@bjoernrochel/sevro 0.1.0-rc.1

package/LICENSE

@@ -0,0 +1,159 @@
+Business Source License 1.1
+
+License text copyright (c) 2017 MariaDB Corporation Ab, All Rights Reserved.
+"Business Source License" is a trademark of MariaDB Corporation Ab.
+
+-----------------------------------------------------------------------------
+
+Parameters
+
+Licensor:             Björn Rochel <bjoern@bjro.de>
+
+Licensed Work:        Sevro — a standalone evaluation runner for coding agents.
+                      The Licensed Work is (c) 2026 Björn Rochel.
+
+Additional Use Grant: You may make production use of the Licensed Work only
+                      as follows:
+
+                        (a) use within your own organization, for any
+                            purpose, commercial or non-commercial, provided
+                            that such use is not Commercial Educational
+                            Production Use;
+
+                        (b) use while performing professional, consulting,
+                            or contract services for your own clients,
+                            provided that those services do not include
+                            Commercial Educational Production Use;
+
+                        (c) use in preparing or delivering training,
+                            workshops, courses, talks, presentations, or
+                            other educational offerings, or in creating or
+                            publishing blog posts, articles, or other
+                            educational content, provided that such
+                            production use is not Commercial Educational
+                            Production Use;
+
+                        (d) use in research, evaluation, and personal
+                            projects, provided that such use is not
+                            Commercial Educational Production Use;
+
+                      provided that such production use does not include
+                      distributing, selling, sublicensing, hosting, or
+                      otherwise offering the Licensed Work, or a derivative
+                      work of the Licensed Work, to third parties as a
+                      product or service whose principal value is the
+                      functionality of the Licensed Work.
+
+                      For purposes of this Additional Use Grant,
+                      "Commercial Educational Production Use" means
+                      production use of the Licensed Work in preparing,
+                      delivering, or publishing any educational offering or
+                      content where you or anyone acting on your behalf:
+
+                        (i) receives or expects to receive, directly or
+                            indirectly, a fee, compensation, sponsorship, or
+                            other consideration in connection with it;
+
+                        (ii) supplies it as part of, or uses it to advertise
+                             or promote, a paid product, service, membership,
+                             or engagement; or
+
+                        (iii) uses it to generate leads or obtain any other
+                              direct or indirect commercial benefit.
+
+                      Reasonable reimbursement of expenses alone does not
+                      constitute Commercial Educational Production Use.
+                      Commercial Educational Production Use is not included
+                      in this Additional Use Grant.
+
+                      For clarity, nothing in this Additional Use Grant
+                      limits the non-production rights granted under the
+                      Terms below.
+
+                      For clarity, contributing modifications back to the
+                      Licensed Work, and publishing forks that are
+                      themselves offered free of charge under this License,
+                      are permitted.
+
+Change Date:          Two years from the date on which the applicable
+                      version of the Licensed Work is first made publicly
+                      available. The Change Date is determined separately
+                      for each released version.
+
+Change License:       Mozilla Public License, version 2.0
+
+For information about alternative licensing arrangements for the Licensed Work,
+please contact: bjoern@bjro.de
+
+-----------------------------------------------------------------------------
+
+Notice
+
+Business Source License 1.1
+
+Terms
+
+The Licensor hereby grants you the right to copy, modify, create derivative
+works, redistribute, and make non-production use of the Licensed Work. The
+Licensor may make an Additional Use Grant, above, permitting limited
+production use.
+
+Effective on the Change Date, or the fourth anniversary of the first publicly
+available distribution of a specific version of the Licensed Work under this
+License, whichever comes first, the Licensor hereby grants you rights under
+the terms of the Change License, and the rights granted in the paragraph
+above terminate.
+
+If your use of the Licensed Work does not comply with the requirements
+currently in effect as described in this License, you must purchase a
+commercial license from the Licensor, its affiliated entities, or authorized
+resellers, or you must refrain from using the Licensed Work.
+
+All copies of the original and modified Licensed Work, and derivative works
+of the Licensed Work, are subject to this License. This License applies
+separately for each version of the Licensed Work and the Change Date may vary
+for each version of the Licensed Work released by Licensor.
+
+You must conspicuously display this License on each original or modified copy
+of the Licensed Work. If you receive the Licensed Work in original or
+modified form from a third party, the terms and conditions set forth in this
+License apply to your use of that work.
+
+Any use of the Licensed Work in violation of this License will automatically
+terminate your rights under this License for the current and all other
+versions of the Licensed Work.
+
+This License does not grant you any right in any trademark or logo of
+Licensor or its affiliates (provided that you may use a trademark or logo of
+Licensor as expressly required by this License).
+
+TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON
+AN "AS IS" BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS,
+EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND
+TITLE.
+
+MariaDB hereby grants you permission to use this License's text to license
+your works, and to refer to it using the trademark "Business Source License",
+as long as you comply with the Covenants of Licensor below.
+
+Covenants of Licensor
+
+In consideration of the right to use this License's text and the "Business
+Source License" name and trademark, Licensor covenants to MariaDB, and to all
+other recipients of the licensed work to be provided by Licensor:
+
+1. To specify as the Change License the GPL Version 2.0 or any later version,
+   or a license that is compatible with GPL Version 2.0 or a later version,
+   where "compatible" means that software provided under the Change License
+   can be included in a program with software provided under GPL Version 2.0
+   or a later version. Licensor may specify additional Change Licenses
+   without limitation.
+
+2. To either: (a) specify an additional grant of rights to use that does not
+   impose any additional restriction on the right granted in this License, as
+   the Additional Use Grant; or (b) insert the text "None".
+
+3. To specify a Change Date.
+
+4. Not to modify this License in any other way.

package/README.md

@@ -0,0 +1,71 @@
+# Sevro
+
+Sevro is a standalone evaluation runner for agentic coding capabilities. It is
+being extracted from [Darrow](https://github.com/BjRo/darrow/issues/95). This
+checkout runs locally and packs as an installable npm tarball.
+The npm package is `@bjoernrochel/sevro`; its installed command is `sevro`.
+
+The public v1 contracts are [the extension protocol](docs/extension-protocol-v1.md)
+and [run results](docs/results-v1.md). Sevro owns these generic interfaces;
+projects own their cases and evaluator policy.
+The [generic report](docs/report-v1.md) summarizes retained public results
+without treating unknown measurements as zero or inferring matched comparisons.
+
+Machine-readable contracts live in [`schemas/`](schemas/). Run `bun install`,
+`bun test`, `bun run typecheck`, `bun run format:check`, and
+`bun run test:package-install` to validate the npm tarball locally. The package
+test packs and installs Sevro in a temporary project, then runs the installed
+CLI without a Sevro Git checkout.
+
+The [release workflow](docs/releases.md) prepares a versioned artifact with its
+file inventory and checksums, verifies that exact tarball, and documents manual
+publication, trusted publishing, Darrow pinning, updates, and rollback.
+
+Sevro uses the owner-selected [Business Source License 1.1](LICENSE), preserving
+Darrow's terms and parameters with Sevro named as the Licensed Work. The first
+local candidate is `0.1.0-rc.1`; publication and Darrow's registry pin remain
+separate steps.
+
+[`extension-client.ts`](src/extension-client.ts) validates one request and
+response per extension process and negotiates the v1 protocol. It enforces
+message limits, timeouts, response identity, and process-group cancellation.
+
+[`extension-session.ts`](src/extension-session.ts) runs the negotiated
+`resolve`, `prepare`, and `evaluate` methods and checks source stability and
+evidence references. The engine accepts additive extension checks for inline
+cases.
+
+[`results.ts`](src/results.ts) reduces checks to separate execution, grading,
+and task states, applies case thresholds, and maps the aggregate to a CLI exit
+category.
+[`identity.ts`](src/identity.ts) computes versioned comparison identities from
+canonical JSON. The [identity contract](docs/identity-v1.md) defines the input
+dimensions.
+
+The [built-in output graders](docs/builtin-graders-v1.md) evaluate regex, JSON,
+and inline schema assertions on bounded final-message observations.
+
+The [first engine slice](docs/engine-slice.md) executes resolved cases through
+an injected host adapter and retains trial evidence before fixture cleanup.
+The [advisory review fixture](docs/advisory-fixture.md) builds a separate Git
+view of the complete candidate change while withholding evaluator paths.
+The [development CLI](docs/development-cli.md) runs that path with a trusted
+adapter module or the bundled Codex and Claude Code routes and emits a
+machine-readable result.
+The [native control observation](docs/native-controls.md) exposes bounded tool
+labels for extension policy on both Codex and Claude, with explicit completeness.
+
+The packaged [basic example](examples/basic/) runs without Darrow or a model
+account. From this checkout, run the graded case with:
+
+```sh
+bun src/cli.ts run --json \
+  --case-file "$PWD/examples/basic/graded.json" \
+  --adapter-module "$PWD/examples/basic/host.ts" \
+  --project-root "$PWD" --results-root /tmp/sevro-basic-results \
+  --condition passive --trials 1 --threshold 1
+```
+
+Use `prompt-only.json` in place of `graded.json` to see successful execution
+with `task.verdict: not_assessed`. The package installation check runs both
+cases through the installed CLI, with no Sevro source checkout present.

package/docs/advisory-fixture.md

@@ -0,0 +1,23 @@
+# Advisory review fixture
+
+`buildBlindAdvisoryFixture(candidateWorkspace, { baseRevision, excludedPaths })`
+creates a temporary Git workspace for a separate quality reviewer. The caller
+supplies the candidate workspace and its `HEAD` revision from before the host
+ran. The helper starts with that revision, replaces the original Git history
+with one synthetic baseline commit, then applies committed, staged, unstaged,
+and non-ignored untracked candidate changes. The returned directory is owned
+by the caller, which must remove it after review.
+
+Root `.agents`, `.claude`, `.codex`, and `.git` paths are withheld from both the
+baseline and the change. `excludedPaths` withholds any additional evaluator
+paths. The review workspace has no remote. The helper rejects escaping or
+broken symlinks and limits Git output, untracked file count, and untracked
+bytes. A failed build removes its temporary directory.
+
+`advisoryPrompt` passes the task and deterministic check facts to a separate
+review host. `parseAdvisoryAssessment` accepts one bounded JSON response with a
+pass or fail recommendation, overall score, four dimension scores, strengths,
+weaknesses, and a summary. The engine invokes this route when given an
+`advisoryHost` and a Git fixture. It records the route, response, assessment,
+and usage in trial evidence. A reviewer failure or recommendation never
+changes the task verdict. The development CLI exposes adapter and Codex routes.

package/docs/builtin-graders-v1.md

@@ -0,0 +1,77 @@
+# Built-in graders v1
+
+The first built-in graders inspect a complete, bounded final-message
+observation. The engine compiles evaluator-owned check declarations before host
+execution. A missing or incomplete observation yields `unavailable` for every
+output check; it never passes. A failed assertion yields `failed` while grading
+itself remains `completed`.
+
+Each declaration has `{ "id", "grader", "configuration" }`. The supported
+output graders are:
+
+| Grader         | Configuration                                                      | Assessment                                                  |
+| -------------- | ------------------------------------------------------------------ | ----------------------------------------------------------- |
+| `sevro.regex`  | `pattern` string; optional `negate` boolean and `flags` string     | Tests final-message text with multiline matching.           |
+| `sevro.json`   | Optional RFC 6901 `pointer`, `equals`, `contains`, `exactDocument` | Parses JSON, then checks selected value or an array member. |
+| `sevro.schema` | Inline `schema` object; optional `exactDocument`                   | Validates the parsed JSON with JSON Schema Draft 2020-12.   |
+| `sevro.output` | Optional text, JSON, and schema assertions in one declaration      | Retains one outcome for a combined final-message contract.  |
+
+JSON may be raw or contained in one `json` code fence. `exactDocument` requires
+the whole trimmed message to be that JSON document or fence. `contains` selects
+an array and compares one member against a recursive subset; an object with
+only `$regex` matches a string value. Invalid patterns, pointers, and schemas
+fail preflight. Schema references are resolved only from the inline schema; the
+grader does not read paths supplied by a candidate.
+
+`sevro.output` accepts `expectExact`, `expectRegex`, `notRegex`, and regex
+`flags`; `validJson`; an inline `schema`; and `jsonPath` with optional
+`expectJson` or `containsJson`. It checks them in that order: JSON validity,
+schema, selected JSON value, exact text, positive regex, then negative regex.
+`validJson: true` requires the entire trimmed message to be one JSON document
+or fence. Exact text compares the untrimmed final message. A bad declaration
+fails before host execution.
+
+The shell-check process runner accepts a bounded evaluator-owned `run` string,
+optional `expectedExitCode` and `timeoutMs`, plus `expectExact`, `expectRegex`,
+`notRegex`, and regex `flags` for stdout. Exact matching removes one final
+newline; regex matching always uses multiline mode. The runner executes with
+`sh -e`. On macOS it runs through the outer sandbox with network access denied,
+a credential-free environment, and caller-declared protected roots. Without a
+stdout assertion, process output is discarded. With one, the runner captures
+at most 1 MiB in memory and retains only its digest and byte length. Oversized
+or invalid UTF-8 output is a grading error.
+
+The engine grades `sevro.shell` checks after a completed host turn and retains
+one bounded observation per check. A mismatched exit code or stdout assertion
+fails the task; an isolation, timeout, or process error makes grading
+an error. Callers must supply `shellIsolation.protectedRoots` for any shell
+check. The engine also protects its package source, project, results, user
+home, configured host homes, and active peer fixtures. The caller's list must
+include any other source worktrees or private roots. A peer path already
+canonicalized by the engine remains in the deny profile if that peer is
+removed before the sandbox starts; unverified missing roots still fail.
+
+`sevro.git-head` accepts `kind: "changed"`, `"unchanged"`, or
+`"base-ancestor"` for a generated or repository Git fixture. The engine
+captures the fixture's base HEAD before the candidate turn, then compares the
+current HEAD and ancestry after a completed turn. The base stays in runner
+memory, outside candidate control. An invalid declaration or non-Git fixture
+fails preflight. An unreadable or malformed Git state is a grading error. A
+bounded `sevro.observation.git-head` records the base, current revision, and
+ancestry result; checks reference that observation.
+
+`sevro.semantic` accepts a single nonempty `proposition` string (at most 8 KiB)
+per check. The operator supplies a separate semantic host route. After a
+complete candidate response, the engine sends the bounded final message and
+all declared propositions to that route in an empty, temporary workspace. It
+requires exactly one `pass` or `fail` verdict with a reason for every declared
+check ID. A failed proposition fails the task. A missing or incomplete candidate
+message makes semantic checks unavailable without calling the semantic host; a
+failed, incomplete, or malformed semantic response makes grading an error.
+
+The engine retains the raw semantic response outside the candidate workspace
+as `sevro.semantic.verdicts`, plus per-check observations and any bounded
+artifacts returned by the semantic route. The route identity enters the
+evaluation identity and run evidence. Semantic host usage is retained
+separately from candidate usage. Advisory quality judgments still need a host
+routing implementation.

package/docs/cache-ownership-validation.md

@@ -0,0 +1,49 @@
+# Cache ownership validation
+
+The public CLI's curated Claude runtime no longer supplies repository-specific
+cache variables. Tools select their own defaults under an isolated home in the
+trial's Git metadata. Candidate and shell-check homes are separate; their
+curated UV cache is shared within one trial.
+
+## Test-first trace
+
+1. Red — `bun test tests/cli.test.ts -t "CLI curated Claude runtime leaves repository caches to tools"`:
+   the synthetic Claude process rejected the injected `DARROW_CACHE_DIR`;
+   the public result recorded failed execution and exit 2 instead of a passed
+   task. Product code was unchanged.
+2. Green — `bun test tests/cli.test.ts -t "CLI curated Claude runtime leaves repository caches to tools"`:
+   one test passed after removing that override and placing the curated
+   candidate home in Git metadata. An intermediate fixture correction
+   canonicalized macOS path aliases before testing containment.
+3. Red — `bun test tests/cli.test.ts -t "CLI curated shell grading leaves repository caches to tools"`:
+   candidate execution completed, but the isolated shell check rejected the
+   injected cache override and the public task failed. The shell grader was
+   unchanged.
+4. Green — `bun test tests/cli.test.ts -t "CLI curated shell grading leaves repository caches to tools"`:
+   one test passed after removing the shell override. Intermediate test repairs
+   corrected the public check status to `passed` and read checks from the
+   documented CLI result, rather than a nonexistent evidence field.
+
+The two commands remain the literal focused commands for these slices.
+Intermediate fixture/assertion failures are not additional behavior evidence.
+The candidate test supplies an unusable caller cache override and verifies
+that it is absent from the host environment. Both tests write tool-owned cache
+files. The shell test also verifies the curated cache, separate homes, and
+an unchanged Git worktree.
+
+## Final gates
+
+- `bun run typecheck`
+- `bun run format:check`
+- `bun test`
+- `bun run test:package-install`
+
+The installation gate exercises the same environment migration through the
+installed CLI, synthetic Claude executable, and an isolated shell check, with
+no source Git metadata. Darrow separately runs its installed-package parity
+gate against the exact candidate tarball.
+
+These fixtures exercise Sevro's real preparation, execution, shell isolation,
+grading, and package boundary. Claude is synthetic; this is not live model
+evidence or proof of Claude's own sandbox behavior. No release is published by
+these checks.

package/docs/claude-continuation-validation.md

@@ -0,0 +1,47 @@
+# Claude continuation validation
+
+The bundled Claude host now starts and resumes the same UUID-bound native
+session for a declared follow-up prompt. The public CLI regressions use
+synthetic executables and credentials without model calls.
+
+Working directory: `/Users/bjro/Sources/sevro`.
+
+## Public CLI slices
+
+1. Red — `lean-ctx -c 'bun test tests/cli.test.ts -t "CLI resumes Claude in the same isolated session and grades its final turn"'`:
+   exit `64`, with `selected host does not support continuation`.
+2. Green — `lean-ctx -c 'bun test tests/cli.test.ts -t "CLI resumes Claude in the same isolated session and grades its final turn"'`:
+   one test passed with eight assertions. Both calls use the same native
+   session, settings, credentials, model, and effort. The final response passes;
+   separate turn artifacts, combined usage, and the workspace boundary remain
+   in public evidence. A later guard also confirms exactly one initial and one
+   resume launch, bringing this test to nine assertions.
+3. Red — `lean-ctx -c 'bun test tests/cli.test.ts -t "CLI leaves Claude usage unmeasured when a resumed result belongs to another session"'`:
+   foreign-session usage was incorrectly retained as complete with four input
+   tokens, six output tokens, and cost `0.03`.
+4. Green — `lean-ctx -c 'bun test tests/cli.test.ts -t "CLI leaves Claude usage unmeasured when a resumed result belongs to another session"'`:
+   one test passed with three assertions. Execution fails, task success is
+   unassessed, and unbound token and cost measurements remain unknown.
+
+The first test initially omitted the generated fixture's `kind`. Its invalid
+configuration was corrected before the meaningful red above; that setup error
+was not a missing-behavior red.
+
+## Additional guards and final gates
+
+Two additional CLI guards passed with 62 assertions. They cover failed,
+missing, foreign, and duplicate native results in either turn, prevent resume
+after an invalid initial result, retain failed event evidence without grading,
+and preserve changed, unmeasured, or incomplete usage observations. They were
+added after implementation, without a test-first claim. One initial assertion
+used the wrong retained-check location; it was corrected to the public CLI
+trial checks.
+
+The full `lean-ctx -c 'bun test'` gate passed 210 tests with 1,131 assertions
+across 36 files in 67.67 seconds. Typechecking and formatting passed.
+`lean-ctx -c 'bun run test:package-install'` installed Sevro `0.1.0-dev.0`
+without source Git metadata and passed its public-command checks.
+
+These results verify the implementation and deterministic failure boundaries.
+A live continuation and Darrow's installed-package integration are recorded
+separately when observed. This remains an unpublished development version.

package/docs/codex-host.md

@@ -0,0 +1,134 @@
+# Codex host integration
+
+The Codex adapter consumes `codex exec --json` as one JSONL turn. The
+`summarizeCodexEvents` parser requires one thread start and a completed turn
+with a zero process exit before reporting completion. Malformed, ambiguous,
+and oversized streams are errors. Missing or invalid final usage remains
+incomplete and is never estimated. The last completed `agent_message` before
+turn completion supplies the bounded final response; missing text stays
+unavailable.
+The bounded JSONL stream is retained per trial as the private
+`sevro.codex.events` host artifact. Its file URL and digest appear in trial
+evidence and are available to extension grading; the stream bytes stay out of
+the run JSON.
+The host also retains a bounded `sevro.codex.skill-reads` observation. It
+records the first verified mounted skill and ordered skill names, without
+commands or skill bodies. A completed direct `cat` of a mounted `SKILL.md`
+counts only when the command output contains that file's exact body. Direct
+`sed -n` pages count after their verified line ranges cover the whole body. An
+exact `cat` wrapped by `lean-ctx -c` is accepted only when its reported output
+still contains the full body; a compressed summary cannot prove the read. An
+attempted indirect, malformed, or incomplete read makes the observation
+partial. This is a host observation; an extension decides what selection means
+for its case.
+The same check accepts skill files below the exact installed plugin roots from
+Codex's installation receipts. It does not infer activation from arbitrary
+files in the private plugin cache.
+The `sevro.codex.native-calls` capability retains allowlisted direct goal and
+agent control calls from the native session bound to the completed thread. Its
+observation contains only call names, namespaces, and source ordinals, plus the
+count of submitted `exec` calls. It also records accepted native subagent
+spawns when one request, host start, and matching result occur in order. That
+receipt contains bounded agent identity, route fields, and source ordinals;
+private task messages, code, and outputs are discarded. An accepted spawn proves
+host acceptance, not the child's role, work, or completion. Duplicate,
+mismatched, or malformed evidence cannot establish acceptance.
+The observation also records the ordered names and namespaces of direct native
+tool calls. For collaboration feedback it includes a bounded target when the
+target is readable. That list lets an extension evaluate parent activity after
+handoff without exposing messages or command input. A partial list cannot
+prove that parent work was absent.
+The observation also retains bounded feedback call targets and whether one
+native tool response was observed for each call. It discards message text and
+response content. A response receipt does not establish that the child acted.
+For a two-turn case, it classifies native feedback messages as plaintext,
+encrypted, or unavailable and records exact equality with the follow-up prompt
+only when plaintext is readable. It retains neither message nor prompt bytes.
+
+For a second prompt, `sevro.codex.continuation` retains the last validated
+native-session ordinal before resume. Extensions can compare later call
+ordinals with that boundary without reading private arguments.
+The host also retains separate `sevro.codex.initial-skill-reads` and
+`sevro.codex.follow-up-skill-reads` observations. Each applies the same exact
+mounted-skill read check to one completed turn, so an extension can grade read
+order or a missing repeat read without inferring it from the combined list.
+
+It also checks native parent command records for exact mounted skill bodies,
+including sessions with no spawn request. The bounded diagnostic distinguishes
+no read from an incomplete read without claiming skill activation.
+It retains the skill name and native ordinal when verified reads complete a
+whole body. Repeated complete reads produce separate receipts; paged reads
+produce one receipt when their ranges first cover the body. An incomplete
+later reread makes the diagnostic partial. Extensions can compare these
+ordinals with an accepted owner boundary without retaining commands or output.
+For accepted spawns, it also checks up to eight child thread rollouts and
+reports whether each is available, unavailable, ambiguous, or partial, with an
+explicit truncation flag. An available rollout includes bounded diagnostics for
+native child commands: the number of commands and skill read attempts, whether
+the exact mounted `SKILL.md` body was read, and whether the check was complete
+or truncated. A rollout with no read differs from a missing or malformed
+rollout. These diagnostics do not establish skill activation or task completion
+by themselves and retain no child prompt, command, or output.
+An available child rollout also reports whether one nonempty final assistant
+message matches a later native completion event for the same turn. This proves
+a returned turn, not the accuracy of the child's work, and retains no message
+body.
+Each available accepted child rollout also retains up to eight nested spawn
+requests with an explicit `requestsTruncated` flag. A request records bounded
+task name, model, effort, and context-fork fields, whether the host accepted it,
+and, for an accepted request, the child reference and thread. The corresponding
+reader session is classified as available, unavailable, ambiguous, or partial;
+`readerResultStatus` is completed only when a nonempty final answer matches a
+later native completion in that session. Private task and answer text are
+discarded. Extensions interpret task names and decide whether a nested reader
+satisfies their policy.
+The record proves an invocation attempt, not its success. A missing, ambiguous,
+unreadable, oversized, or malformed session is unavailable or partial, so its
+absence cannot prove that a control was unused. Calls made through submitted
+code are not classified by this first observation.
+For an explicitly declared `$plugin:skill`, the host verifies that the installed
+skill exists and that the exact token occurs once in the delivered prompt. A
+completed turn yields `sevro.codex.explicit-invocation` with the owner first and
+verified supporting reads after it. Incomplete reads make that receipt partial.
+The `sevro.codex.repository-invocation` capability supports an explicitly
+declared `$skill` from `.agents/skills/<skill>/SKILL.md`. The host checks that
+the repository mount is a bounded regular file with no symlink components and
+that the token occurs once across the delivered turns. It uses the same
+completed-turn dispatch receipt without wrapping the skill as a plugin.
+
+`createCodexHost` copies file-based authentication into a private Codex home
+for one turn. It supplies only explicit environment variables to the parent
+process and uses a runner-generated permission profile for candidate commands.
+When the extension declares a local Codex marketplace, the host verifies its
+manifest contains only the named plugins with local sources, rejects package
+symlinks, and installs it with `codex plugin marketplace add` followed by
+`codex plugin add`. It checks each installation receipt against the private
+plugin cache. Candidate commands can read that cache, while the rest of the
+private Codex home, including authentication and configuration, remains denied.
+It refuses fixture-local `.codex` configuration, unsupported enforced
+conditions, unreadable or oversized auth files, malformed event streams, and
+incomplete turns. The host bounds output and runtime, kills its process group
+on timeout or cancellation, and removes private state after the turn. It is
+available through the engine's injected host interface and the development
+CLI's explicit `--host codex` route. Its protocol and evidence host ID is
+`sevro.host.codex`; `codex` remains the CLI route selector.
+
+`prepareMacSandboxCommand` provides the macOS shell-grading boundary. Callers
+provide absolute protected roots and a private state root; the primitive
+canonicalizes them, refuses overlap with the fixture workspace, and creates a
+temporary `sandbox-exec` profile that denies reads and writes. It fails if
+macOS isolation is unavailable. The caller releases the profile after the
+process exits. The runner assembles the same protected-root set for Codex
+candidate commands and shell grading.
+
+Codex cannot start its native sandbox inside an outer `sandbox-exec` process
+on this host. Its runner-generated permission profile therefore sets an
+explicit workspace rule, denies all other filesystem roots except minimal
+runtime files and the selected executable's install directories, and
+specifically denies protected roots and the private Codex home. An executable
+inside a protected root is rejected. The profile also disables command
+network access and clears inherited command environment variables. The Codex
+parent can read authentication before it starts sandboxed commands. Tests
+invoke the installed `codex sandbox` CLI to prove fixture access, denied
+source/auth reads, and executable access. The process adapter verifies these
+properties before every turn.

package/docs/concurrency-validation.md

@@ -0,0 +1,86 @@
+# Trial concurrency validation
+
+The public CLI preserves the positive `--jobs` contract required by Darrow's
+extraction. Its default is three; the option bounds trials within one case.
+Tests invoke the actual CLI and replace only the external candidate host with
+synthetic adapters. No live model call was made.
+
+## Observed test-first slice
+
+Working directory: `/Users/bjro/Sources/sevro`.
+
+Red — `lean-ctx -c 'bun test tests/cli-concurrency.test.ts -t "CLI bounds parallel trials and retains ordered isolated evidence"'`:
+exit `64` because the public CLI did not accept `--jobs`.
+
+Green — `lean-ctx -c 'bun test tests/cli-concurrency.test.ts -t "CLI bounds parallel trials and retains ordered isolated evidence"'`:
+one test passed with 23 assertions. Five trials reach a peak of two active host
+calls, retain separate workspaces and artifacts, and preserve trial-number order
+in results, run evidence, and checkpoints. Every workspace is removed after
+its trial artifact is retained.
+
+The first implementation run reached the concurrency assertions but exposed
+an incorrect temporary-path oracle: macOS canonicalized `/var` to `/private/var`.
+The fixture now uses its canonical root; the original missing-option red remains
+the test-first evidence.
+
+## Additional guards
+
+Four post-implementation guards cover cancellation of both active trials without
+starting queued work; persistence failure that retains a completed peer before
+diagnostic finalization and keeps the failed fixture; default three-job and
+explicit serial execution with different configuration identities; and invalid
+job limits before result or state storage is created. The complete file passed
+five tests with 70 assertions. These guards do not claim an observed red.
+
+Five prior internal tests require serial host-call order to bind expected trial
+values, or a completed first trial before a later failure or cancellation.
+They now request `jobs: 1` explicitly and retain their original assertions.
+The first three focused repairs passed three tests with 25 assertions.
+The combined command `lean-ctx -c 'bun test tests/engine.test.ts tests/claude-host.test.ts -t "runs trials, applies threshold|host artifacts are retained|host failure retains completed|cancellation retains prior|failed Claude execution"'`
+passed all five serial tests with 51 assertions.
+
+Final gates cover the full Sevro suite, types, formatting, installed-package
+verification, and Darrow public-interface parity against the same tarball.
+The bounded independent review retains its exact scope and checks outside the
+repository. Dry or synthetic execution does not prove live-model stability.
+
+## Review repairs
+
+The independent review identified future-peer sandbox access, late admission
+shutdown on errors, and cancellation before first admission. Each repair has
+an observed public-CLI red and green in `/Users/bjro/Sources/sevro`.
+
+Red — `lean-ctx -c 'bun test tests/cli-concurrency.test.ts -t "CLI retains interruption before admitting its first trial"'`:
+SIGINT returned `70` instead of `130`.
+
+Green — `lean-ctx -c 'bun test tests/cli-concurrency.test.ts -t "CLI retains interruption before admitting its first trial"'`:
+one test passed with 20 assertions, covering SIGINT and SIGTERM, no host calls,
+empty trial evidence, retained results, and interrupted ownership. The first
+fixture sent its signal before CLI handlers existed and was corrected before
+the recorded red; that process exit is not red evidence.
+
+Red — `lean-ctx -c 'bun test tests/cli-concurrency.test.ts -t "CLI sandbox denies read and write access to later admitted peer fixtures"'`:
+the real macOS sandbox allowed access to the later peer, failing the isolation
+check with task exit `1`.
+
+Green — `lean-ctx -c 'bun test tests/cli-concurrency.test.ts -t "CLI sandbox denies read and write access to later admitted peer fixtures"'`:
+one test passed with four assertions. Trial one can use its own fixture while
+its sandbox denies reading and writing trial three's marker; trial three keeps
+the original content. The initial inline fixture produced an unrelated Git
+metadata grading error. Using a declared generated Git fixture established the
+recorded isolation red. Candidate and semantic roots are reserved before
+execution. Peer roots are denied directly without querying Git metadata that
+may still be under preparation.
+
+Red — `lean-ctx -c 'bun test tests/cli-concurrency.test.ts -t "CLI closes queued admission when grading fails before advisory retention"'`:
+four candidate calls started instead of two while the failing trial's advisory
+work remained held.
+
+Green — `lean-ctx -c 'bun test tests/cli-concurrency.test.ts -t "CLI closes queued admission when grading fails before advisory retention"'`:
+one test passed with eight assertions. A required grader error closes admission
+immediately; both admitted trials and advisory results remain retained.
+
+A post-implementation guard also covers an execution failure with an already
+active peer, retained trial artifacts, and completed ownership. It makes no red
+claim. These repairs require fresh checks and verification of the original
+closed finding set before committing.