@aviaratech/ai-delivery 0.3.10 → 0.3.12

package/README.md

@@ -10,6 +10,15 @@ Install the versioned package from npm or a reviewed package archive. The
 consuming repository must run its own configuration and runtime-admission
 procedure before any lifecycle write.
 
+The selected CLI, MCP server and verification controller use Node 24.21.0 and
+npm 11.19.0. The public library exports also support Node 26.2.0 consumers.
+Package checks run the Node 24 controller against actual npm-packed Node 26
+consumers, including filesystem fixture contention, reader and link rejection,
+success/failure teardown, cancellation, leaked fixtures and positive byte limits.
+For package development, set `AI_DELIVERY_NODE26_EXECUTABLE` to the absolute
+Node 26.2.0 executable before `npm run checks`; CI retains that executable while
+selecting Node 24 for the canonical commands.
+
 ```sh
 node --version # 24.21.0
 npm --version  # 11.19.0
@@ -327,7 +336,7 @@ The `--admit` flag explicitly admits additional resource classes for execution.
 
 For a bounded run, pass `--max-aggregate-rss-bytes`, `--min-free-disk-bytes`, and optionally `--max-new-output-bytes` with one or more `--output-root` paths to `verify`. `issue_verify` accepts the same values in `resourceBounds`. RSS is sampled across the observed child process tree, including observed detached descendants; free disk is checked before commands and during execution on the worktree and declared output filesystems. Positive file-size growth is sampled under the declared roots, with previously measured completed stages carried across a resume. The caller must declare every output root relevant to its allowance; aliases must resolve within those roots. The roots are relative to the issue worktree unless absolute. Output growth is separate from the 8 MiB captured stdout/stderr limit. Resource limits are opt in and do not impose a total runtime deadline.
 
-During a running command, an `ENOENT` from symlink resolution can reflect ordinary tree removal. The observer reports the first path and errno and retries complete scans for at most one second; it never accepts a partial scan or resets that observation-stall window. Cancellation interrupts the wait, and RSS and disk checks continue. Baseline and final scans remain strict; persistent broken links, cycles and escaping aliases fail closed. Failed commands retain captured stdout/stderr in the existing private content-addressed command-output store, with its digest and the actual exit status in the failure diagnostic. Output still buffered inside a killed child is unavailable to the runner.
+During a running command, a previously validated, unchanged alias may temporarily lose its physical target during a rebuild. The observer checks its current identity and target ancestry, reports the path and errno, and still completes a fresh scan of all physical files in every declared root. It never substitutes an incomplete scan or an earlier byte count. A missing target does not impose a build deadline when complete output accounting remains available. Unvalidated aliases that prevent a complete scan retain the one-second observation-stall window, starting after the first failed scan rather than before it. Cancellation, RSS and disk checks continue. Baseline and final scans remain strict; permanent broken links, cycles, escaping aliases and changed identities fail closed. Failed commands retain captured stdout/stderr in the existing private content-addressed command-output store, with its digest, actual exit status and first/last filesystem observation in the failure diagnostic. Output still buffered inside a killed child is unavailable to the runner.
 
 Real filesystem-negative tests can use `withVerificationFilesystemFixture` from `@aviaratech/ai-delivery` (or its `agent` export):
 

package/dist/lifecycle.test.js

@@ -1,10 +1,12 @@
 import assert from 'node:assert/strict';
 import { execFileSync, spawn, spawnSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
+import { syncBuiltinESMExports } from 'node:module';
 import { cpSync, chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readlinkSync, readdirSync, realpathSync, rmSync, symlinkSync, unlinkSync, utimesSync, writeFileSync, } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
-import { test, vi } from 'vitest';
+import { fileURLToPath } from 'node:url';
+import { afterAll, test, vi } from 'vitest';
 import { syntheticDiscoveryClients, syntheticOverrides } from './fixtures/discovery.js';
 import { Octokit } from '@octokit/rest';
 import { Client } from '@modelcontextprotocol/sdk/client/index.js';
@@ -4021,7 +4023,196 @@ test.each([
 test('an unrelated consumer uses public MCP setup through verified configured-author publication, counted review readback, merge and cleanup', { timeout: 0 }, async () => {
     await syntheticLifecycle({ remote: 'origin', divergentOrigin: false, producerOnboarding: true });
 });
-test.each(['pass', 'command-error', 'cancel', 'persistent', 'limit'])('ordinary owned symlink teardown preserves observation and %s command evidence', async (mode) => {
+function ordinaryCliRebuildScript(output, mode = 'pass', target = join(output, 'cli.js')) {
+    return `(async () => {
+    const fs = require('node:fs');
+    const trace = event => fs.appendFileSync(${JSON.stringify(join(output, 'events'))}, event + '\\n');
+    trace('command-started'); fs.unlinkSync(${JSON.stringify(target)}); trace('target-removed');
+    if (${JSON.stringify(dirname(target))} !== ${JSON.stringify(output)}) fs.rmdirSync(${JSON.stringify(dirname(target))});
+    if (${JSON.stringify(mode)} === 'limit') fs.writeFileSync(${JSON.stringify(join(output, 'oversized'))}, 'x'.repeat(4096));
+    for (let unit = 0; unit < 32; unit++) {
+      fs.appendFileSync(${JSON.stringify(join(output, 'compiled'))}, 'build-unit\\n');
+      trace('build-unit-' + unit);
+      await new Promise(resolve => setTimeout(resolve, 100));
+    }
+    if (${JSON.stringify(mode)} !== 'absent') {
+      fs.mkdirSync(${JSON.stringify(dirname(target))}, { recursive: true });
+      fs.writeFileSync(${JSON.stringify(target)}, 'rebuilt CLI'); trace('target-restored');
+    }
+  })().catch(error => { console.error(error); process.exitCode = 1; });`;
+}
+test.each(['direct', 'chain', 'directory'])('ordinary bounded rebuild restores its %s CLI target after observable build work', async (shape) => {
+    const output = realpathSync(mkdtempSync(join(tmpdir(), 'ai-delivery-cli-rebuild-')));
+    const { root } = await fixture();
+    const target = shape === 'directory' ? join(output, 'dist', 'cli.js') : join(output, 'cli.js');
+    const alias = join(output, 'cli');
+    const events = join(output, 'events');
+    mkdirSync(dirname(target), { recursive: true });
+    writeFileSync(target, 'original CLI');
+    writeFileSync(join(output, 'unrelated'), 'preserved');
+    if (shape === 'direct')
+        symlinkSync('./cli.js', alias);
+    else {
+        symlinkSync(shape === 'chain' ? './cli.js' : './dist', join(output, 'intermediate'));
+        symlinkSync(shape === 'chain' ? './intermediate' : './intermediate/cli.js', alias);
+    }
+    const observations = [];
+    const duringAbsence = [];
+    const progress = vi.spyOn(process.stderr, 'write').mockImplementation((line) => {
+        observations.push(String(line));
+        if (!existsSync(target) && String(line).includes('sampledNewOutputBytes'))
+            duringAbsence.push(JSON.parse(String(line).slice(String(line).indexOf('{'))));
+        return true;
+    });
+    const script = ordinaryCliRebuildScript(output, 'pass', target);
+    try {
+        const { withRuntimeSetupWriter } = await import('./verification.js');
+        await withRuntimeSetupWriter(root, (runner) => runner.run([process.execPath, '-e', script], {
+            maxAggregateRssBytes: 1_000_000_000,
+            minFreeDiskBytes: 1,
+            maxNewOutputBytes: 8192,
+            outputRoots: [output],
+        }));
+        assert.equal(readFileSync(target, 'utf8'), 'rebuilt CLI');
+        assert.equal(readFileSync(join(output, 'compiled'), 'utf8').split('\n').length, 33);
+        assert.equal(readFileSync(join(output, 'unrelated'), 'utf8'), 'preserved');
+        assert.ok(duringAbsence.some((sample) => (sample.sampledNewOutputBytes ?? 0) > 0));
+        assert.ok(duringAbsence.every((sample) => (sample.sampledAggregateRssBytes ?? 0) > 0));
+    }
+    finally {
+        console.log(JSON.stringify({
+            scenario: 'ordinary-cli-rebuild',
+            shape,
+            firstObservation: observations.find((line) => line.includes('ENOENT')),
+            events: readFileSync(events, 'utf8').trim().split('\n'),
+            targetRestored: existsSync(target),
+            unrelatedPreserved: readFileSync(join(output, 'unrelated'), 'utf8') === 'preserved',
+        }));
+        progress.mockRestore();
+        rmSync(root, { recursive: true, force: true });
+        rmSync(output, { recursive: true, force: true });
+    }
+});
+test.each([
+    'bytes',
+    'rss',
+    'disk',
+    'fifo',
+    'permission',
+    'identity',
+    'ancestor',
+    'cycle',
+    'chain-identity',
+    'directory-identity',
+    'chain-cycle',
+])('a missing validated target retains complete scan and %s rejection across roots', async (mode) => {
+    const output = realpathSync(mkdtempSync(join(tmpdir(), 'ai-delivery-rebuild-boundary-')));
+    const { root } = await fixture();
+    const first = join(output, 'first'), second = join(output, 'second');
+    mkdirSync(first);
+    mkdirSync(second);
+    const directory = join(first, 'dist'), target = join(directory, 'cli.js'), alias = join(first, 'cli');
+    mkdirSync(directory);
+    writeFileSync(target, 'CLI');
+    const intermediate = join(first, 'intermediate');
+    if (mode === 'chain-identity' || mode === 'chain-cycle') {
+        symlinkSync('./dist/cli.js', intermediate);
+        symlinkSync('./intermediate', alias);
+    }
+    else if (mode === 'directory-identity') {
+        symlinkSync('./dist', intermediate);
+        symlinkSync('./intermediate/cli.js', alias);
+    }
+    else
+        symlinkSync('./dist/cli.js', alias);
+    writeFileSync(join(second, 'unrelated'), 'preserved');
+    const released = join(second, 'released');
+    const observations = [];
+    const progress = vi.spyOn(process.stderr, 'write').mockImplementation((line) => {
+        observations.push(String(line));
+        if (String(line).includes('ENOENT'))
+            writeFileSync(released, 'observed');
+        return true;
+    });
+    const script = `(async () => {
+      const fs = require('node:fs'), cp = require('node:child_process');
+      fs.unlinkSync(${JSON.stringify(target)});
+      while (!fs.existsSync(${JSON.stringify(released)})) await new Promise(resolve => setTimeout(resolve, 10));
+      if (${JSON.stringify(mode)} === 'bytes') fs.writeFileSync(${JSON.stringify(join(second, 'oversized'))}, 'x'.repeat(4096));
+      if (${JSON.stringify(mode)} === 'rss') globalThis.retainedBuildMemory = Buffer.alloc(200 * 1024 * 1024, 1);
+      if (${JSON.stringify(mode)} === 'disk') fs.writeFileSync(${JSON.stringify(join(second, 'disk-output'))}, Buffer.alloc(64 * 1024 * 1024, 1));
+      if (${JSON.stringify(mode)} === 'fifo') cp.execFileSync('mkfifo', [${JSON.stringify(join(second, 'unsupported'))}]);
+      if (${JSON.stringify(mode)} === 'permission') {
+        fs.mkdirSync(${JSON.stringify(join(second, 'denied'))});
+        fs.chmodSync(${JSON.stringify(join(second, 'denied'))}, 0);
+      }
+      if (${JSON.stringify(mode)} === 'identity') {
+        fs.unlinkSync(${JSON.stringify(alias)}); fs.writeFileSync(${JSON.stringify(join(first, 'other'))}, 'other');
+        fs.symlinkSync('./other', ${JSON.stringify(alias)});
+      }
+      if (${JSON.stringify(mode)} === 'ancestor') {
+        fs.rmdirSync(${JSON.stringify(directory)}); fs.symlinkSync(${JSON.stringify(second)}, ${JSON.stringify(directory)});
+      }
+      if (${JSON.stringify(mode)} === 'cycle') fs.symlinkSync('./cli.js', ${JSON.stringify(target)});
+      if (${JSON.stringify(mode)} === 'chain-identity') {
+        fs.unlinkSync(${JSON.stringify(intermediate)}); fs.writeFileSync(${JSON.stringify(join(first, 'other'))}, 'other');
+        fs.symlinkSync('./other', ${JSON.stringify(intermediate)});
+      }
+      if (${JSON.stringify(mode)} === 'directory-identity') {
+        fs.unlinkSync(${JSON.stringify(intermediate)}); fs.mkdirSync(${JSON.stringify(join(first, 'other'))});
+        fs.writeFileSync(${JSON.stringify(join(first, 'other', 'cli.js'))}, 'other');
+        fs.symlinkSync('./other', ${JSON.stringify(intermediate)});
+      }
+      if (${JSON.stringify(mode)} === 'chain-cycle') {
+        fs.unlinkSync(${JSON.stringify(intermediate)}); fs.symlinkSync('./cli', ${JSON.stringify(intermediate)});
+      }
+      for (let unit = 0; unit < 32; unit++) {
+        fs.appendFileSync(${JSON.stringify(join(second, 'work'))}, 'unit\\n');
+        await new Promise(resolve => setTimeout(resolve, 100));
+      }
+      fs.writeFileSync(${JSON.stringify(target)}, 'rebuilt CLI');
+    })().catch(error => { console.error(error); process.exitCode = 1; });`;
+    try {
+        const { withRuntimeSetupWriter } = await import('./verification.js');
+        const disk = (await import('node:fs')).statfsSync(output);
+        await assert.rejects(withRuntimeSetupWriter(root, (runner) => runner.run([process.execPath, '-e', script], {
+            maxAggregateRssBytes: mode === 'rss' ? 128 * 1024 * 1024 : 1_000_000_000,
+            minFreeDiskBytes: mode === 'disk' ? disk.bavail * disk.bsize - 32 * 1024 * 1024 : 1,
+            maxNewOutputBytes: mode === 'disk' ? 128 * 1024 * 1024 : 1024,
+            outputRoots: [first, second],
+        })), (error) => {
+            const message = String(error);
+            assert.match(message, mode === 'bytes'
+                ? /filesystem output.*exceeded/u
+                : mode === 'rss'
+                    ? /aggregate RSS.*exceeded/u
+                    : mode === 'disk'
+                        ? /Free disk fell below/u
+                        : mode === 'fifo'
+                            ? /unsupported file/u
+                            : mode === 'permission'
+                                ? /readdir failed.*EACCES/u
+                                : mode === 'cycle' || mode === 'chain-cycle'
+                                    ? /ELOOP/u
+                                    : /identity changed/u);
+            assert.match(message, /First filesystem observation:.*ENOENT.*Last filesystem observation:/u);
+            assert.doesNotMatch(message, /cleanup failed/u);
+            return true;
+        });
+        assert.ok(observations.some((line) => line.includes('ENOENT')));
+        assert.equal(observations.some((line) => line.includes('"state":"completed"')), false);
+        assert.equal(readFileSync(join(second, 'unrelated'), 'utf8'), 'preserved');
+    }
+    finally {
+        const denied = join(second, 'denied');
+        if (existsSync(denied))
+            chmodSync(denied, 0o700);
+        progress.mockRestore();
+        rmSync(root, { recursive: true, force: true });
+        rmSync(output, { recursive: true, force: true });
+    }
+});
+test.each(['pass', 'chain-pass', 'command-error', 'cancel', 'persistent', 'limit'])('ordinary owned symlink teardown preserves observation and %s command evidence', async (mode) => {
     const output = realpathSync(mkdtempSync(join(tmpdir(), 'ai-delivery-ordinary-teardown-')));
     const { root } = await fixture();
     const controller = new AbortController();
@@ -4030,7 +4221,9 @@ test.each(['pass', 'command-error', 'cancel', 'persistent', 'limit'])('ordinary
     const release = join(output, 'release');
     writeFileSync(join(output, 'unrelated'), 'preserved');
     writeFileSync(join(output, 'target'), 'x'.repeat(128));
-    symlinkSync('./target', join(output, 'alias'));
+    if (mode === 'chain-pass')
+        symlinkSync('./target', join(output, 'intermediate'));
+    symlinkSync(mode === 'chain-pass' ? './intermediate' : './target', join(output, 'alias'));
     let observedGap = false;
     const observations = [];
     let releaseTimer;
@@ -4043,7 +4236,7 @@ test.each(['pass', 'command-error', 'cancel', 'persistent', 'limit'])('ordinary
             releaseTimer = setTimeout(() => {
                 if (mode === 'cancel')
                     controller.abort();
-                else if (mode !== 'persistent')
+                else
                     writeFileSync(release, 'continue');
             }, 100);
         }
@@ -4059,7 +4252,10 @@ test.each(['pass', 'command-error', 'cancel', 'persistent', 'limit'])('ordinary
   trace('target-removed'); fs.writeFileSync(${JSON.stringify(ready)}, 'ready');
   if (${JSON.stringify(mode)} === 'limit') fs.writeFileSync(${JSON.stringify(join(output, 'retained'))}, 'x'.repeat(512));
   while (!fs.existsSync(${JSON.stringify(release)})) await new Promise(resolve => setTimeout(resolve, 10));
-  fs.unlinkSync(${JSON.stringify(join(output, 'alias'))}); trace('alias-removed');
+  if (${JSON.stringify(mode)} !== 'persistent') {
+    fs.unlinkSync(${JSON.stringify(join(output, 'alias'))}); trace('alias-removed');
+    if (${JSON.stringify(mode)} === 'chain-pass') fs.unlinkSync(${JSON.stringify(join(output, 'intermediate'))});
+  }
   process.exitCode = ${mode === 'command-error' ? 7 : 0};
 })().catch(error => { console.error(error); process.exitCode = 1; });`;
     try {
@@ -4070,7 +4266,7 @@ test.each(['pass', 'command-error', 'cancel', 'persistent', 'limit'])('ordinary
             maxNewOutputBytes: mode === 'limit' ? 256 : 4096,
             outputRoots: [output],
         }, controller.signal));
-        if (mode === 'pass')
+        if (mode === 'pass' || mode === 'chain-pass')
             await run;
         else
             await assert.rejects(run, (error) => {
@@ -4078,7 +4274,7 @@ test.each(['pass', 'command-error', 'cancel', 'persistent', 'limit'])('ordinary
                 assert.match(message, mode === 'cancel'
                     ? /cancelled/u
                     : mode === 'persistent'
-                        ? /remained unavailable.*First observation:.*ENOENT/u
+                        ? /broken or cyclic symbolic link.*ENOENT/u
                         : mode === 'limit'
                             ? /filesystem output.*exceeded/u
                             : /exit 7/u);
@@ -4107,7 +4303,7 @@ test.each(['pass', 'command-error', 'cancel', 'persistent', 'limit'])('ordinary
             unrelatedPreserved: true,
             aliasRetained: readdirSync(output).includes('alias'),
         }));
-        assert.deepEqual(readFileSync(events, 'utf8').trim().split('\n'), mode === 'cancel' || mode === 'persistent'
+        assert.deepEqual(readFileSync(events, 'utf8').trim().split('\n'), mode === 'cancel' || mode === 'persistent' || mode === 'limit'
             ? ['command-started', 'target-removed']
             : ['command-started', 'target-removed', 'alias-removed']);
         if (mode === 'cancel' || mode === 'persistent') {
@@ -4132,12 +4328,68 @@ test.each(['pass', 'command-error', 'cancel', 'persistent', 'limit'])('ordinary
         rmSync(output, { recursive: true, force: true });
     }
 });
-test('injected observation deadline rejects a late complete real filesystem retry', async () => {
+test('injected first failed scan duration does not consume the subsequent observation stall window', async () => {
+    const output = realpathSync(mkdtempSync(join(tmpdir(), 'ai-delivery-scan-duration-')));
+    const { root } = await fixture();
+    const target = join(output, 'target'), alias = join(output, 'alias'), release = join(output, 'release');
+    writeFileSync(target, 'target');
+    const fs = (await import('node:fs')).default;
+    const actualRealpath = fs.realpathSync;
+    const now = Date.now.bind(Date);
+    let offset = 0, delayed = false, firstObservation;
+    const clock = vi.spyOn(Date, 'now').mockImplementation(() => now() + offset);
+    const scan = vi.spyOn(fs, 'realpathSync').mockImplementation((path, options) => {
+        try {
+            return actualRealpath(path, options);
+        }
+        catch (error) {
+            if (path === alias && !delayed) {
+                delayed = true;
+                offset = 1500;
+            }
+            throw error;
+        }
+    });
+    syncBuiltinESMExports();
+    const progress = vi.spyOn(process.stderr, 'write').mockImplementation((line) => {
+        if (firstObservation === undefined && String(line).includes('ENOENT')) {
+            firstObservation = String(line);
+            unlinkSync(alias);
+            writeFileSync(release, 'finish');
+        }
+        return true;
+    });
+    const script = `(async () => {
+    const fs = require('node:fs'); fs.unlinkSync(${JSON.stringify(target)});
+    fs.symlinkSync('./target', ${JSON.stringify(alias)});
+    while (!fs.existsSync(${JSON.stringify(release)})) await new Promise(resolve => setTimeout(resolve, 10));
+  })().catch(error => { console.error(error); process.exitCode = 1; });`;
+    try {
+        const { withRuntimeSetupWriter } = await import('./verification.js');
+        await withRuntimeSetupWriter(root, (runner) => runner.run([process.execPath, '-e', script], {
+            maxAggregateRssBytes: 1_000_000_000,
+            minFreeDiskBytes: 1,
+            maxNewOutputBytes: 4096,
+            outputRoots: [output],
+        }));
+        assert.ok(delayed);
+        assert.ok(firstObservation);
+        assert.equal(existsSync(alias), false);
+    }
+    finally {
+        progress.mockRestore();
+        scan.mockRestore();
+        syncBuiltinESMExports();
+        clock.mockRestore();
+        rmSync(root, { recursive: true, force: true });
+        rmSync(output, { recursive: true, force: true });
+    }
+});
+test('injected observation stall rejects a late complete retry for an unvalidated alias', async () => {
     const output = realpathSync(mkdtempSync(join(tmpdir(), 'ai-delivery-observation-deadline-')));
     const { root } = await fixture();
     const target = join(output, 'target'), alias = join(output, 'alias'), release = join(output, 'release');
     writeFileSync(target, 'target');
-    symlinkSync('./target', alias);
     const now = Date.now.bind(Date);
     let offset = 0;
     let firstObservation;
@@ -4157,6 +4409,7 @@ test('injected observation deadline rejects a late complete real filesystem retr
     });
     const script = `(async () => {
     const fs = require('node:fs'); fs.unlinkSync(${JSON.stringify(target)});
+    fs.symlinkSync('./target', ${JSON.stringify(alias)});
     while (!fs.existsSync(${JSON.stringify(release)})) await new Promise(resolve => setTimeout(resolve, 10));
   })().catch(error => { console.error(error); process.exitCode = 1; });`;
     try {
@@ -4251,13 +4504,155 @@ test('fully cached bounded verification still rejects a newly leaked FIFO', asyn
         rmSync(root, { recursive: true, force: true });
     }
 });
-function filesystemFixtureScript(output, mode) {
+let node26Package;
+function packedNode26Consumer() {
+    if (node26Package !== undefined)
+        return node26Package;
+    assert.equal(process.version, 'v24.21.0', 'canonical verification controller must remain Node 24.21.0');
+    const executable = process.env['AI_DELIVERY_NODE26_EXECUTABLE'];
+    assert.ok(executable, 'set AI_DELIVERY_NODE26_EXECUTABLE to the actual Node 26.2.0 executable');
+    assert.equal(execFileSync(executable, ['--version'], { encoding: 'utf8' }).trim(), 'v26.2.0');
+    const temporary = realpathSync(mkdtempSync(join(tmpdir(), 'ai-delivery-node26-')));
+    try {
+        const source = fileURLToPath(new URL('../', import.meta.url));
+        const pack = JSON.parse(execFileSync('npm', ['pack', '--json', '--pack-destination', temporary], {
+            cwd: source,
+            encoding: 'utf8',
+            maxBuffer: 4 * 1024 * 1024,
+        }));
+        execFileSync('tar', ['-xzf', join(temporary, pack[0].filename), '-C', temporary]);
+        const root = join(temporary, 'package');
+        symlinkSync(join(source, 'node_modules'), join(root, 'node_modules'), 'dir');
+        process.stderr.write(`ai-delivery.node26-consumer ${JSON.stringify({
+            controller: process.version,
+            consumer: 'v26.2.0',
+            archiveSha256: createHash('sha256')
+                .update(readFileSync(join(temporary, pack[0].filename)))
+                .digest('hex'),
+            manifestSha256: createHash('sha256')
+                .update(readFileSync(join(root, 'package.json')))
+                .digest('hex'),
+        })}\n`);
+        node26Package = { executable: realpathSync(executable), root, temporary };
+        return node26Package;
+    }
+    catch (error) {
+        rmSync(temporary, { recursive: true, force: true });
+        throw error;
+    }
+}
+afterAll(() => {
+    if (node26Package !== undefined)
+        rmSync(node26Package.temporary, { recursive: true, force: true });
+});
+function node26ConsumerScript(script) {
+    const consumer = packedNode26Consumer();
     return `
+require('node:assert/strict').equal(process.version, 'v24.21.0');
+const child = require('node:child_process').spawnSync(${JSON.stringify(consumer.executable)}, ['-e', ${JSON.stringify(script)}], { cwd: ${JSON.stringify(consumer.root)}, stdio: 'inherit' });
+if (child.error) throw child.error;
+process.exit(child.status ?? 1);`;
+}
+test.each(['pass', 'absent', 'limit', 'cancel'])('Node 26 packed public verification preserves CLI rebuild %s behavior', async (mode) => {
+    const output = realpathSync(mkdtempSync(join(tmpdir(), 'ai-delivery-packed-rebuild-')));
+    const target = join(output, 'cli.js');
+    writeFileSync(target, 'original CLI');
+    symlinkSync('./cli.js', join(output, 'cli'));
+    writeFileSync(join(output, 'unrelated'), 'preserved');
+    const { root } = await fixture({ personalAuthor: true, firstStageScript: ordinaryCliRebuildScript(output, mode) });
+    try {
+        const row = await prepareIssueWorktree({
+            baseRef: 'main',
+            identity: 'host-author',
+            issueNumber: 17,
+            repoRoot: root,
+        });
+        const clients = syntheticDiscoveryClients();
+        const replies = [];
+        for (const fragment of [
+            'query DeliveryRepository',
+            'query ProjectDeliveryConfiguration',
+            'issueFields(first:',
+            'issueTypes(first:',
+        ])
+            replies.push({ fragment, data: await clients.graphql(fragment) });
+        const consumer = packedNode26Consumer();
+        const result = execFileSync(consumer.executable, [
+            '-e',
+            `(async () => {
+        const assert = require('node:assert/strict'), fs = require('node:fs');
+        assert.equal(process.version, 'v26.2.0');
+        const replies = ${JSON.stringify(replies)};
+        // Only GitHub discovery transport is synthetic; package, writer, scanner and child filesystem are real.
+        globalThis.fetch = async (url, options) => {
+          assert.equal(String(url), 'https://api.github.com/graphql');
+          const query = JSON.parse(options.body).query;
+          const reply = replies.find(reply => query.includes(reply.fragment));
+          assert.ok(reply, 'unexpected synthetic discovery query');
+          return new Response(JSON.stringify({ data: reply.data }), { status: 200, headers: { 'content-type': 'application/json' } });
+        };
+        process.env.AUTHOR_TOKEN = 'synthetic-author-token';
+        const { verifyIssue } = await import('@aviaratech/ai-delivery/agent');
+        const controller = new AbortController();
+        const observations = []; const write = process.stderr.write.bind(process.stderr);
+        process.stderr.write = line => {
+          observations.push(String(line));
+          if (${JSON.stringify(mode)} === 'cancel' && String(line).includes('ENOENT')) controller.abort();
+          return true;
+        };
+        try {
+          const running = verifyIssue({ issueNumber: 17, repoRoot: ${JSON.stringify(row.path)}, signal: controller.signal,
+            resourceBounds: { maxAggregateRssBytes: 1000000000, minFreeDiskBytes: 1,
+              maxNewOutputBytes: ${mode === 'limit' ? 1024 : 8192}, outputRoots: [${JSON.stringify(output)}] } });
+          if (${JSON.stringify(mode)} === 'pass') {
+            const run = await running;
+            assert.ok(run.resources.sampleCount > 0); assert.ok(run.resources.maxSampledNewOutputBytes > 0);
+            assert.equal(fs.readFileSync(${JSON.stringify(target)}, 'utf8'), 'rebuilt CLI');
+            // Compatible completed proof is reused, but the current final filesystem is still strictly scanned.
+            fs.unlinkSync(${JSON.stringify(target)});
+            await assert.rejects(verifyIssue({ issueNumber: 17, repoRoot: ${JSON.stringify(row.path)},
+              resourceBounds: { maxAggregateRssBytes: 1000000000, minFreeDiskBytes: 1, maxNewOutputBytes: 8192,
+                outputRoots: [${JSON.stringify(output)}] } }), /broken or cyclic symbolic link/);
+          } else {
+            await assert.rejects(running, error => {
+              assert.match(String(error), ${mode === 'cancel' ? '/cancelled/' : mode === 'limit' ? '/filesystem output.*exceeded/' : '/broken or cyclic symbolic link/'});
+              assert.doesNotMatch(String(error), /cleanup failed/); return true;
+            });
+          }
+          assert.ok(observations.some(line => line.includes('ENOENT')));
+          assert.equal(fs.readFileSync(${JSON.stringify(join(output, 'unrelated'))}, 'utf8'), 'preserved');
+          console.log(JSON.stringify({ scenario: 'packed-node26-cli-rebuild', mode: ${JSON.stringify(mode)},
+            firstObservation: observations.find(line => line.includes('ENOENT')), events: fs.readFileSync(${JSON.stringify(join(output, 'events'))}, 'utf8').trim().split('\\n') }));
+        } finally { controller.abort(); process.stderr.write = write; }
+      })().catch(error => { console.error(error); process.exitCode = 1; });`,
+        ], {
+            cwd: consumer.root,
+            encoding: 'utf8',
+            maxBuffer: 1024 * 1024,
+        });
+        console.log(result.trim());
+    }
+    finally {
+        rmSync(root, { recursive: true, force: true });
+        rmSync(output, { recursive: true, force: true });
+    }
+});
+function filesystemFixtureScript(output, mode, runtime = 'node24') {
+    const script = `
 (async () => {
   const fs = require('node:fs'), cp = require('node:child_process'), path = require('node:path'), assert = require('node:assert/strict');
-  const { withVerificationFilesystemFixture } = await import(${JSON.stringify(new URL('./agent.js', import.meta.url).href)});
-  const { assertPrivateFile } = await import(${JSON.stringify(new URL('./delivery/common.js', import.meta.url).href)});
+  assert.equal(process.version, ${JSON.stringify(runtime === 'node26' ? 'v26.2.0' : 'v24.21.0')});
+  const { withVerificationFilesystemFixture } = await import(${JSON.stringify(runtime === 'node26' ? '@aviaratech/ai-delivery/agent' : new URL('./agent.js', import.meta.url).href)});
+  const { loadValidRepositoryDeliveryEvidence } = await import(${JSON.stringify(runtime === 'node26' ? '@aviaratech/ai-delivery/delivery' : new URL('./delivery/index.js', import.meta.url).href)});
   const output = ${JSON.stringify(output)}, fifo = path.join(output, 'fifo'), events = path.join(output, 'events');
+  const evidenceId = 'sha256:' + 'a'.repeat(64), currentHead = { sha: 'b'.repeat(40), tree: 'c'.repeat(40) };
+  const evidence = path.join(output, 'ai-delivery', 'receipts', 'delivery@1', currentHead.sha, evidenceId.slice(7) + '.json');
+  fs.mkdirSync(path.dirname(evidence), { recursive: true });
+  const rejectPrivateFile = file => {
+    fs.renameSync(file, evidence);
+    try { assert.throws(() => loadValidRepositoryDeliveryEvidence({ createInput: { gitCommonDir: output, currentHead }, evidenceId }), /private regular file/); }
+    finally { fs.renameSync(evidence, file); }
+  };
   const gate = JSON.parse(process.env.AI_DELIVERY_OUTPUT_OBSERVATION_GATE);
   const trace = value => fs.appendFileSync(events, value + '\\n');
   await withVerificationFilesystemFixture(async () => {
@@ -4270,20 +4665,26 @@ function filesystemFixtureScript(output, mode) {
       if (${JSON.stringify(mode)} === 'block') fs.readFileSync(fifo);
       while (fs.readdirSync(path.join(gate.directory, 'requests')).length === 0) await new Promise(resolve => setTimeout(resolve, 10));
       assert.ok(fs.existsSync(fifo)); trace('scan-queued');
-      assert.throws(() => assertPrivateFile(fifo), /private regular file/); trace('reader-rejected');
+      rejectPrivateFile(fifo); trace('reader-rejected');
       const regular = path.join(output, 'regular'), hard = path.join(output, 'hard'), alias = path.join(output, 'alias');
       fs.writeFileSync(regular, 'x'.repeat(128), { mode: 0o600 });
-      fs.linkSync(regular, hard); assert.throws(() => assertPrivateFile(hard), /private regular file/); fs.unlinkSync(hard);
-      fs.symlinkSync('./regular', alias); assert.throws(() => assertPrivateFile(alias), /private regular file/); fs.unlinkSync(alias);
+      fs.linkSync(regular, hard); rejectPrivateFile(hard); fs.unlinkSync(hard);
+      fs.symlinkSync('./regular', alias); rejectPrivateFile(alias); fs.unlinkSync(alias);
       if (${JSON.stringify(mode)} === 'assertion') throw new Error('synthetic reader assertion failure');
     } finally { fs.unlinkSync(fifo); trace('cleaned'); }
   });
   trace('released');
 })().catch(error => { console.error(error.message); process.exitCode = 1; });`;
+    return runtime === 'node26' ? node26ConsumerScript(script) : script;
 }
-test.each(['pass', 'assertion'])('filesystem fixture gate deterministically queues a scan through reader rejection and %s teardown', async (mode) => {
+test.each([
+    ['pass', 'node24'],
+    ['assertion', 'node24'],
+    ['pass', 'node26'],
+    ['assertion', 'node26'],
+])('filesystem fixture gate deterministically queues a scan through reader rejection and %s teardown on %s', async (mode, runtime) => {
     const output = realpathSync(mkdtempSync(join(tmpdir(), 'ai-delivery-fixture-gate-')));
-    const { root } = await fixture({ firstStageScript: filesystemFixtureScript(output, mode) });
+    const { root } = await fixture({ firstStageScript: filesystemFixtureScript(output, mode, runtime) });
     try {
         const row = await prepareIssueWorktree({
             baseRef: 'main',
@@ -4319,10 +4720,17 @@ test.each(['pass', 'assertion'])('filesystem fixture gate deterministically queu
         rmSync(output, { recursive: true, force: true });
     }
 });
-test.each(['abrupt', 'block', 'cancel'])('filesystem fixture gate preserves leaked FIFO and unrelated files after %s', async (mode) => {
+test.each([
+    ['abrupt', 'node24'],
+    ['block', 'node24'],
+    ['cancel', 'node24'],
+    ['abrupt', 'node26'],
+    ['block', 'node26'],
+    ['cancel', 'node26'],
+])('filesystem fixture gate preserves leaked FIFO and unrelated files after %s on %s', async (mode, runtime) => {
     const output = realpathSync(mkdtempSync(join(tmpdir(), 'ai-delivery-fixture-failure-')));
     writeFileSync(join(output, 'unrelated'), 'preserved');
-    const { root } = await fixture({ firstStageScript: filesystemFixtureScript(output, mode) });
+    const { root } = await fixture({ firstStageScript: filesystemFixtureScript(output, mode, runtime) });
     const controller = new AbortController();
     let running;
     const progress = vi.spyOn(process.stderr, 'write');
@@ -4374,9 +4782,9 @@ test.each(['abrupt', 'block', 'cancel'])('filesystem fixture gate preserves leak
         rmSync(output, { recursive: true, force: true });
     }
 });
-test('filesystem fixture gate still enforces positive byte limits after deterministic contention', async () => {
+test.each(['node24', 'node26'])('filesystem fixture gate still enforces positive byte limits after deterministic contention on %s', async (runtime) => {
     const output = realpathSync(mkdtempSync(join(tmpdir(), 'ai-delivery-fixture-limit-')));
-    const { root } = await fixture({ firstStageScript: filesystemFixtureScript(output, 'pass') });
+    const { root } = await fixture({ firstStageScript: filesystemFixtureScript(output, 'pass', runtime) });
     try {
         const row = await prepareIssueWorktree({
             baseRef: 'main',
@@ -4478,6 +4886,37 @@ test.each(['verification', 'runtime'])('filesystem fixture gate preserves observ
         rmSync(output, { recursive: true, force: true });
     }
 });
+test('Node 26 packed public exports preserve standalone and malformed-capability behavior', () => {
+    const consumer = packedNode26Consumer();
+    execFileSync(consumer.executable, [
+        '-e',
+        `
+(async () => {
+  const assert = require('node:assert/strict');
+  assert.equal(process.version, 'v26.2.0');
+  const [root, agent, delivery, mcp] = await Promise.all([
+    import('@aviaratech/ai-delivery'), import('@aviaratech/ai-delivery/agent'),
+    import('@aviaratech/ai-delivery/delivery'), import('@aviaratech/ai-delivery/mcp'),
+  ]);
+  assert.equal(root.withVerificationFilesystemFixture, agent.withVerificationFilesystemFixture);
+  assert.equal(typeof agent.verifyIssue, 'function');
+  assert.equal(typeof delivery.loadValidRepositoryDeliveryEvidence, 'function');
+  assert.equal(typeof mcp.createAiDeliveryMcpServer, 'function');
+  const manifest = JSON.parse(require('node:fs').readFileSync('package.json', 'utf8'));
+  assert.deepEqual(Object.keys(manifest.exports).sort(), ['.', './agent', './delivery', './mcp']);
+  const prior = process.env.AI_DELIVERY_OUTPUT_OBSERVATION_GATE;
+  delete process.env.AI_DELIVERY_OUTPUT_OBSERVATION_GATE;
+  assert.equal(await agent.withVerificationFilesystemFixture(() => 'standalone'), 'standalone');
+  process.env.AI_DELIVERY_OUTPUT_OBSERVATION_GATE = '{}';
+  let executed = false;
+  await assert.rejects(agent.withVerificationFilesystemFixture(() => { executed = true; }), /invalid or stale/);
+  assert.equal(executed, false);
+  if (prior === undefined) delete process.env.AI_DELIVERY_OUTPUT_OBSERVATION_GATE;
+  else process.env.AI_DELIVERY_OUTPUT_OBSERVATION_GATE = prior;
+})().catch(error => { console.error(error); process.exitCode = 1; });
+`,
+    ], { cwd: consumer.root, stdio: 'pipe' });
+});
 test('filesystem fixture helper runs standalone and fails closed on malformed capability', async () => {
     const { withVerificationFilesystemFixture } = await import('./agent.js');
     assert.equal(await withVerificationFilesystemFixture(() => 'standalone'), 'standalone');