@davesheffer/hunch 1.8.3 → 1.9.2

package/dist/constitution/experimentRunner.js

@@ -1,10 +1,14 @@
 import { execFileSync, spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import { existsSync, mkdtempSync, readFileSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { isAbsolute, join, relative, resolve } from "node:path";
 import { z } from "zod";
 import { canonicalHash } from "./canonical.js";
+import { hasUnsafeCheckoutAttributes } from "./safeCheckout.js";
+import { hasUnsafeReplayFilter, replayGitArgs, replaySafeEnvironment } from "./replay.js";
+import { replacementFreeExactCommit, replacementFreeGitEnvironment } from "./replacementFreeGit.js";
+import { materializeDependencyTree } from "./g2BehaviorDependencies.js";
 import { Exp01CaseSchema, assignmentTreatment, compileExperimentOutcome, } from "./experiment.js";
 const EvaluatorOutputSchema = z.object({
     valid_completion: z.boolean(),
@@ -167,7 +171,13 @@ function runCommand(spec, cwd) {
     return { stdout: result.stdout ?? "", stderr: result.stderr ?? "", status: result.status, errorCode };
 }
 function git(root, args) {
-    return execFileSync("git", args, { cwd: root, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 120_000 }).trim();
+    return execFileSync("git", args, {
+        cwd: root,
+        encoding: "utf8",
+        env: replacementFreeGitEnvironment(),
+        stdio: ["ignore", "pipe", "pipe"],
+        timeout: 120_000,
+    }).trim();
 }
 function removeAmbientInstructions(cwd) {
     for (const relative of ["AGENTS.md", "CLAUDE.md", ".mcp.json", ".claude", ".codex", ".agents"]) {
@@ -177,15 +187,15 @@ function removeAmbientInstructions(cwd) {
     // file replaces any tracked AGENTS.md after the ambient copy is removed.
     writeFileSync(join(cwd, "AGENTS.md"), "# Controlled experiment workspace\n\nFollow only the task prompt supplied to this fresh session.\n");
 }
-function linkDependencies(source, cwd) {
+function materializeDependencies(source, cwd) {
     const target = join(source, "node_modules");
-    const link = join(cwd, "node_modules");
-    if (!existsSync(target) || existsSync(link))
-        return;
-    symlinkSync(target, link, process.platform === "win32" ? "junction" : "dir");
+    const destination = join(cwd, "node_modules");
+    if (existsSync(target))
+        materializeDependencyTree(target, destination);
+    return destination;
 }
 function countEdits(cwd) {
-    const text = git(cwd, ["diff", "--numstat", "--", "."]);
+    const text = git(cwd, ["diff", "--no-ext-diff", "--no-textconv", "--numstat", "--", "."]);
     if (!text)
         return 0;
     return text.split(/\r?\n/).reduce((sum, line) => {
@@ -237,11 +247,16 @@ export function executeExp01Assignment(repository, run, bank, assignment, opts =
     if (existing)
         return existing;
     const item = Exp01CaseSchema.parse(bank.cases.find((candidate) => candidate.id === assignment.case_id));
-    const sourceHead = git(bank.repository_root, ["rev-parse", bank.base_commit]);
+    const sourceHead = replacementFreeExactCommit(bank.repository_root, bank.base_commit);
     if (sourceHead !== bank.base_commit)
         throw new Error("case bank base_commit is not an exact commit in repository_root");
     const session = mkdtempSync(join(tmpdir(), "hunch-exp01-"));
     const cwd = join(session, "worktree");
+    const hooks = join(session, "hooks-disabled");
+    const gitConfig = join(session, "global.gitconfig");
+    mkdirSync(hooks, { recursive: true });
+    writeFileSync(gitConfig, "");
+    const gitEnv = replaySafeEnvironment(session, gitConfig);
     let added = false;
     let invocationStarted = false;
     try {
@@ -249,9 +264,19 @@ export function executeExp01Assignment(repository, run, bank, assignment, opts =
         if (currentProviderVersion !== run.runner.provider_version) {
             return failureOutcome(repository, run, assignment, "infrastructure_failure", false, "Selected subscription CLI version drifted after assignment; assignment was excluded before model invocation.", "provider-version-drift", { evaluator: canonicalHash({ expected: run.runner.provider_version, actual: currentProviderVersion }) }, opts.now);
         }
-        execFileSync("git", ["worktree", "add", "--detach", cwd, bank.base_commit], { cwd: bank.repository_root, stdio: ["ignore", "pipe", "pipe"], timeout: 120_000 });
+        if (hasUnsafeReplayFilter(bank.repository_root, gitEnv)) {
+            return failureOutcome(repository, run, assignment, "infrastructure_failure", false, "Repository-local Git content filters make the controlled checkout unsafe.", "unsafe-local-filter-config", {}, opts.now);
+        }
+        if (hasUnsafeCheckoutAttributes(bank.repository_root, bank.base_commit, gitEnv, { allowDisabledLfs: true })) {
+            return failureOutcome(repository, run, assignment, "infrastructure_failure", false, "Git checkout attributes could transform or execute content outside the locked case bytes.", "unsafe-checkout-attributes", {}, opts.now);
+        }
+        execFileSync("git", replayGitArgs(bank.repository_root, hooks, ["worktree", "add", "--detach", "--force", cwd, bank.base_commit]), {
+            env: gitEnv,
+            stdio: ["ignore", "pipe", "pipe"],
+            timeout: 120_000,
+        });
         added = true;
-        linkDependencies(bank.repository_root, cwd);
+        const dependencyRoot = materializeDependencies(bank.repository_root, cwd);
         removeAmbientInstructions(cwd);
         if (item.setup) {
             if (!isAbsolute(item.setup.artifact) || !existsSync(item.setup.artifact) || externalArtifactHash(item.setup.artifact) !== item.setup.artifact_hash) {
@@ -271,9 +296,9 @@ export function executeExp01Assignment(repository, run, bank, assignment, opts =
         }
         const treatment = assignmentTreatment(bank, run, assignment);
         invocationStarted = true;
-        const agent = invokeAgent(run, cwd, controlledPrompt(treatment), opts.timeoutMs ?? 30 * 60 * 1000, join(bank.repository_root, "node_modules"));
+        const agent = invokeAgent(run, cwd, controlledPrompt(treatment), opts.timeoutMs ?? 30 * 60 * 1000, dependencyRoot);
         const outputHash = canonicalHash(agent.stdout);
-        const diff = git(cwd, ["diff", "--binary", "--", "."]);
+        const diff = git(cwd, ["diff", "--no-ext-diff", "--no-textconv", "--binary", "--", "."]);
         const diffHash = canonicalHash(diff);
         if (agent.errorCode) {
             return failureOutcome(repository, run, assignment, "invalid_completion", true, "Subscription CLI did not produce a successful terminal run; outcome remains visible and unscored.", agent.errorCode, { output: outputHash, diff: diffHash }, opts.now);
@@ -333,7 +358,11 @@ export function executeExp01Assignment(repository, run, bank, assignment, opts =
     finally {
         try {
             if (added)
-                execFileSync("git", ["worktree", "remove", "--force", cwd], { cwd: bank.repository_root, stdio: "ignore", timeout: 120_000 });
+                execFileSync("git", replayGitArgs(bank.repository_root, hooks, ["worktree", "remove", "--force", cwd]), {
+                    env: gitEnv,
+                    stdio: "ignore",
+                    timeout: 120_000,
+                });
         }
         catch {
             // The assignment outcome already records any execution failure; prune is best effort.

package/dist/constitution/g2BehaviorCandidates.js

@@ -1,15 +1,17 @@
 import { execFileSync, spawnSync } from "node:child_process";
-import { existsSync, mkdirSync, mkdtempSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, isAbsolute, join } from "node:path";
 import { pathToFileURL } from "node:url";
 import { shortHash } from "../core/ids.js";
+import { compareCodeUnits } from "../core/canonicalOrder.js";
 import { loadNativeTreeSitter } from "../extractors/nativeTreeSitter.js";
-import { commitMeta, revExists } from "../extractors/git.js";
 import { canonicalHash } from "./canonical.js";
 import { buildG2CandidateReview, positiveBound, } from "./g2Candidates.js";
 import { cleanupReplayWorktree, hasUnsafeReplayFilter, replayGitArgs, replaySafeEnvironment, } from "./replay.js";
-import { dependencySnapshotForCommit } from "./g2BehaviorDependencies.js";
+import { dependencySnapshotForCommit, materializeDependencySnapshot } from "./g2BehaviorDependencies.js";
+import { hasUnsafeCheckoutAttributes } from "./safeCheckout.js";
+import { replacementFreeCommitFiles, replacementFreeExactCommit, replacementFreeGitEnvironment, } from "./replacementFreeGit.js";
 import { NODE_TEST_REPORTER_SOURCE, exactNodeTestPattern, nodeTestIsolationFlag, nodeTestReporterEvents, } from "./nodeTestEvidence.js";
 const TEST_FILE = /\.(?:test|spec)\.(?:[cm]?[jt]sx?)$/;
 const FULL_SHA = /^[a-f0-9]{40}$/;
@@ -38,6 +40,7 @@ function fileAt(root, commit, file) {
     try {
         return execFileSync("git", ["-C", root, "show", `${commit}:${file}`], {
             encoding: "utf8",
+            env: replacementFreeGitEnvironment(),
             maxBuffer: 10 * 1024 * 1024,
             stdio: ["ignore", "pipe", "ignore"],
         });
@@ -203,8 +206,9 @@ function literalNodeTestCases(file, source) {
 function addedLineNumbers(root, knownBad, knownGood, file) {
     let diff;
     try {
-        diff = execFileSync("git", ["-C", root, "diff", "--unified=0", "--no-ext-diff", knownBad, knownGood, "--", file], {
+        diff = execFileSync("git", ["-C", root, "diff", "--unified=0", "--no-ext-diff", "--no-textconv", knownBad, knownGood, "--", file], {
             encoding: "utf8",
+            env: replacementFreeGitEnvironment(),
             maxBuffer: 10 * 1024 * 1024,
             stdio: ["ignore", "pipe", "ignore"],
         });
@@ -271,13 +275,28 @@ function currentHumanDecision(store, decisionId) {
 }
 function directDecisionCommit(store, root, decisionId) {
     const decision = currentHumanDecision(store, decisionId);
-    const meta = commitMeta(decision.commit, root);
-    if (!meta)
+    const sha = replacementFreeExactCommit(root, decision.commit);
+    if (!sha || !FULL_SHA.test(sha))
         throw new Error(`G2 behavior decision ${decisionId} fixing commit is unavailable`);
+    let subject;
+    let date;
+    try {
+        const raw = execFileSync("git", ["-C", root, "show", "-s", "--format=%s%x00%aI", sha], {
+            encoding: "utf8",
+            env: replacementFreeGitEnvironment(),
+            maxBuffer: 10 * 1024 * 1024,
+            stdio: ["ignore", "pipe", "ignore"],
+        }).trimEnd();
+        [subject = "", date = ""] = raw.split("\0");
+    }
+    catch {
+        throw new Error(`G2 behavior decision ${decisionId} fixing commit metadata is unavailable`);
+    }
     let knownBad;
     try {
-        knownBad = execFileSync("git", ["-C", root, "rev-parse", `${meta.sha}^`], {
+        knownBad = execFileSync("git", ["-C", root, "rev-parse", `${sha}^`], {
             encoding: "utf8",
+            env: replacementFreeGitEnvironment(),
             stdio: ["ignore", "pipe", "ignore"],
         }).trim();
     }
@@ -287,10 +306,10 @@ function directDecisionCommit(store, root, decisionId) {
     if (!FULL_SHA.test(knownBad))
         throw new Error(`G2 behavior decision ${decisionId} first parent is invalid`);
     return {
-        commit: meta.sha,
-        subject: meta.subject,
-        date: meta.date,
-        changedFiles: new Set(meta.files),
+        commit: sha,
+        subject,
+        date,
+        changedFiles: new Set(replacementFreeCommitFiles(root, sha)),
         decisionId: decision.id,
         knownBad,
         groundingHash: canonicalHash(decision),
@@ -360,7 +379,7 @@ function directDecisionReview(store, root, opts, behaviorResolutions, since, max
         if (resolution)
             candidate.human_review = resolution;
     }
-    candidates.sort((left, right) => left.test.file.localeCompare(right.test.file) || left.test.name.localeCompare(right.test.name));
+    candidates.sort((left, right) => compareCodeUnits(left.test.file, right.test.file) || compareCodeUnits(left.test.name, right.test.name));
     const items = candidates.slice(0, limit);
     const reviewCounts = candidates.some((candidate) => candidate.human_review !== undefined) ? {
         selected_candidates: candidates.filter((candidate) => candidate.human_review?.disposition === "selected").length,
@@ -425,9 +444,9 @@ export function buildG2BehaviorCandidateReview(store, root, opts = {}, resolutio
     const candidates = [];
     const failures = [];
     const withoutTests = [];
-    for (const commit of [...commits.values()].sort((left, right) => left.commit.localeCompare(right.commit))) {
+    for (const commit of [...commits.values()].sort((left, right) => compareCodeUnits(left.commit, right.commit))) {
         let found = false;
-        for (const file of [...commit.changedFiles].filter(safeTestFile).sort()) {
+        for (const file of [...commit.changedFiles].filter(safeTestFile).sort(compareCodeUnits)) {
             const after = fileAt(root, commit.commit, file);
             if (after == null) {
                 failures.push({ commit: commit.commit, file, error: "known-good test source unavailable" });
@@ -447,9 +466,9 @@ export function buildG2BehaviorCandidateReview(store, root, opts = {}, resolutio
                     statement: name,
                     test: { file, name, source_hash: sourceHash },
                     runner: runnerFor(file, name),
-                    decision_ids: [...commit.decisionIds].sort(),
-                    source_candidate_ids: [...commit.sourceCandidateIds].sort(),
-                    source_attestation_ids: [...commit.sourceAttestationIds].sort(),
+                    decision_ids: [...commit.decisionIds].sort(compareCodeUnits),
+                    source_candidate_ids: [...commit.sourceCandidateIds].sort(compareCodeUnits),
+                    source_attestation_ids: [...commit.sourceAttestationIds].sort(compareCodeUnits),
                     proposed_corpus: {
                         known_bad: { ref: commit.knownBad, expected: "failed" },
                         known_good: { ref: commit.commit, expected: "passed" },
@@ -471,10 +490,10 @@ export function buildG2BehaviorCandidateReview(store, root, opts = {}, resolutio
         if (resolution)
             candidate.human_review = resolution;
     }
-    candidates.sort((left, right) => right.commit_date.localeCompare(left.commit_date)
-        || left.commit.localeCompare(right.commit)
-        || left.test.file.localeCompare(right.test.file)
-        || left.test.name.localeCompare(right.test.name));
+    candidates.sort((left, right) => compareCodeUnits(right.commit_date, left.commit_date)
+        || compareCodeUnits(left.commit, right.commit)
+        || compareCodeUnits(left.test.file, right.test.file)
+        || compareCodeUnits(left.test.name, right.test.name));
     const items = candidates.slice(0, limit);
     const reviewCounts = candidates.some((candidate) => candidate.human_review !== undefined) ? {
         selected_candidates: candidates.filter((candidate) => candidate.human_review?.disposition === "selected").length,
@@ -490,8 +509,8 @@ export function buildG2BehaviorCandidateReview(store, root, opts = {}, resolutio
         candidate_commits: commits.size,
         behavior_candidates: candidates.length,
         ...reviewCounts,
-        commits_without_added_tests: withoutTests.sort(),
-        extraction_failures: failures.sort((left, right) => left.commit.localeCompare(right.commit) || left.file.localeCompare(right.file)),
+        commits_without_added_tests: withoutTests.sort(compareCodeUnits),
+        extraction_failures: failures.sort((left, right) => compareCodeUnits(left.commit, right.commit) || compareCodeUnits(left.file, right.file)),
         items,
         has_more: candidates.length > items.length,
         limitations: LIMITATIONS,
@@ -523,12 +542,16 @@ export function nodeTestInfrastructureError(output) {
     return null;
 }
 function runLeg(root, session, hooks, env, candidate, commit, expected, source, budgetMs) {
-    if (!FULL_SHA.test(commit) || !revExists(commit, root))
+    if (!FULL_SHA.test(commit) || replacementFreeExactCommit(root, commit) !== commit)
         return errorLeg(commit, expected, "commit-ref-unresolved");
     const run = mkdtempSync(join(session, `${expected}-`));
     const checkout = join(run, "checkout");
     const dependencySnapshot = dependencySnapshotForCommit(root, commit);
     const dependencySnapshotId = dependencySnapshot?.snapshot.id;
+    if (hasUnsafeCheckoutAttributes(root, commit, env, { allowDisabledLfs: true })) {
+        rmSync(run, { recursive: true, force: true });
+        return errorLeg(commit, expected, "unsafe-checkout-attributes", dependencySnapshotId);
+    }
     let added = false;
     let leg;
     try {
@@ -539,7 +562,7 @@ function runLeg(root, session, hooks, env, candidate, commit, expected, source,
         });
         added = true;
         if (dependencySnapshot) {
-            symlinkSync(dependencySnapshot.nodeModules, join(checkout, "node_modules"), process.platform === "win32" ? "junction" : "dir");
+            materializeDependencySnapshot(dependencySnapshot, join(checkout, "node_modules"));
         }
         const testFile = join(checkout, candidate.test.file);
         mkdirSync(dirname(testFile), { recursive: true });
@@ -565,7 +588,7 @@ function runLeg(root, session, hooks, env, candidate, commit, expected, source,
             args = testArgs;
         }
         else {
-            const tsx = dependencySnapshot ? join(dependencySnapshot.nodeModules, "tsx", "dist", "cli.mjs") : "";
+            const tsx = dependencySnapshot ? join(checkout, "node_modules", "tsx", "dist", "cli.mjs") : "";
             args = existsSync(tsx) ? [tsx, ...testArgs] : null;
         }
         if (!args) {

package/dist/constitution/g2BehaviorDependencies.js

@@ -1,22 +1,207 @@
 import { execFileSync, spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync, } from "node:fs";
-import { basename, join } from "node:path";
+import { chmodSync, closeSync, constants as fsConstants, copyFileSync, existsSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readlinkSync, readSync, readdirSync, realpathSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync, } from "node:fs";
+import { basename, dirname, isAbsolute, join, resolve, sep } from "node:path";
+import { TextDecoder } from "node:util";
 import { shortHash } from "../core/ids.js";
+import { compareCodeUnits } from "../core/canonicalOrder.js";
 import { canonicalHash, canonicalJson } from "./canonical.js";
 import { replaySafeEnvironment } from "./replay.js";
+import { replacementFreeExactCommit, replacementFreeGitEnvironment } from "./replacementFreeGit.js";
 const FULL_SHA = /^[a-f0-9]{40}$/;
 const PACKAGE_NAME = /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/i;
-const SNAPSHOT_VERSION = 1;
+// v1 bound only the installed lock and native binaries. Including the version
+// in SnapshotInput makes those caches ineligible and provisions a fresh v2 tree.
+const SNAPSHOT_VERSION = 2;
+const TREE_HASH_VERSION = "hunch-node-modules-tree-v1";
+const HASH_BUFFER_BYTES = 64 * 1024;
+const UTF8_DECODER = new TextDecoder("utf-8", { fatal: true });
 function sha256(value) {
     return `sha256:${createHash("sha256").update(value).digest("hex")}`;
 }
-function gitFile(root, commit, file) {
-    if (!FULL_SHA.test(commit))
-        throw new Error(`dependency snapshot commit ${commit} is not a full SHA`);
+function fileSha256(file) {
+    const hash = createHash("sha256");
+    const buffer = Buffer.allocUnsafe(HASH_BUFFER_BYTES);
+    const fd = openSync(file, "r");
+    try {
+        for (let bytes = readSync(fd, buffer, 0, buffer.length, null); bytes > 0; bytes = readSync(fd, buffer, 0, buffer.length, null)) {
+            hash.update(buffer.subarray(0, bytes));
+        }
+    }
+    finally {
+        closeSync(fd);
+    }
+    return `sha256:${hash.digest("hex")}`;
+}
+function hashField(hash, value) {
+    const bytes = typeof value === "string" ? Buffer.from(value, "utf8") : value;
+    const length = Buffer.allocUnsafe(8);
+    length.writeBigUInt64BE(BigInt(bytes.length));
+    hash.update(length);
+    hash.update(bytes);
+}
+function safeEntryName(name) {
+    if (!name || name === "." || name === ".." || name.includes("\0") || name.includes("/") || (sep === "\\" && name.includes("\\"))) {
+        throw new Error("dependency snapshot contains an unsafe filesystem entry name");
+    }
+    return name;
+}
+function symlinkTarget(link) {
+    const raw = readlinkSync(link, { encoding: "buffer" });
+    try {
+        return UTF8_DECODER.decode(raw);
+    }
+    catch {
+        throw new Error("dependency snapshot contains a non-UTF-8 symlink target");
+    }
+}
+function inside(root, target) {
+    return target === root || target.startsWith(`${root}${sep}`);
+}
+function safeInternalSymlink(root, link, target) {
+    if (!target || target.includes("\0") || isAbsolute(target)) {
+        throw new Error("dependency snapshot contains an absolute or empty symlink target");
+    }
+    const lexicalRoot = resolve(root);
+    const lexicalTarget = resolve(dirname(link), target);
+    if (!inside(lexicalRoot, lexicalTarget)) {
+        throw new Error("dependency snapshot contains an escaping symlink target");
+    }
+    const realRoot = realpathSync(root);
+    const realTarget = realpathSync(lexicalTarget);
+    if (!inside(realRoot, realTarget)) {
+        throw new Error("dependency snapshot contains a symlink target outside node_modules");
+    }
+    const targetStat = statSync(link);
+    if (targetStat.isFile())
+        return "file";
+    if (targetStat.isDirectory())
+        return "dir";
+    throw new Error("dependency snapshot symlink resolves to a special filesystem entry");
+}
+function treeEntries(dir) {
+    return readdirSync(dir, { encoding: "buffer" })
+        .sort((left, right) => Buffer.compare(left, right))
+        .map((raw) => {
+        let name;
+        try {
+            name = UTF8_DECODER.decode(raw);
+        }
+        catch {
+            throw new Error("dependency snapshot contains a non-UTF-8 filesystem entry name");
+        }
+        return safeEntryName(name);
+    });
+}
+function treeRecord(hash, relative, kind, mode, payload = "") {
+    hashField(hash, relative);
+    hashField(hash, kind);
+    hashField(hash, (mode & 0o7777).toString(8).padStart(4, "0"));
+    hashField(hash, payload);
+}
+/** Hash every directory, regular file, executable bit, and internal symlink in
+ * a dependency tree. Traversal uses raw UTF-8 byte ordering rather than the
+ * host locale, and rejects filesystem shapes that cannot be copied safely. */
+export function dependencySnapshotTreeHash(nodeModules) {
+    const rootStat = lstatSync(nodeModules);
+    if (!rootStat.isDirectory() || rootStat.isSymbolicLink()) {
+        throw new Error("dependency snapshot node_modules root is not a real directory");
+    }
+    const hash = createHash("sha256");
+    hashField(hash, TREE_HASH_VERSION);
+    treeRecord(hash, "", "directory", rootStat.mode);
+    const walk = (dir, relative) => {
+        for (const name of treeEntries(dir)) {
+            const absolute = join(dir, name);
+            const next = relative ? `${relative}/${name}` : name;
+            const stat = lstatSync(absolute);
+            if (stat.isSymbolicLink()) {
+                const target = symlinkTarget(absolute);
+                safeInternalSymlink(nodeModules, absolute, target);
+                treeRecord(hash, next, "symlink", stat.mode, target);
+            }
+            else if (stat.isDirectory()) {
+                treeRecord(hash, next, "directory", stat.mode);
+                walk(absolute, next);
+            }
+            else if (stat.isFile()) {
+                treeRecord(hash, next, "file", stat.mode, fileSha256(absolute));
+            }
+            else {
+                throw new Error(`dependency snapshot contains special filesystem entry ${next}`);
+            }
+        }
+    };
+    walk(nodeModules, "");
+    return `sha256:${hash.digest("hex")}`;
+}
+function copyDependencyTree(source, destination) {
+    const copyDirectory = (sourceDir, destinationDir) => {
+        const sourceStat = lstatSync(sourceDir);
+        if (!sourceStat.isDirectory() || sourceStat.isSymbolicLink()) {
+            throw new Error("dependency snapshot copy source is not a real directory");
+        }
+        mkdirSync(destinationDir, { mode: sourceStat.mode & 0o7777 });
+        for (const name of treeEntries(sourceDir)) {
+            const sourceEntry = join(sourceDir, name);
+            const destinationEntry = join(destinationDir, name);
+            const stat = lstatSync(sourceEntry);
+            if (stat.isSymbolicLink()) {
+                const target = symlinkTarget(sourceEntry);
+                const targetType = safeInternalSymlink(source, sourceEntry, target);
+                symlinkSync(target, destinationEntry, process.platform === "win32" ? targetType : undefined);
+            }
+            else if (stat.isDirectory()) {
+                copyDirectory(sourceEntry, destinationEntry);
+            }
+            else if (stat.isFile()) {
+                copyFileSync(sourceEntry, destinationEntry, fsConstants.COPYFILE_FICLONE);
+                chmodSync(destinationEntry, stat.mode & 0o7777);
+            }
+            else {
+                throw new Error("dependency snapshot contains a special filesystem entry");
+            }
+        }
+        chmodSync(destinationDir, sourceStat.mode & 0o7777);
+    };
+    copyDirectory(source, destination);
+}
+/** Create one independently writable dependency tree. COPYFILE_FICLONE is a
+ * copy-on-write optimization where supported, never a shared hardlink; the
+ * byte-copy fallback has the same isolation. Pre/post hashes bind the copy. */
+export function materializeDependencyTree(source, destination, opts = {}) {
+    if (existsSync(destination))
+        throw new Error("dependency snapshot destination already exists");
+    const sourceHash = dependencySnapshotTreeHash(source);
+    if (opts.expectedHash && sourceHash !== opts.expectedHash) {
+        throw new Error("dependency tree hash mismatch before materialization");
+    }
+    try {
+        copyDependencyTree(source, destination);
+        if (dependencySnapshotTreeHash(destination) !== sourceHash) {
+            throw new Error("dependency tree hash mismatch after materialization");
+        }
+        return sourceHash;
+    }
+    catch (error) {
+        rmSync(destination, { recursive: true, force: true });
+        throw error;
+    }
+}
+/** Materialize a private writable dependency tree for one disposable run. */
+export function materializeDependencySnapshot(dependency, destination) {
+    materializeDependencyTree(dependency.nodeModules, destination, {
+        expectedHash: dependency.snapshot.node_modules_hash,
+    });
+}
+function gitFile(root, commit, file, env) {
+    if (!FULL_SHA.test(commit) || replacementFreeExactCommit(root, commit) !== commit) {
+        throw new Error(`dependency snapshot commit ${commit} is not one exact commit`);
+    }
     try {
         return execFileSync("git", ["-C", root, "show", `${commit}:${file}`], {
             encoding: "utf8",
+            env: replacementFreeGitEnvironment(env),
             maxBuffer: 20 * 1024 * 1024,
             stdio: ["ignore", "pipe", "ignore"],
         });
@@ -62,7 +247,7 @@ function lockedPackageNames(lock) {
     return names;
 }
 function normalizeAllowlist(values, lock) {
-    const result = [...new Set(values.map((value) => value.trim()).filter(Boolean))].sort();
+    const result = [...new Set(values.map((value) => value.trim()).filter(Boolean))].sort(compareCodeUnits);
     const locked = lockedPackageNames(lock);
     for (const name of result) {
         if (!PACKAGE_NAME.test(name))
@@ -104,8 +289,8 @@ function runtimeIdentity(env) {
     return { node: process.version, npm: result.stdout.trim(), platform: process.platform, arch: process.arch };
 }
 function snapshotInput(root, commit, allowInstallScripts, env) {
-    const packageJson = gitFile(root, commit, "package.json");
-    const packageLock = gitFile(root, commit, "package-lock.json");
+    const packageJson = gitFile(root, commit, "package.json", env);
+    const packageLock = gitFile(root, commit, "package-lock.json", env);
     const pkg = parseObject(packageJson, "package.json");
     const lock = parseObject(packageLock, "package-lock.json");
     if (lock.lockfileVersion !== 2 && lock.lockfileVersion !== 3) {
@@ -139,7 +324,7 @@ function snapshotInput(root, commit, allowInstallScripts, env) {
 function nativeInventory(nodeModules) {
     const files = [];
     const walk = (dir, relative) => {
-        for (const entry of readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+        for (const entry of readdirSync(dir, { withFileTypes: true }).sort((a, b) => compareCodeUnits(a.name, b.name))) {
             const absolute = join(dir, entry.name);
             const next = relative ? `${relative}/${entry.name}` : entry.name;
             if (entry.isSymbolicLink())
@@ -171,6 +356,8 @@ function readSnapshot(dir) {
         const installedLock = join(nodeModules, ".package-lock.json");
         if (!existsSync(nodeModules) || !lstatSync(nodeModules).isDirectory())
             return null;
+        if (dependencySnapshotTreeHash(nodeModules) !== value.node_modules_hash)
+            return null;
         const installedLockHash = existsSync(installedLock) ? sha256(readFileSync(installedLock)) : sha256("");
         if (installedLockHash !== value.installed_lock_hash)
             return null;
@@ -232,6 +419,7 @@ function buildSnapshot(base, input, env, timeoutMs) {
         const nodeModules = join(work, "node_modules");
         const installedLock = join(nodeModules, ".package-lock.json");
         mkdirSync(nodeModules, { recursive: true });
+        const nodeModulesHash = dependencySnapshotTreeHash(nodeModules);
         const body = {
             input_hash: input.inputHash,
             package_json_hash: input.packageJsonHash,
@@ -242,6 +430,7 @@ function buildSnapshot(base, input, env, timeoutMs) {
             allow_install_scripts: input.allowInstallScripts,
             installed_lock_hash: existsSync(installedLock) ? sha256(readFileSync(installedLock)) : sha256(""),
             native_binaries: nativeInventory(nodeModules),
+            node_modules_hash: nodeModulesHash,
             format_version: SNAPSHOT_VERSION,
             data_class: "private",
             authority: "none",
@@ -298,8 +487,8 @@ export function dependencySnapshotForCommit(root, commit, allowedIds) {
     let packageJson;
     let packageLock;
     try {
-        packageJson = gitFile(root, commit, "package.json");
-        packageLock = gitFile(root, commit, "package-lock.json");
+        packageJson = gitFile(root, commit, "package.json", env);
+        packageLock = gitFile(root, commit, "package-lock.json", env);
     }
     catch {
         return null;
@@ -343,7 +532,7 @@ export function provisionG2BehaviorDependencySnapshotsForCommits(root, commits,
         });
         return {
             snapshots: [...new Map([...byInput.values()].map((snapshot) => [snapshot.id, snapshot])).values()]
-                .sort((left, right) => left.id.localeCompare(right.id)),
+                .sort((left, right) => compareCodeUnits(left.id, right.id)),
             commits: mapped,
         };
     }
@@ -367,7 +556,7 @@ export function provisionG2BehaviorDependencySnapshots(root, report, candidate,
             known_bad: { commit: candidate.proposed_corpus.known_bad.ref, dependency_snapshot_id: bad.dependency_snapshot_id },
             known_good: { commit: candidate.proposed_corpus.known_good.ref, dependency_snapshot_id: good.dependency_snapshot_id },
         },
-        allow_install_scripts: [...new Set(allowInstallScripts.map((value) => value.trim()).filter(Boolean))].sort(),
+        allow_install_scripts: [...new Set(allowInstallScripts.map((value) => value.trim()).filter(Boolean))].sort(compareCodeUnits),
         data_class: "private",
         authority: "none",
         effects: "cache_only",

package/dist/constitution/g2Candidates.js

@@ -77,7 +77,7 @@ export function buildG2CandidateReview(store, root, opts = {}, resolutions = [])
     const graphStore = new HunchStore(hunchPathsForDir(scratchRoot));
     try {
         graphStore.json.ensureDirs();
-        indexRepo(graphStore, root, { churn: false });
+        indexRepo(graphStore, root, { churn: false, requireComplete: true });
         return buildFromIndexedGraph(store, graphStore, root, opts, resolutions);
     }
     finally {

package/dist/constitution/lifecycle.js

@@ -24,11 +24,25 @@ export function blockingEvidenceError(proof, dispositions = []) {
     return assessHistoryDispositions(proof, dispositions).blocking_error;
 }
 const proofRank = { P0: 0, P1: 1, P2: 2, P3: 3, P4: 4, P5: 5 };
+/** Activation is a runtime property, not merely an approval-time check. The
+ * audit fallback keeps correction policies compiled before `origin` was added
+ * fail-closed after they are loaded by the current schema. */
+export function activationGateError(policy) {
+    const isMd1Correction = policy.origin === "correction_md1a"
+        || policy.audit.some((event) => event.action === "compiled" && event.actor === "hunch:correction-policy-materializer");
+    if (isMd1Correction && policy.activation_gate?.status !== "blocked") {
+        return "MD-1a correction policy is missing its required source-currentness activation gate";
+    }
+    return policy.activation_gate?.status === "blocked" ? policy.activation_gate.reason : null;
+}
 /** Rechecked on every blocking evaluation; a hand-edited lifecycle flag without
  * a current P3 proof is a configuration error, never authority. */
 export function blockingProofError(policy, proof, dispositions = [], composition = [], currentBehaviorAttestations = []) {
     if (policy.state !== "active_blocking")
         return null;
+    const activationError = activationGateError(policy);
+    if (activationError)
+        return activationError;
     if (policy.authority?.kind !== "human")
         return "active blocking policy has no human authority event";
     const behaviorAttestationError = executableBehaviorAttestationError(policy, currentBehaviorAttestations);
@@ -95,6 +109,9 @@ export function proposeProvedPolicy(policy, proof, at, composition = [], current
     };
 }
 export function approvePolicy(policy, proof, mode, actor, at, dispositions = [], composition = [], currentBehaviorAttestations = []) {
+    const activationError = activationGateError(policy);
+    if (activationError)
+        throw new Error(`policy ${policy.id} cannot activate: ${activationError}`);
     requireHuman(actor);
     const behaviorAttestationError = executableBehaviorAttestationError(policy, currentBehaviorAttestations);
     if (behaviorAttestationError)