@@ -14332,8 +14533,9 @@ async function executeRunCommand(config, command) {
     asRecord(asRecord(command.payload).contextSnapshot)
   );
   const cwd = workspace.cwd;
+  let materializedAgentInstructions = [];
   try {
-    await materializeAgentInstructionsBundle(config, command, workspace);
+    materializedAgentInstructions = await materializeAgentInstructionsBundle(config, command, workspace);
   } catch (err) {
     await ingestLog(config, command, "system", "warn", `Failed to materialize agent instruction files: ${err instanceof Error ? err.message : String(err)}`, {
       error: err instanceof Error ? err.message : String(err)
@@ -14351,7 +14553,9 @@ async function executeRunCommand(config, command) {
   }
   await ingestWorkspaceStatus(config, command, cwd);
   const promptCompilation = buildCommandPrompt(command, workspace, materializedAttachments, {
+    runnerKind: config.runnerKind,
     executorKind: executor.kind,
+    materializedAgentInstructionFiles: materializedAgentInstructions.map((entry) => entry.path),
     managedMcpToolMode: executor.kind === "pi" && Object.keys(governedMcp).length > 0 ? readString(governedMcp.mcpToolMode) ?? MANAGED_PI_MCP_TOOL_MODE : null,
     managedMcpToolCatalog: asRecord(governedMcp.toolCatalog),
     artifactVerifierCommands: config.artifactVerifierCommands,
@@ -14606,6 +14810,12 @@ async function executeRunCommand(config, command) {
       presentationKind: "context_manifest",
       contextManifest
     });
+    if (contextManifest.currentRunContractShadow.status !== "match") {
+      await ingestLog(config, command, "system", "warn", "Current Run Contract shadow comparison did not match the legacy runtime inference", {
+        presentationKind: "current_run_contract_shadow_audit",
+        currentRunContractShadow: contextManifest.currentRunContractShadow
+      });
+    }
     await ackCommand(config, command, "spawned");
     await ingestLog(config, command, "system", "info", `Starting ${executor.kind} executor`, {
       executorKind: executor.kind,
@@ -14889,10 +15099,11 @@ async function executeRunCommand(config, command) {
     const sourceErrorCode = sourceAcquisition ? execution.timedOut ? "source_acquisition_timeout" : cancelled ? "source_acquisition_cancelled" : hasOutputFlood ? "source_acquisition_output_flood" : hasMemoryLimit ? "source_acquisition_memory_limit" : execution.spawnError ? "source_acquisition_executor_unavailable" : succeeded ? null : "source_acquisition_executor_failed" : null;
     const error = sourceAcquisition ? sourceErrorCode : unsafeError;
     const costUsage = parsedCostUsage(parsed.usage);
+    const cleanPiTerminalOutputStop = succeeded && completionOutputStopped && execution.completionOutputType === "agent_end" && parsed.terminalEventType === "agent_end" && Number.isInteger(parsed.terminalEventIndex);
     const executorOutcome = {
-      status: cancelled ? "cancelled" : execution.timedOut ? "timed_out" : execution.exitCode === 0 && execution.signal === null ? "completed" : "failed",
-      exitCode: execution.exitCode,
-      signal: execution.signal,
+      status: cancelled ? "cancelled" : execution.timedOut ? "timed_out" : cleanPiTerminalOutputStop || execution.exitCode === 0 && execution.signal === null ? "completed" : "failed",
+      exitCode: cleanPiTerminalOutputStop ? 0 : execution.exitCode,
+      signal: cleanPiTerminalOutputStop ? null : execution.signal,
       terminalEvent: ["agent_end", "turn_end"].includes(readString(parsed.terminalEventType) ?? "") ? readString(parsed.terminalEventType) : null,
       terminalEventIndex: Number.isInteger(parsed.terminalEventIndex) ? parsed.terminalEventIndex : null
     };

package/dist/amaster-runtime.mjs

@@ -6,7 +6,7 @@ import { basename, dirname, join, resolve } from "node:path";
 import { homedir, hostname } from "node:os";
 import { fileURLToPath } from "node:url";
 
-const CONNECTOR_VERSION = "0.1.1-beta.20";
+const CONNECTOR_VERSION = "0.1.1-beta.21";
 
 const CAPABILITIES = [
   "remote_registration",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amaster.ai/employee-runtime-connector",
-  "version": "0.1.1-beta.20",
+  "version": "0.1.1-beta.21",
   "description": "MirrorX runtime connector CLI and daemon",
   "license": "MIT",
   "type": "module",