@aviaratech/ai-delivery 0.3.9 → 0.3.11

package/README.md

@@ -10,6 +10,15 @@ Install the versioned package from npm or a reviewed package archive. The
 consuming repository must run its own configuration and runtime-admission
 procedure before any lifecycle write.
 
+The selected CLI, MCP server and verification controller use Node 24.21.0 and
+npm 11.19.0. The public library exports also support Node 26.2.0 consumers.
+Package checks run the Node 24 controller against actual npm-packed Node 26
+consumers, including filesystem fixture contention, reader and link rejection,
+success/failure teardown, cancellation, leaked fixtures and positive byte limits.
+For package development, set `AI_DELIVERY_NODE26_EXECUTABLE` to the absolute
+Node 26.2.0 executable before `npm run checks`; CI retains that executable while
+selecting Node 24 for the canonical commands.
+
 ```sh
 node --version # 24.21.0
 npm --version  # 11.19.0
@@ -323,7 +332,7 @@ The classifier owns the digest values and must include every relevant source, co
 
 Verification holds one file lease per worktree and durably records its writer and observed command process identities. A second writer in the same worktree is rejected before execution. Separate worktrees can overlap, including at the same head, with separate stage inputs and mutable manifests. Callers must first qualify their commands' CPU, memory, disk, I/O and shared-file/service requirements; a resource class alone grants no shared-resource exclusivity. The runtime adds no global executor cap. On retry after writer interruption, it refuses live or unknown ownership and reconciles only the recorded command group and observed descendants before reusing compatible completed stages. A launch interrupted before command identity was recorded requires explicit reconciliation. Process identity observation is required on supported POSIX hosts; unavailable or ambiguous observation fails closed.
 
-The `--admit` flag explicitly admits additional resource classes. Publication creates a draft PR only after exact-head verification; a high-risk policy also requires a prepublication review artifact. Ready promotion and merge require a submitted formal review. Merge checks live blockers, checks, base/head coordinates, and the policy boundary. Repositories may require an exact base/head lease for merge.
+The `--admit` flag explicitly admits additional resource classes for execution. Compatible complete stages are reused only after their existing stage, artifact, command-output and applicable resource proofs are fully validated, without admitting execution of those classes. Missing or incompatible proof requires the current invocation's admission for the actual stage class before any command runs; corrupt proof remains a hard failure. This permits serial `source_only`, `model`, then `postgres_docker` invocations to reuse prior completed stages while admitting only the next class to execute. Publication creates a draft PR only after exact-head verification; a high-risk policy also requires a prepublication review artifact. Ready promotion and merge require a submitted formal review. Merge checks live blockers, checks, base/head coordinates, and the policy boundary. Repositories may require an exact base/head lease for merge.
 
 For a bounded run, pass `--max-aggregate-rss-bytes`, `--min-free-disk-bytes`, and optionally `--max-new-output-bytes` with one or more `--output-root` paths to `verify`. `issue_verify` accepts the same values in `resourceBounds`. RSS is sampled across the observed child process tree, including observed detached descendants; free disk is checked before commands and during execution on the worktree and declared output filesystems. Positive file-size growth is sampled under the declared roots, with previously measured completed stages carried across a resume. The caller must declare every output root relevant to its allowance; aliases must resolve within those roots. The roots are relative to the issue worktree unless absolute. Output growth is separate from the 8 MiB captured stdout/stderr limit. Resource limits are opt in and do not impose a total runtime deadline.
 

package/dist/lifecycle.test.js

@@ -4,7 +4,8 @@ import { createHash } from 'node:crypto';
 import { cpSync, chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readlinkSync, readdirSync, realpathSync, rmSync, symlinkSync, unlinkSync, utimesSync, writeFileSync, } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
-import { test, vi } from 'vitest';
+import { fileURLToPath } from 'node:url';
+import { afterAll, test, vi } from 'vitest';
 import { syntheticDiscoveryClients, syntheticOverrides } from './fixtures/discovery.js';
 import { Octokit } from '@octokit/rest';
 import { Client } from '@modelcontextprotocol/sdk/client/index.js';
@@ -12,7 +13,7 @@ import { InMemoryTransport } from '@modelcontextprotocol/sdk/inMemory.js';
 import { AI_DELIVERY_MCP_TOOLS } from './mcp/tools.js';
 import { createAiDeliveryMcpServer } from './mcp/index.js';
 import { loadDeliveryConfig, parseDeliveryConfig } from './config/deliveryConfig.js';
-import { digestValue } from './delivery/index.js';
+import { digestValue, stableJson } from './delivery/index.js';
 import { contextFor, executeTool, resumedIssueUpdate, startTrackedIssue } from './dispatch.js';
 import { defaultBaseRef, gitCommonDir } from './git.js';
 import * as githubClient from './github/client.js';
@@ -210,6 +211,7 @@ async function fixture(options = {}) {
     const remoteName = options.remote ?? 'origin';
     const counter = join(root, '.git', 'stage-count.txt');
     const secondCounter = join(root, '.git', 'second-stage-count.txt');
+    const thirdCounter = join(root, '.git', 'third-stage-count.txt');
     const failSecond = join(root, '.git', 'fail-second-stage');
     try {
         git(root, 'init', '-q', '-b', 'main');
@@ -290,11 +292,16 @@ export default {
       requiredStages: [{ id: 'check', dependsOn: [], semanticInputKeys: ['source'],
         ${options.componentPolicy ? "semanticInputs: [{ key: 'source', digest: bytes(readFileSync(new URL('./artifact.txt', import.meta.url))) }]," : ''}
         resourceClass: 'source_only', commands: [{ label: 'count', argv: [process.execPath, '-e',
-          ${JSON.stringify(options.firstStageScript ?? `const fs=require('fs');const p=${JSON.stringify(counter)};fs.writeFileSync(p,String(Number(fs.existsSync(p)?fs.readFileSync(p,'utf8'):0)+1));`)}] }] }${options.twoStages
+          ${JSON.stringify(options.firstStageScript ?? `const fs=require('fs');const p=${JSON.stringify(counter)};fs.writeFileSync(p,String(Number(fs.existsSync(p)?fs.readFileSync(p,'utf8'):0)+1));`)}] }] }${options.twoStages || options.serialResourceStages
             ? `, { id: 'second', dependsOn: ['check'], semanticInputKeys: ['source'],
         ${options.componentPolicy ? "semanticInputs: [{ key: 'source', digest: bytes(readFileSync(new URL('./component.txt', import.meta.url))) }]," : ''}
-        resourceClass: 'source_only', commands: [{ label: 'retry', argv: [process.execPath, '-e',
+        resourceClass: '${options.serialResourceStages ? 'model' : 'source_only'}', commands: [{ label: 'retry', argv: [process.execPath, '-e',
           ${JSON.stringify(options.secondStageScript ?? `const fs=require('fs');const p=${JSON.stringify(secondCounter)};fs.writeFileSync(p,String(Number(fs.existsSync(p)?fs.readFileSync(p,'utf8'):0)+1));if(fs.existsSync(${JSON.stringify(failSecond)}))process.exit(7);`)}] }] }`
+            : ''}${options.serialResourceStages
+            ? `, { id: 'postgres', dependsOn: ['second'], semanticInputKeys: ['source'],
+        ${options.componentPolicy ? "semanticInputs: [{ key: 'source', digest: bytes(readFileSync(new URL('./component.txt', import.meta.url))) }]," : ''}
+        resourceClass: 'postgres_docker', commands: [{ label: 'count', argv: [process.execPath, '-e',
+          ${JSON.stringify(`const fs=require('fs');const p=${JSON.stringify(thirdCounter)};fs.writeFileSync(p,String(Number(fs.existsSync(p)?fs.readFileSync(p,'utf8'):0)+1));`)}] }] }`
             : ''}],
       risk: 'standard' };
   },
@@ -353,7 +360,7 @@ export default {
         mkdirSync(dirname(admissionPath), { recursive: true });
         if (!options.omitRuntimeAdmission)
             writeFileSync(admissionPath, JSON.stringify({ ...content, admissionId: digestValue(content) }), { mode: 0o600 });
-        return { root, counter, secondCounter, failSecond, runtimeEntryPath };
+        return { root, counter, secondCounter, thirdCounter, failSecond, runtimeEntryPath };
     }
     catch (error) {
         rmSync(root, { recursive: true, force: true });
@@ -1803,6 +1810,224 @@ test('a bounded passing run records measured resources in versioned evidence', a
         rmSync(root, { recursive: true, force: true });
     }
 });
+test.each([
+    { bounded: false, componentPolicy: false },
+    { bounded: true, componentPolicy: false },
+    { bounded: true, componentPolicy: true },
+])('serial admission reuses complete stages with bounds $bounded and component policy $componentPolicy', async ({ bounded, componentPolicy }) => {
+    const { root, counter, secondCounter, thirdCounter } = await fixture({
+        serialResourceStages: true,
+        componentPolicy,
+    });
+    try {
+        const row = await prepareIssueWorktree({
+            baseRef: 'main',
+            identity: 'synthetic-author',
+            issueNumber: 17,
+            repoRoot: root,
+        });
+        const input = {
+            issueNumber: 17,
+            repoRoot: row.path,
+            ...(bounded ? { resourceBounds: { maxAggregateRssBytes: 1_000_000_000, minFreeDiskBytes: 1 } } : {}),
+        };
+        await assert.rejects(verifyIssue({ ...input, admittedResourceClasses: ['source_only'] }), /Stage 'second' requires explicit model admission/u);
+        assert.equal(readFileSync(counter, 'utf8'), '1');
+        assert.equal(existsSync(secondCounter), false);
+        assert.equal(existsSync(thirdCounter), false);
+        await assert.rejects(verifyIssue({ ...input, admittedResourceClasses: ['model'] }), /Stage 'postgres' requires explicit postgres_docker admission/u);
+        assert.equal(readFileSync(counter, 'utf8'), '1');
+        assert.equal(readFileSync(secondCounter, 'utf8'), '1');
+        assert.equal(existsSync(thirdCounter), false);
+        const completed = await verifyIssue({ ...input, admittedResourceClasses: ['postgres_docker'] });
+        const repeated = await verifyIssue({ ...input, admittedResourceClasses: [] });
+        assert.deepEqual(repeated.stageReceipts, completed.stageReceipts);
+        for (const path of [counter, secondCounter, thirdCounter])
+            assert.equal(readFileSync(path, 'utf8'), '1');
+        if (bounded) {
+            assert.deepEqual(repeated.resources, completed.resources);
+            assert.ok((repeated.resources?.sampleCount ?? 0) > 0);
+            const first = completed.stageReceipts[0];
+            const stagePath = join(root, '.git', 'ai-delivery', first.input.schemaVersion === 'ai-delivery.stage-input@2' ? 'verification@2' : 'verification@1', 'stages', 'check', `${first.input.inputId.slice(7)}.json`);
+            rmSync(stagePath);
+            const repaired = await verifyIssue({ ...input, admittedResourceClasses: [] });
+            assert.deepEqual(repaired.stageReceipts, completed.stageReceipts);
+            assert.deepEqual(repaired.resources, completed.resources);
+            assert.equal(existsSync(stagePath), true);
+            assert.equal(readFileSync(counter, 'utf8'), '1');
+        }
+    }
+    finally {
+        rmSync(root, { recursive: true, force: true });
+    }
+});
+test.each(['missing', 'unmeasured', 'source', 'command', 'environment', 'runtime', 'producer', 'bounds'])('serial admission refuses execution after %s proof invalidation', async (changed) => {
+    const { root, counter, secondCounter, thirdCounter } = await fixture({ serialResourceStages: true });
+    const previousPath = process.env.PATH;
+    const versionDescriptor = Object.getOwnPropertyDescriptor(process, 'version');
+    const producerPath = join(import.meta.dirname, 'serial-producer-fixture.js');
+    let producerOwned = false;
+    try {
+        const row = await prepareIssueWorktree({
+            baseRef: 'main',
+            identity: 'synthetic-author',
+            issueNumber: 17,
+            repoRoot: root,
+        });
+        const input = {
+            issueNumber: 17,
+            repoRoot: row.path,
+            resourceBounds: { maxAggregateRssBytes: 1_000_000_000, minFreeDiskBytes: 1 },
+        };
+        const completed = await verifyIssue({
+            ...(changed === 'unmeasured' ? { issueNumber: input.issueNumber, repoRoot: input.repoRoot } : input),
+            admittedResourceClasses: ['source_only', 'model', 'postgres_docker'],
+        });
+        if (changed === 'missing') {
+            const id = completed.stageReceipts[0].input.inputId.slice(7);
+            rmSync(join(root, '.git', 'ai-delivery', 'verification@1', 'stages', 'check', `${id}.json`));
+            rmSync(join(root, '.git', 'ai-delivery', 'resource-stages@1', `${id}.json`));
+        }
+        else if (changed === 'source' || changed === 'command') {
+            const path = join(row.path, changed === 'source' ? 'change.txt' : 'policy.mjs');
+            writeFileSync(path, changed === 'source'
+                ? 'changed source\n'
+                : readFileSync(path, 'utf8').replace("label: 'count'", "label: 'changed-count'"));
+            git(row.path, 'add', '.');
+            git(row.path, 'commit', '-qm', 'synthetic checkpoint invalidation');
+        }
+        else if (changed === 'environment')
+            process.env.PATH = `${previousPath ?? ''}:/synthetic-environment`;
+        else if (changed === 'runtime')
+            Object.defineProperty(process, 'version', { value: 'v0.0.0' });
+        else if (changed === 'producer') {
+            assert.equal(existsSync(producerPath), false);
+            writeFileSync(producerPath, '// changed synthetic runner identity\n');
+            producerOwned = true;
+        }
+        else if (changed === 'bounds')
+            input.resourceBounds.maxAggregateRssBytes -= 1;
+        await assert.rejects(verifyIssue({ ...input, admittedResourceClasses: ['postgres_docker'] }), /Stage 'check' requires explicit source_only admission/u);
+        for (const path of [counter, secondCounter, thirdCounter])
+            assert.equal(readFileSync(path, 'utf8'), '1');
+    }
+    finally {
+        if (previousPath === undefined)
+            delete process.env.PATH;
+        else
+            process.env.PATH = previousPath;
+        Object.defineProperty(process, 'version', versionDescriptor);
+        if (producerOwned)
+            rmSync(producerPath);
+        rmSync(root, { recursive: true, force: true });
+    }
+});
+test.each([
+    'stage',
+    'canonical',
+    'artifact',
+    'output',
+    'resource',
+    'resource-bounds',
+    'resource-samples',
+    'missing-resource',
+    'baseline',
+])('serial admission rejects corrupt %s proof before considering execution', async (corrupt) => {
+    const { root, counter, secondCounter, thirdCounter } = await fixture({ serialResourceStages: true });
+    try {
+        const row = await prepareIssueWorktree({
+            baseRef: 'main',
+            identity: 'synthetic-author',
+            issueNumber: 17,
+            repoRoot: root,
+        });
+        mkdirSync(join(row.path, '.issue-cli'), { recursive: true });
+        const input = {
+            issueNumber: 17,
+            repoRoot: row.path,
+            resourceBounds: {
+                maxAggregateRssBytes: 1_000_000_000,
+                minFreeDiskBytes: 1,
+                maxNewOutputBytes: 1_000_000,
+                outputRoots: ['.issue-cli'],
+            },
+        };
+        const completed = await verifyIssue({
+            ...input,
+            admittedResourceClasses: ['source_only', 'model', 'postgres_docker'],
+        });
+        const first = completed.stageReceipts[0];
+        const common = join(root, '.git', 'ai-delivery');
+        const id = first.input.inputId.slice(7);
+        const stagePath = join(common, 'verification@1', 'stages', 'check', `${id}.json`);
+        const resourcePath = join(common, 'resource-stages@1', `${id}.json`);
+        if (corrupt === 'stage')
+            writeFileSync(stagePath, 'corrupt stage proof\n');
+        else if (corrupt === 'canonical')
+            writeFileSync(stagePath, `${readFileSync(stagePath, 'utf8')}\n`);
+        else if (corrupt === 'artifact') {
+            const { receiptId: _receiptId, ...content } = first;
+            const altered = { ...content, artifacts: [{ path: 'artifact.txt', digest: digestValue('corrupt artifact') }] };
+            writeFileSync(stagePath, stableJson({ ...altered, receiptId: digestValue(altered) }));
+        }
+        else if (corrupt === 'output') {
+            writeFileSync(join(common, 'verification@1', 'command-output', `${first.commands[0].outputDigest.slice(7)}.bin`), 'corrupt output');
+        }
+        else if (corrupt === 'resource')
+            writeFileSync(resourcePath, 'corrupt resource proof\n');
+        else if (corrupt === 'missing-resource')
+            rmSync(resourcePath);
+        else if (corrupt === 'baseline') {
+            const directory = join(common, 'output-baselines@1');
+            const file = readdirSync(directory).find((name) => name.endsWith('.json') && !name.endsWith('.state.json'));
+            writeFileSync(join(directory, file), 'corrupt baseline proof\n');
+        }
+        else {
+            const { checkpointId: _checkpointId, ...content } = JSON.parse(readFileSync(resourcePath, 'utf8'));
+            if (corrupt === 'resource-bounds')
+                content.resources.bounds.maxAggregateRssBytes += 1;
+            else
+                content.resources.sampleCount = 0;
+            writeFileSync(resourcePath, JSON.stringify({ ...content, checkpointId: digestValue(content) }));
+        }
+        await assert.rejects(verifyIssue({ ...input, admittedResourceClasses: ['postgres_docker'] }), (error) => error instanceof Error && !error.message.includes('admission'));
+        for (const path of [counter, secondCounter, thirdCounter])
+            assert.equal(readFileSync(path, 'utf8'), '1');
+    }
+    finally {
+        rmSync(root, { recursive: true, force: true });
+    }
+});
+test('serial admission requires dependent execution after a real upstream rerun', async () => {
+    const { root, counter, secondCounter, thirdCounter } = await fixture({ serialResourceStages: true });
+    try {
+        const row = await prepareIssueWorktree({
+            baseRef: 'main',
+            identity: 'synthetic-author',
+            issueNumber: 17,
+            repoRoot: root,
+        });
+        const input = {
+            issueNumber: 17,
+            repoRoot: row.path,
+            resourceBounds: { maxAggregateRssBytes: 1_000_000_000, minFreeDiskBytes: 1 },
+        };
+        const completed = await verifyIssue({
+            ...input,
+            admittedResourceClasses: ['source_only', 'model', 'postgres_docker'],
+        });
+        const id = completed.stageReceipts[0].input.inputId.slice(7);
+        rmSync(join(root, '.git', 'ai-delivery', 'verification@1', 'stages', 'check', `${id}.json`));
+        rmSync(join(root, '.git', 'ai-delivery', 'resource-stages@1', `${id}.json`));
+        await assert.rejects(verifyIssue({ ...input, admittedResourceClasses: ['source_only'] }), /Stage 'second' requires explicit model admission/u);
+        assert.equal(readFileSync(counter, 'utf8'), '2');
+        assert.equal(readFileSync(secondCounter, 'utf8'), '1');
+        assert.equal(readFileSync(thirdCounter, 'utf8'), '1');
+    }
+    finally {
+        rmSync(root, { recursive: true, force: true });
+    }
+});
 test('bounded verification reruns unmeasured work and reuses only matching measured stages', async () => {
     const { root, counter, secondCounter, failSecond } = await fixture({ twoStages: true });
     try {
@@ -4027,13 +4252,71 @@ test('fully cached bounded verification still rejects a newly leaked FIFO', asyn
         rmSync(root, { recursive: true, force: true });
     }
 });
-function filesystemFixtureScript(output, mode) {
+let node26Package;
+function packedNode26Consumer() {
+    if (node26Package !== undefined)
+        return node26Package;
+    assert.equal(process.version, 'v24.21.0', 'canonical verification controller must remain Node 24.21.0');
+    const executable = process.env['AI_DELIVERY_NODE26_EXECUTABLE'];
+    assert.ok(executable, 'set AI_DELIVERY_NODE26_EXECUTABLE to the actual Node 26.2.0 executable');
+    assert.equal(execFileSync(executable, ['--version'], { encoding: 'utf8' }).trim(), 'v26.2.0');
+    const temporary = realpathSync(mkdtempSync(join(tmpdir(), 'ai-delivery-node26-')));
+    try {
+        const source = fileURLToPath(new URL('../', import.meta.url));
+        const pack = JSON.parse(execFileSync('npm', ['pack', '--json', '--pack-destination', temporary], {
+            cwd: source,
+            encoding: 'utf8',
+            maxBuffer: 4 * 1024 * 1024,
+        }));
+        execFileSync('tar', ['-xzf', join(temporary, pack[0].filename), '-C', temporary]);
+        const root = join(temporary, 'package');
+        symlinkSync(join(source, 'node_modules'), join(root, 'node_modules'), 'dir');
+        process.stderr.write(`ai-delivery.node26-consumer ${JSON.stringify({
+            controller: process.version,
+            consumer: 'v26.2.0',
+            archiveSha256: createHash('sha256')
+                .update(readFileSync(join(temporary, pack[0].filename)))
+                .digest('hex'),
+            manifestSha256: createHash('sha256')
+                .update(readFileSync(join(root, 'package.json')))
+                .digest('hex'),
+        })}\n`);
+        node26Package = { executable: realpathSync(executable), root, temporary };
+        return node26Package;
+    }
+    catch (error) {
+        rmSync(temporary, { recursive: true, force: true });
+        throw error;
+    }
+}
+afterAll(() => {
+    if (node26Package !== undefined)
+        rmSync(node26Package.temporary, { recursive: true, force: true });
+});
+function node26ConsumerScript(script) {
+    const consumer = packedNode26Consumer();
     return `
+require('node:assert/strict').equal(process.version, 'v24.21.0');
+const child = require('node:child_process').spawnSync(${JSON.stringify(consumer.executable)}, ['-e', ${JSON.stringify(script)}], { cwd: ${JSON.stringify(consumer.root)}, stdio: 'inherit' });
+if (child.error) throw child.error;
+process.exit(child.status ?? 1);`;
+}
+function filesystemFixtureScript(output, mode, runtime = 'node24') {
+    const script = `
 (async () => {
   const fs = require('node:fs'), cp = require('node:child_process'), path = require('node:path'), assert = require('node:assert/strict');
-  const { withVerificationFilesystemFixture } = await import(${JSON.stringify(new URL('./agent.js', import.meta.url).href)});
-  const { assertPrivateFile } = await import(${JSON.stringify(new URL('./delivery/common.js', import.meta.url).href)});
+  assert.equal(process.version, ${JSON.stringify(runtime === 'node26' ? 'v26.2.0' : 'v24.21.0')});
+  const { withVerificationFilesystemFixture } = await import(${JSON.stringify(runtime === 'node26' ? '@aviaratech/ai-delivery/agent' : new URL('./agent.js', import.meta.url).href)});
+  const { loadValidRepositoryDeliveryEvidence } = await import(${JSON.stringify(runtime === 'node26' ? '@aviaratech/ai-delivery/delivery' : new URL('./delivery/index.js', import.meta.url).href)});
   const output = ${JSON.stringify(output)}, fifo = path.join(output, 'fifo'), events = path.join(output, 'events');
+  const evidenceId = 'sha256:' + 'a'.repeat(64), currentHead = { sha: 'b'.repeat(40), tree: 'c'.repeat(40) };
+  const evidence = path.join(output, 'ai-delivery', 'receipts', 'delivery@1', currentHead.sha, evidenceId.slice(7) + '.json');
+  fs.mkdirSync(path.dirname(evidence), { recursive: true });
+  const rejectPrivateFile = file => {
+    fs.renameSync(file, evidence);
+    try { assert.throws(() => loadValidRepositoryDeliveryEvidence({ createInput: { gitCommonDir: output, currentHead }, evidenceId }), /private regular file/); }
+    finally { fs.renameSync(evidence, file); }
+  };
   const gate = JSON.parse(process.env.AI_DELIVERY_OUTPUT_OBSERVATION_GATE);
   const trace = value => fs.appendFileSync(events, value + '\\n');
   await withVerificationFilesystemFixture(async () => {
@@ -4046,20 +4329,26 @@ function filesystemFixtureScript(output, mode) {
       if (${JSON.stringify(mode)} === 'block') fs.readFileSync(fifo);
       while (fs.readdirSync(path.join(gate.directory, 'requests')).length === 0) await new Promise(resolve => setTimeout(resolve, 10));
       assert.ok(fs.existsSync(fifo)); trace('scan-queued');
-      assert.throws(() => assertPrivateFile(fifo), /private regular file/); trace('reader-rejected');
+      rejectPrivateFile(fifo); trace('reader-rejected');
       const regular = path.join(output, 'regular'), hard = path.join(output, 'hard'), alias = path.join(output, 'alias');
       fs.writeFileSync(regular, 'x'.repeat(128), { mode: 0o600 });
-      fs.linkSync(regular, hard); assert.throws(() => assertPrivateFile(hard), /private regular file/); fs.unlinkSync(hard);
-      fs.symlinkSync('./regular', alias); assert.throws(() => assertPrivateFile(alias), /private regular file/); fs.unlinkSync(alias);
+      fs.linkSync(regular, hard); rejectPrivateFile(hard); fs.unlinkSync(hard);
+      fs.symlinkSync('./regular', alias); rejectPrivateFile(alias); fs.unlinkSync(alias);
       if (${JSON.stringify(mode)} === 'assertion') throw new Error('synthetic reader assertion failure');
     } finally { fs.unlinkSync(fifo); trace('cleaned'); }
   });
   trace('released');
 })().catch(error => { console.error(error.message); process.exitCode = 1; });`;
+    return runtime === 'node26' ? node26ConsumerScript(script) : script;
 }
-test.each(['pass', 'assertion'])('filesystem fixture gate deterministically queues a scan through reader rejection and %s teardown', async (mode) => {
+test.each([
+    ['pass', 'node24'],
+    ['assertion', 'node24'],
+    ['pass', 'node26'],
+    ['assertion', 'node26'],
+])('filesystem fixture gate deterministically queues a scan through reader rejection and %s teardown on %s', async (mode, runtime) => {
     const output = realpathSync(mkdtempSync(join(tmpdir(), 'ai-delivery-fixture-gate-')));
-    const { root } = await fixture({ firstStageScript: filesystemFixtureScript(output, mode) });
+    const { root } = await fixture({ firstStageScript: filesystemFixtureScript(output, mode, runtime) });
     try {
         const row = await prepareIssueWorktree({
             baseRef: 'main',
@@ -4095,10 +4384,17 @@ test.each(['pass', 'assertion'])('filesystem fixture gate deterministically queu
         rmSync(output, { recursive: true, force: true });
     }
 });
-test.each(['abrupt', 'block', 'cancel'])('filesystem fixture gate preserves leaked FIFO and unrelated files after %s', async (mode) => {
+test.each([
+    ['abrupt', 'node24'],
+    ['block', 'node24'],
+    ['cancel', 'node24'],
+    ['abrupt', 'node26'],
+    ['block', 'node26'],
+    ['cancel', 'node26'],
+])('filesystem fixture gate preserves leaked FIFO and unrelated files after %s on %s', async (mode, runtime) => {
     const output = realpathSync(mkdtempSync(join(tmpdir(), 'ai-delivery-fixture-failure-')));
     writeFileSync(join(output, 'unrelated'), 'preserved');
-    const { root } = await fixture({ firstStageScript: filesystemFixtureScript(output, mode) });
+    const { root } = await fixture({ firstStageScript: filesystemFixtureScript(output, mode, runtime) });
     const controller = new AbortController();
     let running;
     const progress = vi.spyOn(process.stderr, 'write');
@@ -4150,9 +4446,9 @@ test.each(['abrupt', 'block', 'cancel'])('filesystem fixture gate preserves leak
         rmSync(output, { recursive: true, force: true });
     }
 });
-test('filesystem fixture gate still enforces positive byte limits after deterministic contention', async () => {
+test.each(['node24', 'node26'])('filesystem fixture gate still enforces positive byte limits after deterministic contention on %s', async (runtime) => {
     const output = realpathSync(mkdtempSync(join(tmpdir(), 'ai-delivery-fixture-limit-')));
-    const { root } = await fixture({ firstStageScript: filesystemFixtureScript(output, 'pass') });
+    const { root } = await fixture({ firstStageScript: filesystemFixtureScript(output, 'pass', runtime) });
     try {
         const row = await prepareIssueWorktree({
             baseRef: 'main',
@@ -4254,6 +4550,37 @@ test.each(['verification', 'runtime'])('filesystem fixture gate preserves observ
         rmSync(output, { recursive: true, force: true });
     }
 });
+test('Node 26 packed public exports preserve standalone and malformed-capability behavior', () => {
+    const consumer = packedNode26Consumer();
+    execFileSync(consumer.executable, [
+        '-e',
+        `
+(async () => {
+  const assert = require('node:assert/strict');
+  assert.equal(process.version, 'v26.2.0');
+  const [root, agent, delivery, mcp] = await Promise.all([
+    import('@aviaratech/ai-delivery'), import('@aviaratech/ai-delivery/agent'),
+    import('@aviaratech/ai-delivery/delivery'), import('@aviaratech/ai-delivery/mcp'),
+  ]);
+  assert.equal(root.withVerificationFilesystemFixture, agent.withVerificationFilesystemFixture);
+  assert.equal(typeof agent.verifyIssue, 'function');
+  assert.equal(typeof delivery.loadValidRepositoryDeliveryEvidence, 'function');
+  assert.equal(typeof mcp.createAiDeliveryMcpServer, 'function');
+  const manifest = JSON.parse(require('node:fs').readFileSync('package.json', 'utf8'));
+  assert.deepEqual(Object.keys(manifest.exports).sort(), ['.', './agent', './delivery', './mcp']);
+  const prior = process.env.AI_DELIVERY_OUTPUT_OBSERVATION_GATE;
+  delete process.env.AI_DELIVERY_OUTPUT_OBSERVATION_GATE;
+  assert.equal(await agent.withVerificationFilesystemFixture(() => 'standalone'), 'standalone');
+  process.env.AI_DELIVERY_OUTPUT_OBSERVATION_GATE = '{}';
+  let executed = false;
+  await assert.rejects(agent.withVerificationFilesystemFixture(() => { executed = true; }), /invalid or stale/);
+  assert.equal(executed, false);
+  if (prior === undefined) delete process.env.AI_DELIVERY_OUTPUT_OBSERVATION_GATE;
+  else process.env.AI_DELIVERY_OUTPUT_OBSERVATION_GATE = prior;
+})().catch(error => { console.error(error); process.exitCode = 1; });
+`,
+    ], { cwd: consumer.root, stdio: 'pipe' });
+});
 test('filesystem fixture helper runs standalone and fails closed on malformed capability', async () => {
     const { withVerificationFilesystemFixture } = await import('./agent.js');
     assert.equal(await withVerificationFilesystemFixture(() => 'standalone'), 'standalone');