@cassiomc1/forgeloop 1.6.0 → 1.6.1

package/CONTRACT_COVERAGE.md

@@ -14,6 +14,7 @@ coverage.
 | Required artifact freshness | `readRequiredArtifactFingerprints`, `classifyLoadedWorkState` | `tests/checkpoint-freshness.test.js`, `tests/validate-protocol-cli.test.js` | matching hash, missing, and changed artifact cases |
 | Schema health | `inspectSchemaHealth` | `tests/schema-health.test.js` | missing, invalid, and unsupported-version schemas |
 | Evidence vocabulary | `src/core/evidence.js` | `tests/evidence.test.js` | unknown kind and incomplete record |
+| Verification execution isolation | `src/core/verification-execution.js`, `src/core/runtime-context.js` | adapter call binding, disposable cwd, timeout/termination/truncation preservation, and canonical isolation combinations in `tests/verification-execution-isolation.test.js` | missing adapter under required policy, malformed/contradictory isolation metadata, and live-root cwd claims in `tests/verification-execution-isolation.test.js` |
 | Receipt semantics | `src/core/receipt.js` | `tests/receipt-semantics.test.js` | unsupported publication, review, check, and completion claims |
 | Cross-artifact conformance | `src/core/conformance.js`, `src/commands/validate-protocol.js` | `tests/conformance.test.js`, `tests/validate-protocol-cli.test.js` | `stateClassification`, derived stale details, precedence, mismatch, incomplete, and incompatible fixtures |
 | Delegation conflicts | `src/core/delegation.js` | `tests/delegation-set.test.js` | WRITE/WRITE, WRITE/READ, unknown dependency, and cycle cases |

package/DOCS_INDEX.md

@@ -26,7 +26,8 @@ integration and guide context. Use this map before editing documentation.
 | Universal integration API | [`docs/UNIVERSAL_INTEGRATION.md`](./docs/UNIVERSAL_INTEGRATION.md) | Programmatic integration subpath, envelope semantics, and consumer map |
 | Local-first MCP adapter | [`docs/MCP.md`](./docs/MCP.md) | stdio default, optional strict loopback HTTP; server modes/capabilities and canonical resources |
 | Documentation guide | [`docs/DOCUMENTATION_GUIDE.md`](./docs/DOCUMENTATION_GUIDE.md) | Rules and checklist for modifying documentation |
-| ForgeLoop 1.5/MCP release checklist | [`docs/RELEASE_CHECKLIST_1_5_MCP.md`](./docs/RELEASE_CHECKLIST_1_5_MCP.md) | Integration API v1, MCP package, and publication gates |
+| ForgeLoop 1.6.1 release checklist (current) | [`docs/RELEASE_CHECKLIST_1_6_1.md`](./docs/RELEASE_CHECKLIST_1_6_1.md) | Verification adapter boundary, isolation invariants, and publication gates |
+| ForgeLoop 1.5/MCP release checklist (historical) | [`docs/RELEASE_CHECKLIST_1_5_MCP.md`](./docs/RELEASE_CHECKLIST_1_5_MCP.md) | Integration API v1, MCP package, and publication gates |
 | ForgeLoop 1.4 release checklist | [`docs/RELEASE_CHECKLIST_1_4.md`](./docs/RELEASE_CHECKLIST_1_4.md) | Claim-recovery, compatibility, package, and publication gates |
 | Lifecycle, gates, planning, verification, and recovery | [`LOOP_ENGINEERING.md`](./LOOP_ENGINEERING.md) | Normative process for agents and developer workflows |
 | Capability levels, discovery, and degradation | [`PROTOCOL_INTEGRATION.md`](./PROTOCOL_INTEGRATION.md) | Vendor-neutral harness contract |
@@ -39,6 +40,7 @@ integration and guide context. Use this map before editing documentation.
 | Guide content | [`ENG/`](./ENG/) | Context-specific, English-only operational guides |
 | Diagram governance | [`docs/diagrams/manifest.json`](./docs/diagrams/manifest.json) | Authoritative taxonomy, renderer mapping, canonical purposes, artifact ownership, and references |
 | Diagram maintainer entrypoint | [`docs/diagrams/README.md`](./docs/diagrams/README.md) | Typed Archify source, animated HTML explorer, animated SVG fallback, review, and regeneration workflow |
+| Real Execution Proof of Concept (PoC) | [`poc/README.md`](./poc/README.md) | Non-normative, reproducible public engineering workload, audit evidence, and technical audit. Normative behavior remains owned by [`LOOP_ENGINEERING.md`](./LOOP_ENGINEERING.md). |
 
 ## Audience map
 
@@ -46,6 +48,7 @@ integration and guide context. Use this map before editing documentation.
 | --- | --- |
 | **First-time user or developer** | [`docs/GETTING_STARTED.md`](./docs/GETTING_STARTED.md) |
 | **AI coding agent / harness** | [`AGENTS.md`](./AGENTS.md) → [`LOOP_ENGINEERING.md`](./LOOP_ENGINEERING.md) |
+| **Technical auditor / Evaluator** | [`poc/README.md`](./poc/README.md) → [`poc/reports/poc-20260826-real-execution-technical-audit-v2.md`](./poc/reports/poc-20260826-real-execution-technical-audit-v2.md) |
 | **Harness integrator** | [`PROTOCOL_INTEGRATION.md`](./PROTOCOL_INTEGRATION.md) |
 | **External runtime / orchestrator integrator** | [`ORCHESTRATOR_INTEGRATION.md`](./ORCHESTRATOR_INTEGRATION.md) |
 | **Resuming another tool / session** | [`docs/CROSS_HARNESS_CONTINUITY.md`](./docs/CROSS_HARNESS_CONTINUITY.md) |
@@ -54,7 +57,8 @@ integration and guide context. Use this map before editing documentation.
 | **Fixing a broken or stale state** | [`docs/TROUBLESHOOTING.md`](./docs/TROUBLESHOOTING.md) |
 | **Looking for quick recipes** | [`docs/RECIPES.md`](./docs/RECIPES.md) |
 | **Documentation contributor** | [`docs/DOCUMENTATION_GUIDE.md`](./docs/DOCUMENTATION_GUIDE.md) |
-| **Release maintainer (current)** | [`docs/RELEASE_CHECKLIST_1_5_MCP.md`](./docs/RELEASE_CHECKLIST_1_5_MCP.md) |
+| **Release maintainer (current)** | [`docs/RELEASE_CHECKLIST_1_6_1.md`](./docs/RELEASE_CHECKLIST_1_6_1.md) |
+| **Release maintainer (historical 1.5/MCP)** | [`docs/RELEASE_CHECKLIST_1_5_MCP.md`](./docs/RELEASE_CHECKLIST_1_5_MCP.md) |
 | **Release maintainer (historical 1.4)** | [`docs/RELEASE_CHECKLIST_1_4.md`](./docs/RELEASE_CHECKLIST_1_4.md) |
 | **Protocol architect / maintainer** | [`LOOP_SYSTEM_DESIGN.md`](./LOOP_SYSTEM_DESIGN.md) + [`schemas/`](./schemas/) |
 | **Security auditor** | [`THREAT_MODEL.md`](./THREAT_MODEL.md) |
@@ -63,6 +67,7 @@ integration and guide context. Use this map before editing documentation.
 ## Task map
 
 - **Start my first task**: [`docs/GETTING_STARTED.md`](./docs/GETTING_STARTED.md)
+- **Inspect real execution PoC and audit evidence**: [`poc/README.md`](./poc/README.md)
 - **Resume after switching tools**: [`docs/CROSS_HARNESS_CONTINUITY.md`](./docs/CROSS_HARNESS_CONTINUITY.md)
 - **Check CLI options and syntax**: [`docs/CLI_REFERENCE.md`](./docs/CLI_REFERENCE.md)
 - **Understand what `.forgeloop/` stores**: [`docs/ARTIFACT_REFERENCE.md`](./docs/ARTIFACT_REFERENCE.md)

package/LOOP_ENGINEERING.md

@@ -149,7 +149,7 @@ Every verification command path is classified by resolution mode:
 
 **Validator-enforced rule**: Any verification command executed via an installation-capable or explicit-installation resolution mode without a valid canonical installation authority grant is rejected by `record-check`, `audit`, and `complete` with error code `E_INSTALLATION_AUTHORITY_REQUIRED`, `E_AUTHORITY_INVALID`, `E_AUTHORITY_SCOPE_MISMATCH`, or `E_AUTHORITY_UNTRUSTED_SOURCE` and cannot contribute to `VALID` completion.
 
-Recognized command dispatchers (such as `npm test`, `npm start`, `npm stop`, `npm restart`, `npm run <script>`, `npm run-script <script>`, `npm rum <script>`, `npm urn <script>`) are classified by their effective package resolution behavior across recognized lifecycle scripts before process launch. npm invocation parsing recognizes options (e.g. `--silent`, `--loglevel=error`) before the subcommand. Recognized npm-script dispatch is resolved recursively before process launch. `npm restart` uses npm's restart-specific lifecycle semantics (`prerestart`, `prestop`, `stop`, `poststop`, `prestart`, `start`, `poststart`, `postrestart` when `restart` is absent; `prerestart`, `restart`, `postrestart` when `restart` is present) rather than generic pre/main/post handling. ForgeLoop fails closed (`mayInstall: true`) when recursive npm-script resolution encounters a cycle or exceeds its maximum resolution depth (16). ForgeLoop does not resolve npm workspace selection in `run-check` for `0.1.15`. npm script executions using `--workspace`, `-w`, `--workspaces`, or `--ws` fail closed (`E_COMMAND_RESOLUTION_AMBIGUOUS`) because the effective `package.json` execution context may differ from the current ForgeLoop target. Run ForgeLoop against the selected workspace directory directly instead. If any nested lifecycle script invokes an installation-capable command (such as `npx`, `npm exec`, or `pnpm dlx`), the execution is elevated to `INSTALL_CAPABLE_RESOLUTION` and blocked before launch without authority.
+Recognized command dispatchers (such as `npm test`, `npm start`, `npm stop`, `npm restart`, `npm run <script>`, `npm run-script <script>`, `npm rum <script>`, `npm urn <script>`) are classified by their effective package resolution behavior across recognized lifecycle scripts before process launch. npm invocation parsing recognizes options (e.g. `--silent`, `--loglevel=error`) before the subcommand. Recognized npm-script dispatch is resolved recursively before process launch. `npm restart` uses npm's restart-specific lifecycle semantics (`prerestart`, `prestop`, `stop`, `poststop`, `prestart`, `start`, `poststart`, `postrestart` when `restart` is absent; `prerestart`, `restart`, `postrestart` when `restart` is present) rather than generic pre/main/post handling. ForgeLoop fails closed (`mayInstall: true`) when recursive npm-script resolution encounters a cycle or exceeds its maximum resolution depth (16). ForgeLoop does not resolve npm workspace selection in `run-check`. npm script executions using `--workspace`, `-w`, `--workspaces`, or `--ws` fail closed (`E_COMMAND_RESOLUTION_AMBIGUOUS`) because the effective `package.json` execution context may differ from the current ForgeLoop target. Run ForgeLoop against the selected workspace directory directly instead. If any nested lifecycle script invokes an installation-capable command (such as `npx`, `npm exec`, or `pnpm dlx`), the execution is elevated to `INSTALL_CAPABLE_RESOLUTION` and blocked before launch without authority.
 
 **npm Classification Model**: npm classification is semantic and fail-closed. Unknown npm commands are not assumed safe. The classifier specifically identifies install-capable families including: `exec`/`x`, `install` aliases, `ci` aliases, `install-test` families, `install-ci-test` families, `update` aliases, `audit fix`, and conditional `init`/`create`/`innit` invocations. Unknown or ambiguous semantics fail closed (`E_COMMAND_RESOLUTION_AMBIGUOUS`).
 
@@ -162,6 +162,27 @@ resolution is rejected without a valid host-attested authority, while
 `npx --no-install` remains a non-installing path and may fail honestly when a
 tool is absent. `run-check` launches the supplied argv without a shell.
 
+### Verification execution isolation
+
+Without a trusted adapter, verification executes in the live project and is
+recorded as `NATIVE_PROJECT` (`isolated: false`, `liveProjectWritable: true`,
+inherited network and environment). A host may supply a trusted verification
+execution adapter and an isolation policy through the integration runtime
+context (`verificationExecutionAdapter`, `verificationExecutionPolicy`).
+The policy modes are `NONE`, `NATIVE_PROJECT`, `PROJECT_ISOLATED`
+(`isolated: true`, `liveProjectWritable: false`), and `SYSTEM_ISOLATED`
+(additionally `networkPolicy: DENIED`). `liveProjectWritable` is an enforced
+host guarantee reported by the adapter, not an inference from a different
+working directory, and a disposable copy alone does not satisfy filesystem
+isolation. Isolated execution must use a working directory separate from the
+protocol project root. Contradictory isolation metadata is intrinsically
+rejected before evidence persistence with `E_VERIFICATION_EXECUTION_INVALID`,
+and verification that cannot satisfy the required isolation boundary fails
+closed with `E_VERIFICATION_ISOLATION_UNAVAILABLE` instead of running in the
+live project. ForgeLoop owns the adapter contract and evidence semantics; the
+harness owns the concrete isolation backend and no specific backend is
+normative.
+
 `forgeloop record-check` is serialization-only. Its `--command` value is
 metadata and is never executed. A `kind: command`, `evidenceKind: OBSERVED`
 check must carry `provenance: FORGELOOP_EXECUTED` and a valid `executionRef`;

package/PROTOCOL_INTEGRATION.md

@@ -204,6 +204,50 @@ metadata. Invalid or missing references return `E_EXECUTION_REF_INVALID`; an
 observed command without ForgeLoop provenance returns
 `E_COMMAND_PROVENANCE_UNATTESTED`.
 
+### Verification execution adapter boundary
+
+Verification execution is separated from protocol state through a trusted
+adapter boundary. A host supplies both through the integration runtime
+context, and neither is accepted as CLI flags, input, or project files:
+
+```js
+createForgeLoopContext({
+  verificationExecutionAdapter: { execute: async (request) => { /* ... */ } },
+  verificationExecutionPolicy: { requiredIsolation: "PROJECT_ISOLATED" },
+});
+```
+
+The adapter receives a frozen request (`argv`, `protocolProjectRoot`, `taskId`,
+`checkId`, `requirement`, `timeoutMs`, `resolution`) and returns the execution
+result plus isolation metadata. Isolation modes are:
+
+| Mode | `isolated` | `liveProjectWritable` | Network/environment |
+| --- | --- | --- | --- |
+| `NATIVE_PROJECT` | `false` | `true` | Inherited |
+| `PROJECT_ISOLATED` | `true` | `false` | Adapter-declared policy |
+| `SYSTEM_ISOLATED` | `true` | `false` | `networkPolicy: DENIED` required |
+
+ForgeLoop owns the adapter contract and evidence semantics; the harness owns
+the concrete isolation backend, and no specific backend is normative in
+ForgeLoop core documentation. The boundary is fail-closed:
+
+- isolation metadata must be internally consistent with its declared mode
+  (`NATIVE_PROJECT` is never isolated; isolated modes are never
+  `liveProjectWritable`; `SYSTEM_ISOLATED` never inherits network access).
+  Contradictory metadata is rejected with `E_VERIFICATION_EXECUTION_INVALID`
+  before evidence persistence;
+- isolated execution must use a working directory separate from the protocol
+  project root;
+- verification that cannot satisfy the required isolation boundary fails with
+  `E_VERIFICATION_ISOLATION_UNAVAILABLE` and must never fall back to running
+  in the live project.
+
+`protocol-info --json` advertises this capability as
+`features.verificationExecutionIsolation` (version 1), including the supported
+modes and the `protocolProjectRootSeparateFromExecutionCwd` invariant. The
+modes, public error codes, and `createForgeLoopContext` are exported from
+`@cassiomc1/forgeloop/integration`.
+
 ## Missing tool capability
 
 A missing tool is a capability gap, not installation authority.

package/README.md

@@ -28,6 +28,7 @@ relevant guides.
 ## Where should I start?
 
 - **New to ForgeLoop** → [`docs/GETTING_STARTED.md`](./docs/GETTING_STARTED.md)
+- **Inspect a real ForgeLoop execution** → [`poc/README.md`](./poc/README.md)
 - **Full protocol specification** → [`LOOP_ENGINEERING.md`](./LOOP_ENGINEERING.md)
 - **Integrating an AI harness** → [`PROTOCOL_INTEGRATION.md`](./PROTOCOL_INTEGRATION.md)
 - **Continuing another harness's task** → [`docs/CROSS_HARNESS_CONTINUITY.md`](./docs/CROSS_HARNESS_CONTINUITY.md)
@@ -38,6 +39,21 @@ relevant guides.
 - **System architecture & safety** → [`LOOP_SYSTEM_DESIGN.md`](./LOOP_SYSTEM_DESIGN.md) & [`THREAT_MODEL.md`](./THREAT_MODEL.md)
 - **Documentation index & ownership** → [`DOCS_INDEX.md`](./DOCS_INDEX.md)
 
+## Real execution proof
+
+ForgeLoop includes a public real-execution PoC with the workload,
+protocol artifacts, trusted command provenance, execution receipt,
+event history, cryptographic evidence manifest, and technical audit.
+
+The original task reached validator-backed `COMPLETE / VALID`.
+The evidence package also preserves a later
+`E_RECEIPT_PATH_MISMATCH`, detected after evidence publication itself
+changed the repository.
+
+- [PoC overview](./poc/README.md)
+- [Canonical technical audit](./poc/reports/poc-20260826-real-execution-technical-audit-v2.md)
+- [Evidence package](./poc/evidence/poc-20260826-real-execution/)
+
 ## Catalog
 
 | Topic | Guide |

package/THREAT_MODEL.md

@@ -81,6 +81,7 @@ provide a universal exactly-once guarantee.
 | Unsupported profile fact | Turns an agent decision into a durable user fact | `PROJECT_PROFILE.md` and `.forgeloop/sources.json` | Source IDs, source-kind validation, unknown-reference rejection, and explicit misclassification failures | Arbitrary Markdown semantics still require a human or host-specific parser | `tests/profile-provenance.test.js`, `src/core/profile.js` |
 | Weak verification | Treats a vague or inferred claim as observed evidence | Receipt checks and coverage | Versioned check schema, contradictory-status rejection, observed-evidence requirements, and coverage matrix | Evidence remains local and declarative; it is not a remote attestation service | `tests/evidence-coverage.test.js`, `tests/completion.test.js` |
 | Unattested observed command | An actor supplies `--command "..."` or forged command metadata and makes an unrun process appear to be observed evidence | Check provenance, execution artifact, and process boundary | `run-check` captures exact argv, cwd, resolution, timestamps, exit status, and task/check binding; it classifies before launch, uses `shell: false`, and rejects install-capable resolution without trusted authority. `record-check --command` is metadata only; command `OBSERVED` checks require `FORGELOOP_EXECUTED` plus a valid `executionRef`; completion, audit, protocol validation, and bundles revalidate it | The local execution artifact is not cryptographic remote attestation, and a separately privileged process can alter the target after execution | `tests/run-check.test.js`, `tests/completion-cli.test.js`, `tests/verification-capability.test.js`, `tests/validate-protocol-cli.test.js` |
+| Contradictory execution isolation metadata | A custom execution adapter reports guarantees the host does not enforce, for example `NATIVE_PROJECT` claiming `isolated=true`, an isolated mode claiming `liveProjectWritable=true`, or `SYSTEM_ISOLATED` claiming inherited network access | Verification execution adapter boundary and execution evidence | Adapter results are normalized and validated before evidence persistence: canonical mode/guarantee invariants are intrinsically enforced, isolated execution must use a cwd separate from the protocol project root, and violations fail closed with `E_VERIFICATION_EXECUTION_INVALID` or `E_VERIFICATION_ISOLATION_UNAVAILABLE` | The isolation report is still host-supplied; ForgeLoop validates coherence and policy satisfaction, not the underlying OS enforcement | `tests/verification-execution-isolation.test.js` |
 | Malicious receipt | Turns local claims into false publication or completion claims | Execution receipt JSON | Semantic evidence checks for completion, checks, review, push, commit, and deployment; explicit publication booleans | Evidence text is declarative and must still be reviewed for provenance | `tests/receipt-semantics.test.js`, `tests/observability.test.js` |
 | Malicious task brief | Grants a child task more authority than intended | Delegation brief JSON and host harness | Relative path boundaries, guide/verification/authority checks, secret-free validation, set validation, parent integration ownership | The host harness remains responsible for OS permissions and execution policy | `tests/delegation.test.js`, `tests/delegation-set.test.js` |
 | Artifact content exposure | Sensitive material enters portable artifacts or diagnostics | State, receipt, delegation, evidence, and repository text | Nested key/value detection, shaped marker patterns, scanner coverage, no content echo in errors | Content scanners cannot prove that an unknown encoding is harmless | `tests/security-limits.test.js`, `tests/test_scan_secrets.py`, `scripts/scan_secrets.py` |
@@ -101,7 +102,7 @@ provide a universal exactly-once guarantee.
 | Environment-injected trust root | The active actor creates an authority file outside the project target and sets `FORGELOOP_AUTHORITY_FILE` or `FORGELOOP_AUTHORITY_DIR` when invoking ForgeLoop | Actor-controlled process environment versus host-attested runtime authority | Standalone CLI uses `trustMode: NONE`; environment-selected sources are metadata/candidates only and fail with `E_AUTHORITY_UNTRUSTED_SOURCE`; trusted authority requires an internal `HOST_ATTESTED` context not exposed as a self-assertable CLI option | If the host integration allows the actor to mutate or replace the attested source/context, the host trust boundary is compromised | Environment-injection rejection, standalone audit/complete rejection, host-attested positive path |
 | Stale receipt recovery dead-end | Work state changes after preparing a receipt, leaving a mismatch that cannot be refreshed because the old receipt is rejected during re-preparation | Preparation lifecycle and recovery action resolution | Recoverable stale receipt binding in `prepareCompletion`, executable `PREPARE_COMPLETION` return from `next`, atomic refresh of stateFingerprint and changedPaths | Manual file corruption outside CLI commands requires manual diagnostic recovery | `tests/stale-receipt-recovery.test.js`, `tests/next-executability.test.js` |
 | Recursive npm script dispatch | A recognized npm lifecycle script invokes another npm script, which later invokes an installation-capable resolver (e.g. `test` -> `npm run visual` -> `npx package`) | Recognized npm dispatcher semantics before ForgeLoop process launch | Recursive npm-script resolution with cycle detection, maximum depth (16), lifecycle hook inspection, restart special semantics, and fail-closed behavior when the resolver cannot prove the chain is non-installing | Opaque executables may spawn arbitrary descendants. Full descendant-process attestation requires host-level process controls and is outside this release | `tests/run-check.test.js`, `tests/verification-capability.test.js` |
-| npm invocation rewriting and workspace dispatch | npm configuration flags appear before the subcommand, or npm workspace selectors cause script execution to occur against a package.json different from the ForgeLoop target root | Raw npm argv versus effective npm command and execution context | Canonical npm invocation parsing, effective subcommand extraction, workspace flag detection across the full npm argv, and fail-closed workspace script handling when the selected package.json cannot be proven from the current target | ForgeLoop 0.1.15 intentionally does not implement full npm workspace resolution. Users should execute run-check from the selected workspace target directory | `tests/run-check.test.js`, `tests/verification-capability.test.js` |
+| npm invocation rewriting and workspace dispatch | npm configuration flags appear before the subcommand, or npm workspace selectors cause script execution to occur against a package.json different from the ForgeLoop target root | Raw npm argv versus effective npm command and execution context | Canonical npm invocation parsing, effective subcommand extraction, workspace flag detection across the full npm argv, and fail-closed workspace script handling when the selected package.json cannot be proven from the current target | ForgeLoop intentionally does not implement full npm workspace resolution. Users should execute run-check from the selected workspace target directory | `tests/run-check.test.js`, `tests/verification-capability.test.js` |
 | Unclassified npm Install-Capable Command | The npm security classifier recognizes only a small denylist of package-mutating commands. Another official npm command or alias with install/update/bootstrap semantics falls through as a local package command | Effective npm command semantics versus ForgeLoop's command classifier | Semantic npm command classification with explicit install-capable families, explicit script-dispatch families, a deliberately small non-installing allowlist, and fail-closed behavior for unknown or ambiguous npm commands | Future npm commands are blocked until ForgeLoop explicitly classifies them | `tests/verification-capability.test.js`, `tests/run-check.test.js` |
 | Policy weakening bypass | An actor weakens complexity or security thresholds mid-task to bypass verification failures | Task policy snapshot (`policy-snapshot.json`) and semantic policy diff | `policy-diff` classifies rule relaxations as `WEAKEN`, preflight snapshots enforce baseline digests, and `complete` blocks on `E_POLICY_WEAKENING` | A project operator with local filesystem access can authoritatively update project rules | `tests/policy-autonomy.test.js`, `tests/policy-hardening.test.js` |
 | Inert check evasion | An actor relies on an inert or non-matching checker to create false verification pass | Policy engine checker inspection | Scanned file counters and adapter target checks; unproven or inert project rules trigger `E_CHECK_INERT` | Discovered rules gracefully downgrade to advisory without stopping execution | `tests/policy-autonomy.test.js`, `tests/policy-hardening.test.js` |

package/docs/ARTIFACT_REFERENCE.md

@@ -423,8 +423,17 @@ Attested command execution provenance artifact generated by `forgeloop run-check
 - `requirement` *(string, required, minLength: 1)*
 - `verificationCycle` *(integer, required, minimum: 1)*
 - `kind` *(string, required, const: `COMMAND_EXECUTION`)*
+- `executionKind` *(string, optional, enum: `VERIFICATION`, `DURABLE_ACTION`)*
 - `argv` *(array<string>, required, minItems: 1)*
+- `protocolProjectRoot` *(string, optional, minLength: 1)*
 - `cwd` *(string, required, minLength: 1)*
+- `executionIsolation` *(string, optional, enum: `NATIVE_PROJECT`, `PROJECT_ISOLATED`, `SYSTEM_ISOLATED`)*
+- `isolation` *(object, optional)*
+  - `mode` *(string, required, enum: `NATIVE_PROJECT`, `PROJECT_ISOLATED`, `SYSTEM_ISOLATED`)*
+  - `isolated` *(boolean, required)*
+  - `liveProjectWritable` *(boolean, required)*
+  - `networkPolicy` *(string, required, minLength: 1)*
+  - `environmentPolicy` *(string, required, minLength: 1)*
 - `resolution` *(object, required)*
   - `resolutionMode` *(string, required, minLength: 1)*
   - `mayInstall` *(boolean, required)*
@@ -450,6 +459,16 @@ Attested command execution provenance artifact generated by `forgeloop run-check
 
 <!-- END FORGELOOP GENERATED: schema:execution -->
 
+Isolation metadata must be intrinsically truthful. `liveProjectWritable` is an
+enforced host guarantee reported by the trusted execution adapter, not a claim
+implied by a different working directory; a disposable copy alone is
+insufficient. Canonical combinations are `NATIVE_PROJECT` (`isolated=false`,
+`liveProjectWritable=true`), `PROJECT_ISOLATED` (`isolated=true`,
+`liveProjectWritable=false`), and `SYSTEM_ISOLATED` (`isolated=true`,
+`liveProjectWritable=false`, `networkPolicy=DENIED`). Contradictory metadata is
+rejected with `E_VERIFICATION_EXECUTION_INVALID` before the execution artifact
+is persisted, even when the required isolation policy would be `NONE`.
+
 ---
 
 ### 2.13 `task-state/<taskKey>/task.json`

package/docs/MCP.md

@@ -105,7 +105,7 @@ forgeloop-mcp-http --project /repo --mode safe          # 127.0.0.1:3333
 
 | Component | Current contract |
 | --- | --- |
-| ForgeLoop core package | `1.5.x` repository generation |
+| ForgeLoop core package | `>=1.5.0 <2` dependency range; current repository generation `1.6.x` |
 | ForgeLoop protocol | `1` |
 | Integration API | `1` |
 | MCP package | `0.1.x` initial package |

package/docs/RECIPES.md

@@ -394,7 +394,7 @@ After commit ambiguity is settled as `COMMITTED`, verify the independent
 postcondition before completion:
 
 ```bash
-forgeloop run-check --task release --id check-release-live --requirement publication -- node scripts/check-release-live.js
+forgeloop run-check --task release --id check-release-live --requirement publication -- npm view your-package-name@1.0.0 version
 forgeloop action-verify --task release --action action-publish --evidence <execution-ref>
 ```
 

package/docs/RELEASE_CHECKLIST_1_6_1.md

@@ -0,0 +1,121 @@
+# ForgeLoop 1.6.1 release checklist
+
+Preparation checklist for the `@cassiomc1/forgeloop` 1.6.1 release. It does not
+authorize publication. Historical checklists:
+[`RELEASE_CHECKLIST_1_5_MCP.md`](./RELEASE_CHECKLIST_1_5_MCP.md),
+[`RELEASE_CHECKLIST_1_4.md`](./RELEASE_CHECKLIST_1_4.md).
+
+## Version and contract identity
+
+- [ ] Core package version is `1.6.1` in `package.json` and the lockfile root.
+- [ ] ForgeLoop protocol version is `1`.
+- [ ] Integration API version is `1`
+      (`FORGELOOP_INTEGRATION_API_VERSION`).
+- [ ] Candidate version is absent from npm and the `v1.6.1` tag is absent from
+      origin before release preparation starts.
+- [ ] `CHANGELOG.md` has a versioned `1.6.1` section with the actual release
+      date and an empty `Unreleased` section above it.
+
+## Verification execution adapter contract (new in 1.6.x line)
+
+- [ ] `src/core/verification-execution.js` defines the adapter boundary,
+      `VERIFICATION_ISOLATION_MODES`, and the two public error codes.
+- [ ] `runtimeContext.verificationExecutionAdapter` and
+      `runtimeContext.verificationExecutionPolicy` are validated at context
+      creation and never accepted as CLI flags or command input.
+- [ ] `createForgeLoopContext`, the isolation modes, and both error codes are
+      exported from `@cassiomc1/forgeloop/integration`.
+- [ ] `protocol-info --json` advertises
+      `features.verificationExecutionIsolation` (version 1, adapter-backed,
+      modes enumerated, `protocolProjectRootSeparateFromExecutionCwd: true`).
+
+## Isolation metadata invariants
+
+- [ ] `NATIVE_PROJECT` requires `isolated: false` and
+      `liveProjectWritable: true`; it is never described as isolated.
+- [ ] `PROJECT_ISOLATED` and `SYSTEM_ISOLATED` require `isolated: true` and
+      `liveProjectWritable: false`; `SYSTEM_ISOLATED` additionally requires
+      `networkPolicy: DENIED`.
+- [ ] Contradictory isolation metadata is rejected with
+      `E_VERIFICATION_EXECUTION_INVALID` before evidence persistence.
+- [ ] Isolated execution must use a cwd separate from the protocol project
+      root; violation fails closed with `E_VERIFICATION_EXECUTION_INVALID`.
+- [ ] Unsatisfiable isolation policy fails closed with
+      `E_VERIFICATION_ISOLATION_UNAVAILABLE` and never falls back to the live
+      project.
+- [ ] Execution records persist `executionKind`, `protocolProjectRoot`,
+      `executionIsolation`, and the `isolation` object per
+      `schemas/execution.schema.json`.
+
+## Durable-action invariants
+
+- [ ] Trusted `COMMITTED` reconciliation replays exactly once; reconciled
+      mirrors are corroborations, never second transitions.
+- [ ] Action verification requires an independent passed execution covering the
+      action's exact immutable requirement.
+- [ ] `REQUIRE_APPROVAL` authorizations bind approval fingerprints validated by
+      readiness and audit.
+- [ ] Public provenance metadata matches behavior
+      (`CALLER_REPORTED` / `EXTERNAL_OBSERVED`).
+
+## PoC evidence validation
+
+- [ ] `npm run poc:evidence:verify` passes against committed evidence bundles.
+- [ ] `npm run poc:evidence:test` passes.
+- [ ] PoC docs (`poc/README.md`,
+      `poc/FORGELOOP_REAL_EXECUTION_POC.md`) match committed evidence paths,
+      manifests, and hashes.
+
+## Documentation freshness
+
+- [ ] `npm run docs:generate` leaves no diff (generated regions current).
+- [ ] `npm run docs:generated:check` passes.
+- [ ] `npm run docs:conformance` passes.
+- [ ] `npm run docs:diagrams:check` passes (typed Archify source unchanged or
+      regenerated with receipt).
+- [ ] `npm run docs:check` passes.
+- [ ] Normative docs represent the post-`v1.6.0` verification execution
+      boundary without making a harness-specific backend normative.
+- [ ] `DOCS_INDEX.md` points release maintainers to this checklist as current.
+
+## Local validation gates
+
+- [ ] `npm run dependency:policy` passes (runtime dependencies remain zero).
+- [ ] `npm run lint` passes.
+- [ ] `npm test` passes.
+- [ ] `npm run coverage` passes.
+- [ ] `npm run pack:check` passes.
+- [ ] Python validators pass: `python3 -m unittest discover -s tests`,
+      `validate_markdown.py` (+ self-test), `validate_loop_system.py`
+      (+ self-test).
+- [ ] `python3 scripts/scan_secrets.py` passes.
+- [ ] `npm pack` tarball inspected: correct name/version, intended docs, no
+      secrets, no `.git`, no `.forgeloop` execution state.
+
+## Protected-branch and PR gates
+
+- [ ] Changes reach `main` only through a reviewed PR; `main-protection`
+      ruleset never bypassed.
+- [ ] Required checks green: `audit`, `CodeQL`, `Verify generated Archify
+      diagram`, `validate (22)`, `tarball smoke (ubuntu-latest)`,
+      `dependency-review`; every other relevant check green.
+- [ ] No unresolved review threads; PR merged without admin bypass.
+
+## Publication boundary
+
+- [ ] Post-merge `main` workflows green before tagging.
+- [ ] npm candidate version and tag re-checked for collision immediately before
+      tagging.
+- [ ] Annotated tag `v1.6.1` created on the exact validated `main` commit and
+      pushed once; never moved after publication.
+- [ ] `npm-publish.yml` retains `contents: read` + `id-token: write`; no
+      `NPM_TOKEN`/`NODE_AUTH_TOKEN` is added anywhere.
+- [ ] `Publish npm package` workflow succeeds (trusted OIDC publishing).
+- [ ] `Release notes` workflow succeeds; GitHub Release is not draft or
+      prerelease and carries the checksum asset.
+- [ ] npm registry reports the exact version with `gitHead` equal to the
+      release commit.
+- [ ] `npm run release:identity` returns `RELEASE_IDENTITY_VALID` with every
+      individual check `ok`.
+- [ ] Optional clean-install smoke test installs `@cassiomc1/forgeloop@1.6.1`
+      and `forgeloop --version` reports `1.6.1`.

package/docs/TROUBLESHOOTING.md

@@ -462,6 +462,31 @@ A verification check requires an executable or tool that is not installed in the
 
 ---
 
+### Symptom: Verification Reports Contradictory Isolation Metadata
+
+#### Error Code: `E_VERIFICATION_EXECUTION_INVALID`
+
+#### What it means
+
+The trusted verification execution adapter returned isolation metadata that contradicts itself, for example `NATIVE_PROJECT` claiming `isolated=true`, an isolated mode claiming `liveProjectWritable=true`, or `SYSTEM_ISOLATED` claiming `networkPolicy=INHERITED`. The execution artifact is rejected before evidence persistence.
+
+#### Likely causes
+
+1. A custom execution adapter hard-coded isolation fields instead of reporting what the host actually enforced.
+2. A disposable-copy workspace reported itself as system isolated, or claimed the live project is not writable when no filesystem boundary enforces it.
+
+#### Safe recovery
+
+1. Repair the adapter so each isolation mode reports its canonical guarantees: `NATIVE_PROJECT` (`isolated=false`, `liveProjectWritable=true`), `PROJECT_ISOLATED` (`isolated=true`, `liveProjectWritable=false`), `SYSTEM_ISOLATED` (`isolated=true`, `liveProjectWritable=false`, `networkPolicy=DENIED`).
+2. `liveProjectWritable` is an enforced host guarantee, not a claim implied by a different working directory; a disposable copy alone is insufficient.
+3. Rerun verification after the adapter reports truthful metadata.
+
+#### Do not
+
+**Do not weaken the required isolation policy to bypass contradictory metadata, and do not persist execution evidence that claims guarantees the host does not enforce.**
+
+---
+
 ### Symptom: Installation Authority Required
 
 #### Error Code: `E_INSTALLATION_AUTHORITY_REQUIRED`
@@ -920,6 +945,8 @@ forgeloop next --task <id> --json
 | `E_TRACE_SNAPSHOT_INCONSISTENT` | Task artifacts changed while the execution trace was being read. | Rerun the read-only projection to obtain a consistent view. |
 | `E_TRAJECTORY_REFERENCE_REQUIRED` | Comparative efficiency requires a reference scenario with positive comparableSteps. | Provide --scenario with reference.comparableSteps, or omit efficiency from the result. |
 | `E_TRAJECTORY_SCENARIO_INVALID` | Trajectory scenario file is missing required fields or schema-invalid. | Correct the scenario JSON against schemas/trajectory-scenario.schema.json. |
+| `E_VERIFICATION_EXECUTION_INVALID` | The trusted verification execution adapter returned incomplete or invalid execution metadata. | Repair the adapter contract and rerun verification; do not promote incomplete execution evidence. |
+| `E_VERIFICATION_ISOLATION_UNAVAILABLE` | Verification cannot run because the required disposable or system isolation boundary is unavailable. | Use a trusted ForgeLoop execution adapter with the required isolation mode; never run the check in the live project. |
 | `E_VERIFICATION_TOOL_UNAVAILABLE` | Required verification executable is missing in environment. | Use local equivalent, obtain host authority, or record NOT_VERIFIED. |
 
 <!-- END FORGELOOP GENERATED: public-error-codes -->

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cassiomc1/forgeloop",
-  "version": "1.6.0",
+  "version": "1.6.1",
   "description": "Portable, verifiable engineering protocol for AI coding environments and developer workflows",
   "repository": {
     "type": "git",
@@ -60,7 +60,8 @@
     "docs/UNIVERSAL_INTEGRATION.md",
     "docs/DIAGNOSTIC_MODEL.md",
     "docs/EXECUTION_TRACE.md",
-    "docs/RELEASE_CHECKLIST_1_5_MCP.md"
+    "docs/RELEASE_CHECKLIST_1_5_MCP.md",
+    "docs/RELEASE_CHECKLIST_1_6_1.md"
   ],
   "scripts": {
     "test": "node scripts/run-tests.js",
@@ -81,7 +82,9 @@
     "dependency:policy": "node scripts/check-dependency-policy.mjs",
     "mcp:test": "node --test integrations/mcp/tests/*.test.js",
     "mcp:setup": "node scripts/mcp-setup.mjs",
-    "mcp:pack:check": "node scripts/mcp-package-smoke.mjs"
+    "mcp:pack:check": "node scripts/mcp-package-smoke.mjs",
+    "poc:evidence:verify": "node scripts/verify_poc_evidence.mjs",
+    "poc:evidence:test": "node --test poc/test/poc-evidence-publication.test.js"
   },
   "devDependencies": {
     "c8": "^12.0.0",

package/schemas/execution.schema.json

@@ -29,12 +29,27 @@
     "requirement": { "type": "string", "minLength": 1 },
     "verificationCycle": { "type": "integer", "minimum": 1 },
     "kind": { "const": "COMMAND_EXECUTION" },
+    "executionKind": { "enum": ["VERIFICATION", "DURABLE_ACTION"] },
     "argv": {
       "type": "array",
       "minItems": 1,
       "items": { "type": "string", "minLength": 1 }
     },
+    "protocolProjectRoot": { "type": "string", "minLength": 1 },
     "cwd": { "type": "string", "minLength": 1 },
+    "executionIsolation": { "enum": ["NATIVE_PROJECT", "PROJECT_ISOLATED", "SYSTEM_ISOLATED"] },
+    "isolation": {
+      "type": "object",
+      "required": ["mode", "isolated", "liveProjectWritable", "networkPolicy", "environmentPolicy"],
+      "properties": {
+        "mode": { "enum": ["NATIVE_PROJECT", "PROJECT_ISOLATED", "SYSTEM_ISOLATED"] },
+        "isolated": { "type": "boolean" },
+        "liveProjectWritable": { "type": "boolean" },
+        "networkPolicy": { "type": "string", "minLength": 1 },
+        "environmentPolicy": { "type": "string", "minLength": 1 }
+      },
+      "additionalProperties": false
+    },
     "resolution": {
       "type": "object",
       "required": ["resolutionMode", "mayInstall", "installer", "tool"],

package/src/commands/run-check.js

@@ -48,6 +48,7 @@ export async function runCheck({
       timeoutMs,
       authorityContext,
       runtimeContext,
+      executionKind: "VERIFICATION",
     });
     const status = execution.execution.status === "passed" ? "passed" : "failed";
     const recorded = await recordCheckArtifact({

package/src/core/action-execution.js

@@ -72,6 +72,7 @@ export async function executeDurableAction({
       target, packageRoot, taskId, checkId: `action:${action.actionId}`,
       requirement: input.requirement ?? `durable action ${action.actionId}`,
       prepared, timeoutMs,
+      executionKind: "DURABLE_ACTION",
     });
   } catch (error) {
     // Persistence uncertainty after the launch boundary can never downgrade a

package/src/core/completion-artifacts.js

@@ -152,10 +152,42 @@ export async function validateCheckExecutionProvenance(check, {
     requirement: check.requirement,
     verificationCycle: check.details?.verificationCycle ?? 1,
   });
-  if (!allowForeignCwd && path.resolve(execution.cwd) !== path.resolve(target)) {
+  const protocolProjectRoot = execution.protocolProjectRoot ?? execution.cwd;
+  if (
+    execution.executionKind !== undefined
+    && execution.executionKind !== "VERIFICATION"
+  ) {
     throw artifactError(
       "E_EXECUTION_REF_INVALID",
-      "Execution artifact cwd does not match the current target",
+      "A command check must reference a verification execution artifact",
+      [taskId ? taskExecutionPath(taskId, check.executionRef) : ARTIFACT_PATHS.executionDirectory],
+    );
+  }
+  if (
+    execution.executionIsolation !== undefined
+    && execution.isolation?.mode !== execution.executionIsolation
+  ) {
+    throw artifactError(
+      "E_EXECUTION_REF_INVALID",
+      "Execution artifact isolation mode does not match its isolation metadata",
+      [taskId ? taskExecutionPath(taskId, check.executionRef) : ARTIFACT_PATHS.executionDirectory],
+    );
+  }
+  if (
+    execution.isolation?.mode !== undefined
+    && execution.isolation.mode !== "NATIVE_PROJECT"
+    && path.resolve(execution.cwd) === path.resolve(protocolProjectRoot)
+  ) {
+    throw artifactError(
+      "E_EXECUTION_REF_INVALID",
+      "Isolated execution artifact cwd must be separate from the protocol project root",
+      [taskId ? taskExecutionPath(taskId, check.executionRef) : ARTIFACT_PATHS.executionDirectory],
+    );
+  }
+  if (!allowForeignCwd && path.resolve(protocolProjectRoot) !== path.resolve(target)) {
+    throw artifactError(
+      "E_EXECUTION_REF_INVALID",
+      "Execution artifact protocol project root does not match the current target",
       [taskId ? taskExecutionPath(taskId, check.executionRef) : ARTIFACT_PATHS.executionDirectory],
     );
   }

package/src/core/error-codes.js

@@ -6,6 +6,10 @@ import {
   E_INSTALLATION_AUTHORITY_REQUIRED,
   E_VERIFICATION_TOOL_UNAVAILABLE,
 } from "./verification-constants.js";
+import {
+  E_VERIFICATION_EXECUTION_INVALID,
+  E_VERIFICATION_ISOLATION_UNAVAILABLE,
+} from "./verification-execution.js";
 
 export const E_TASK_REQUIRED = "E_TASK_REQUIRED";
 export const E_TASK_NOT_FOUND = "E_TASK_NOT_FOUND";
@@ -145,6 +149,20 @@ export const PUBLIC_ERROR_CODES = Object.freeze({
     meaning: "Required verification executable is missing in environment.",
     safeResolution: "Use local equivalent, obtain host authority, or record NOT_VERIFIED.",
   }),
+  E_VERIFICATION_ISOLATION_UNAVAILABLE: Object.freeze({
+    code: "E_VERIFICATION_ISOLATION_UNAVAILABLE",
+    category: "verification-isolation",
+    classification: "PUBLIC_STABLE",
+    meaning: "Verification cannot run because the required disposable or system isolation boundary is unavailable.",
+    safeResolution: "Use a trusted ForgeLoop execution adapter with the required isolation mode; never run the check in the live project.",
+  }),
+  E_VERIFICATION_EXECUTION_INVALID: Object.freeze({
+    code: "E_VERIFICATION_EXECUTION_INVALID",
+    category: "verification-isolation",
+    classification: "PUBLIC_STABLE",
+    meaning: "The trusted verification execution adapter returned incomplete or invalid execution metadata.",
+    safeResolution: "Repair the adapter contract and rerun verification; do not promote incomplete execution evidence.",
+  }),
   E_INSTALLATION_AUTHORITY_REQUIRED: Object.freeze({
     code: "E_INSTALLATION_AUTHORITY_REQUIRED",
     category: "authority",
@@ -833,6 +851,8 @@ export const E_INIT_KIT_CONFLICT = "E_INIT_KIT_CONFLICT";
 export const ALL_KNOWN_ERROR_CODES = Object.freeze(new Set([
   ...FAILURE_CODES,
   E_VERIFICATION_TOOL_UNAVAILABLE,
+  E_VERIFICATION_ISOLATION_UNAVAILABLE,
+  E_VERIFICATION_EXECUTION_INVALID,
   E_INSTALLATION_AUTHORITY_REQUIRED,
   E_COMMAND_RESOLUTION_AMBIGUOUS,
   E_AUTHORITY_INVALID,

package/src/core/execution.js

@@ -62,6 +62,7 @@ export async function runCommandExecution({
   runtimeContext,
   executionPath,
   timeoutMs = null,
+  executionKind = "VERIFICATION",
 } = {}) {
   const prepared = await prepareCommandExecution({
     target,
@@ -80,6 +81,8 @@ export async function runCommandExecution({
     prepared,
     timeoutMs,
     executionPath,
+    executionKind,
+    runtimeContext,
   });
 }
 

package/src/core/integration-invocation-policy.js

@@ -2,6 +2,7 @@ import { CLI_COMMAND_DEFINITIONS } from "./cli-command-definitions.js";
 import { COMMAND_EXECUTORS } from "./command-executors.js";
 import { PROTOCOL_VERSION } from "./protocol.js";
 import { FORGELOOP_INTEGRATION_RUNTIME_VERSION } from "./command-runtime.js";
+import { VERIFICATION_ISOLATION_MODES } from "./verification-execution.js";
 
 /**
  * Integration risk classes. They classify the *invocation*, not only the
@@ -133,6 +134,13 @@ export function getForgeLoopCapabilities({ packageVersion = null } = {}) {
         readOnlyMetrics: true,
         projectLocalReference: true,
       },
+      verificationExecutionIsolation: {
+        version: 1,
+        supported: true,
+        adapter: true,
+        modes: [...VERIFICATION_ISOLATION_MODES],
+        protocolProjectRootSeparateFromExecutionCwd: true,
+      },
     },
     commands,
     resources: [

package/src/core/prepared-execution.js

@@ -4,6 +4,7 @@ import {
   validateVerificationAuthority,
   E_COMMAND_RESOLUTION_AMBIGUOUS,
 } from "./verification-capability.js";
+import { executeVerificationProcess } from "./verification-execution.js";
 
 export { E_COMMAND_RESOLUTION_AMBIGUOUS };
 
@@ -171,12 +172,36 @@ export async function runPreparedCommandExecution({
   prepared,
   timeoutMs = null,
   executionPath,
+  executionKind = "VERIFICATION",
+  runtimeContext,
 }) {
   const { createHash } = await import("node:crypto");
   const digest = (bytes) => createHash("sha256").update(bytes).digest("hex");
   const executionId = `exec-${randomUUID()}`;
   const startedAt = new Date().toISOString();
-  const processResult = await executePreparedProcess(prepared.argv, target, { timeoutMs });
+  const processResult = executionKind === "VERIFICATION"
+    ? await executeVerificationProcess({
+      argv: prepared.argv,
+      protocolProjectRoot: target,
+      taskId,
+      checkId,
+      requirement,
+      resolution: prepared.resolution,
+      timeoutMs,
+      runtimeContext,
+      nativeExecute: executePreparedProcess,
+    })
+    : {
+      ...(await executePreparedProcess(prepared.argv, target, { timeoutMs })),
+      cwd: target,
+      isolation: {
+        mode: "NATIVE_PROJECT",
+        isolated: false,
+        liveProjectWritable: true,
+        networkPolicy: "INHERITED",
+        environmentPolicy: "INHERITED",
+      },
+    };
   const finishedAt = new Date().toISOString();
   const execution = {
     schemaVersion: 1,
@@ -187,8 +212,10 @@ export async function runPreparedCommandExecution({
     requirement,
     verificationCycle,
     kind: "COMMAND_EXECUTION",
+    executionKind,
     argv: prepared.argv,
-    cwd: target,
+    protocolProjectRoot: target,
+    cwd: processResult.cwd,
     resolution: {
       resolutionMode: prepared.resolution.resolutionMode,
       mayInstall: prepared.resolution.mayInstall,
@@ -203,6 +230,8 @@ export async function runPreparedCommandExecution({
     durationMs: Math.max(0, Date.parse(finishedAt) - Date.parse(startedAt)),
     termination: processResult.spawnError ? "spawn-error" : processResult.timedOut ? "timeout" : processResult.signal ? "signal" : "exit",
     signal: processResult.signal ?? null,
+    executionIsolation: processResult.isolation.mode,
+    isolation: processResult.isolation,
     stdoutSha256: digest(processResult.stdout),
     stderrSha256: digest(processResult.stderr),
     stdoutBytes: processResult.stdoutBytes,

package/src/core/protocol-info.js

@@ -3,6 +3,7 @@ import { ARTIFACT_REGISTRY } from "./artifact-registry.js";
 import { PUBLIC_ERROR_REGISTRY } from "./error-codes.js";
 import { GUIDE_REGISTRY } from "./guide-registry.js";
 import { PROTOCOL_VERSION, WORK_PHASES, WORK_TRANSITIONS } from "./protocol.js";
+import { VERIFICATION_ISOLATION_MODES } from "./verification-execution.js";
 
 export const SCHEMA_COMPATIBILITY_POLICY = Object.freeze({
   protocolVersion: PROTOCOL_VERSION,
@@ -50,6 +51,13 @@ export function protocolInfo({ packageVersion = null } = {}) {
         supported: true,
         schemaVersion: 1,
       },
+      verificationExecutionIsolation: {
+        version: 1,
+        supported: true,
+        adapter: true,
+        modes: [...VERIFICATION_ISOLATION_MODES],
+        protocolProjectRootSeparateFromExecutionCwd: true,
+      },
       structuredTrace: {
         version: 1,
         supported: true,

package/src/core/runtime-context.js

@@ -1,3 +1,9 @@
+import {
+  E_VERIFICATION_ISOLATION_UNAVAILABLE,
+  isVerificationExecutionAdapter,
+  normalizeVerificationExecutionPolicy,
+} from "./verification-execution.js";
+
 export const AUTHORITY_TRUST_MODES = Object.freeze(["NONE", "HOST_ATTESTED"]);
 
 const AUTHORITY_CONTEXT_FIELDS = Object.freeze([
@@ -76,5 +82,17 @@ export function resolveAuthorityContext(options = {}) {
 
 export function createForgeLoopContext(options = {}) {
   const authorityContext = createAuthorityContext(options);
-  return Object.freeze({ authorityContext });
+  const context = { authorityContext };
+  if (options?.verificationExecutionAdapter !== undefined) {
+    if (!isVerificationExecutionAdapter(options.verificationExecutionAdapter)) {
+      const error = new Error("Verification execution adapter is unavailable or invalid");
+      error.code = E_VERIFICATION_ISOLATION_UNAVAILABLE;
+      throw error;
+    }
+    context.verificationExecutionAdapter = options.verificationExecutionAdapter;
+  }
+  if (options?.verificationExecutionPolicy !== undefined) {
+    context.verificationExecutionPolicy = normalizeVerificationExecutionPolicy(options.verificationExecutionPolicy);
+  }
+  return Object.freeze(context);
 }

package/src/core/verification-execution.js

@@ -0,0 +1,257 @@
+export const VERIFICATION_ISOLATION_MODES = Object.freeze([
+  "NATIVE_PROJECT",
+  "PROJECT_ISOLATED",
+  "SYSTEM_ISOLATED",
+]);
+
+export const VERIFICATION_EXECUTION_POLICY_MODES = Object.freeze([
+  "NONE",
+  ...VERIFICATION_ISOLATION_MODES,
+]);
+
+export const E_VERIFICATION_ISOLATION_UNAVAILABLE = "E_VERIFICATION_ISOLATION_UNAVAILABLE";
+export const E_VERIFICATION_EXECUTION_INVALID = "E_VERIFICATION_EXECUTION_INVALID";
+
+const ISOLATION_RANK = Object.freeze({
+  NATIVE_PROJECT: 0,
+  PROJECT_ISOLATED: 1,
+  SYSTEM_ISOLATED: 2,
+});
+
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function executionError(code, message) {
+  const error = new Error(message);
+  error.code = code;
+  return error;
+}
+
+function requiredString(value, field) {
+  if (typeof value !== "string" || value.trim() === "") {
+    throw executionError(E_VERIFICATION_EXECUTION_INVALID, `Verification execution ${field} must be a non-empty string`);
+  }
+  return value;
+}
+
+function nullableString(value, field) {
+  if (value !== null && typeof value !== "string") {
+    throw executionError(E_VERIFICATION_EXECUTION_INVALID, `Verification execution ${field} must be a string or null`);
+  }
+  return value;
+}
+
+function outputBytes(value, field) {
+  if (value === undefined || value === null) return Buffer.alloc(0);
+  if (typeof value === "string") return Buffer.from(value, "utf8");
+  if (Buffer.isBuffer(value) || value instanceof Uint8Array) return Buffer.from(value);
+  throw executionError(E_VERIFICATION_EXECUTION_INVALID, `Verification execution ${field} must be text or bytes`);
+}
+
+function nonNegativeInteger(value, field, fallback) {
+  const resolved = value === undefined ? fallback : value;
+  if (!Number.isInteger(resolved) || resolved < 0) {
+    throw executionError(E_VERIFICATION_EXECUTION_INVALID, `Verification execution ${field} must be a non-negative integer`);
+  }
+  return resolved;
+}
+
+export function normalizeVerificationExecutionPolicy(policy = {}) {
+  if (policy === undefined || policy === null) return Object.freeze({ requiredIsolation: "NONE" });
+  if (!isRecord(policy)) {
+    throw executionError(E_VERIFICATION_ISOLATION_UNAVAILABLE, "Verification execution isolation policy is invalid");
+  }
+  const requiredIsolation = policy.requiredIsolation ?? "NONE";
+  if (!VERIFICATION_EXECUTION_POLICY_MODES.includes(requiredIsolation)) {
+    throw executionError(E_VERIFICATION_ISOLATION_UNAVAILABLE, "Verification execution isolation policy is unsupported");
+  }
+  return Object.freeze({ requiredIsolation });
+}
+
+export function isVerificationExecutionAdapter(value) {
+  return isRecord(value) && typeof value.execute === "function";
+}
+
+function readAdapter(runtimeContext) {
+  const value = isRecord(runtimeContext) ? runtimeContext.verificationExecutionAdapter : undefined;
+  if (value === undefined || value === null) return null;
+  if (!isVerificationExecutionAdapter(value)) {
+    throw executionError(E_VERIFICATION_ISOLATION_UNAVAILABLE, "Verification execution adapter is unavailable or invalid");
+  }
+  return value;
+}
+
+function assertIsolationMetadataConsistency(isolation) {
+  if (isolation.mode === "NATIVE_PROJECT") {
+    if (
+      isolation.isolated !== false
+      || isolation.liveProjectWritable !== true
+    ) {
+      throw executionError(
+        E_VERIFICATION_EXECUTION_INVALID,
+        "NATIVE_PROJECT must report isolated=false and liveProjectWritable=true",
+      );
+    }
+    return;
+  }
+
+  if (
+    isolation.isolated !== true
+    || isolation.liveProjectWritable !== false
+  ) {
+    throw executionError(
+      E_VERIFICATION_EXECUTION_INVALID,
+      `${isolation.mode} must report isolated=true and liveProjectWritable=false`,
+    );
+  }
+
+  if (
+    isolation.mode === "SYSTEM_ISOLATED"
+    && isolation.networkPolicy !== "DENIED"
+  ) {
+    throw executionError(
+      E_VERIFICATION_EXECUTION_INVALID,
+      "SYSTEM_ISOLATED must report networkPolicy=DENIED",
+    );
+  }
+}
+
+function normalizeIsolation(value) {
+  if (!isRecord(value)) {
+    throw executionError(E_VERIFICATION_EXECUTION_INVALID, "Verification execution isolation metadata is missing");
+  }
+  const mode = value.mode;
+  if (!VERIFICATION_ISOLATION_MODES.includes(mode)) {
+    throw executionError(E_VERIFICATION_EXECUTION_INVALID, "Verification execution isolation mode is unsupported");
+  }
+  if (typeof value.isolated !== "boolean" || typeof value.liveProjectWritable !== "boolean") {
+    throw executionError(E_VERIFICATION_EXECUTION_INVALID, "Verification execution isolation booleans are invalid");
+  }
+  const isolation = {
+    mode,
+    isolated: value.isolated,
+    liveProjectWritable: value.liveProjectWritable,
+    networkPolicy: requiredString(value.networkPolicy, "networkPolicy"),
+    environmentPolicy: requiredString(value.environmentPolicy, "environmentPolicy"),
+  };
+  assertIsolationMetadataConsistency(isolation);
+  return isolation;
+}
+
+export function normalizeVerificationExecutionResult(value, { defaultCwd = null } = {}) {
+  if (!isRecord(value)) {
+    throw executionError(E_VERIFICATION_EXECUTION_INVALID, "Verification execution adapter returned an invalid result");
+  }
+  const cwd = value.cwd ?? defaultCwd;
+  requiredString(cwd, "cwd");
+  if (value.exitCode !== null && !Number.isInteger(value.exitCode)) {
+    throw executionError(E_VERIFICATION_EXECUTION_INVALID, "Verification execution exitCode must be an integer or null");
+  }
+  const signal = nullableString(value.signal ?? null, "signal");
+  if (typeof value.timedOut !== "boolean") {
+    throw executionError(E_VERIFICATION_EXECUTION_INVALID, "Verification execution timedOut must be boolean");
+  }
+  if (typeof value.outputTruncated !== "boolean") {
+    throw executionError(E_VERIFICATION_EXECUTION_INVALID, "Verification execution outputTruncated must be boolean");
+  }
+  const stdout = outputBytes(value.stdout, "stdout");
+  const stderr = outputBytes(value.stderr, "stderr");
+  return {
+    exitCode: value.exitCode,
+    signal,
+    timedOut: value.timedOut,
+    stdout,
+    stderr,
+    stdoutBytes: nonNegativeInteger(value.stdoutBytes, "stdoutBytes", stdout.length),
+    stderrBytes: nonNegativeInteger(value.stderrBytes, "stderrBytes", stderr.length),
+    outputTruncated: value.outputTruncated,
+    spawnError: Boolean(value.spawnError),
+    cwd,
+    isolation: normalizeIsolation(value.isolation),
+  };
+}
+
+function satisfiesIsolationPolicy(isolation, requiredIsolation) {
+  if (requiredIsolation === "NONE") return true;
+  if (ISOLATION_RANK[isolation.mode] < ISOLATION_RANK[requiredIsolation]) return false;
+  if (requiredIsolation === "NATIVE_PROJECT") return true;
+  return isolation.isolated === true
+    && isolation.liveProjectWritable === false
+    && (requiredIsolation !== "SYSTEM_ISOLATED" || isolation.networkPolicy === "DENIED");
+}
+
+export function assertVerificationIsolation(result, policy) {
+  const requiredIsolation = normalizeVerificationExecutionPolicy(policy).requiredIsolation;
+  if (!satisfiesIsolationPolicy(result.isolation, requiredIsolation)) {
+    throw executionError(
+      E_VERIFICATION_ISOLATION_UNAVAILABLE,
+      `Verification execution did not satisfy the required ${requiredIsolation} isolation boundary`,
+    );
+  }
+  return result;
+}
+
+export async function executeVerificationProcess({
+  argv,
+  protocolProjectRoot,
+  taskId,
+  checkId,
+  requirement,
+  resolution,
+  timeoutMs,
+  runtimeContext,
+  nativeExecute,
+}) {
+  const policy = normalizeVerificationExecutionPolicy(runtimeContext?.verificationExecutionPolicy);
+  const adapter = readAdapter(runtimeContext);
+  let rawResult;
+  if (adapter) {
+    try {
+      rawResult = await adapter.execute(Object.freeze({
+        argv: [...argv],
+        protocolProjectRoot,
+        taskId,
+        checkId,
+        requirement,
+        timeoutMs,
+        resolution,
+      }));
+    } catch (error) {
+      if (error?.code === E_VERIFICATION_ISOLATION_UNAVAILABLE) throw error;
+      throw executionError(E_VERIFICATION_EXECUTION_INVALID, "Verification execution adapter failed");
+    }
+  } else {
+    if (policy.requiredIsolation !== "NONE") {
+      throw executionError(
+        E_VERIFICATION_ISOLATION_UNAVAILABLE,
+        `Verification execution requires ${policy.requiredIsolation}, but no trusted adapter was supplied`,
+      );
+    }
+    const nativeResult = await nativeExecute(argv, protocolProjectRoot, { timeoutMs });
+    rawResult = {
+      ...nativeResult,
+      cwd: protocolProjectRoot,
+      isolation: {
+        mode: "NATIVE_PROJECT",
+        isolated: false,
+        liveProjectWritable: true,
+        networkPolicy: "INHERITED",
+        environmentPolicy: "INHERITED",
+      },
+    };
+  }
+
+  const normalized = normalizeVerificationExecutionResult(rawResult, { defaultCwd: protocolProjectRoot });
+  if (
+    policy.requiredIsolation !== "NONE"
+    && normalized.isolation.mode !== "NATIVE_PROJECT"
+    && normalized.cwd === protocolProjectRoot
+  ) {
+    throw executionError(
+      E_VERIFICATION_EXECUTION_INVALID,
+      "Isolated verification execution must use a cwd separate from the protocol project root",
+    );
+  }
+  return assertVerificationIsolation(normalized, policy);
+}

package/src/integration.js

@@ -44,4 +44,12 @@ export {
   CLI_COMMAND_DEFINITIONS,
 };
 
+export { createForgeLoopContext } from "./core/runtime-context.js";
+export {
+  E_VERIFICATION_EXECUTION_INVALID,
+  E_VERIFICATION_ISOLATION_UNAVAILABLE,
+  VERIFICATION_EXECUTION_POLICY_MODES,
+  VERIFICATION_ISOLATION_MODES,
+} from "./core/verification-execution.js";
+
 export const FORGELOOP_INTEGRATION_API_VERSION = FORGELOOP_INTEGRATION_RUNTIME_VERSION;