@claudexor/orchestrator 3.2.0 → 3.3.7-rc.0

package/dist/orchestrator.js

@@ -1,10 +1,11 @@
 import { existsSync } from "node:fs";
-import { effectiveAuthPreference, observeNativeSessionEvent, preflightCredentialProfile, preflightDefaultSubject, probeCredentialProfileStatus, profileHeadroomBreach, profileStatusAdmits, resolveCredentialProfile, resumeSessionForProfile, rotateSpecOnTypedLimit, selectedProfileAvailability, staticRotationCandidates, } from "./credential-profiles.js";
+import { effectiveAuthPreference, observeNativeSessionEvent, preflightCredentialProfile, preflightDefaultSubject, probeCredentialProfileStatus, profileHeadroomBreach, profileStatusAdmits, resolveCredentialProfile, resumeSessionForProfile, rotateSpecOnTypedLimit, selectedProfileAvailability, staticRotationCandidates, vendorVerifiedProfileStatus, } from "./credential-profiles.js";
 import { writeRunTelemetryArtifact } from "./runTelemetryWriter.js";
 import { buildFileBackedSynthesisInput, materializeWinnerOutputs, stageFileBackedContext, writeCandidateAttemptArtifacts, } from "./candidateOutputs.js";
 import { processAttemptUsage } from "./attemptUsage.js";
+import { appliedAttemptFacts, assertDelegatedEvidence, confinementNotice, externallyConfinedLane, scopedHarnessHome, } from "./delegatedHome.js";
 import * as AC from "./attemptUsageCost.js";
-import { candidateRoster, convergenceOutcomeFacts, isWorkingCandidate, partitionCandidates, toCandidateEvidence, } from "./candidateEvidence.js";
+import { candidateRoster, convergenceOutcomeFacts, isWorkingCandidate, partitionCandidates, toCandidateEvidence, unanimousDeclaredFailure, } from "./candidateEvidence.js";
 import { capabilityIntents } from "@claudexor/gateway";
 import { policyFindings } from "./policyFindings.js";
 import { join } from "node:path";
@@ -26,7 +27,7 @@ import { resolveRunInputDefaults } from "./run-input-resolution.js";
 import { beginAnnouncedRun } from "./runEventLog.js";
 import { arbitrationBudgetOptions, decisionBudgetSummary } from "./decisionBudget.js";
 import { buildRevisePrompt } from "./revisePrompt.js";
-import { cancelledResult, failTerminally, guardAnnouncedRun, writeFailure, } from "./runTerminals.js";
+import { cancelledResult, declaredFailure, failTerminally, guardAnnouncedRun, writeFailure, } from "./runTerminals.js";
 import { budgetFailureRecord, classifyBudgetFailure } from "./budgetFailure.js";
 import { assertOutputSchemaCompiles, finalizeStructuredOutput } from "./structuredOutput.js";
 import { transientRetryDelayMs, promptWithEngineConstraints, sleep, redactHarnessEvent, harnessEventPayload, safeErrorMessage, renderSummary, observeBudgetSignals, rotateOnStall, recordCleanAttemptMetrics, envInheritance, transientRetryPolicy, reviewerTimeoutMs, harnessInactivityTimeoutMs, observeAuthSwitch, emitPrimaryDivergence, emitPoolDegraded, deliveryRefusalFailure, winnerNeedsHuman, writeRaceDeliveryDecision, } from "./runSupport.js";
@@ -407,8 +408,19 @@ export class Orchestrator {
         const policy = this.config(repoRoot)?.global.harnesses?.[harnessId]?.profile_policy;
         return policy ?? { limit_action: "fail", rotation_eligible: [], headroom_threshold: 0.9 };
     }
+    /** The quota poller's authenticated vendor evidence for THIS decision epoch,
+     * read once so every profile in the epoch is judged against one observation
+     * set. This is what makes profile readiness at admission mean the same thing
+     * it means on the Accounts card (INV-135 honesty). */
+    vendorQuotaObservations() {
+        return {
+            snapshots: this.deps.quotaSnapshots?.() ?? [],
+            absences: this.deps.quotaAbsences?.() ?? [],
+        };
+    }
     /** Fresh profile readiness for one rotation decision epoch. Accounts uses
-     * the same probe wrapper + admission predicate when projecting next_up. */
+     * the same probe wrapper + vendor overlay + admission predicate when
+     * projecting next_up. */
     async readyProfileIdsForRotation(input, harnessId, current, excluded = new Set()) {
         const profiles = staticRotationCandidates({
             registry: this.config(input.repoRoot)?.global.credential_profiles ?? [],
@@ -418,9 +430,12 @@ export class Orchestrator {
             excluded,
         });
         const adapter = this.deps.registry.get(harnessId);
+        const quota = this.vendorQuotaObservations();
         const entries = await Promise.all(profiles.map(async (profile) => ({
             profile,
-            status: await probeCredentialProfileStatus(profile, adapter?.probeCredentialProfile?.bind(adapter)),
+            // Rotating INTO a profile the vendor has already rejected would spend a
+            // whole attempt to rediscover the 401 the poller reported a minute ago.
+            status: vendorVerifiedProfileStatus(await probeCredentialProfileStatus(profile, adapter?.probeCredentialProfile?.bind(adapter)), quota),
         })));
         return new Set(entries
             .filter(({ profile, status }) => profileStatusAdmits(profile, status))
@@ -576,6 +591,9 @@ export class Orchestrator {
             dropped.push(detail);
             droppedLanes.push({ harnessId, stage, detail });
         };
+        // One observation set for the whole admission pass, so two lanes cannot be
+        // judged against different vendor epochs.
+        const vendorQuota = this.vendorQuotaObservations();
         for (const id of ids) {
             const adapter = this.deps.registry.get(id);
             if (!adapter) {
@@ -639,6 +657,11 @@ export class Orchestrator {
                 profileId: this.effectiveProfileId(input, id),
                 harnessId: id,
                 probe: profileAdapter?.probeCredentialProfile?.bind(profileAdapter),
+                // `verification: passed` from the local store only means a login file
+                // is present. The poller's authenticated vendor call is the only
+                // liveness evidence we have, and admission is the surface that must
+                // act on it — otherwise the run dispatches into a revoked token.
+                quota: vendorQuota,
             });
             if (profileVerdict !== null) {
                 if (profileVerdict === "available") {
@@ -671,7 +694,7 @@ export class Orchestrator {
             const readOnlyIntent = intent === "plan" || intent === "spec" || intent === "explain" || intent === "audit";
             const requiredAccess = this.requestRequirements.adapterAccess(intent, manifest.capabilities.implementation_transport, readOnlyIntent
                 ? "readonly"
-                : (input.access ?? this.config(input.repoRoot).trust.access_default));
+                : (input.access ?? this.config(input.repoRoot).trust.access_default), externallyConfinedLane(input.delegated === true));
             const accessSupported = !requiredAccess || manifest.access_profiles_supported.includes(requiredAccess);
             const webSupport = manifest.capabilities.web_policy;
             // Match routeSpecKnobs: a per-harness web default upgrades run-level auto,
@@ -1332,11 +1355,28 @@ export class Orchestrator {
             return { pointerLine: null };
         }
     }
-    async runCandidateInEnvelope(routed, envelope, attemptId, label, contract, prompt, store, paths, wsm, ledger, access = "workspace_write", onHarnessEvent, signal, modelHint, effortHint, intent = "implement", log, effectiveWebMode, interaction, budgetGuard, runInput, streamDeltas = false, fileBackedContext, 
+    /**
+     * The ONE place an attempt's HOME and OS boundary are decided.
+     *
+     * Called by every caller of `runCandidateInEnvelope` INSIDE that caller's
+     * try, so a delegated refusal is caught by the same catch that writes the
+     * attempt record, and so the decided home is in scope there.
+     */
+    harnessHomeFor(wsm, envelope, routed, runInput) {
+        // Refuses (never silently degrades) when a delegated run cannot be confined.
+        return scopedHarnessHome(wsm, envelope, envelope.worktree_path === envelope.repo_root, runInput?.delegated === true, routed.adapterAccess);
+    }
+    async runCandidateInEnvelope(routed, envelope, attemptId, label, contract, prompt, store, paths, wsm, ledger, access, onHarnessEvent, signal, modelHint, effortHint, intent, log, effectiveWebMode, interaction, budgetGuard, runInput, streamDeltas, fileBackedContext, 
     /** D-16d: when set, the mechanical continuation checkpoint pointer for a
      * one-shot fresh-session continuation — appended to the prompt so the model
      * (and the offline fake) re-grounds in the exhausted attempt's partial work. */
-    continuationPointer) {
+    continuationPointer, 
+    /** Decided by `harnessHomeFor` in the CALLER, so the per-attempt applied
+     * facts exist in the caller's catch too: an attempt that ran and then threw
+     * must record what it ran under, not just why it stopped. REQUIRED (no
+     * default): a silent fallback here would spawn a delegated child on the
+     * operator's real home while the record still claimed confinement. */
+    harnessHome) {
         const adapter = routed.adapter;
         const knobs = this.routeSpecKnobs(routed, contract, modelHint, effortHint);
         // Isolated scoped-home sessions are never retained after disposal.
@@ -1357,7 +1397,9 @@ export class Orchestrator {
             intent,
             // Engine-derived read-only prompt constraints: protected/auto-protected
             // paths PLUS the exact typed gate argv the run will execute (QA-022 FIX B).
-            prompt: promptWithEngineConstraints([prompt, laneContinuity?.pointerLine, continuationPointer]
+            prompt: promptWithEngineConstraints(
+            // A child running without an OS boundary is TOLD so (disclosure 2 of 3).
+            [prompt, confinementNotice(harnessHome), laneContinuity?.pointerLine, continuationPointer]
                 .filter((s) => typeof s === "string" && s.length > 0)
                 .join("\n\n"), contract.constraints.protected_paths, contract.constraints.auto_protected_paths, contract.constraints.protected_path_approvals, contract.tests.commands),
             attachments: runInput?.attachments ?? [],
@@ -1379,9 +1421,14 @@ export class Orchestrator {
             ...(inPlaceEnvelope && sessionFields?.resume_session_id
                 ? { resume_session_id: sessionFields.resume_session_id }
                 : {}),
-            // Scoped harness home only for isolated envelopes; in-place runs use the
-            // native environment so the resumed vendor session is actually reachable.
-            ...(inPlaceEnvelope ? {} : { env: wsm.envFor(envelope) }),
+            // Scoped harness home for isolated envelopes AND for every delegated run;
+            // an ordinary in-place run keeps the native environment so the resumed
+            // vendor session is reachable. See scopedHarnessHome for the cost a
+            // delegated in-place attempt pays for that confinement.
+            ...(harnessHome.env ? { env: harnessHome.env } : {}),
+            // The OS boundary itself. The shared CLI run loop wraps the argv with it;
+            // no adapter opts in, so no adapter can forget.
+            confinement: harnessHome.confinement,
             raw_context_packet: rawContextPacket,
             stream_deltas: streamDeltas,
         });
@@ -1392,6 +1439,9 @@ export class Orchestrator {
         const workEnvelope = this.workReportEnvelopeFor(routed, contract, Boolean(interaction));
         const workReportMode = this.applyWorkEnvelope(spec, workEnvelope);
         const inactivityMs = harnessInactivityTimeoutMs(this.config(contract.repo.root));
+        // Named once: the attempt record, the CandidateRun and the terminal gate all
+        // read the SAME applied facts rather than three re-derivations.
+        const applied = appliedAttemptFacts(harnessHome, spec.access, sessionFields?.credential_profile?.profile_id ?? runInput?.credentialProfileId ?? null);
         const attemptStartedMs = Date.now();
         const budgetSignalState = { quotaPressureDisclosed: false };
         const triedProfiles = new Set(); // W5.4 failover: each profile at most once
@@ -1763,6 +1813,10 @@ export class Orchestrator {
                 ...(secretDiffRefusal ? { secret_diff_refusal: secretDiffRefusal } : {}),
                 gates: gates.map((g) => ({ id: g.id, status: g.status })),
                 branch: envelope.branch_name,
+                // Applied facts, not promises: the caller of a delegated run
+                // verifies the confinement it asked for instead of trusting it.
+                // Built by the SAME shape the failure path writes.
+                ...applied,
             },
         }), {
             totalUsd: cost,
@@ -1786,6 +1840,7 @@ export class Orchestrator {
             telemetry,
             ...(secretDiffRefusal ? { secretDiffRefusal } : {}),
             outcomeClass: finalized.outcomeClass,
+            applied,
         };
     }
     interactionChannelFor(input, log, runId, taskId, attemptId, harnessId, 
@@ -2055,6 +2110,9 @@ export class Orchestrator {
             const knobs = this.routeSpecKnobs(slot.routed, contract, downgradeModel ?? undefined, input.effort);
             const effectiveWeb = this.discloseWebUpgrade(log, slot.routed, knobs.webPolicy, slot.attemptId);
             let envelope;
+            // Declared OUTSIDE the try so the catch below can state what the attempt
+            // actually ran under, not merely that it stopped.
+            let harnessHome;
             try {
                 log.emit("harness.started", {
                     harness_id: adapter.id,
@@ -2074,6 +2132,7 @@ export class Orchestrator {
                         requestedSingleCandidate &&
                         slot.routed.implementationTransport !== "git_patch_envelope",
                 });
+                harnessHome = this.harnessHomeFor(wsm, envelope, slot.routed, input);
                 const run = await this.runCandidateInEnvelope(slot.routed, envelope, slot.attemptId, slot.label, contract, input.prompt, store, paths, wsm, ledger, candidateAccess, (ev) => {
                     const safeEv = redactHarnessEvent(ev);
                     safeInvoke(input.onHarnessEvent, safeEv);
@@ -2084,7 +2143,8 @@ export class Orchestrator {
                         return false;
                     budgetStopped = true;
                     return true;
-                }, input, requestedSingleCandidate);
+                }, input, requestedSingleCandidate, // W-C4 deltas: single-candidate chat lane only (racing = noise x N)
+                undefined, undefined, harnessHome);
                 ledger.settle(slot.leaseId, attemptUsageCostSettlement(run.cost, run.costEstimated, run.attemptId, run.harnessId, run.telemetry.authMode, run.telemetry.usageCost));
                 log.emit("harness.completed", {
                     harness_id: adapter.id,
@@ -2160,7 +2220,7 @@ export class Orchestrator {
                                         return false;
                                     budgetStopped = true;
                                     return true;
-                                }, input, requestedSingleCandidate, undefined, packet.pointerLine ?? undefined);
+                                }, input, requestedSingleCandidate, undefined, packet.pointerLine ?? undefined, harnessHome);
                                 ledger.settle(contLeaseId, attemptUsageCostSettlement(contRun.cost, contRun.costEstimated, contRun.attemptId, contRun.harnessId, contRun.telemetry.authMode, contRun.telemetry.usageCost));
                                 log.emit("harness.completed", {
                                     harness_id: adapter.id,
@@ -2206,6 +2266,7 @@ export class Orchestrator {
                 const failureCost = AC.attemptFailureCost(err, "post-stream-error", 0);
                 ledger.settle(slot.leaseId, failureCost.settlement);
                 const message = safeErrorMessage(err);
+                const declared = declaredFailure(err);
                 const infraPhase = envelope === undefined ? "workspace" : "harness";
                 log.emit("harness.completed", {
                     harness_id: adapter.id,
@@ -2214,7 +2275,7 @@ export class Orchestrator {
                     error: message,
                     phase: infraPhase,
                 });
-                store.writeYaml(join(paths.attemptsDir, slot.attemptId, "attempt.yaml"), AC.attemptFailureRecord(slot.attemptId, adapter.id, failureCost, infraPhase, message));
+                store.writeYaml(join(paths.attemptsDir, slot.attemptId, "attempt.yaml"), AC.attemptFailureRecord(slot.attemptId, adapter.id, failureCost, infraPhase, message, appliedAttemptFacts(harnessHome, slot.routed.adapterAccess, this.effectiveProfileId(input, adapter.id))));
                 runsBySlot[slotIdx] = {
                     attemptId: slot.attemptId,
                     harnessId: adapter.id,
@@ -2231,6 +2292,11 @@ export class Orchestrator {
                         slot.routed.delegationRequirement,
                     ], knobs.model),
                     infraPhase,
+                    // Keep a TYPED pre-spawn refusal (spent quota window + its reset)
+                    // alive past this catch; `message` alone would force the terminal to
+                    // read prose back out.
+                    ...(declared.code ? { declaredFailure: declared } : {}),
+                    applied: appliedAttemptFacts(harnessHome, slot.routed.adapterAccess, this.effectiveProfileId(input, adapter.id)),
                 };
             }
             finally {
@@ -2240,6 +2306,9 @@ export class Orchestrator {
         };
         await runBounded(slots, Math.min(slots.length, MAX_PARALLEL_CANDIDATES), runSlot);
         const runs = runsBySlot.filter((r) => r !== undefined);
+        // Fail-closed terminal: a delegated mutating run whose attempts cannot state
+        // their applied confinement refuses instead of passing.
+        assertDelegatedEvidence(input.delegated === true, candidateAccess, runs);
         const cancelledCandidates = () => runs.map((r) => ({
             attemptId: r.attemptId,
             harnessId: r.harnessId,
@@ -2363,15 +2432,21 @@ export class Orchestrator {
             // harness cause (timeout, rate limit, crash, config) gets remediation that
             // fits it, instead of a doomed "Check harness authentication".
             const harnessCategory = dominantHarnessFailureCategory(first.telemetry.transientFailures);
+            // A run speaks with a candidate's TYPED refusal only when EVERY candidate
+            // died of the same one (candidateEvidence owns that rule); mixed causes
+            // keep the honest harness terminal.
+            const unanimous = unanimousDeclaredFailure(runs);
             writeFailure(store, paths, {
                 phase,
-                category: phase === "workspace" ? "project" : "harness_error",
+                category: unanimous?.category ?? (phase === "workspace" ? "project" : "harness_error"),
+                code: unanimous?.code ?? null,
                 harnessId: first.harnessId,
                 attemptId: first.attemptId,
                 safeMessage: rootCause,
                 rawDetailRef: `attempts/${first.attemptId}/attempt.yaml`,
                 eventRefs: existingEventRefs,
                 runDir: paths.root,
+                resetsAt: unanimous?.resetsAt ?? null,
                 nextActions: first.secretDiffRefusal
                     ? secretDiff.secretDiffNextActions(first.secretDiffRefusal)
                     : phase === "workspace"
@@ -2483,11 +2558,12 @@ export class Orchestrator {
                         dirtyPolicy: "snapshot",
                         accessProfile: candidateAccess,
                     });
+                    const synthHome = this.harnessHomeFor(wsm, envelope, synthRouted, input);
                     const run = await this.runCandidateInEnvelope(synthRouted, envelope, "synth", "Synthesis", contract, synthesisInput.prompt, store, paths, wsm, ledger, candidateAccess, (ev) => {
                         const safeEv = redactHarnessEvent(ev);
                         safeInvoke(input.onHarnessEvent, safeEv);
                         log.emit("harness.event", harnessEventPayload(synthAdapter.id, "synth", safeEv));
-                    }, input.signal, undefined, input.effort, "synthesize", log, effectiveWeb, this.interactionChannelFor(input, log, runId, taskId, "synth", synthAdapter.id, synthRouted.supportsInteractive), undefined, input, false, synthesisInput.content);
+                    }, input.signal, undefined, input.effort, "synthesize", log, effectiveWeb, this.interactionChannelFor(input, log, runId, taskId, "synth", synthAdapter.id, synthRouted.supportsInteractive), undefined, input, false, synthesisInput.content, undefined, synthHome);
                     ledger.settle(lease.lease?.lease_id ?? "", attemptUsageCostSettlement(run.cost, run.costEstimated, run.attemptId, run.harnessId, run.telemetry.authMode, run.telemetry.usageCost));
                     reviewEnvelopes.push(envelope);
                     envelope = undefined;
@@ -3329,7 +3405,9 @@ export class Orchestrator {
                 const knobs = this.routeSpecKnobs(routed, contract, undefined, input.effort);
                 const effectiveWeb = this.discloseWebUpgrade(log, routed, knobs.webPolicy, attemptId);
                 let run;
+                let harnessHome;
                 try {
+                    harnessHome = this.harnessHomeFor(wsm, envelope, routed, input);
                     log.emit("harness.started", {
                         harness_id: adapter.id,
                         attempt_id: attemptId,
@@ -3343,7 +3421,8 @@ export class Orchestrator {
                     }, input.signal, undefined, input.effort, "repair", log, effectiveWeb, this.interactionChannelFor(input, log, runId, taskId, attemptId, adapter.id, routed.supportsInteractive), (streamedUsd) => {
                         ledger.updateHold(lease.lease?.lease_id ?? "", streamedUsd);
                         return ledger.tier() === "hard";
-                    }, input, true);
+                    }, input, true, // convergence runs one candidate: live deltas on (W-C4)
+                    undefined, undefined, harnessHome);
                     ledger.settle(lease.lease?.lease_id ?? "", attemptUsageCostSettlement(run.cost, run.costEstimated, run.attemptId, run.harnessId, run.telemetry.authMode, run.telemetry.usageCost));
                     log.emit("harness.completed", {
                         harness_id: adapter.id,
@@ -3366,8 +3445,9 @@ export class Orchestrator {
                         status: "failed",
                         error: message,
                     });
-                    store.writeYaml(join(paths.attemptsDir, attemptId, "attempt.yaml"), AC.attemptFailureRecord(attemptId, adapter.id, failureCost, "harness", message));
+                    store.writeYaml(join(paths.attemptsDir, attemptId, "attempt.yaml"), AC.attemptFailureRecord(attemptId, adapter.id, failureCost, "harness", message, appliedAttemptFacts(harnessHome, routed.adapterAccess, this.effectiveProfileId(input, adapter.id))));
                     run = {
+                        applied: appliedAttemptFacts(harnessHome, routed.adapterAccess, this.effectiveProfileId(input, adapter.id)),
                         attemptId,
                         harnessId: adapter.id,
                         label: `Attempt ${attempt}`,
@@ -3381,6 +3461,9 @@ export class Orchestrator {
                     };
                 }
                 lastRun = run;
+                // Fail-closed twin of the candidate lane's gate: this loop terminalizes
+                // per attempt, so the proof is spent per attempt.
+                assertDelegatedEvidence(input.delegated === true, convergenceAccess, [run]);
                 attemptTelemetries.push({ attemptId, harnessId: adapter.id, telemetry: run.telemetry });
                 // Cancellation/deadline keeps priority over a belt failure finalized concurrently.
                 if (input.signal?.aborted)