@dharma-ai-labs/agent-fabric 0.2.152 → 0.2.154

package/dist/codexBootstrapCompletion.test.js

@@ -0,0 +1,630 @@
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { randomBytes } from 'node:crypto';
+import { constants as fsConstants } from 'node:fs';
+import { mkdtemp, readFile, realpath, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { resolve } from 'node:path';
+import { compileFunction } from 'node:vm';
+import test from 'node:test';
+import ts from 'typescript';
+import { canonicalize, sha256 } from '@dharma-ai-labs/agent-fabric-contracts';
+import { LocalVault } from '@dharma-ai-labs/agent-fabric-local-vault';
+import { parseLocalCodexSetupReadiness } from '@dharma-ai-labs/agent-fabric-local-vault/setup-readiness';
+import { assertBootstrapHostSource, currentBootstrapHostScope, inspectCodexBootstrapHostPreparation, prepareCodexBootstrapHost, runCodexBootstrapHostScope } from './bootstrapHostScope.js';
+import { assertCodexSetupExecutionLease, createCodexSetupAdmission } from './codexSetupAdmission.js';
+import { createCodexSetupReadinessOwner } from './codexSetupReadiness.js';
+import { isNamedSessionOwnerReceipt } from './namedSessionTrust.js';
+import { parseNamedCodexSkillObservation } from './namedCodexSkillDiscovery.js';
+import { discoverRepositoryRoleMetadata } from './repositoryRoleMetadata.js';
+import { repositoryRelayObservationReady } from './repositoryRelaySupervisor.js';
+import { selectDeviceWorkspace, workspaceIdForDevice } from './onboardingWorkspace.js';
+import { startCodexSetupNativeHost } from './codexSetupNativeHost.js';
+import { bootstrapFromCodexSetupScope, loadAgentFabricOnboardingContract, parseCliOptions } from './index.js';
+import { originalCodexSetupSessionSender, withCodexSetupSessionSender } from './codexSetupSessionHandoff.js';
+const id = (n) => `${String(n).padStart(8, '0')}-1111-4111-8111-111111111111`;
+const hash = `sha256:${'a'.repeat(64)}`;
+// Execute unchanged production declarations; only OS/server/native boundaries
+// are fixtures. These tests do not establish Linux or production readiness.
+async function declaration(name, dependencies) {
+    const baseline = process.env.DHARMA_COMPLETION_PARENT_TEST_BASELINE;
+    if (baseline && baseline !== 'e48fcd0798c26f9b8078f3ec2b4ea5bc782ad383')
+        throw new Error('fixture_source_unqualified');
+    const source = baseline ? execFileSync('git', ['show', `${baseline}:packages/cli/src/index.ts`], { encoding: 'utf8' })
+        : await readFile(new URL('../src/index.ts', import.meta.url), 'utf8');
+    const ast = ts.createSourceFile('index.ts', source, ts.ScriptTarget.Latest, true);
+    const matches = ast.statements.filter(node => ts.isFunctionDeclaration(node) && node.name?.text === name);
+    assert.equal(matches.length, 1);
+    const output = ts.transpileModule(matches[0].getText(ast), { compilerOptions: {
+            target: ts.ScriptTarget.ES2023, module: ts.ModuleKind.CommonJS
+        }, reportDiagnostics: true });
+    assert.equal(output.diagnostics?.filter(d => d.category === ts.DiagnosticCategory.Error).length, 0);
+    const body = output.outputText.replaceAll('import.meta.url', 'ENTRY_URL');
+    return compileFunction(`${body}\nreturn ${name};`, ['exports', ...Object.keys(dependencies)])({}, ...Object.values(dependencies));
+}
+async function fixture(t) {
+    const root = await realpath(await mkdtemp(resolve(tmpdir(), 'dharma-completion-'))), now = Date.now();
+    const prepared = prepareCodexBootstrapHost({ workspace: root, signal: new AbortController().signal, current: async () => true,
+        intent: { schema: 'dharma.codex-setup-intent/v1', operationId: id(1), setupReference: id(2),
+            organizationId: 'org_demo', recipientMembershipId: id(3), origin: 'https://hq.example',
+            repositoryFingerprint: hash, policyRevision: 'policy-v1', scopeDigest: hash, contractDigest: hash,
+            hostContextId: id(4), issuedAt: new Date(now - 1000).toISOString(), expiresAt: new Date(now + 600_000).toISOString() } });
+    const vault = await LocalVault.open({ root: resolve(root, 'vault'), masterKey: randomBytes(32) }, prepared.scope);
+    t.after(async () => { prepared.scope.close(); await vault.close(); await rm(root, { recursive: true, force: true }); });
+    const profile = { roleName: 'Reviewer', description: 'Bounded synthetic code review.', questionCategories: ['code-review'] };
+    const workspaceId = workspaceIdForDevice({ organizationId: 'org_demo', deviceId: id(5), path: root });
+    const identity = { organizationId: 'org_demo', membershipId: id(3), deviceId: id(5), workspaceId,
+        repositoryBindingId: id(7), endpointId: id(9), provider: 'codex' };
+    const roleScope = { organizationId: 'org_demo', workspaceId, repositoryBindingId: id(7),
+        repositoryAgentId: id(8), endpointId: id(9), sourceFingerprint: hash };
+    const row = { ...identity, path: root, routeHash: sha256(root), repositoryRemoteHash: hash, status: 'active', repositoryAgentId: id(8),
+        repositoryRole: { revision: 1, profileHash: sha256(canonicalize(profile)) } };
+    const name = `codex-${workspaceId.slice(0, 8)}`, home = resolve(root, 'home'), entry = resolve(root, 'index.js');
+    const policyPath = resolve(root, '.dharma', 'approved-policy.json');
+    const policy = { revision: 'policy-v1', serverAuthorization: { workspaceId, expiresAt: prepared.intent.expiresAt } };
+    const content = { bundleId: id(11), bundleHash: hash, manifestHash: hash, catalogHash: hash, skillsHash: hash };
+    const binding = { ...identity, owner: 'dharma_bridge', workspaceRoot: root, bindingId: id(10),
+        sessionId: 'synthetic_session', expiresAt: prepared.intent.expiresAt };
+    const native = { ok: true, ...identity, name, bindingId: id(10), sessionId: binding.sessionId,
+        nativeSkill: { ...content, schema: 'dharma.named-codex-skill-observation/v1', nativeDiscovered: true,
+            observedAt: new Date(now).toISOString() } };
+    const { organizationId, ...remoteIdentity } = identity;
+    const remote = { ok: true, organizationId, correlationId: id(90), registration: { ...remoteIdentity,
+            bindingId: id(10), mode: 'bridge_owned', revision: 1, state: 'attached', replay: false,
+            leaseUntil: new Date(now + 60_000).toISOString() } };
+    const startup = { backend: 'container-entrypoint', version: '0.2.153', workspace: root, policy: policyPath,
+        launcher: resolve(root, '.dharma', 'bin', 'dharma') };
+    const startupState = { state: 'enabled', backend: startup.backend, version: startup.version, lifecycle: 'running' };
+    const poll = { at: new Date(now).toISOString(), workspaceId, version: '0.2.153', pid: 102 };
+    const supervisor = { pid: 101, organizationId: 'org_demo', deviceId: id(5), policyPath,
+        version: '0.2.153', standardRepositories: true };
+    const processes = [
+        { pid: 101, uid: 1000, parentPid: 1, processGroupId: 101, sessionId: 101, startTicks: '10',
+            argv: ['synthetic-node', entry, 'relay', 'supervise', '--policy', policyPath] },
+        { pid: 102, uid: 1000, parentPid: 101, processGroupId: 101, sessionId: 101, startTicks: '20',
+            argv: ['synthetic-node', entry, 'relay', 'start', '--policy', policyPath] },
+        { pid: 103, uid: 1000, parentPid: 101, processGroupId: 101, sessionId: 101, startTicks: '30',
+            argv: ['synthetic-node', entry, 'sessions', 'serve', '--name', name, '--workspace-id', workspaceId, '--apply'] },
+    ];
+    const paths = new Map([
+        [resolve(home, 'relay', 'supervisor.pid'), 101], [resolve(home, 'relay', 'relay.pid'), 102],
+        [resolve(home, 'sessions', name, 'service.lock'), 103],
+        [resolve(home, 'relay', 'supervisor-workspace.json'), supervisor],
+        [resolve(home, 'relay', 'repositories', workspaceId, 'last-successful-poll.json'), poll],
+    ]);
+    const calls = [], mutations = {};
+    const dependencies = {
+        resolve, Date, canonicalize, sha256, selectDeviceWorkspace, parseLocalCodexSetupReadiness, parseNamedCodexSkillObservation,
+        isNamedSessionOwnerReceipt, repositoryRelayObservationReady, discoverRepositoryRoleMetadata,
+        ENTRY_URL: 'file:///synthetic/index.js', fileURLToPath: () => entry, VERSION: '0.2.153',
+        process: { platform: 'linux', execPath: 'synthetic-node', getuid: () => 1000 },
+        preflightBootstrapWorkspaceIdentity: async () => ({ fingerprint: hash }), assertBootstrapHostSource: async () => { },
+        loadAgentFabricOnboardingContract: async () => ({ sha256: 'a'.repeat(64) }),
+        readDeviceConfig: async () => ({ ...identity, hqUrl: 'https://hq.example' }), normalizeHqUrl: (s) => s,
+        loadDeviceEnrollmentAnchor: async () => ({ devicePublicKeyEd25519: 'synthetic-public-key' }),
+        enrolledDeviceIdentity: async () => ({ publicKeyEd25519: 'synthetic-public-key' }), registry: async () => [row],
+        repositoryRoleScope: () => roleScope, loadVerifiedWorkspacePolicy: async () => policy,
+        verifyServerAuthorizedPolicy: () => { calls.push('verified-policy'); mutations.policy?.(); },
+        assertWorkspaceAuthorizationCurrent: async () => { calls.push('current-policy'); mutations.authorization?.(); },
+        activeSkillAuthorization: async () => ({ ...content, expiresAt: prepared.intent.expiresAt }),
+        loadActiveSkillAuthorizationAnchor: async () => ({ bundleId: id(11), receiptHash: hash }),
+        verifyAgentFabricSkillInstallation: async () => { calls.push('installation'); mutations.installation?.(); return { ready: true }; },
+        readNamedSessionPackageContent: async () => ({ ...content }),
+        client: async () => ({ signedGet: async () => ({ ok: true, organizationId: 'org_demo', correlationId: 'synthetic',
+                discovery: { organizationId: roleScope.organizationId, workspaceId: roleScope.workspaceId,
+                    repositoryBindingId: roleScope.repositoryBindingId, repositoryAgentId: roleScope.repositoryAgentId,
+                    peers: [{ endpointId: id(9), workspaceId, provider: 'codex', ...profile, revision: 1 }],
+                    limit: 50, possiblyTruncated: false } }),
+            signedPost: async () => remote }),
+        dharmaHome: () => home, readNamedSession: async () => ({ enabled: true, identity, bindingId: id(10) }),
+        namedSessionCommand: async () => native, inspectOwnedRelayAutostart: async () => startup,
+        relayAutostartStatus: async () => startupState,
+        namedSessionPaths: () => ({ root: resolve(home, 'sessions', name) }),
+        readContainerProcessIdentity: async (pid) => {
+            calls.push(`process-${pid}`);
+            mutations.process?.();
+            return structuredClone(processes.find(p => p.pid === pid));
+        },
+        readBootstrapRuntimeJson: async (path, scope) => scope.step(async () => {
+            calls.push('owned-state');
+            if (!paths.has(path))
+                throw new Error('fixture_path_unknown');
+            return structuredClone(paths.get(path));
+        }),
+    };
+    const observe = await declaration('observeCodexBootstrapRuntime', dependencies);
+    let handoffEnabled = false;
+    const handoff = { state: 'accepted', request: { ...identity, setupReference: prepared.intent.setupReference,
+            workspaceRoot: root, name, repositoryFingerprint: hash, policyRevision: policy.revision,
+            scopeDigest: hash, contractDigest: hash }, result: { state: 'started', bindingId: binding.bindingId,
+            sessionId: binding.sessionId, sessionPid: 103, supervisorPid: 101, sessionStartTicks: '30', supervisorStartTicks: '10' } };
+    const providerVault = { getProviderSessionBinding: async () => binding,
+        readCodexSetupSession: async (operation, digest) => {
+            assert.equal(operation, prepared.intent.operationId);
+            assert.equal(digest, hash);
+            return handoffEnabled ? handoff : null;
+        } };
+    return { prepared, vault, observe, providerVault, calls, paths, mutations, row, profile, binding, native, remote,
+        content, startup, startupState, policy, supervisor, poll, processes, dependencies, handoff,
+        enableHandoff: () => { handoffEnabled = true; processes[2].argv.push('--setup-handoff'); } };
+}
+test('actual CLI producer joins the IPC-started child to its exact encrypted handoff result', async (t) => {
+    const f = await fixture(t);
+    f.enableHandoff();
+    assert.equal((await f.observe(f.prepared, f.providerVault, 'no_eligible_history', hash)).sessionId, f.binding.sessionId);
+});
+for (const change of ['absent', 'digest', 'member', 'device', 'repository', 'endpoint', 'source', 'scope', 'contract',
+    'binding', 'session', 'child', 'child-creation', 'supervisor', 'supervisor-creation', 'result', 'args']) {
+    test(`actual CLI producer rejects IPC handoff ${change}`, async (t) => {
+        const f = await fixture(t);
+        if (change !== 'absent')
+            f.enableHandoff();
+        if (change === 'member')
+            f.handoff.request.membershipId = id(99);
+        if (change === 'device')
+            f.handoff.request.deviceId = id(99);
+        if (change === 'repository')
+            f.handoff.request.repositoryBindingId = id(99);
+        if (change === 'endpoint')
+            f.handoff.request.endpointId = id(99);
+        if (change === 'source')
+            f.handoff.request.repositoryFingerprint = `sha256:${'b'.repeat(64)}`;
+        if (change === 'scope')
+            f.handoff.request.scopeDigest = `sha256:${'b'.repeat(64)}`;
+        if (change === 'contract')
+            f.handoff.request.contractDigest = `sha256:${'b'.repeat(64)}`;
+        if (change === 'binding')
+            f.handoff.result.bindingId = id(99);
+        if (change === 'session')
+            f.handoff.result.sessionId = 'foreign-session';
+        if (change === 'child')
+            f.handoff.result.sessionPid = 999;
+        if (change === 'child-creation')
+            f.handoff.result.sessionStartTicks = '31';
+        if (change === 'supervisor')
+            f.handoff.result.supervisorPid = 999;
+        if (change === 'supervisor-creation')
+            f.handoff.result.supervisorStartTicks = '11';
+        if (change === 'result')
+            f.handoff.result.state = 'unconfirmed';
+        if (change === 'args')
+            f.processes[2].argv.push('--arbitrary');
+        await assert.rejects(f.observe(f.prepared, f.providerVault, 'no_eligible_history', change === 'digest' ? undefined : hash), /setup_runtime_(?:session|process)_unconfirmed/);
+    });
+}
+async function siblingAnchor(f) {
+    const path = resolve(f.row.path, 'sibling');
+    const workspaceId = workspaceIdForDevice({ organizationId: f.row.organizationId, deviceId: f.row.deviceId, path });
+    const row = { ...f.row, path, workspaceId, routeHash: sha256(path), repositoryRemoteHash: `sha256:${'b'.repeat(64)}` };
+    const policy = { ...f.policy, revision: 'sibling-policy', serverAuthorization: { ...f.policy.serverAuthorization, workspaceId } };
+    f.startup.workspace = path;
+    f.startup.policy = resolve(path, '.dharma', 'approved-policy.json');
+    f.startup.launcher = resolve(path, '.dharma', 'bin', 'dharma');
+    f.supervisor.policyPath = f.startup.policy;
+    f.processes[0].argv[5] = f.startup.policy;
+    f.processes[1].argv[5] = f.startup.policy;
+    f.dependencies.registry = async () => [f.row, row];
+    f.dependencies.loadVerifiedWorkspacePolicy = async (path) => path === f.startup.policy ? policy : f.policy;
+    const observe = await declaration('observeCodexBootstrapRuntime', f.dependencies);
+    return { row, policy, observe };
+}
+test('actual CLI producer accepts a verified same-device sibling startup anchor without retargeting it', async (t) => {
+    const f = await fixture(t), sibling = await siblingAnchor(f);
+    const before = structuredClone(f.startup);
+    const result = await sibling.observe(f.prepared, f.providerVault, 'no_eligible_history');
+    assert.equal(result.workspaceId, f.row.workspaceId);
+    assert.equal(result.policyRevision, f.policy.revision);
+    assert.deepEqual(f.startup, before);
+});
+for (const change of ['foreign-device', 'foreign-org', 'route', 'inactive', 'unregistered', 'policy',
+    'supervisor', 'startup-change', 'state-change', 'route-change', 'policy-change', 'config-change', 'authorization']) {
+    test(`actual CLI producer rejects a sibling startup anchor with ${change}`, async (t) => {
+        const f = await fixture(t), sibling = await siblingAnchor(f);
+        if (change === 'foreign-device')
+            sibling.row.workspaceId = workspaceIdForDevice({ organizationId: 'org_demo', deviceId: id(99), path: sibling.row.path });
+        if (change === 'foreign-org')
+            sibling.row.organizationId = 'org_foreign';
+        if (change === 'route')
+            sibling.row.routeHash = `sha256:${'f'.repeat(64)}`;
+        if (change === 'inactive')
+            sibling.row.status = 'revoked';
+        if (change === 'unregistered')
+            f.dependencies.registry = async () => [f.row];
+        if (change === 'policy')
+            f.dependencies.verifyServerAuthorizedPolicy = ({ workspaceId }) => {
+                if (workspaceId === sibling.row.workspaceId)
+                    throw new Error('fixture_invalid_anchor_signature');
+            };
+        if (change === 'supervisor')
+            f.supervisor.deviceId = id(99);
+        if (change === 'authorization')
+            f.dependencies.assertWorkspaceAuthorizationCurrent = async (workspaceId) => {
+                if (workspaceId === sibling.row.workspaceId)
+                    throw new Error('fixture_anchor_authority_revoked');
+            };
+        let reads = 0;
+        f.mutations.process = () => {
+            if (++reads !== 4)
+                return;
+            if (change === 'startup-change')
+                f.startup.launcher = resolve(f.row.path, 'foreign-launcher');
+            if (change === 'state-change')
+                f.startupState.lifecycle = 'stopped';
+            if (change === 'route-change')
+                sibling.row.repositoryRemoteHash = `sha256:${'f'.repeat(64)}`;
+            if (change === 'policy-change')
+                sibling.policy.revision = 'withdrawn';
+        };
+        if (change === 'config-change')
+            f.dependencies.readDeviceConfig = async () => ({ organizationId: 'org_demo',
+                deviceId: reads >= 4 ? id(99) : id(5), hqUrl: 'https://hq.example' });
+        const observe = await declaration('observeCodexBootstrapRuntime', f.dependencies);
+        const expected = change === 'policy' ? /fixture_invalid_anchor_signature/
+            : change === 'authorization' ? /fixture_anchor_authority_revoked/
+                : change === 'supervisor' ? /setup_runtime_process_unconfirmed/
+                    : change.endsWith('-change') ? /setup_runtime_startup_changed/ : /setup_runtime_startup_unconfirmed/;
+        await assert.rejects(observe(f.prepared, f.providerVault, 'no_eligible_history'), expected);
+    });
+}
+test('actual CLI producer joins scoped identity, server role, native package and creation-identity observations', async (t) => {
+    const f = await fixture(t);
+    const observation = await f.observe(f.prepared, f.providerVault, 'no_eligible_history');
+    assert.equal(Object.isFrozen(observation), true);
+    assert.equal(observation.endpointId, id(9));
+    assert.equal(observation.catalogHash, hash);
+    assert.equal(observation.firstLearning, 'no_eligible_history');
+    assert.equal(f.calls.filter(c => c === 'current-policy').length, 4);
+    assert.equal(f.calls.filter(c => c === 'process-102').length, 2);
+    const claim = await f.vault.claimCodexSetupOperation(id(1), hash);
+    assert.equal(claim.state, 'acquired');
+    if (claim.state !== 'acquired')
+        throw new Error('fixture_claim_missing');
+    const owner = createCodexSetupReadinessOwner({ intent: f.prepared.intent, workspace: f.row.path,
+        scope: f.prepared.scope, vault: f.vault, observe: () => f.observe(f.prepared, f.providerVault, 'no_eligible_history') });
+    const receipt = await owner.record({ leaseId: claim.leaseId, intentDigest: hash });
+    assert.equal(await owner.verify(receipt.readinessReceiptId, f.prepared.intent, hash), true);
+    f.native.sessionId = 'different_session';
+    assert.equal(await owner.verify(receipt.readinessReceiptId, f.prepared.intent, hash), false);
+});
+test('actual CLI producer rejects a named worker not owned by the verified standing supervisor', async (t) => {
+    const f = await fixture(t);
+    f.processes[2].parentPid = 1;
+    await assert.rejects(f.observe(f.prepared, f.providerVault, 'no_eligible_history'), { message: 'setup_runtime_process_unconfirmed' });
+});
+for (const change of ['source', 'recipient', 'role', 'package', 'native', 'lease', 'startup', 'poll', 'process', 'withdrawn']) {
+    test(`actual CLI producer withholds readiness for ${change} mismatch`, async (t) => {
+        const f = await fixture(t);
+        if (change === 'source')
+            f.row.repositoryRemoteHash = `sha256:${'b'.repeat(64)}`;
+        if (change === 'recipient')
+            f.binding.membershipId = id(99);
+        if (change === 'role')
+            f.row.repositoryRole.revision = 2;
+        if (change === 'package')
+            f.content.catalogHash = `sha256:${'b'.repeat(64)}`;
+        if (change === 'native')
+            f.native.nativeSkill.observedAt = new Date(Date.now() - 90_000).toISOString();
+        if (change === 'lease')
+            f.remote.registration.leaseUntil = new Date(Date.now() - 1).toISOString();
+        if (change === 'startup')
+            f.startupState.lifecycle = 'stopped';
+        if (change === 'poll')
+            f.poll.pid = 104;
+        if (change === 'process')
+            f.processes[1].parentPid = 999;
+        if (change === 'withdrawn')
+            f.prepared.scope.close();
+        const expected = { source: 'setup_runtime_repository_unconfirmed', recipient: 'setup_runtime_session_unconfirmed',
+            role: 'setup_runtime_role_unconfirmed', package: 'setup_runtime_session_unconfirmed', native: 'named_session_native_skill_invalid',
+            lease: 'setup_runtime_session_unconfirmed', startup: 'setup_runtime_startup_unconfirmed', poll: 'setup_runtime_poll_unconfirmed',
+            process: 'setup_runtime_process_unconfirmed', withdrawn: 'codex_setup_host_scope_unavailable' };
+        await assert.rejects(f.observe(f.prepared, f.providerVault, 'no_eligible_history'), { message: expected[change] });
+    });
+}
+test('actual CLI producer denies process reuse and policy withdrawal during readback', async (t) => {
+    const f = await fixture(t);
+    let processReads = 0;
+    f.mutations.process = () => { if (++processReads === 4)
+        f.processes[1].startTicks = '999'; };
+    await assert.rejects(f.observe(f.prepared, f.providerVault, 'no_eligible_history'), /process_changed/);
+    delete f.mutations.process;
+    f.mutations.authorization = () => { f.prepared.scope.close(); };
+    await assert.rejects(f.observe(f.prepared, f.providerVault, 'no_eligible_history'), /scope_unavailable/);
+});
+test('actual completion composition denies copied leases and retains the incomplete-execution guard', async (t) => {
+    const f = await fixture(t);
+    let executions = 0;
+    const compose = await declaration('createCodexBootstrapCompletionOwner', { ...f.dependencies,
+        runCodexBootstrapHostScope, createCodexSetupReadinessOwner, assertCodexSetupExecutionLease, withCodexSetupSessionSender,
+        observeCodexBootstrapRuntime: f.observe,
+        bootstrapFromCodexSetupScope: async () => {
+            executions++;
+            return { ok: false, stage: 'host_setup_unavailable',
+                code: 'codex_setup_host_execution_unqualified', effects: false, grantRedeemed: false };
+        },
+    });
+    const completion = await compose(f.prepared.scope, f.vault);
+    await assert.rejects(completion.execute({ leaseId: id(99), intentDigest: hash }), /execution_lease_unavailable/);
+    assert.equal(executions, 0);
+    const active = { connectionId: id(20), threadId: 'synthetic_thread', turnId: 'synthetic_turn', hostContextId: id(4) };
+    const owner = createCodexSetupAdmission({ ...active, intent: f.prepared.intent,
+        current: async () => ({ ...active, mode: 'setup' }), qualifyHost: async () => true,
+        journal: { claim: async (operation, digest) => f.vault.claimCodexSetupOperation(operation, digest),
+            read: async (operation, digest) => f.vault.readCodexSetupOperation(operation, digest),
+            finish: async (lease, digest, result) => f.vault.finishCodexSetupOperation(lease, digest, result) },
+        execute: (_intent, _signal, _current, lease) => completion.execute(lease), verifyReadiness: completion.verify });
+    try {
+        const result = await owner.handler({ threadId: active.threadId, turnId: active.turnId,
+            callId: 'synthetic_call', tool: 'dharma_setup_reference', namespace: null,
+            arguments: { operationId: id(1), setupReference: id(2) } }, { signal: new AbortController().signal });
+        assert.equal(result.success, false);
+        assert.equal(executions, 1);
+        assert.equal(JSON.stringify(result).includes('readinessReceiptId'), false);
+        assert.equal(f.calls.length, 0);
+    }
+    finally {
+        owner.close();
+        await owner.settled;
+    }
+});
+for (const disposition of ['complete', 'package-pending', 'foreign-recipient',
+    ...['source', 'device-config', 'claim', 'credentials', 'onboard', 'launcher', 'startup', 'skill', 'relay', 'api', 'named']
+        .map(stage => `withdrawn-${stage}`)]) {
+    test(`actual bootstrap composition admits only the original lease (${disposition})`, async (t) => {
+        const f = await fixture(t);
+        f.enableHandoff();
+        let claims = 0, onboards = 0, starts = 0, completionDigest = '';
+        const effects = [];
+        const effect = (stage, value) => {
+            effects.push(stage);
+            if (disposition === `withdrawn-${stage}`)
+                f.prepared.scope.close();
+            return value;
+        };
+        const config = { organizationId: f.row.organizationId, deviceId: f.row.deviceId,
+            hqUrl: f.prepared.intent.origin, installationId: id(80), setupClaimReference: id(2) };
+        const source = { fingerprint: f.prepared.intent.repositoryFingerprint };
+        const bootstrap = await declaration('bootstrap', {
+            ...f.dependencies, originalCodexSetupSessionSender, assertBootstrapHostSource,
+            currentBootstrapHostScope, UUID_PATTERN: /^[0-9a-f-]{36}$/,
+            portalUrl: (flags) => flags.get('portal-url'),
+            required: (flags, key) => {
+                const value = flags.get(key);
+                assert.equal(typeof value, 'string');
+                return value;
+            },
+            bootstrapGrantMode: () => 'reference', realpath: async (path) => path,
+            readDeviceConfig: async () => effect('device-config', config),
+            preflightBootstrapWorkspaceIdentity: async () => effect('source', source),
+            isLocalProviderId: (provider) => provider === 'codex',
+            process: { platform: 'linux', env: {}, stderr: { write() { throw new Error('fixture_unexpected_output'); } } },
+            configPath: () => 'synthetic-config', platform: async () => 'linux',
+            claimSetupReference: async (input) => {
+                claims++;
+                assert.equal(input.hostScope, f.prepared.scope);
+                assert.equal(input.recipientMembershipId, f.prepared.intent.recipientMembershipId);
+                assert.equal(input.repositoryFingerprint, source.fingerprint);
+                assert.equal(input.setupReference, f.prepared.intent.setupReference);
+                return effect('claim', { config, scopes: ['fabric:tasks'] });
+            },
+            loadOrganizationApiToken: async () => effect('credentials', 'synthetic-not-a-real-credential'),
+            retryBootstrapOnboarding: async (operation) => operation(),
+            onboard: async (flags) => {
+                onboards++;
+                assert.equal(currentBootstrapHostScope(), f.prepared.scope);
+                for (const key of ['grant', 'grant-prompt', 'setup-reference', 'setup-recipient-membership-id']) {
+                    assert.equal(flags.has(key), false);
+                }
+                return effect('onboard', { ok: true, stage: 'complete', workspaceId: f.row.workspaceId,
+                    sharedRepositoryReady: disposition !== 'package-pending', repositoryRole: f.profile,
+                    firstLearningEvidence: { state: 'synchronized', discovered: 0, disclosureReady: true } });
+            },
+            installStableRepositoryLauncher: async () => effect('launcher', { shell: '.dharma/bin/dharma', windows: '.dharma/bin/dharma.cmd' }),
+            withOnboardingStage: async (_stage, _workspace, _command, operation) => operation(),
+            withRelayStartupMutation: async (operation) => operation(),
+            relayAutostartStatus: async () => ({ state: 'disabled', backend: null }),
+            enableRelayAutostart: async () => effect('startup', { state: 'enabled', backend: 'systemd-user' }),
+            verifyAgentFabricSkillInstallation: async () => effect('skill', { ready: true }),
+            startRelayDaemon: async () => effect('relay', { state: 'running', probe: { connected: true } }),
+            waitForRepositoryReadiness: async () => ({ outcome: 'blocked' }),
+            runOrganizationCommand: async () => effect('api', { organizationId: f.row.organizationId }),
+            summarizeBootstrapOrganizationApi: () => ({ ready: true }),
+            namedSessionCommand: async (action) => {
+                if (action === 'start')
+                    starts++;
+                return effect('named', { ...f.native, state: 'running' });
+            },
+        });
+        const run = await declaration('run', { parseCliOptions, currentBootstrapHostScope,
+            inspectCodexBootstrapHostPreparation, originalCodexSetupSessionSender, bootstrap });
+        const continueFromScope = await declaration('bootstrapFromCodexSetupScope', { runCodexBootstrapHostScope, run });
+        const vault = { ...f.vault, ...f.providerVault,
+            readCodexSetupSession: async (operation, digest) => {
+                assert.equal(operation, f.prepared.intent.operationId);
+                assert.equal(digest, completionDigest);
+                return f.handoff;
+            } };
+        if (disposition === 'foreign-recipient')
+            f.binding.membershipId = id(99);
+        const compose = await declaration('createCodexBootstrapCompletionOwner', { ...f.dependencies,
+            runCodexBootstrapHostScope, createCodexSetupReadinessOwner, assertCodexSetupExecutionLease, withCodexSetupSessionSender,
+            observeCodexBootstrapRuntime: f.observe,
+            bootstrapFromCodexSetupScope: continueFromScope,
+        });
+        const completion = await compose(f.prepared.scope, vault);
+        const active = { connectionId: id(20), threadId: 'synthetic_thread', turnId: 'synthetic_turn', hostContextId: id(4) };
+        const admission = createCodexSetupAdmission({ ...active, intent: f.prepared.intent,
+            current: async () => ({ ...active, mode: 'setup' }), qualifyHost: async () => true,
+            journal: { claim: async (operation, digest) => f.vault.claimCodexSetupOperation(operation, digest),
+                read: async (operation, digest) => f.vault.readCodexSetupOperation(operation, digest),
+                finish: async (lease, digest, result) => f.vault.finishCodexSetupOperation(lease, digest, result) },
+            execute: (_intent, _signal, _current, lease) => {
+                completionDigest = lease.intentDigest;
+                return completion.execute(lease);
+            }, verifyReadiness: completion.verify });
+        try {
+            const response = await admission.handler({ threadId: active.threadId, turnId: active.turnId,
+                callId: 'original_bootstrap', tool: 'dharma_setup_reference', namespace: null,
+                arguments: { operationId: id(1), setupReference: id(2) } }, { signal: new AbortController().signal });
+            await admission.settled;
+            assert.equal(claims, ['withdrawn-source', 'withdrawn-device-config'].includes(disposition) ? 0 : 1, 'the actual bootstrap must reach only a still-admitted bound claim');
+            assert.equal(onboards, effects.filter(stage => stage === 'onboard').length);
+            if (disposition === 'package-pending')
+                assert.equal(starts, 0);
+            if (disposition.startsWith('withdrawn-')) {
+                const withdrawn = disposition.slice('withdrawn-'.length);
+                assert.equal(effects.at(-1), withdrawn, 'no later boundary may run after withdrawal');
+                assert.equal(await f.prepared.scope.current(), false);
+                await assert.rejects(f.vault.readCodexSetupOperation(id(1), completionDigest), /vault_scope_unavailable/);
+            }
+            assert.equal(response.success, disposition === 'complete');
+            if (disposition === 'complete') {
+                const saved = await f.vault.readCodexSetupOperation(id(1), completionDigest);
+                assert.equal(saved?.state, 'terminal');
+                if (saved?.state !== 'terminal')
+                    throw new Error('fixture_terminal_missing');
+                assert.equal(saved.result.state, 'completed');
+                assert.equal(JSON.parse(response.contentItems[0].text).readinessReceiptId, saved.result.readinessReceiptId);
+                const reconciled = await admission.handler({ threadId: active.threadId, turnId: active.turnId,
+                    callId: 'reconcile_bootstrap', tool: 'dharma_setup_reference', namespace: null,
+                    arguments: { operationId: id(1), setupReference: id(2) } }, { signal: new AbortController().signal });
+                await admission.settled;
+                assert.equal(reconciled.success, true);
+                assert.equal(claims, 1);
+                assert.equal(onboards, 1);
+                assert.equal(starts, 1);
+                assert.equal(JSON.parse(reconciled.contentItems[0].text).readinessReceiptId, saved.result.readinessReceiptId);
+            }
+            else
+                assert.equal(JSON.stringify(response).includes('readinessReceiptId'), false);
+        }
+        finally {
+            admission.close();
+            await admission.settled;
+        }
+    });
+}
+test('actual runtime-state reader enforces ownership, private mode, bounds and unchanged descriptor identity', async (t) => {
+    const f = await fixture(t), bytes = Buffer.from('{"pid":102}\n');
+    let opens = 0, closes = 0, changed = false, short = false;
+    const stat = { dev: 1n, ino: 2n, nlink: 1n, size: BigInt(bytes.length), mtimeNs: 1n, ctimeNs: 1n,
+        mode: 33152n, uid: 1000n, gid: 1000n, isFile: () => true, isSymbolicLink: () => false };
+    const read = await declaration('readBootstrapRuntimeJson', { Buffer, JSON, fsConstants,
+        process: { getuid: () => 1000 },
+        lstat: async () => ({ ...stat }),
+        open: async (_path, flags) => {
+            opens++;
+            assert.equal(flags, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW | fsConstants.O_NONBLOCK);
+            return { stat: async () => ({ ...stat, ino: changed ? 3n : stat.ino }),
+                read: async (target) => { bytes.copy(target); return { bytesRead: short ? bytes.length - 1 : bytes.length }; },
+                close: async () => { closes++; } };
+        } });
+    assert.deepEqual(await read('synthetic-owned-state', f.prepared.scope), { pid: 102 });
+    assert.equal(opens, 1);
+    assert.equal(closes, 1);
+    for (const change of [{ uid: 999n }, { mode: 33184n }, { nlink: 2n }, { size: 32769n }]) {
+        const old = { ...stat };
+        Object.assign(stat, change);
+        await assert.rejects(read('synthetic-owned-state', f.prepared.scope), /state_unconfirmed/);
+        assert.equal(opens, 1);
+        Object.assign(stat, old);
+    }
+    changed = true;
+    await assert.rejects(read('synthetic-owned-state', f.prepared.scope), /state_unconfirmed/);
+    assert.equal(closes, 2);
+    changed = false;
+    short = true;
+    await assert.rejects(read('synthetic-owned-state', f.prepared.scope), /state_unconfirmed/);
+    assert.equal(closes, 3);
+    f.prepared.scope.close();
+    await assert.rejects(read('synthetic-owned-state', f.prepared.scope), /scope_unavailable/);
+    assert.equal(opens, 3);
+});
+for (const withdrawAfterOpen of [false, true]) {
+    test(`official composition owns the same protected vault and closes a denied opening (withdraw=${withdrawAfterOpen})`, async (t) => {
+        const f = await fixture(t), key = randomBytes(32), home = resolve(f.row.path, 'native-home');
+        let allowed = true, opens = 0, closes = 0, vault;
+        let originalScope, handler;
+        const listeners = new Set(), lifetime = new AbortController();
+        t.after(() => { key.fill(0); });
+        const transport = {
+            signal: lifetime.signal, close: async () => { lifetime.abort(); },
+            onNotification: listener => { listeners.add(listener); return () => { listeners.delete(listener); }; },
+            onToolCall: callback => { handler = callback; return () => { handler = undefined; }; },
+            request: async (method) => {
+                if (method === 'permissionProfile/list')
+                    return { data: [{ id: 'dharma_bridge', allowed: true }] };
+                if (method === 'config/read')
+                    return { config: { permissions: { dharma_bridge: {
+                                    filesystem: { ':minimal': 'read', ':workspace_roots': { '.': 'read' } }, network: { enabled: false }
+                                } } } };
+                if (method === 'thread/start' || method === 'thread/read')
+                    return { thread: {
+                            id: 'synthetic_thread', cwd: f.row.path, name: 'reviewer', status: { type: 'idle' }
+                        } };
+                if (method === 'thread/name/set' || method === 'turn/interrupt')
+                    return {};
+                if (method === 'turn/start')
+                    return { turn: { id: 'synthetic_turn', status: 'inProgress' } };
+                throw new Error('fixture_native_method_unexpected');
+            },
+        };
+        const compose = await declaration('createCodexBootstrapCompletionOwner', { ...f.dependencies,
+            runCodexBootstrapHostScope, createCodexSetupReadinessOwner, assertCodexSetupExecutionLease, withCodexSetupSessionSender,
+            observeCodexBootstrapRuntime: f.observe, bootstrapFromCodexSetupScope,
+        });
+        const start = await declaration('startCodexBootstrapNativeHost', { resolve, dharmaHome: () => home,
+            runCodexBootstrapHostScope, startCodexSetupNativeHost, createCodexBootstrapCompletionOwner: compose,
+            openBootstrapVault: async (options) => {
+                opens++;
+                assert.equal(options.root, resolve(home, 'vault'));
+                const scope = currentBootstrapHostScope();
+                assert.ok(scope);
+                originalScope = scope;
+                vault = await LocalVault.open({ ...options, masterKey: key }, scope);
+                if (withdrawAfterOpen)
+                    allowed = false;
+                const owned = vault;
+                return { ...owned, close: async () => { closes++; await owned.close(); } };
+            },
+        });
+        const contract = await loadAgentFabricOnboardingContract();
+        const input = { transport, workspace: f.row.path, name: 'reviewer',
+            intent: { ...f.prepared.intent, contractDigest: `sha256:${contract.sha256}` },
+            signal: new AbortController().signal, current: async () => allowed,
+            maximumProviderCostCents: 25, reserve: async () => true };
+        if (withdrawAfterOpen) {
+            await assert.rejects(start(input), { message: 'codex_setup_host_scope_unavailable' });
+            assert.equal(opens, 1);
+            assert.equal(closes, 1);
+            assert.equal(handler, undefined);
+            return;
+        }
+        const host = await start(input);
+        try {
+            assert.ok(handler);
+            assert.ok(originalScope);
+            assert.equal(await originalScope.current(), true);
+            const response = await handler({ threadId: 'synthetic_thread', turnId: 'synthetic_turn', callId: 'setup_call',
+                tool: 'dharma_setup_reference', namespace: null, arguments: { operationId: id(1), setupReference: id(2) } }, { signal: transport.signal });
+            assert.equal(response.success, false);
+            assert.equal(JSON.parse(response.contentItems[0].text).code, 'codex_setup_execution_unconfirmed');
+            assert.equal(f.calls.length, 0, 'the guarded actual bootstrap cannot synthesize live readiness');
+            assert.equal(opens, 1);
+            assert.equal(closes, 0);
+            for (const listener of listeners)
+                listener({ method: 'turn/completed',
+                    params: { threadId: 'synthetic_thread', turn: { id: 'synthetic_turn', status: 'completed' } } });
+            await host.settled;
+            assert.equal(closes, 1);
+            assert.equal(await originalScope.current(), false);
+            assert.equal(handler, undefined);
+            assert.equal(listeners.size, 0);
+        }
+        finally {
+            await host.close();
+        }
+        assert.equal(closes, 1);
+    });
+}
+//# sourceMappingURL=codexBootstrapCompletion.test.js.map