@aviaratech/ai-delivery 0.3.6 → 0.3.7

package/README.md

@@ -327,6 +327,23 @@ The `--admit` flag explicitly admits additional resource classes. Publication cr
 
 For a bounded run, pass `--max-aggregate-rss-bytes`, `--min-free-disk-bytes`, and optionally `--max-new-output-bytes` with one or more `--output-root` paths to `verify`. `issue_verify` accepts the same values in `resourceBounds`. RSS is sampled across the observed child process tree, including observed detached descendants; free disk is checked before commands and during execution on the worktree and declared output filesystems. Positive file-size growth is sampled under the declared roots, with previously measured completed stages carried across a resume. The caller must declare every output root relevant to its allowance; aliases must resolve within those roots. The roots are relative to the issue worktree unless absolute. Output growth is separate from the 8 MiB captured stdout/stderr limit. Resource limits are opt in and do not impose a total runtime deadline.
 
+Real filesystem-negative tests can use `withVerificationFilesystemFixture` from `@aviaratech/ai-delivery` (or its `agent` export):
+
+```js
+import { withVerificationFilesystemFixture } from '@aviaratech/ai-delivery';
+
+await withVerificationFilesystemFixture(async () => {
+  // Create the real negative fixture inside a declared output root.
+  try {
+    // Assert the actual reader rejects it without blocking.
+  } finally {
+    // Remove every negative fixture before returning or throwing.
+  }
+});
+```
+
+Bounded verification supplies an inherited, run-owned filesystem coordination capability. The helper serializes the fixture's lifetime against strict scans of every declared root; nested verification and runtime setup join the same boundary. Without an inherited observer the helper runs its callback normally. Malformed, foreign or stale capabilities fail closed. The callback must contain only the negative test and its teardown, and must not start verification while holding the fixture. A queued scan takes priority over new fixtures. RSS, disk, captured-log limits and cancellation continue while the scan waits; waiting observations do not claim a new filesystem measurement. A fixture that fails to release a waiting scan within five seconds is a stalled reader/teardown failure: the command is terminated through the existing identity-checked cleanup, without stealing the live fixture lease. This is an operation-specific observation-stall bound, not a verification runtime limit. Successful commands and fully cached resumes receive fresh strict scans; ordinary or leaked unsupported entries still fail. Abrupt termination can prevent callback teardown; leaked fixtures remain visible and fail subsequent verification. After existing writer recovery confirms command quiescence, only validated abandoned control metadata from that worktree is retired. No output roots, special-file kinds or byte growth are exempted.
+
 Bounded stage checkpoints bind the limits and sampled observations. Older unmeasured stages and stages with different limits rerun. Current manifests use `ai-delivery.run@3`, bind the worktree and producer, and live under `runs@2/<worktree-digest>/<head>.json`. Bounded manifests also record limits, sample count, and sampled RSS, output, and disk extrema. Historical run versions 1 and 2 remain historical and are available for merged-issue recovery; current publication requires current-producer verification. `processCoverage: "observed-processes-only"` means a passing aggregate is not proof that every detached descendant was drained. A descendant that detaches and closes inherited pipes between samples can evade observation; a pipe holder that prevents command closure fails with unverified cleanup and no checkpoint. Output roots must be canonical and nonoverlapping. Resolvable aliases such as npm `.bin` links may point only within the declared roots; aliases are not traversed or counted twice, and growth of their physical targets remains measured. Escaping, broken and cyclic links fail closed. Output baselines are retained across retries, including failed stages. They are range scoped: a changed baseline regenerates the measured stage proof. Consumers must confirm their command graph remains observable and declare all relevant output roots; this contract does not assert ownership of undeclared output locations or other concurrent writers.
 
 A reviewed policy transition can be verified and published before activating

package/dist/agent.d.ts

@@ -14,7 +14,7 @@ export { buildVelocityReport, getDeliveryRecords, recordMergedDelivery } from '.
 export type { DeliveryRecord, VelocityReport, PointBucketStatistics } from './services/deliveryRecordService.js';
 export { getIssueWorktreeStrict, listWorktreesStrict } from './services/worktreeRegistry.js';
 export { prepareIssueWorktree, prepareStandaloneWorktree } from './worktree.js';
-export { verifyIssue, createIssuePhaseEvidence } from './verification.js';
+export { verifyIssue, createIssuePhaseEvidence, withVerificationFilesystemFixture } from './verification.js';
 export { discoverDeliveryRouting } from './github/discovery.js';
 export type { DeliveryRouting, DiscoveryClients } from './github/discovery.js';
 export type { DeliveryOverrides, DeliveryPolicySettings, LoadedDeliverySettings } from './config/deliveryConfig.js';

package/dist/agent.js

@@ -12,7 +12,7 @@ export { normalizeLegacyIssue, planOfflineLegacyIssueMigration } from './service
 export { buildVelocityReport, getDeliveryRecords, recordMergedDelivery } from './services/deliveryRecordService.js';
 export { getIssueWorktreeStrict, listWorktreesStrict } from './services/worktreeRegistry.js';
 export { prepareIssueWorktree, prepareStandaloneWorktree } from './worktree.js';
-export { verifyIssue, createIssuePhaseEvidence } from './verification.js';
+export { verifyIssue, createIssuePhaseEvidence, withVerificationFilesystemFixture } from './verification.js';
 export { discoverDeliveryRouting } from './github/discovery.js';
 export { stageRuntime, admitRuntime, RuntimeAdmissionCommitUnknownError } from './setup.js';
 //# sourceMappingURL=agent.js.map

package/dist/agent.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent.js","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,8BAA8B,GAC/B,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,gCAAgC,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AACpH,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC/G,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,kBAAkB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACrH,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAC3E,OAAO,EACL,6BAA6B,EAC7B,8BAA8B,EAC9B,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,oBAAoB,EAAE,+BAA+B,EAAE,MAAM,oCAAoC,CAAC;AAC3G,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAEpH,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAC7F,OAAO,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAE1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAIhE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,kCAAkC,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"agent.js","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,8BAA8B,GAC/B,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,gCAAgC,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AACpH,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC/G,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,kBAAkB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACrH,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAC3E,OAAO,EACL,6BAA6B,EAC7B,8BAA8B,EAC9B,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,oBAAoB,EAAE,+BAA+B,EAAE,MAAM,oCAAoC,CAAC;AAC3G,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAEpH,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAC7F,OAAO,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,iCAAiC,EAAE,MAAM,mBAAmB,CAAC;AAE7G,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAIhE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,kCAAkC,EAAE,MAAM,YAAY,CAAC"}

package/dist/lifecycle.test.js

@@ -3663,4 +3663,399 @@ test.each(['escape', 'broken', 'cycle'])('output observation rejects %s aliases
         rmSync(base, { recursive: true, force: true });
     }
 });
+test('fully cached bounded verification still rejects a newly leaked FIFO', async () => {
+    const { root, counter } = await fixture();
+    const output = realpathSync(mkdtempSync(join(tmpdir(), 'ai-delivery-cached-fifo-')));
+    try {
+        const row = await prepareIssueWorktree({
+            baseRef: 'main',
+            identity: 'synthetic-author',
+            issueNumber: 17,
+            repoRoot: root,
+        });
+        const bounds = {
+            maxAggregateRssBytes: 1_000_000_000,
+            minFreeDiskBytes: 1,
+            maxNewOutputBytes: 1024,
+            outputRoots: [output],
+        };
+        await verifyIssue({ issueNumber: 17, repoRoot: row.path, resourceBounds: bounds });
+        assert.equal(readFileSync(counter, 'utf8'), '1');
+        execFileSync('mkfifo', [join(output, 'leaked')]);
+        await assert.rejects(verifyIssue({ issueNumber: 17, repoRoot: row.path, resourceBounds: bounds }), /unsupported file/u);
+        assert.equal(readFileSync(counter, 'utf8'), '1');
+    }
+    finally {
+        rmSync(output, { recursive: true, force: true });
+        rmSync(root, { recursive: true, force: true });
+    }
+});
+function filesystemFixtureScript(output, mode) {
+    return `
+(async () => {
+  const fs = require('node:fs'), cp = require('node:child_process'), path = require('node:path'), assert = require('node:assert/strict');
+  const { withVerificationFilesystemFixture } = await import(${JSON.stringify(new URL('./agent.js', import.meta.url).href)});
+  const { assertPrivateFile } = await import(${JSON.stringify(new URL('./delivery/common.js', import.meta.url).href)});
+  const output = ${JSON.stringify(output)}, fifo = path.join(output, 'fifo'), events = path.join(output, 'events');
+  const gate = JSON.parse(process.env.AI_DELIVERY_OUTPUT_OBSERVATION_GATE);
+  const trace = value => fs.appendFileSync(events, value + '\\n');
+  await withVerificationFilesystemFixture(async () => {
+    cp.execFileSync('mkfifo', ['-m', '600', fifo]);
+    fs.writeFileSync(path.join(output, 'capability'), JSON.stringify(gate));
+    trace('created');
+    try {
+      if (${JSON.stringify(mode)} === 'abrupt') process.exit(9);
+      if (${JSON.stringify(mode)} === 'cancel') await new Promise(() => { setInterval(() => {}, 1000); });
+      if (${JSON.stringify(mode)} === 'block') fs.readFileSync(fifo);
+      while (fs.readdirSync(path.join(gate.directory, 'requests')).length === 0) await new Promise(resolve => setTimeout(resolve, 10));
+      assert.ok(fs.existsSync(fifo)); trace('scan-queued');
+      assert.throws(() => assertPrivateFile(fifo), /private regular file/); trace('reader-rejected');
+      const regular = path.join(output, 'regular'), hard = path.join(output, 'hard'), alias = path.join(output, 'alias');
+      fs.writeFileSync(regular, 'x'.repeat(128), { mode: 0o600 });
+      fs.linkSync(regular, hard); assert.throws(() => assertPrivateFile(hard), /private regular file/); fs.unlinkSync(hard);
+      fs.symlinkSync('./regular', alias); assert.throws(() => assertPrivateFile(alias), /private regular file/); fs.unlinkSync(alias);
+      if (${JSON.stringify(mode)} === 'assertion') throw new Error('synthetic reader assertion failure');
+    } finally { fs.unlinkSync(fifo); trace('cleaned'); }
+  });
+  trace('released');
+})().catch(error => { console.error(error.message); process.exitCode = 1; });`;
+}
+test.each(['pass', 'assertion'])('filesystem fixture gate deterministically queues a scan through reader rejection and %s teardown', async (mode) => {
+    const output = realpathSync(mkdtempSync(join(tmpdir(), 'ai-delivery-fixture-gate-')));
+    const { root } = await fixture({ firstStageScript: filesystemFixtureScript(output, mode) });
+    try {
+        const row = await prepareIssueWorktree({
+            baseRef: 'main',
+            identity: 'synthetic-author',
+            issueNumber: 17,
+            repoRoot: root,
+        });
+        const run = verifyIssue({
+            issueNumber: 17,
+            repoRoot: row.path,
+            resourceBounds: {
+                maxAggregateRssBytes: 1_000_000_000,
+                minFreeDiskBytes: 1,
+                maxNewOutputBytes: 2048,
+                outputRoots: [output],
+            },
+        });
+        if (mode === 'assertion')
+            await assert.rejects(run, /exit 1/u);
+        else
+            assert.ok((await run).resources.maxSampledNewOutputBytes >= 128);
+        assert.equal(existsSync(join(output, 'fifo')), false);
+        const events = readFileSync(join(output, 'events'), 'utf8').trim().split('\n');
+        assert.deepEqual(events, mode === 'pass'
+            ? ['created', 'scan-queued', 'reader-rejected', 'cleaned', 'released']
+            : ['created', 'scan-queued', 'reader-rejected', 'cleaned']);
+        const capability = JSON.parse(readFileSync(join(output, 'capability'), 'utf8'));
+        assert.equal(existsSync(capability.directory), false);
+        assert.equal(readFileSync(join(output, 'regular'), 'utf8').length, 128);
+    }
+    finally {
+        rmSync(root, { recursive: true, force: true });
+        rmSync(output, { recursive: true, force: true });
+    }
+});
+test.each(['abrupt', 'block', 'cancel'])('filesystem fixture gate preserves leaked FIFO and unrelated files after %s', async (mode) => {
+    const output = realpathSync(mkdtempSync(join(tmpdir(), 'ai-delivery-fixture-failure-')));
+    writeFileSync(join(output, 'unrelated'), 'preserved');
+    const { root } = await fixture({ firstStageScript: filesystemFixtureScript(output, mode) });
+    const controller = new AbortController();
+    let running;
+    const progress = vi.spyOn(process.stderr, 'write');
+    try {
+        const row = await prepareIssueWorktree({
+            baseRef: 'main',
+            identity: 'synthetic-author',
+            issueNumber: 17,
+            repoRoot: root,
+        });
+        const bounds = {
+            maxAggregateRssBytes: 1_000_000_000,
+            minFreeDiskBytes: 1,
+            maxNewOutputBytes: 2048,
+            outputRoots: [output],
+        };
+        running = verifyIssue({
+            issueNumber: 17,
+            repoRoot: row.path,
+            resourceBounds: bounds,
+            signal: controller.signal,
+        }).catch((error) => error);
+        if (mode === 'cancel') {
+            for (let attempt = 0; attempt < 300 && !existsSync(join(output, 'capability')); attempt++)
+                await new Promise((resolve) => setTimeout(resolve, 20));
+            assert.ok(existsSync(join(output, 'capability')));
+            const cap = JSON.parse(readFileSync(join(output, 'capability'), 'utf8'));
+            for (let attempt = 0; attempt < 300 && readdirSync(join(cap.directory, 'requests')).length === 0; attempt++)
+                await new Promise((resolve) => setTimeout(resolve, 20));
+            assert.ok(readdirSync(join(cap.directory, 'requests')).length > 0);
+            controller.abort();
+        }
+        const failure = String(await running);
+        assert.match(failure, mode === 'abrupt' ? /exit 9/u : mode === 'block' ? /reader or teardown is stalled/u : /cancelled/u);
+        assert.doesNotMatch(failure, /cleanup failed|live holder/u);
+        const capability = JSON.parse(readFileSync(join(output, 'capability'), 'utf8'));
+        assert.equal(existsSync(capability.directory), false);
+        assert.ok(existsSync(join(output, 'fifo')));
+        assert.equal(readFileSync(join(output, 'unrelated'), 'utf8'), 'preserved');
+        if (mode !== 'abrupt')
+            assert.ok(progress.mock.calls.filter(([line]) => String(line).includes('sampledAggregateRssBytes')).length > 2);
+        await assert.rejects(verifyIssue({ issueNumber: 17, repoRoot: row.path, resourceBounds: bounds }), /unsupported file/u);
+    }
+    finally {
+        controller.abort();
+        await running;
+        progress.mockRestore();
+        rmSync(root, { recursive: true, force: true });
+        rmSync(output, { recursive: true, force: true });
+    }
+});
+test('filesystem fixture gate still enforces positive byte limits after deterministic contention', async () => {
+    const output = realpathSync(mkdtempSync(join(tmpdir(), 'ai-delivery-fixture-limit-')));
+    const { root } = await fixture({ firstStageScript: filesystemFixtureScript(output, 'pass') });
+    try {
+        const row = await prepareIssueWorktree({
+            baseRef: 'main',
+            identity: 'synthetic-author',
+            issueNumber: 17,
+            repoRoot: root,
+        });
+        await assert.rejects(verifyIssue({
+            issueNumber: 17,
+            repoRoot: row.path,
+            resourceBounds: {
+                maxAggregateRssBytes: 1_000_000_000,
+                minFreeDiskBytes: 1,
+                maxNewOutputBytes: 64,
+                outputRoots: [output],
+            },
+        }), /filesystem output.*exceeded/u);
+        assert.equal(existsSync(join(output, 'fifo')), false);
+        assert.equal(readFileSync(join(output, 'regular'), 'utf8').length, 128);
+    }
+    finally {
+        rmSync(root, { recursive: true, force: true });
+        rmSync(output, { recursive: true, force: true });
+    }
+});
+test.each(['verification', 'runtime'])('filesystem fixture gate preserves observation and cancellation after direct %s command closure', async (mode) => {
+    const output = realpathSync(mkdtempSync(join(tmpdir(), 'ai-delivery-fixture-close-')));
+    writeFileSync(join(output, 'unrelated'), 'preserved');
+    const script = `
+(async () => {
+  const fs = require('node:fs'), cp = require('node:child_process');
+  const child = cp.spawn(process.execPath, ['-e', ${JSON.stringify(filesystemFixtureScript(output, 'cancel'))}], { stdio: 'ignore' });
+  child.unref();
+  fs.writeFileSync(${JSON.stringify(join(output, 'pids'))}, JSON.stringify({ root: process.pid, descendant: child.pid }));
+  while (!fs.existsSync(${JSON.stringify(join(output, 'exit-parent'))})) await new Promise(resolve => setTimeout(resolve, 10));
+  process.exit(0);
+})().catch(error => { console.error(error.message); process.exitCode = 1; });`;
+    const { root } = await fixture({ firstStageScript: script });
+    const controller = new AbortController();
+    const progress = vi.spyOn(process.stderr, 'write');
+    let running;
+    try {
+        const row = await prepareIssueWorktree({
+            baseRef: 'main',
+            identity: 'synthetic-author',
+            issueNumber: 17,
+            repoRoot: root,
+        });
+        const bounds = {
+            maxAggregateRssBytes: 1_000_000_000,
+            minFreeDiskBytes: 1,
+            maxNewOutputBytes: 4096,
+            outputRoots: [output],
+        };
+        const { withRuntimeSetupWriter } = await import('./verification.js');
+        running = (mode === 'verification'
+            ? verifyIssue({ issueNumber: 17, repoRoot: row.path, resourceBounds: bounds, signal: controller.signal })
+            : withRuntimeSetupWriter(row.path, (runner) => runner.run([process.execPath, '-e', script], bounds, controller.signal))).catch((error) => error);
+        for (let attempt = 0; attempt < 300 && !existsSync(join(output, 'capability')); attempt++)
+            await new Promise((resolve) => setTimeout(resolve, 20));
+        assert.ok(existsSync(join(output, 'capability')));
+        const cap = JSON.parse(readFileSync(join(output, 'capability'), 'utf8'));
+        const pids = JSON.parse(readFileSync(join(output, 'pids'), 'utf8'));
+        const writerPath = join(root, '.git', 'ai-delivery', 'writers@1', digestValue(row.path).slice(7) + '.json');
+        const descendantObserved = () => {
+            const state = JSON.parse(readFileSync(writerPath, 'utf8'));
+            return state.command.tracked?.some((member) => member.pid === pids.descendant) === true;
+        };
+        for (let attempt = 0; attempt < 300 && (!descendantObserved() || readdirSync(join(cap.directory, 'requests')).length === 0); attempt++)
+            await new Promise((resolve) => setTimeout(resolve, 20));
+        assert.ok(descendantObserved());
+        assert.ok(readdirSync(join(cap.directory, 'requests')).length > 0);
+        writeFileSync(join(output, 'exit-parent'), 'exit');
+        const parentAlive = () => spawnSync('ps', ['-p', String(pids.root), '-o', 'stat='], { encoding: 'utf8' }).stdout.trim().length > 0;
+        for (let attempt = 0; attempt < 100 && parentAlive(); attempt++)
+            await new Promise((resolve) => setTimeout(resolve, 20));
+        assert.equal(parentAlive(), false);
+        const samples = () => progress.mock.calls.filter(([line]) => String(line).includes('sampledAggregateRssBytes')).length;
+        const afterExit = samples();
+        for (let attempt = 0; attempt < 100 && samples() === afterExit; attempt++)
+            await new Promise((resolve) => setTimeout(resolve, 20));
+        const observedAfterExit = samples() > afterExit;
+        controller.abort();
+        const failure = String(await running);
+        assert.match(failure, /cancelled/u);
+        assert.doesNotMatch(failure, /cleanup failed|live holder/u);
+        assert.ok(observedAfterExit, 'RSS and disk observation continues while the closed command awaits its scan');
+        assert.equal(existsSync(cap.directory), false);
+        assert.ok(existsSync(join(output, 'fifo')));
+        assert.equal(readFileSync(join(output, 'unrelated'), 'utf8'), 'preserved');
+        assert.equal(spawnSync('ps', ['-p', String(pids.descendant), '-o', 'stat='], { encoding: 'utf8' }).stdout.trim().length, 0);
+        assert.equal(progress.mock.calls.some(([line]) => String(line).includes('"state":"completed"')), false);
+    }
+    finally {
+        controller.abort();
+        await running;
+        progress.mockRestore();
+        rmSync(root, { recursive: true, force: true });
+        rmSync(output, { recursive: true, force: true });
+    }
+});
+test('filesystem fixture helper runs standalone and fails closed on malformed capability', async () => {
+    const { withVerificationFilesystemFixture } = await import('./agent.js');
+    assert.equal(await withVerificationFilesystemFixture(() => 'standalone'), 'standalone');
+    const prior = process.env['AI_DELIVERY_OUTPUT_OBSERVATION_GATE'];
+    try {
+        process.env['AI_DELIVERY_OUTPUT_OBSERVATION_GATE'] = '{}';
+        let executed = false;
+        await assert.rejects(withVerificationFilesystemFixture(() => {
+            executed = true;
+        }), /invalid or stale/u);
+        assert.equal(executed, false);
+    }
+    finally {
+        if (prior === undefined)
+            delete process.env['AI_DELIVERY_OUTPUT_OBSERVATION_GATE'];
+        else
+            process.env['AI_DELIVERY_OUTPUT_OBSERVATION_GATE'] = prior;
+    }
+});
+test('nested runtime setup inherits the outer gate for its baseline and child command', async () => {
+    const output = realpathSync(mkdtempSync(join(tmpdir(), 'ai-delivery-nested-fixture-')));
+    const inner = await fixture();
+    const worker = filesystemFixtureScript(output, 'pass');
+    const { root } = await fixture({
+        firstStageScript: `
+(async () => {
+  const fs = require('node:fs'), cp = require('node:child_process'), assert = require('node:assert/strict');
+  const { withRuntimeSetupWriter } = await import(${JSON.stringify(new URL('./verification.js', import.meta.url).href)});
+  const capability = process.env.AI_DELIVERY_OUTPUT_OBSERVATION_GATE;
+  const child = cp.spawn(process.execPath, ['-e', ${JSON.stringify(worker)}], { stdio: ['ignore', 'inherit', 'inherit'] });
+  const closed = new Promise((resolve, reject) => child.once('exit', code => code === 0 ? resolve() : reject(new Error('fixture child exit ' + code))));
+  while (!fs.existsSync(${JSON.stringify(join(output, 'capability'))})) await new Promise(resolve => setTimeout(resolve, 10));
+  assert.equal(fs.readFileSync(${JSON.stringify(join(output, 'capability'))}, 'utf8'), capability);
+  await withRuntimeSetupWriter(${JSON.stringify(inner.root)}, async runner => {
+    await runner.run([process.execPath, '-e', 'require("node:assert/strict").equal(process.env.AI_DELIVERY_OUTPUT_OBSERVATION_GATE, ' + JSON.stringify(capability) + ')'], { maxAggregateRssBytes: 1000000000, minFreeDiskBytes: 1, maxNewOutputBytes: 2048, outputRoots: [${JSON.stringify(output)}] });
+  });
+  await closed;
+})().catch(error => { console.error(error.message); process.exitCode = 1; });`,
+    });
+    try {
+        const row = await prepareIssueWorktree({
+            baseRef: 'main',
+            identity: 'synthetic-author',
+            issueNumber: 17,
+            repoRoot: root,
+        });
+        await verifyIssue({
+            issueNumber: 17,
+            repoRoot: row.path,
+            resourceBounds: {
+                maxAggregateRssBytes: 1_000_000_000,
+                minFreeDiskBytes: 1,
+                maxNewOutputBytes: 2048,
+                outputRoots: [output],
+            },
+        });
+        assert.deepEqual(readFileSync(join(output, 'events'), 'utf8').trim().split('\n'), [
+            'created',
+            'scan-queued',
+            'reader-rejected',
+            'cleaned',
+            'released',
+        ]);
+        assert.equal(existsSync(join(inner.root, '.git', 'ai-delivery', 'output-observation')), false);
+    }
+    finally {
+        rmSync(root, { recursive: true, force: true });
+        rmSync(inner.root, { recursive: true, force: true });
+        rmSync(output, { recursive: true, force: true });
+    }
+});
+test('interrupted fixture owner recovers its gate, preserves completed work and rejects a leaked FIFO before resume', async () => {
+    const output = realpathSync(mkdtempSync(join(tmpdir(), 'ai-delivery-fixture-recovery-')));
+    const marker = join(output, 'capability');
+    const { root, counter, secondCounter, failSecond } = await fixture({ twoStages: true });
+    let child;
+    let childOutput = '';
+    try {
+        const row = await prepareIssueWorktree({
+            baseRef: 'main',
+            identity: 'synthetic-author',
+            issueNumber: 17,
+            repoRoot: root,
+        });
+        const bounds = {
+            maxAggregateRssBytes: 1_000_000_000,
+            minFreeDiskBytes: 1,
+            maxNewOutputBytes: 2048,
+            outputRoots: [output],
+        };
+        writeFileSync(failSecond, 'fail once');
+        await assert.rejects(verifyIssue({ issueNumber: 17, repoRoot: row.path, resourceBounds: bounds }), /exit 7/u);
+        assert.equal(readFileSync(counter, 'utf8'), '1');
+        child = spawn(process.execPath, [
+            '-e',
+            `(async () => {
+      const { withRuntimeSetupWriter } = await import(${JSON.stringify(new URL('./verification.js', import.meta.url).href)});
+      await withRuntimeSetupWriter(${JSON.stringify(row.path)}, runner => runner.run([process.execPath, '-e', ${JSON.stringify(filesystemFixtureScript(output, 'cancel'))}], ${JSON.stringify(bounds)}));
+    })().catch(error => { console.error(error.message); process.exitCode = 1; });`,
+        ], { stdio: ['ignore', 'pipe', 'pipe'] });
+        const capture = (chunk) => {
+            childOutput += chunk.toString();
+            if (childOutput.length > 1024 * 1024)
+                child.kill('SIGKILL');
+        };
+        child.stdout.on('data', capture);
+        child.stderr.on('data', capture);
+        const closed = new Promise((resolve) => child.once('exit', () => resolve()));
+        for (let attempt = 0; attempt < 500 && !existsSync(marker); attempt++)
+            await new Promise((resolve) => setTimeout(resolve, 20));
+        assert.ok(existsSync(marker), childOutput);
+        const priorGate = JSON.parse(readFileSync(marker, 'utf8'));
+        child.kill('SIGKILL');
+        await closed;
+        assert.equal(child.signalCode, 'SIGKILL');
+        // Exercise the existing writer's stale-file recovery after the exact parent has exited.
+        const writerPath = join(root, '.git', 'ai-delivery', 'writers@1', digestValue(row.path).slice(7) + '.json');
+        const stale = new Date(Date.now() - 20_000);
+        utimesSync(writerPath + '.lock', stale, stale);
+        await assert.rejects(verifyIssue({ issueNumber: 17, repoRoot: row.path, resourceBounds: bounds }), /unsupported file/u);
+        assert.equal(existsSync(priorGate.directory), false);
+        assert.ok(existsSync(join(output, 'fifo')));
+        assert.equal(readFileSync(counter, 'utf8'), '1');
+        unlinkSync(join(output, 'fifo'));
+        unlinkSync(failSecond);
+        const resumed = await verifyIssue({ issueNumber: 17, repoRoot: row.path, resourceBounds: bounds });
+        assert.equal(resumed.stageReceipts.length, 2);
+        assert.equal(readFileSync(counter, 'utf8'), '1');
+        assert.equal(readFileSync(secondCounter, 'utf8'), '2');
+        assert.ok(resumed.stageReceipts.every((receipt) => receipt.commands.every((command) => command.exitCode === 0)));
+        const cached = await verifyIssue({ issueNumber: 17, repoRoot: row.path, resourceBounds: bounds });
+        assert.deepEqual(cached.stageReceipts.map((receipt) => receipt.receiptId), resumed.stageReceipts.map((receipt) => receipt.receiptId));
+        await verifyIssue({ issueNumber: 17, repoRoot: row.path, resourceBounds: { ...bounds, maxNewOutputBytes: 4096 } });
+        assert.equal(readFileSync(counter, 'utf8'), '2');
+    }
+    finally {
+        child?.kill('SIGKILL');
+        rmSync(root, { recursive: true, force: true });
+        rmSync(output, { recursive: true, force: true });
+    }
+});
 //# sourceMappingURL=lifecycle.test.js.map