@bitkyc08/opencodex 2.12.0 → 2.13.0

package/src/lab/fabric/verifier.ts

@@ -0,0 +1,98 @@
+import { createHash } from "node:crypto";
+import {
+  FABRIC_LIMITS,
+  FABRIC_VERIFIER_ID,
+  SYNTHETIC_AFTER_UTF8,
+  SYNTHETIC_BEFORE_UTF8,
+  SYNTHETIC_VALUE_PATH,
+} from "./constants";
+import { readScratchFileUtf8, walkScratchFiles } from "./scratch";
+import { verifierManifestDigest } from "./subject";
+import type { ExactTreeDiffResultV1 } from "./types";
+import { FabricTaskError } from "./types";
+
+/** SHA-256 hex digest of a UTF-8 string for verifier tree comparisons. */
+function sha256Utf8(value: string): string {
+  return createHash("sha256").update(value, "utf8").digest("hex");
+}
+
+/**
+ * Deterministic exact-tree-diff-v1 verifier. No LLM. Walks only the scratch tree.
+ */
+export function verifyExactTreeDiffV1(scratchRoot: string): ExactTreeDiffResultV1 {
+  const manifestDigest = verifierManifestDigest();
+  const files = walkScratchFiles(scratchRoot);
+  let aggregate = 0;
+  for (const file of files) {
+    aggregate += file.byteLength;
+    if (aggregate > FABRIC_LIMITS.maxAggregateIoBytes) {
+      throw new FabricTaskError("tree exceeds io budget", "budget_exhausted", "environment");
+    }
+  }
+  if (files.length !== 1 || files[0]!.relativePosix !== SYNTHETIC_VALUE_PATH) {
+    const unexpected = files
+      .filter((row) => row.relativePosix !== SYNTHETIC_VALUE_PATH)
+      .map((row) => row.relativePosix);
+    return {
+      verifierId: FABRIC_VERIFIER_ID,
+      manifestDigest,
+      passed: false,
+      pathSummaries: [
+        ...unexpected.map((path) => ({
+          path,
+          kind: "added" as const,
+          reason: "unexpected_file",
+        })),
+        ...(files.some((row) => row.relativePosix === SYNTHETIC_VALUE_PATH)
+          ? []
+          : [{ path: SYNTHETIC_VALUE_PATH, kind: "deleted" as const, reason: "missing_required_file" }]),
+      ],
+      reason: files.length === 0 ? "deleted_required_file" : "unexpected_tree_shape",
+    };
+  }
+  const after = readScratchFileUtf8(scratchRoot, SYNTHETIC_VALUE_PATH, FABRIC_LIMITS.maxAggregateIoBytes);
+  const beforeDigest = sha256Utf8(SYNTHETIC_BEFORE_UTF8);
+  const afterDigest = sha256Utf8(after);
+  const expectedDigest = sha256Utf8(SYNTHETIC_AFTER_UTF8);
+  if (after === SYNTHETIC_BEFORE_UTF8) {
+    return {
+      verifierId: FABRIC_VERIFIER_ID,
+      manifestDigest,
+      passed: false,
+      pathSummaries: [{
+        path: SYNTHETIC_VALUE_PATH,
+        kind: "unchanged",
+        beforeDigest,
+        afterDigest,
+        reason: "unchanged",
+      }],
+      reason: "unchanged_file",
+    };
+  }
+  if (after !== SYNTHETIC_AFTER_UTF8) {
+    return {
+      verifierId: FABRIC_VERIFIER_ID,
+      manifestDigest,
+      passed: false,
+      pathSummaries: [{
+        path: SYNTHETIC_VALUE_PATH,
+        kind: "modified",
+        beforeDigest,
+        afterDigest,
+        reason: "wrong_final_bytes",
+      }],
+      reason: `expected_digest_${expectedDigest}`,
+    };
+  }
+  return {
+    verifierId: FABRIC_VERIFIER_ID,
+    manifestDigest,
+    passed: true,
+    pathSummaries: [{
+      path: SYNTHETIC_VALUE_PATH,
+      kind: "modified",
+      beforeDigest,
+      afterDigest,
+    }],
+  };
+}

package/src/lab/index.ts

@@ -18,6 +18,7 @@ export * from "./ledger/artifact-refs";
 export * from "./projection/verification";
 export * from "./observe/from-conformance";
 export * from "./observe/from-live";
+export * from "./fabric";
 export * from "./live/manifest";
 export * from "./live/runner";
 export * from "./live/executor";
@@ -34,3 +35,4 @@ export * from "./subject/behavior-fingerprint";
 export * from "./subject/installation-salt";
 export { CL03_LIVE_SUITES } from "./conformance/types";
 export * from "./query";
+export * from "./automation";

package/src/lab/ledger/store.ts

@@ -1,13 +1,17 @@
 import {
   closeSync,
+  constants as fsConstants,
   existsSync,
   fsyncSync,
   mkdirSync,
   openSync,
+  readFileSync,
   readSync,
   statSync,
+  unlinkSync,
   writeSync,
 } from "node:fs";
+import { randomBytes } from "node:crypto";
 import { dirname } from "node:path";
 import { jcsStringify } from "../digest";
 import { MAX_SERIALIZED_EVENT_BYTES } from "../constants";
@@ -21,6 +25,153 @@ export interface LedgerStore {
   replay(): ReplayResult;
 }
 
+const eventIdIndexByLedger = new Map<string, Set<string>>();
+const LEDGER_LOCK_STALE_MS = 60_000;
+const LEDGER_LOCK_WAIT_MS = 5_000;
+
+interface LedgerLockMeta {
+  pid: number;
+  createdAt: number;
+  token: string;
+}
+
+/** Block synchronously for the given duration (ledger lock retry only). */
+function sleepSyncMs(ms: number): void {
+  const end = Date.now() + ms;
+  while (Date.now() < end) {
+    /* spin */
+  }
+}
+
+/** Read pid, createdAt, and token metadata from a ledger lock file, if well-formed. */
+function readLedgerLockMeta(lockPath: string): LedgerLockMeta | null {
+  try {
+    const parsed = JSON.parse(readFileSync(lockPath, "utf8")) as LedgerLockMeta;
+    if (
+      typeof parsed.pid === "number"
+      && typeof parsed.createdAt === "number"
+      && typeof parsed.token === "string"
+      && parsed.token.length > 0
+    ) {
+      return parsed;
+    }
+  } catch {
+    /* ignore */
+  }
+  return null;
+}
+
+/** Return true when the lock holder process is still running. */
+function isLockHolderAlive(pid: number): boolean {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    const code = (error as NodeJS.ErrnoException).code;
+    if (code === "ESRCH") return false;
+    if (code === "EPERM") return true;
+    return false;
+  }
+}
+
+/** Return true when a ledger lock file has dead metadata and can be recovered. */
+function isLedgerLockStale(lockPath: string): boolean {
+  const meta = readLedgerLockMeta(lockPath);
+  if (!meta) {
+    try {
+      return Date.now() - statSync(lockPath).mtimeMs > LEDGER_LOCK_STALE_MS;
+    } catch {
+      return false;
+    }
+  }
+  if (isLockHolderAlive(meta.pid)) return false;
+  return Date.now() - meta.createdAt > LEDGER_LOCK_STALE_MS;
+}
+
+/** Create a ledger lock file exclusively, recovering stale locks when needed. */
+function tryAcquireLedgerLock(lockPath: string, deadline: number): { fd: number; token: string } {
+  while (Date.now() < deadline) {
+    const token = randomBytes(16).toString("hex");
+    let fd: number;
+    try {
+      fd = openSync(lockPath, fsConstants.O_CREAT | fsConstants.O_EXCL | fsConstants.O_WRONLY, 0o600);
+    } catch (error) {
+      if (existsSync(lockPath) && isLedgerLockStale(lockPath)) {
+        try {
+          unlinkSync(lockPath);
+        } catch (unlinkError) {
+          if (Date.now() >= deadline) throw unlinkError;
+          sleepSyncMs(10);
+        }
+        continue;
+      }
+      if (Date.now() >= deadline) throw error;
+      sleepSyncMs(10);
+      continue;
+    }
+    try {
+      const metadataBytes = Buffer.from(JSON.stringify({ pid: process.pid, createdAt: Date.now(), token }), "utf8");
+      const written = writeSync(fd, metadataBytes);
+      if (written !== metadataBytes.byteLength) {
+        throw new LabValidationError("short_write", "ledger lock metadata write incomplete");
+      }
+    } catch (error) {
+      closeSync(fd);
+      try {
+        unlinkSync(lockPath);
+      } catch {
+        /* best-effort */
+      }
+      throw error;
+    }
+    return { fd, token };
+  }
+  throw new Error("ledger lock acquisition timed out");
+}
+
+/** Release a ledger lock only when the token still matches the lock file. */
+function releaseLedgerLock(lockPath: string, lockFd: number, token: string): void {
+  try {
+    closeSync(lockFd);
+  } catch {
+    /* ignore */
+  }
+  try {
+    const meta = readLedgerLockMeta(lockPath);
+    if (meta?.token === token) unlinkSync(lockPath);
+  } catch {
+    /* best-effort */
+  }
+}
+
+/** Run a ledger mutation while holding the compatibility ledger lock file. */
+function withLedgerLock<T>(ledgerPath: string, fn: () => T): T {
+  const lockPath = `${ledgerPath}.lock`;
+  mkdirSync(dirname(ledgerPath), { recursive: true, mode: 0o700 });
+  const deadline = Date.now() + LEDGER_LOCK_WAIT_MS;
+  const { fd, token } = tryAcquireLedgerLock(lockPath, deadline);
+  try {
+    return fn();
+  } finally {
+    releaseLedgerLock(lockPath, fd, token);
+  }
+}
+
+/** Load or build the in-memory event-id index for a ledger path. */
+function loadEventIdIndex(ledgerPath: string): Set<string> {
+  let index = eventIdIndexByLedger.get(ledgerPath);
+  if (!index) {
+    index = new Set();
+    if (existsSync(ledgerPath)) {
+      for (const event of replayLabLedger(ledgerPath).events) {
+        index.add(event.eventId);
+      }
+    }
+    eventIdIndexByLedger.set(ledgerPath, index);
+  }
+  return index;
+}
+
 /** Durable append of one validated event as a single JSONL line + fsync. */
 export function appendLabEvent(ledgerPath: string, event: LabEvent): void {
   const validated = validateLabEvent(event);
@@ -41,6 +192,28 @@ export function appendLabEvent(ledgerPath: string, event: LabEvent): void {
   } finally {
     closeSync(fd);
   }
+  loadEventIdIndex(ledgerPath).add(validated.eventId);
+}
+
+/**
+ * Append only when eventId is absent. Uses an exclusive lock file plus a
+ * process-local event-id index refreshed under the lock.
+ */
+export function appendLabEventIfAbsent(ledgerPath: string, event: LabEvent): boolean {
+  const validated = validateLabEvent(event);
+  return withLedgerLock(ledgerPath, () => {
+    // Refresh from disk under the lock so concurrent writers are visible.
+    const fresh = new Set<string>();
+    if (existsSync(ledgerPath)) {
+      for (const row of replayLabLedger(ledgerPath).events) {
+        fresh.add(row.eventId);
+      }
+    }
+    eventIdIndexByLedger.set(ledgerPath, fresh);
+    if (fresh.has(validated.eventId)) return false;
+    appendLabEvent(ledgerPath, validated);
+    return true;
+  });
 }
 
 function processLine(

package/src/lab/live/executor.ts

@@ -21,6 +21,8 @@ export interface LiveExecutorOptions {
   resolve?: DnsResolver;
   configDir?: string;
   env?: NodeJS.ProcessEnv;
+  /** Orchestration cancellation — must not produce route incompatibility evidence. */
+  cancelSignal?: AbortSignal;
 }
 
 interface TrustedLiveResultReceipt {
@@ -143,6 +145,11 @@ function pathForProtocol(protocol: string): string {
   return "/responses";
 }
 
+/** Upstream HTTP path for a trusted live-route request (CL-03 / CL-08 production dispatch). */
+export function liveUpstreamRequestPath(protocol: string): string {
+  return pathForProtocol(protocol);
+}
+
 function chatObservation(body: string, status: number): NormalizedObservation {
   const observation = emptyObservation();
   const output: unknown[] = [];
@@ -215,15 +222,33 @@ function normalizeTransportObservation(route: LabRouteContext, response: { statu
   return observation;
 }
 
-async function withTotalTimeout<T>(timeoutMs: number, run: (signal: AbortSignal) => Promise<T>): Promise<T> {
+/** Normalize a pinned provider response into a Lab observation (trusted-route production path). */
+export function normalizeLabLiveTransportObservation(
+  route: LabRouteContext,
+  response: { status: number; body: string },
+): NormalizedObservation {
+  return normalizeTransportObservation(route, response);
+}
+
+async function withTotalTimeout<T>(
+  timeoutMs: number,
+  run: (signal: AbortSignal) => Promise<T>,
+  cancelSignal?: AbortSignal,
+): Promise<T> {
+  if (cancelSignal?.aborted) throw cancelSignal.reason ?? new TransportError("harness_failure", "cancelled");
   const controller = new AbortController();
+  const abortFromCancel = () => controller.abort(cancelSignal?.reason ?? new TransportError("harness_failure", "cancelled"));
+  if (cancelSignal) cancelSignal.addEventListener("abort", abortFromCancel, { once: true });
   const timer = setTimeout(() => controller.abort(new TransportError("total_timeout", "live scenario total timeout")), timeoutMs);
   try {
     return await Promise.race([
       run(controller.signal),
       new Promise<T>((_, reject) => controller.signal.addEventListener("abort", () => reject(controller.signal.reason), { once: true })),
     ]);
-  } finally { clearTimeout(timer); }
+  } finally {
+    clearTimeout(timer);
+    if (cancelSignal) cancelSignal.removeEventListener("abort", abortFromCancel);
+  }
 }
 
 export async function runLiveScenario(caseRecord: CaseRecord, routeContext: LabRouteContext, opts: LiveExecutorOptions = {}): Promise<LiveScenarioRunResult> {
@@ -266,13 +291,13 @@ export async function runLiveScenario(caseRecord: CaseRecord, routeContext: LabR
       if (!isTrustedLabRouteExecutor(opts.routeExecutor)) throw new TransportError("untrusted_route_executor", "untrusted route executor capability");
       executionAuthority = "trusted_route";
       trustedExecutionStarted = true;
-      observation = await withTotalTimeout(limits.totalTimeoutMs, (signal) => opts.routeExecutor!.execute({ routeContext, destination, routeSubject: routeSubject!, scenarioId: activeCase.id, initiatingRequest: activeCase.initiatingRequest?.bytesUtf8, limits, signal, environment }));
+      observation = await withTotalTimeout(limits.totalTimeoutMs, (signal) => opts.routeExecutor!.execute({ routeContext, destination, routeSubject: routeSubject!, scenarioId: activeCase.id, initiatingRequest: activeCase.initiatingRequest?.bytesUtf8, limits, signal, environment }), opts.cancelSignal);
     } else if (opts.transport && activeCase.initiatingRequest) {
       executionAuthority = "test_transport";
       const body = activeCase.initiatingRequest.bytesUtf8;
       const inputBytes = new TextEncoder().encode(body).byteLength;
       enforceSandboxLimits(state, limits, { requests: 1, inputBytes });
-      const response = await withTotalTimeout(limits.totalTimeoutMs, (signal) => opts.transport!.request({ method: "POST", path: pathForProtocol(routeContext.upstreamProtocol), body, signal }));
+      const response = await withTotalTimeout(limits.totalTimeoutMs, (signal) => opts.transport!.request({ method: "POST", path: pathForProtocol(routeContext.upstreamProtocol), body, signal }), opts.cancelSignal);
       if (response.status === 401 || response.status === 403) throw new TransportError("auth_blocked", `HTTP ${response.status}`);
       if (response.status === 429) throw new TransportError("quota_blocked", "HTTP 429");
       if (response.status === 451) throw new TransportError("region_blocked", "HTTP 451");

package/src/lab/live/transport.ts

@@ -104,8 +104,10 @@ export function classifyTransportError(error: unknown): { classification: Failur
     case "network_blocked": return { classification: "network_failure", secondaryCode: code };
     case "region_blocked": return { classification: "region_blocked", secondaryCode: code };
     case "provider_transient": return { classification: "provider_transient", secondaryCode: code };
-    case "connect_timeout": case "first_byte_timeout": case "inactivity_timeout": case "total_timeout":
+    case "connect_timeout": case "first_byte_timeout": case "total_timeout":
       return { classification: "timeout", secondaryCode: code };
+    case "inactivity_timeout":
+      return { classification: "inactivity_timeout", secondaryCode: code };
     case "request_limit": case "input_byte_limit": case "output_byte_limit": case "output_token_limit":
     case "tool_call_limit": case "artifact_byte_limit": case "memory_limit": case "child_process_limit":
       return { classification: "budget_exhausted", secondaryCode: code };

package/src/lab/observe/from-conformance.ts

@@ -2,7 +2,6 @@
  * Persistence seam: transform CL-01 conformance results into valid observation events.
  * Deterministic harness execution stays separate from ledger persistence.
  */
-import { createHash } from "node:crypto";
 import { createArtifactStore, type ArtifactStore } from "../artifacts/store";
 import { sanitizeDiagnostic, truncateUtf8 } from "../artifacts/sanitize";
 import {
@@ -12,12 +11,11 @@ import {
   type ObservationOutcome,
 } from "../constants";
 import {
-  jcsStringify,
   scenarioManifestDigest,
   subjectIdForSubject,
   suiteManifestDigest,
 } from "../digest";
-import type { ObservationEvent, ProtocolSubjectV1 } from "../events/types";
+import type { ObservationEvent } from "../events/types";
 import { assignEventId } from "../events/validate";
 import { appendLabEvent } from "../ledger/store";
 import { ensureLabDirs } from "../paths";
@@ -31,8 +29,10 @@ import { expandScenario } from "../conformance/manifest";
 import { suiteManifestObjectForCase } from "../conformance/suite-manifest";
 import { fixtureDigest } from "../conformance/digest";
 import { resolveProtocolExecutionContext } from "../conformance/executor";
-
-const COMPAT_VERSION = "protocol-v1";
+import {
+  buildProtocolSubjectV1,
+  protocolBehaviorFingerprintV1,
+} from "../subject/protocol-subject";
 
 export interface PersistConformanceOptions {
   configDir?: string;
@@ -75,71 +75,24 @@ function behaviorFingerprintForCase(
     caseRecord,
     executionContext ?? resolveProtocolExecutionContext(caseRecord),
   );
-  const adapter = upstreamAdapter(ctx.upstreamProtocol);
-  const values = {
-    schemaVersion: 1,
-    resolverVersion: 1,
-    values: {
-      "wire.adapter": {
-        source: "lab_forced",
-        value: adapter,
-      },
-      "wire.upstreamProtocol": {
-        source: "lab_forced",
-        value: ctx.upstreamProtocol,
-      },
-      "runtime.arch": {
-        source: "lab_forced",
-        value: process.arch,
-      },
-      "runtime.bunVersion": {
-        source: "lab_forced",
-        value: process.versions.bun ?? Bun.version,
-      },
-      "runtime.platform": {
-        source: "lab_forced",
-        value: process.platform,
-      },
-    },
-  };
-  return createHash("sha256").update(jcsStringify(values)).digest("hex");
+  return protocolBehaviorFingerprintV1(ctx);
 }
 
-function protocolSubject(caseRecord: CaseRecord, result: ScenarioRunResult): ProtocolSubjectV1 {
+function protocolSubject(caseRecord: CaseRecord, result: ScenarioRunResult) {
   const ctx = validateExecutionContext(
     caseRecord,
     result.executionContext ?? resolveProtocolExecutionContext(caseRecord),
   );
-  return {
-    subjectSchemaVersion: 1,
-    subjectKind: "protocol",
-    opencodexCompatibilityVersion: COMPAT_VERSION,
-    effectiveAdapter: upstreamAdapter(ctx.upstreamProtocol),
-    inboundProtocol: ctx.inboundProtocol,
-    upstreamProtocol: ctx.upstreamProtocol,
-    surface: ctx.surface,
-    behaviorFingerprint: behaviorFingerprintForCase(caseRecord, ctx),
-  };
-}
-
-function upstreamAdapter(protocol: string): string {
-  switch (protocol) {
-    case "openai-responses":
-      return "openai-responses";
-    case "anthropic-messages":
-      return "anthropic";
-    case "openai-chat":
-      return "openai-chat";
-    default:
-      throw new Error(`unsupported protocol identity: ${protocol}`);
-  }
+  return buildProtocolSubjectV1(ctx);
 }
 
 function outcomeFromResult(result: ScenarioRunResult): ObservationOutcome {
   if (result.passed) return "pass";
   switch (result.classification) {
     case "timeout":
+    case "inactivity_timeout":
     case "budget_exhausted":
+    case "sandbox_violation":
     case "authentication_blocked":
     case "quota_blocked":
     case "region_blocked":
@@ -148,6 +101,8 @@ function outcomeFromResult(result: ScenarioRunResult): ObservationOutcome {
       return "blocked";
     case "inconclusive":
     case "harness_failure":
+    case "malformed_producer_outcome":
+    case "layer_subject_mismatch":
       return "inconclusive";
     case "protocol_failure":
     case "capability_failure":

package/src/lab/observe/from-live.ts

@@ -20,7 +20,9 @@ function outcomeFromLiveResult(result: LiveScenarioRunResult): ObservationOutcom
   if (result.passed) return "pass";
   switch (result.classification) {
     case "timeout":
+    case "inactivity_timeout":
     case "budget_exhausted":
+    case "sandbox_violation":
     case "authentication_blocked":
     case "quota_blocked":
     case "region_blocked":
@@ -33,7 +35,13 @@ function outcomeFromLiveResult(result: LiveScenarioRunResult): ObservationOutcom
       return "fail";
     case "inconclusive":
     case "harness_failure":
+    case "malformed_producer_outcome":
+    case "layer_subject_mismatch":
       return "inconclusive";
+    default: {
+      const _never: never = result.classification;
+      throw new Error(`unmapped failure classification: ${String(_never)}`);
+    }
   }
 }
 
@@ -41,7 +49,7 @@ function failureFromLiveResult(result: LiveScenarioRunResult, retryable: boolean
   if (result.passed || result.classification === "inconclusive") return undefined;
   const attribution: FailureRecordV1["attribution"] = result.classification === "harness_failure"
     ? "harness"
-    : ["authentication_blocked", "quota_blocked", "region_blocked", "network_failure", "provider_transient", "timeout", "budget_exhausted"].includes(result.classification)
+    : ["authentication_blocked", "quota_blocked", "region_blocked", "network_failure", "provider_transient", "timeout", "inactivity_timeout", "budget_exhausted"].includes(result.classification)
       ? "environment"
       : "route";
   return {

package/src/lab/paths.ts

@@ -1,12 +1,63 @@
-import { chmodSync, mkdirSync, statSync } from "node:fs";
-import { join } from "node:path";
+import { chmodSync, existsSync, mkdirSync, lstatSync, realpathSync } from "node:fs";
+import { basename, dirname, join, resolve, sep } from "node:path";
 import { getConfigDir } from "../config";
 
-function ensureRestrictedDir(dir: string): void {
-  mkdirSync(dir, { recursive: true, mode: 0o700 });
-  if (process.platform === "win32") return;
-  const mode = statSync(dir).mode & 0o777;
-  if (mode !== 0o700) chmodSync(dir, 0o700);
+/** Return true when path is the Lab root or a descendant path component. */
+function isAtOrBelowLabBoundary(path: string, labRootBoundary: string): boolean {
+  const normalizedPath = resolve(path);
+  const normalizedBoundary = resolve(labRootBoundary);
+  if (normalizedPath === normalizedBoundary) return true;
+  const prefix = normalizedBoundary + sep;
+  return normalizedPath.startsWith(prefix) && normalizedPath.length > normalizedBoundary.length;
+}
+
+/** Reject symlink, non-directory, and reparse-point substitutions for a Lab-owned component. */
+function assertRestrictedDirectoryComponent(path: string): void {
+  const componentStats = lstatSync(path);
+  if (componentStats.isSymbolicLink()) {
+    throw new Error(`restricted directory component is a symbolic link: ${path}`);
+  }
+  if (!componentStats.isDirectory()) {
+    throw new Error(`restricted path component is not a directory: ${path}`);
+  }
+  const canonical = resolve(realpathSync.native(path));
+  const canonicalParent = resolve(realpathSync.native(dirname(path)));
+  const expectedCanonical = resolve(join(canonicalParent, basename(path)));
+  if (canonical !== expectedCanonical) {
+    throw new Error(`restricted directory component contains a link or reparse-point substitution: ${path}`);
+  }
+}
+
+/**
+ * Create (or harden) a directory to mode 0o700 without following symlinks on Lab-owned
+ * components. Ancestors above labRootBoundary are treated as infrastructure and are not
+ * inspected for symlinks (for example macOS /var → /private/var).
+ */
+export function ensureRestrictedDir(dir: string, labRootBoundary: string): void {
+  const abs = resolve(dir);
+  const boundary = resolve(labRootBoundary);
+  const parts = abs.split(sep);
+  let current = parts[0] === "" ? sep : parts[0]!;
+  for (const part of parts.slice(1)) {
+    if (part === "") continue;
+    current = join(current, part);
+    try {
+      mkdirSync(current, { mode: 0o700 });
+    } catch (error) {
+      const code = (error as NodeJS.ErrnoException).code;
+      if (code !== "EEXIST") throw error;
+    }
+    if (isAtOrBelowLabBoundary(current, boundary)) {
+      assertRestrictedDirectoryComponent(current);
+    }
+  }
+  if (!existsSync(abs)) return;
+  if (!isAtOrBelowLabBoundary(abs, boundary)) return;
+  assertRestrictedDirectoryComponent(abs);
+  if (process.platform !== "win32") {
+    const mode = lstatSync(abs).mode & 0o777;
+    if (mode !== 0o700) chmodSync(abs, 0o700);
+  }
 }
 
 /** Canonical Compatibility Lab state root under the OpenCodex config dir. */
@@ -39,6 +90,18 @@ export function labInstallationSaltPath(configDir = getConfigDir()): string {
   return join(labRoot(configDir), "installation-salt.bin");
 }
 
+export function labAutomationPolicyPath(configDir = getConfigDir()): string {
+  return join(labRoot(configDir), "automation-policy.json");
+}
+
+export function labAutomationStatePath(configDir = getConfigDir()): string {
+  return join(labRoot(configDir), "automation-state.json");
+}
+
+export function labAutomationRoutesPath(configDir = getConfigDir()): string {
+  return join(labRoot(configDir), "automation-routes.json");
+}
+
 /** Ensure lab directories exist with restrictive permissions where the platform allows. */
 export function ensureLabDirs(configDir = getConfigDir()): {
   root: string;
@@ -52,8 +115,10 @@ export function ensureLabDirs(configDir = getConfigDir()): {
   const artifactsDir = labArtifactsDir(configDir);
   const scratchDir = labScratchDir(configDir);
   const exportDir = labExportDir(configDir);
-  ensureRestrictedDir(root);
-  ensureRestrictedDir(artifactsDir);
+  ensureRestrictedDir(root, root);
+  ensureRestrictedDir(artifactsDir, root);
+  ensureRestrictedDir(scratchDir, root);
+  ensureRestrictedDir(exportDir, root);
   return {
     root,
     ledgerPath: labLedgerPath(configDir),

package/src/lab/projection/schema.ts

@@ -2,7 +2,7 @@
  * Disposable SQLite projection schema for Compatibility Lab (CL-02).
  * Not canonical storage — rebuildable from JSONL + content-addressed artifacts.
  */
-export const LAB_SQLITE_SCHEMA_VERSION = 2;
+export const LAB_SQLITE_SCHEMA_VERSION = 3;
 
 export const LAB_SQLITE_DDL = `
 CREATE TABLE IF NOT EXISTS schema_meta (
@@ -50,6 +50,19 @@ CREATE INDEX IF NOT EXISTS idx_observations_proj ON observations(
   subject_id, evidence_layer, suite_id, suite_version, suite_manifest_digest, completed_at
 );
 
+CREATE INDEX IF NOT EXISTS idx_observations_exact_identity ON observations(
+  evidence_layer,
+  subject_id,
+  suite_id,
+  suite_version,
+  suite_manifest_digest,
+  scenario_id,
+  scenario_version,
+  scenario_manifest_digest,
+  completed_at DESC,
+  event_id DESC
+);
+
 CREATE TABLE IF NOT EXISTS claims (
   event_id TEXT PRIMARY KEY,
   subject_id TEXT NOT NULL,