@dsh-enhanced/assistant-isolation 0.1.65 → 0.1.67

package/README.md

@@ -1,6 +1,6 @@
 # Assistant Isolation
 
-Host-only `inspectIsolationGrant({ stateRoot, grant, now? })` supplies a read-only schema 6 snapshot for operator diagnostics. It compares every configured grant field with persisted authority and reports revocation, expiry, historical run/duration reservations across revisions, and active/unknown jobs. It never creates or migrates a database, claims a controller, renews authority, refunds reservations, or returns commands/artifacts. Missing, unsupported or corrupt state is unavailable. `available` refers only to these grant checks; the Web owner doctor combines it with owner checks and a real temporary isolation probe. It is not a Policy, resource-admission or complete autonomy verdict.
+Host-only `inspectIsolationGrant({ stateRoot, grant, now? })` supplies a read-only schema 7/8 snapshot for operator diagnostics. It compares every configured grant field with persisted authority and reports revocation, expiry, historical run/duration reservations across revisions, and active/unknown jobs. It never creates or migrates a database, claims a controller, renews authority, refunds reservations, or returns commands/artifacts. Missing, unsupported or corrupt state is unavailable. `available` refers only to these grant checks; the Web owner doctor combines it with owner checks and a real temporary isolation probe. It is not a Policy, resource-admission or complete autonomy verdict.
 
 After a Host crash, startup waits up to 31 seconds for the previous controller's
 30-second lease to expire naturally. The service and its injected consumers stay
@@ -12,7 +12,237 @@ lease interval plus ordinary boot time before treating readiness as a failure.
 
 `@dsh-enhanced/assistant-isolation` adds `isolation_run` to the native DSH ToolRuntime. An operator grants a finite number of offline shell jobs to one authenticated owner, workspace and agent preset. Each job receives only explicitly supplied text files in a fresh scratch directory. Results and artifacts are untrusted process output; exit code zero does not establish that a user goal was achieved.
 
-This is the first actual isolation component of autonomy work packages 08–10. External action/credential brokerage, rollback/compensation and installer bootstrap remain separate delivery requirements. It does not isolate arbitrary Host plugins or replace the native AgentLoop. The Host, Docker daemon, configured image and local operator remain trusted. Each workspace uses a private tmpfs volume with byte and inode hard limits. A persistent pool bounds admitted worker/workspace/keeper reservations across this ledger; it is not a machine-wide guarantee against Docker/kernel overhead or unrelated workloads. Do not treat this initial component as a complete hostile-code production platform.
+This is the first actual isolation component of autonomy work packages 08–10. External action/credential brokerage, rollback/compensation and installer bootstrap remain separate delivery requirements. It does not isolate arbitrary Host plugins or replace the native AgentLoop. The Host, local operator, configured runtime and kernel remain trusted; the Docker backend also trusts its daemon and image. Each workspace uses a private tmpfs volume with byte and inode hard limits. A persistent pool bounds admitted worker/workspace/keeper reservations across this ledger; it is not a machine-wide guarantee against runtime/kernel overhead or unrelated workloads. Do not treat this initial component as a complete hostile-code production platform.
+
+## Native Linux building blocks
+
+The Host-only `runLinuxNamespace`, `LinuxCgroupLease`, and `LinuxRuntime`
+exports provide Docker-free execution on non-root Linux. The public tool accepts
+explicit `backend: 'linux-native'` configuration; the private verifier also
+accepts `LinuxVerifierRunnerConfig` below. Omitting `backend` retains Docker
+configuration semantics. Production setup still selects its existing backend
+until installation and owner migration are integrated.
+
+`runLinuxNamespace` uses fixed `unshare`, mount, bubblewrap and Python/libseccomp
+programs, with a shipped digest-checked syscall policy. It exposes system runtime
+directories and explicit read-only runtime roots, creates bounded workspace/tmp
+tmpfs mounts, and uses a 1 MiB shared-memory mount. The candidate has UID/GID
+65534, no effective capabilities, no network, a private PID view and a clean
+environment. It cannot see Host Home, sysfs, credentials or control sockets.
+Only the repository profile allows nested user namespaces for repository tests.
+The caller must keep exposed runtime roots free of secrets. Input and exported
+UTF-8 artifacts have separate 1 MiB bounds. The separate repository API below
+provides binary transport without expanding this text API's permissions.
+
+The keeper's fixed gate waits for `beforeKeeperStart` before unshare, mounts or
+staging. A separate candidate gate waits until `beforeStart` admits its exact
+PID/start time to resource controls. `afterExit` must prove the candidate group
+quiet before export; `onStop` must reconcile it after cancellation or failure.
+Callback failure or timeout returns `unknown`. The trusted keeper independently
+revokes work on Host disconnect or deadline. `namespaceExited` only proves that
+keeper's close; it is not a durable resource-cleanup or task-success receipt.
+
+`LinuxCgroupLease` configures and reads back CPU, memory including swap, and PID
+limits in pre-delegated v1 controllers. Admission is one-shot; shutdown fences
+late admission and uses freezer/pidfd checks before proving all groups empty.
+Recovery checks boot, owner and directory identities. V2 admission is currently
+rejected because its process-placement path has not been verified. The caller
+still owns pre-creation durable intent, controller exclusivity, orphan recovery,
+keeper resource reservations, authorization and budgets. The repository's
+one-time delegation script is an operator provisioning aid, not a privileged
+runtime broker or a sudo rule for a writable checkout.
+
+`LinuxRuntime` verification binds Node, native pnpm, frozen dependencies and
+retained store/cache to device/inode and deterministic tree hashes. It rejects
+outside links, writable contents and drift. None of these exports activates a
+service, reads provider credentials, accesses a browser, downloads images or
+runs an install lifecycle script. See the [delivery boundary](../../docs/dockerless-runtime.md)
+for remaining integration and acceptance.
+
+### Public native execution
+
+Configure `backend: 'linux-native'` and `linux: { runtime, cgroupRoots }` alongside
+the existing `stateRoot`, finite `grants`, limits and storage policy. `runtime`
+is the digest-pinned `LinuxRuntime` prepared by the native toolchain bootstrap;
+`cgroupRoots` identifies the current user's verified v1 controller delegation.
+The synchronous Cordis Config rejects invalid bindings and insufficient pools;
+service readiness and every newly admitted request recheck the runtime tree.
+This branch does not require an image or resolve a Docker socket.
+
+`isolation_run` keeps its existing request, owner/Policy checks, goal artifact
+binding and cancellation contract. Inline files enter a fresh bounded workspace;
+exported artifacts come back only after cleanup proof. Node and pnpm use the
+pinned runtime PATH. The ledger reserves worker, keeper, workspace, temporary
+and shared-memory allowances before dispatch. Changing backend or contract
+under an existing idempotency key is a conflict and never creates a new job.
+
+Startup and background recovery use each job's persisted backend. Native cleanup
+uses the original contract and private receipts; a native-configured service
+leaves historical Docker unknown resources occupied for their original cleanup
+path. Switching configuration does not extend grants or reset budgets.
+
+`dsh-isolation probe-native /absolute/runtime-config.json` accepts an owned JSON
+file containing exactly `{ runtime, cgroupRoots }`. It tests pinned Node,
+non-root execution, a canary artifact and actual cleanup without Docker or a
+production grant. Unproven cleanup retains its private evidence directory.
+`reconcile /absolute/private/state-root` dispatches cleanup by persisted backend;
+Docker arguments are unused for a native-only ledger. `revoke` first persists
+revocation and lets a live controller stop its work. For pending native jobs it
+also reports `nativeResourcesQuiescent` and `nativeRetained`; exit 2 indicates
+that cleanup is not yet confirmed. It never takes over a live controller.
+
+Positive result retention first commits the ledger's result digest, then
+replaces native journal/receipt bodies with digest-only records. Interrupted
+replacement is retried with the same controller and row-version checks. Unknown
+or unproven work retains its recovery evidence; the default zero-retention
+policy keeps all bodies. Cached results continue through the ledger and cannot
+replay execution after body pruning.
+
+### Durable native verification
+
+New managed installations can freeze a `stateSeal: { path, sha256 }` on
+`LinuxVerifierRunnerConfig` and `LinuxRepositoryRunnerConfig`. Before issuing
+owner grants, `prepareLinuxRunnerState({ stateRoot, sealPath, kind })` initializes
+an empty schema 8 ledger and publishes a private seal outside the runner root.
+The caller creates both private directories first. First installation must pass
+`requireEmpty: true`, including when an earlier preparation left a valid seal:
+all business tables and history sequences must still be empty, with no pending
+WAL or shared-memory state. Loss of outer installation files cannot renew an
+already used sealed ledger. The seal binds the purpose,
+owner UID, original directory and database inodes, and fixed schema. Freeze its
+reference in the owner configuration and authority digest. Restart and install
+retry use the existing-only `inspectLinuxRunnerState()`; missing or replaced
+roots, ledgers or seals fail before writable startup. A used unsealed ledger or
+incomplete initialization needs explicit reconciliation. The helper never
+renews grants, clears history or replays unknown jobs. Configurations without a
+seal retain their original behavior and have not acquired this protection.
+
+An authorized Docker-to-linux-native backend handover runs offline on a staged
+copy of the home. `prepareLinuxVerifierHandoverState({ name, stageStateRoot,
+stageSealPath, liveStateRoot, liveSealPath })` upgrades the staging ledger to
+schema 9 and publishes the seal before the new authority digest is compiled;
+`migrateLinuxVerifierRunnerState({ ..., existingSeal })` then proves that exact
+seal still binds the copy and performs the audited grant/job rewrite without
+resealing, so a digest compiled in between stays valid across the cutover.
+
+`IsolatedVerifierRunner` accepts either the existing Docker configuration or an
+explicit `backend: 'linux-native'` configuration with a verified `LinuxRuntime`
+and delegated `cgroupRoots`. `LinuxVerifierRunner` is also exported directly.
+The API remains `run(key, artifact, stdin, signal)` and `close()`; the fixed
+operator command receives `artifact` and `input` files in the private workspace.
+Its PATH uses the pinned runtime's Node/pnpm. Ordinary agent tools do not receive
+this constructor or the verifier's authority.
+
+The native backend reuses the same schema 8 ledger, finite verification grant,
+controller lease, idempotency key and resource pool. It keeps execution records
+in a private `linux-executions` child directory. Kernel resource identity and a
+durable create intent precede execution. Worker and keeper have separate groups;
+the keeper has 128 MiB memory including swap, 64 PIDs and 0.5 CPU. Reservations
+include both groups plus workspace, temporary and shared-memory allowances.
+Runtime drift, lost authorization or controller fencing stops new admission.
+
+The shared `prepareLinuxExecutionIntent` / `runLinuxExecution` helpers own the
+durable journal, both group lifetimes and private receipts. Recovery reads
+original identities and proves actual group/workspace absence. A missing or
+partial creation record never grants permission to run the command again or to
+signal an unidentified process. Proven cleanup releases active capacity while
+preserving an existing unknown result and its consumed run/duration budget.
+Historical Docker/macOS rows retain their own backend identity; switching this
+API does not reconcile those external resources or reset their grants.
+
+These APIs still require non-root Linux with verified v1 delegation and the
+fixed namespace dependencies. Installer migration, behavior certificates and
+release/adoption remain separate integration steps. V2, arm64 execution and a reboot with changed kernel
+resource identity remain outside the current live acceptance.
+
+### Durable repository execution
+
+Host-only `prepareLinuxRepositoryIntent`, `runLinuxRepositoryExecution`,
+`readLinuxRepositoryReceipt` and `reconcileLinuxRepositoryExecution` share the
+same durable execution engine. They require an explicit schema 2 or 3 repository
+contract, a frozen command/archive/artifact binding, and caller-owned finite
+authorization and controller admission. This is not an agent-visible tool or a
+complete source-build adapter.
+
+`runLinuxRepositoryNamespace` transports a SHA-256-bound archive of at most
+64 MiB through a dedicated input pipe and a read-only `/input/source.tar` mount.
+It exports at most 32 MiB of binary artifacts through a separate pipe after the
+candidate group is proven quiet. Neither transport pipe reaches the candidate.
+Repository limits allow an 8 GiB workspace, 4 GiB executable temporary mount,
+nested namespaces and a 30-minute deadline. Ordinary execution retains its
+existing bounds and non-executable temporary mount.
+
+The durable receipt contains artifact paths, lengths and hashes; bytes remain in
+an owner-only bounded spool. Reading a successful receipt rechecks both kernel
+absence and spool integrity. Failed or unknown executions return no binary
+artifacts, and a recovered identity never dispatches the command again. Partial
+creation and failed writes retain their original recovery fences.
+
+`linuxJobResourceReservation` includes every tmpfs, keeper capacity and durable
+spool; the ledger enforces these minima for both repository schemas. At the maximum artifact
+size, the execution spool and journal allowance is 108 MiB. A caller that stages
+its own archive or output pack must reserve that additional storage before
+staging.
+
+Schema 3 additionally binds a `userNamespace` mapping, `systemSnapshot` and the
+packaged execution implementation digest. It uses the owner's existing
+`/etc/subuid` and `/etc/subgid` allocation and digest-pinned, system-owned
+`newuidmap`/`newgidmap` helpers; execution never allocates or widens those ranges.
+Namespace UID/GID 0 map to the Host owner, and candidate UID/GID 65534 map to the
+allocated subordinate identity. The fixed entry drops UID/GID privileges, clears
+supplementary groups and all capabilities, enables no-new-privileges and waits for an independent Host
+check before executing candidate code. The Host persists both namespace and
+candidate witnesses before START. An absent witness can prove a failed setup
+quiet, but cannot authorize candidate execution or a successful result.
+
+The system snapshot copies a fixed closure of system tools and shared
+libraries from trusted root-owned paths, bounded to 640 MiB and 32,768 entries.
+An optional verified `LinuxRuntime` supplies only its pinned Node executable at
+`/usr/bin/node`; separate provenance binds that copy to the runtime and its
+original Node digest. This supports nested repository tests without depending
+on a Host Node installation. The snapshot hashes the inventory and bytes,
+rewrites only internal symlinks and mounts the result read-only; it does not
+mount the Host's `/etc` or mutable executable search paths. Schema 3 provides a
+fixed `dsh-sandbox` hostname and a read-only synthetic `/etc/hostname`. A separate 8 MiB /
+16,384-inode identity mount is included in schema 3 reservations. Recovery uses
+the original namespace ancestry, PID start times, freezer membership and pidfds
+before terminating descendants; allowing a subordinate UID alone is insufficient.
+Schema 1/2 jobs retain their original single-identity cleanup interpretation.
+
+Host-only `LinuxRepositoryRunner` adds a private, immutable finite authority,
+controller lease and schema 8 ledger to these repository primitives. It reserves
+capacity before calling the archive factory, freezes the archive digest and
+command under the source-job key, and passes a cancellation signal to the
+factory. Factory deadlines, grant expiry and controller loss abort that signal
+before settling the job. A trusted factory must honor cancellation and await its
+child processes; the runner does not isolate arbitrary Host callbacks.
+
+The runner reserves another 256 MiB of Host staging memory and 96 MiB of staging
+storage in addition to the execution minima. Reopening the same authority keeps
+its original expiry and consumed run/duration budget. A repeated key never
+reruns the factory or command; binary results require the original successful
+receipt, intact spool and fresh resource-absence proof. Foreign ledgers are
+rejected before migration or controller acquisition. `close()` fences admission
+and waits for active work and recovery.
+
+A private, single-use admission refusal can prove that this call never created
+an execution. It is valid only for the original runner, request, controller and
+state-directory/database identities; a concurrent or later call with the same
+key invalidates it. Ledger refusals require a known rejection before any insert
+and a confirmed rollback. Callers consume the proof after their own cleanup,
+immediately before settling their original task. Missing records, uncertain
+database errors and historical interrupted calls do not provide this proof;
+`inspectQuiescence()` still returns `unknown` for a missing key. No spent budget
+is refunded and no command is replayed.
+
+Providing both `userNamespace` and `systemSnapshot` selects schema 3; omitting
+both retains schema 2. Mixed or partial configuration is rejected. A ledger
+containing one repository schema cannot be reopened as the other schema.
+
+Control Plane's explicit Linux source-build adapter uses this runner for exact
+Git-tree preparation, frozen offline installation, root `pnpm check` and pack
+verification. Behavior verification and release/adoption still need their own
+native integration; repository execution alone does not authorize adoption.
 
 ## Native macOS execution primitive
 
@@ -73,7 +303,7 @@ dsh plugin --profile <profile> add @dsh-enhanced/assistant-isolation
 
 Required Host services: `agents`, `tools`, `assistantDelivery`, and `assistantPolicy`. The bundle is independently publishable; installing it does not install or activate peers. Without the services it does not register an execution tool. With no grants it does not execute jobs. No Docker image is downloaded by the plugin.
 
-The supported execution path is a non-root Linux or macOS Host process with access to a local Docker daemon. Linux defaults to `/var/run/docker.sock`; macOS defaults to the current user's Docker Desktop socket at `~/.docker/run/docker.sock`. The socket must exist at runtime and remain the same local Unix socket through creation, execution and cleanup. macOS requires an owner-owned socket and private Docker run directory; a remote `DOCKER_HOST`, Docker context or socket path outside that user directory is never used. Configure an already-present, operator-reviewed image **ID** (`sha256:` plus 64 hexadecimal digits), containing `/bin/sh`, a trusted `/bin/busybox` with `sleep`, `stat` and `cat`, and the commands needed for the task. Image-declared `VOLUME` entries are rejected to prevent extra writable Docker volumes. A tag or remote repository digest is not accepted as a substitute for the local immutable image ID. Failed Docker operations do not fall back to a Host shell.
+The Docker backend supports a non-root Linux or macOS Host process with access to a local Docker daemon. Linux defaults to `/var/run/docker.sock`; macOS defaults to the current user's Docker Desktop socket at `~/.docker/run/docker.sock`. The socket must exist at runtime and remain the same local Unix socket through creation, execution and cleanup. macOS requires an owner-owned socket and private Docker run directory; a remote `DOCKER_HOST`, Docker context or socket path outside that user directory is never used. Configure an already-present, operator-reviewed image **ID** (`sha256:` plus 64 hexadecimal digits), containing `/bin/sh`, a trusted `/bin/busybox` with `sleep`, `stat` and `cat`, and the commands needed for the task. Image-declared `VOLUME` entries are rejected to prevent extra writable Docker volumes. A tag or remote repository digest is not accepted as a substitute for the local immutable image ID. Failed Docker operations do not fall back to a Host shell.
 
 ## Configuration
 
@@ -171,7 +401,7 @@ The default command keeps bodies. Maintenance rejects a competing live controlle
 
 ## Worker-protected audit archive
 
-The Host-only archive command copies the schema 6 lifecycle audit into canonical, hash-linked NDJSON batches. The archive is immutable by protocol and content address: a published batch is never overwritten, and any conflicting content is rejected; this is not an operating-system immutable-bit guarantee. The command freezes a SQLite audit high-water mark and reads only through that fixed snapshot. The main database schema and data, including audit, jobs, grants and controller state, remain unchanged; a SQLite read-only snapshot may create or use WAL/SHM coordination sidecars. Repeating an interrupted or completed export is idempotent: already committed matching batches are retained. Files are committed with private permissions using a synced exclusive temporary file, a no-overwrite hard link, temporary unlink and directory sync; a matching crash residue is recovered under the archive lock. The verifier checks the complete local batch chain, including canonical records, contiguous sequence numbers and the previous-batch digest, and reports the source binding plus external anchor tuple `{ archiveInstanceId, highestSequence, headDigest }`. An empty or control-only directory is not a verifiable archive.
+The Host-only archive command copies the supported schema 7/8 lifecycle audit into canonical, hash-linked NDJSON batches. The archive is immutable by protocol and content address: a published batch is never overwritten, and any conflicting content is rejected; this is not an operating-system immutable-bit guarantee. The command freezes a SQLite audit high-water mark and reads only through that fixed snapshot. The main database schema and data, including audit, jobs, grants and controller state, remain unchanged; a SQLite read-only snapshot may create or use WAL/SHM coordination sidecars. Repeating an interrupted or completed export is idempotent: already committed matching batches are retained. Files are committed with private permissions using a synced exclusive temporary file, a no-overwrite hard link, temporary unlink and directory sync; a matching crash residue is recovered under the archive lock. The verifier checks the complete local batch chain, including canonical records, contiguous sequence numbers and the previous-batch digest, and reports the source binding plus external anchor tuple `{ archiveInstanceId, highestSequence, headDigest }`. An empty or control-only directory is not a verifiable archive.
 
 Prepare two distinct canonical, operator-owned directories before running the command; neither directory may be a symlink, group/other-accessible, or the same directory. The archive command does not create or loosen the state root. For a new archive directory, use an owner-only umask and mode explicitly:
 
@@ -193,10 +423,10 @@ The local hash chain proves integrity and linkage relative to a trusted digest;
 
 | Surface | Authority |
 | --- | --- |
-| Filesystem | Host owns a `0700` state directory, `0600` ledger and per-job staging. A separate operator-owned `0700` audit archive may contain canonical hash-linked NDJSON batches; neither state nor archive root is mounted or bind-mounted into a worker. The worker sees its byte/inode-limited tmpfs workspace plus its configured image. Console/artifact results and diagnostic witnesses persist in the private ledger. The Host reads Linux `/proc`, the protected `/run/docker.pid`, and socket metadata for best-effort diagnostics; missing metadata never grants release. No writable Host bind is exposed. Observed storage admission and opt-in result retention are described below; they are not a hard filesystem quota. |
-| Network | Host uses the fixed local Docker Unix socket. The worker has `--network none`, no Host socket/config mount and no external action endpoint. |
-| Subprocess | Host starts the fixed configured Docker executable and packaged detached Node supervisor, and may read fixed docker.service/docker.socket properties through /usr/bin/systemctl for diagnostics. Workers run `/bin/sh` with non-root UID/GID, read-only image filesystem, dropped capabilities, `no-new-privileges`, memory/CPU/PID limits, bounded `/tmp` and `/dev/shm`, and disabled Docker log storage. A fixed BusyBox keeper retains the job volume across execution-container removal and does not execute job code. |
-| Credentials | Worker receives no Host environment or credential files. The Docker daemon access itself is a privileged trusted Host capability. Images must contain no embedded secrets. |
+| Filesystem | Host owns a `0700` state directory, `0600` ledger and per-job staging. A separate operator-owned `0700` audit archive may contain canonical hash-linked NDJSON batches; neither state nor archive root is mounted or bind-mounted into a worker. The worker sees its byte/inode-limited tmpfs workspace plus its configured image or approved native runtime roots. Console/artifact results and diagnostic witnesses persist in the private ledger. The Host reads Linux `/proc`, the protected `/run/docker.pid`, and socket metadata for best-effort diagnostics; missing metadata never grants release. No writable Host bind is exposed. Observed storage admission and opt-in result retention are described below; they are not a hard filesystem quota. |
+| Network | Docker uses its fixed local Unix socket; native Linux does not contact Docker. Workers have no network, Host socket/config mount or external action endpoint. |
+| Subprocess | Native Linux uses the fixed packaged keeper, unshare, mount, bubblewrap and Python/libseccomp programs described above. Docker starts the fixed configured Docker executable and packaged detached Node supervisor, and may read fixed docker.service/docker.socket properties through /usr/bin/systemctl for diagnostics. Workers run `/bin/sh` with non-root UID/GID, read-only image filesystem, dropped capabilities, `no-new-privileges`, memory/CPU/PID limits, bounded `/tmp` and `/dev/shm`, and disabled Docker log storage. A fixed BusyBox keeper retains the job volume across execution-container removal and does not execute job code. |
+| Credentials | Worker receives no Host environment or credential files. The Docker daemon access itself is a privileged trusted Host capability. Images and approved runtime roots must contain no embedded secrets. |
 | Browser | None. |
 | Install scripts | No runtime provisioning, image pull or privileged install hook. Standard package build/prepack only. |
 
@@ -224,10 +454,58 @@ The default export is the Cordis plugin object with stable name, Config and appl
 
 ### 可信目标产物与独立验收
 
-schema v6 新增可空的 artifact admission 绑定，v1–v5 行迁移后保留且不会被追认为目标产物。Host 在真实 Goals native round 内，于 Docker 派发前固定 step acceptance ID/digest、run、turn 与声明输出路径；相同幂等键不会重新绑定。运行中若原 admission 改变则取消。私有 `readAcceptedArtifact` 只读取同一 v4 step scope/owner/Session 的成功、已静止、有效期内且正文未清理的产物；较新的同路径失败尝试禁止回退旧结果。
+schema v6 新增可空的 artifact admission 绑定，v1–v5 行迁移后保留且不会被追认为目标产物。Host 在真实 Goals native round 内，于隔离任务派发前固定 step acceptance ID/digest、run、turn 与声明输出路径；相同幂等键不会重新绑定。运行中若原 admission 改变则取消。私有 `readAcceptedArtifact` 只读取同一 v4 step scope/owner/Session 的成功、已静止、有效期内且正文未清理的产物；较新的同路径失败尝试禁止回退旧结果。
 
 Host Verifier 可使用导出的 `IsolatedVerifierRunner` 在独立私有 stateRoot 中验收复制产物。该类没有模型工具入口，固定 authority/镜像/命令、次数、累计预留时长及期限，可选 `socketPath` 与普通隔离任务遵循相同的本地 Docker socket 约束，并复用相同 Docker supervisor 和资源边界。验收任务与原产物 job 是不同 ID；验收不在宿主执行模型代码。未知派发仍保留资源占用且不自动重放，重复 setup 或重启也不会重置预算。
 
 The read-only `isolation_grants` tool exposes usable grant IDs and remaining limits only for the current authenticated owner and workspace/preset. It applies live Policy, principal lineage, expiry and revocation checks; it cannot create or extend grants and returns no credentials or Host paths. When Policy allows discovery and at least one grant remains usable for that exact owner, the Host registers its exact tool definition for finite preauthorization so this read-only query skips the redundant native risk prompt. Revocation, expiry, owner/scope mismatch, Policy denial, tool replacement, or bundle unload removes that preauthorization. Use a returned ID with `isolation_run`.
 
 Native skill benchmark cells may expose `skill_run` and `skill_status` through the same preauthorization gate. Only the exact Skills definitions with a current, owner-bound isolation-only delegation can execute. This does not enable Host filesystem/shell tools or ordinary saved workflows in an isolated scope; every nested isolation job still needs its own finite grant. See [native skill reuse](../../docs/native-skill-reuse.md).
+
+## Non-activating native resources
+
+`@dsh-enhanced/assistant-isolation/native-resources` is a programmatic resource
+entry, with no Cordis plugin/default export. Importing it does not mount Isolation
+or create grants. `freezeLinuxRuntimeSource({kind:'git-object', repository, commit,
+version})` reads exact commit objects from an existing checkout or bare repository;
+`local-head` captures HEAD even when the working tree is dirty. Neither executes
+repository scripts nor creates an RSI workspace or repair branch. `official-tag`
+fetches only `refs/tags/v<exact-version>` from the fixed official GitHub repository
+into a private temporary bare object database and removes it afterwards. This
+requires HTTPS Git access; cancellation and each command are bounded.
+
+The resulting `{version,sourceCommit,manifests:[{path,bytes}]}` is a manifest byte
+snapshot, not an authenticity certificate. The trusted caller selects the source.
+Preparation copies and validates the root manifests, complete lockfile importer
+inventory, workspace manifests, exact cohort version/package manager and workspace
+links; caller-provided hashes are never accepted as evidence. Workspace YAML only
+permits the reviewed declarative `packages`, `catalog`, `linkWorkspacePackages`,
+`allowBuilds` and `minimumReleaseAgeExclude` fields with strict value shapes.
+Unknown pnpm settings, package-level `pnpm`/`devEngines`/`engines.runtime`, and
+lockfile configuration dependencies are rejected rather than stripped; normal
+`engines.node` constraints remain supported. No source code or
+package lifecycle script is executed. Arbitrary workspace patterns and nonregistry
+resolutions are unsupported.
+
+`prepareLinuxRuntime({dshHome,profile,source,signal?,nodeArchivePath?,
+pnpmArchivePath?,pnpmExeArchivePath?,pnpmNativeArchivePath?,revalidateSource?})`
+prepares pinned official Node/pnpm archives and the frozen dependency closure with
+scripts and pnpmfile hooks explicitly disabled. Cache archives are still checked against fixed SHA-256 values.
+The optional programmatic `revalidateSource` fence authenticates caller-specific
+provenance before/after preparation and retained-tree verification. It is trusted
+Host code, not a serialized config or model callback.
+
+`readLinuxRuntime({dshHome,profile,source,signal?,revalidateSource?})` only reopens
+and verifies an existing private runtime; it does not download, create, repair or
+rebuild it. Both return `PreparedLinuxRuntime` schema 3 and retain the prior RSI
+receipt location `rsi-linux-runtimes/<profile>`, exact receipt field order/digests,
+archive pins and whole-tree/inode validation. The path name is compatibility
+storage, not a requirement for an RSI source workspace.
+
+`discoverLinuxCgroupRoots({signal?})` independently reads existing delegated v1
+roots. It never prepares or grants a cgroup and is deliberately not a prerequisite
+of the base resource builder. `probeLinuxIsolationRuntime` is re-exported unchanged:
+calling it explicitly performs the existing finite isolation probe. Resources do
+not start Host services, configure owners/grants, renew budgets or run sudo. Linux
+x64/arm64 is required for prepare/read/discovery; importing and freezing manifests
+also work on macOS. Offline fixtures do not establish Linux live readiness.

package/lib/audit-archive.d.ts

@@ -9,7 +9,7 @@ export interface IsolationAuditArchiveManifest {
     readonly count: number;
     readonly firstSequence: number;
     readonly lastSequence: number;
-    readonly ledgerSchema: 6 | 7;
+    readonly ledgerSchema: 6 | 7 | 8 | 9;
     readonly previousDigest: string | null;
     readonly protocol: typeof ISOLATION_AUDIT_ARCHIVE_PROTOCOL;
     readonly snapshotThroughSequence: number;

package/lib/audit-archive.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-archive.d.ts","sourceRoot":"","sources":["../src/audit-archive.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,gCAAgC,EAAG,gCAAyC,CAAA;AAgBzF,MAAM,MAAM,8BAA8B,GAAG,UAAU,GAAG,eAAe,GAAG,cAAc,GAAG,gBAAgB,GAAG,iBAAiB,GAAG,IAAI,CAAA;AAExI,qBAAa,0BAA2B,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,8BAA8B;gBAApC,IAAI,EAAE,8BAA8B,EAAE,OAAO,GAAE,MAAa;CAIlF;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,CAAA;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IACtC,QAAQ,CAAC,QAAQ,EAAE,OAAO,gCAAgC,CAAA;IAC1D,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAA;IACxC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAA;IACtC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;CACpB;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAA;IACpB,QAAQ,CAAC,QAAQ,EAAE,OAAO,gCAAgC,CAAA;IAC1D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAA;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAA;CACvC;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,YAAY,EAAE,iCAAiC,CAAA;CACzD;AA+PD,8HAA8H;AAC9H,wBAAgB,2BAA2B,CAAC,gBAAgB,EAAE,MAAM,GAAG,iCAAiC,CAOvG;AA4KD,iGAAiG;AACjG,wBAAgB,qBAAqB,CAAC,OAAO,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,2BAA2B,CAqE/I"}
+{"version":3,"file":"audit-archive.d.ts","sourceRoot":"","sources":["../src/audit-archive.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,gCAAgC,EAAG,gCAAyC,CAAA;AAezF,MAAM,MAAM,8BAA8B,GAAG,UAAU,GAAG,eAAe,GAAG,cAAc,GAAG,gBAAgB,GAAG,iBAAiB,GAAG,IAAI,CAAA;AAExI,qBAAa,0BAA2B,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,8BAA8B;gBAApC,IAAI,EAAE,8BAA8B,EAAE,OAAO,GAAE,MAAa;CAIlF;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACpC,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IACtC,QAAQ,CAAC,QAAQ,EAAE,OAAO,gCAAgC,CAAA;IAC1D,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAA;IACxC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAA;IACtC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;CACpB;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAA;IACpB,QAAQ,CAAC,QAAQ,EAAE,OAAO,gCAAgC,CAAA;IAC1D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAA;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAA;CACvC;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,YAAY,EAAE,iCAAiC,CAAA;CACzD;AA+PD,8HAA8H;AAC9H,wBAAgB,2BAA2B,CAAC,gBAAgB,EAAE,MAAM,GAAG,iCAAiC,CAOvG;AA4LD,iGAAiG;AACjG,wBAAgB,qBAAqB,CAAC,OAAO,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,2BAA2B,CAsE/I"}

package/lib/audit-archive.js

@@ -3,7 +3,6 @@ import { closeSync, constants, existsSync, fchmodSync, fstatSync, fsyncSync, lin
 import { isAbsolute, join, relative, resolve } from 'node:path';
 import { DatabaseSync } from 'node:sqlite';
 export const ISOLATION_AUDIT_ARCHIVE_PROTOCOL = 'dsh-isolation-audit-archive/v1';
-const LEDGER_SCHEMA = 7;
 const DEFAULT_BATCH_SIZE = 100;
 const MAX_BATCH_SIZE = 1_000;
 const MAX_TEXT_LENGTH = 16_384;
@@ -197,7 +196,7 @@ function validateLockedControlPath(identity) {
 function decodeManifest(value) {
     const keys = ['archiveInstanceId', 'count', 'firstSequence', 'lastSequence', 'ledgerSchema', 'previousDigest', 'protocol', 'snapshotThroughSequence', 'sourceStateRootDigest', 'type', 'version'];
     if (!plain(value) || !exactKeys(value, keys) || typeof value.archiveInstanceId !== 'string' || !ARCHIVE_INSTANCE_ID.test(value.archiveInstanceId) || typeof value.sourceStateRootDigest !== 'string' || !DIGEST.test(value.sourceStateRootDigest) || !safeNatural(value.count) || value.count > MAX_BATCH_SIZE
-        || !safePositive(value.firstSequence) || !safeNatural(value.lastSequence) || ![6, 7].includes(value.ledgerSchema)
+        || !safePositive(value.firstSequence) || !safeNatural(value.lastSequence) || ![6, 7, 8, 9].includes(value.ledgerSchema)
         || (value.previousDigest !== null && (typeof value.previousDigest !== 'string' || !DIGEST.test(value.previousDigest)))
         || value.protocol !== ISOLATION_AUDIT_ARCHIVE_PROTOCOL || !safeNatural(value.snapshotThroughSequence) || value.type !== 'manifest' || value.version !== 1)
         fail('invalid-archive', 'invalid audit archive manifest');
@@ -512,21 +511,39 @@ function beginArchiveControl(directory, sourceStateRootDigest) {
 }
 function validateLedgerFile(state) {
     const path = join(state.path, 'ledger.sqlite');
+    let descriptor;
     try {
-        const inspected = inspectPrivateFile(path, 'isolation ledger');
-        return { path, descriptor: inspected.descriptor };
+        // The source ledger is append-only while a live writer holds it, so its size
+        // may grow between stat and open. Identity (device/inode/owner/mode/link
+        // count) must still be stable: a replacement remains invalid-source.
+        const before = lstatSync(path, { bigint: true });
+        const owner = BigInt(process.getuid?.() ?? -1);
+        if (!before.isFile() || before.isSymbolicLink() || before.nlink !== 1n || before.uid !== owner
+            || (before.mode & 4095n) !== 384n)
+            fail('invalid-source', 'isolation ledger must be one private owned regular file');
+        descriptor = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+        const opened = fstatSync(descriptor, { bigint: true });
+        const after = lstatSync(path, { bigint: true });
+        if (!opened.isFile() || opened.nlink !== 1n || opened.uid !== owner || (opened.mode & 4095n) !== 384n
+            || !after.isFile() || after.isSymbolicLink() || after.nlink !== 1n || after.uid !== owner
+            || (after.mode & 4095n) !== 384n || !sameInode(before, opened) || !sameInode(opened, after)) {
+            fail('invalid-source', 'isolation ledger changed while being opened');
+        }
+        return { path, descriptor };
     }
     catch (error) {
+        if (descriptor !== undefined)
+            closeSync(descriptor);
         if (error instanceof IsolationAuditArchiveError)
             fail('invalid-source', error.message);
-        throw error;
+        fail('invalid-source', 'isolation ledger is unavailable');
     }
 }
 function validateLedgerSnapshot(database) {
     const userVersion = database.prepare('PRAGMA user_version').get().user_version;
     const schema = database.prepare("SELECT value FROM schema_meta WHERE key='schema-version'").get();
-    if (userVersion !== LEDGER_SCHEMA || schema?.value !== String(LEDGER_SCHEMA))
-        fail('invalid-source', 'isolation ledger schema 7 is required');
+    if (userVersion !== 7 && userVersion !== 8 && userVersion !== 9 || schema?.value !== String(userVersion))
+        fail('invalid-source', 'isolation ledger schema 7, 8 or 9 is required');
     const highWater = database.prepare("SELECT COALESCE((SELECT seq FROM sqlite_sequence WHERE name='isolation_audit'), 0) AS sequence").get().sequence;
     if (!safeNatural(highWater))
         fail('invalid-source', 'isolation audit high-water is invalid');
@@ -579,8 +596,8 @@ function rowRecord(row, expectedSequence) {
     return freeze({ action: row.action, detail: row.detail, grantId: row.grant_id, jobId: row.job_id, occurredAt: row.occurred_at, sequence: row.sequence });
 }
 function recordsEqual(left, right) { return canonical(left) === canonical(right); }
-function makeManifest(archiveInstanceId, sourceStateRootDigest, firstSequence, lastSequence, count, snapshotThroughSequence, previousDigest) {
-    return freeze({ archiveInstanceId, count, firstSequence, lastSequence, ledgerSchema: LEDGER_SCHEMA, previousDigest, protocol: ISOLATION_AUDIT_ARCHIVE_PROTOCOL, snapshotThroughSequence, sourceStateRootDigest, type: 'manifest', version: 1 });
+function makeManifest(archiveInstanceId, sourceStateRootDigest, firstSequence, lastSequence, count, snapshotThroughSequence, previousDigest, ledgerSchema) {
+    return freeze({ archiveInstanceId, count, firstSequence, lastSequence, ledgerSchema, previousDigest, protocol: ISOLATION_AUDIT_ARCHIVE_PROTOCOL, snapshotThroughSequence, sourceStateRootDigest, type: 'manifest', version: 1 });
 }
 function encodeFile(manifest, records) {
     return Buffer.from(`${[canonical(manifest), ...records.map(record => canonical(record))].join('\n')}\n`, 'utf8');
@@ -674,7 +691,7 @@ export function archiveIsolationAudit(options) {
         if (!disjoint(state.path, archive.path) || (state.device === archive.device && state.inode === archive.inode))
             fail('invalid-path', 'state root and archive directory must be disjoint');
         // Do not initialize or bind an archive when the requested source cannot
-        // first prove that it is a complete schema-6 audit ledger. The locked
+        // first prove that it is a complete supported audit ledger. The locked
         // snapshot below repeats these checks authoritatively.
         preflightLedger(state);
         const controlLock = beginArchiveControl(archive, digest(state.path));
@@ -686,6 +703,7 @@ export function archiveIsolationAudit(options) {
         ledgerDescriptor = snapshot.descriptor;
         transaction = true;
         const highWater = snapshot.highWater;
+        const ledgerSchema = database.prepare('PRAGMA user_version').get().user_version;
         if (existing.verification.highestSequence > highWater || existing.verification.snapshotThroughSequence > highWater)
             fail('conflict', 'archive does not match this isolation ledger');
         let archivedIndex = 0;
@@ -703,7 +721,7 @@ export function archiveIsolationAudit(options) {
         let afterSequence = existing.verification.highestSequence;
         let previousDigest = existing.verification.headDigest;
         if (highWater === 0 && previousDigest === null) {
-            const publication = publish(archive, encodeFile(makeManifest(controlLock.archiveInstanceId, controlLock.sourceStateRootDigest, 1, 0, 0, 0, null), []));
+            const publication = publish(archive, encodeFile(makeManifest(controlLock.archiveInstanceId, controlLock.sourceStateRootDigest, 1, 0, 0, 0, null, ledgerSchema), []));
             if (publication.created)
                 createdFiles.push(publication.name);
             previousDigest = publication.digest;
@@ -719,7 +737,7 @@ export function archiveIsolationAudit(options) {
                 while (cursor < decoded.length && records.length < input.batchSize) {
                     const candidate = decoded[cursor];
                     const next = [...records, candidate];
-                    const provisional = makeManifest(controlLock.archiveInstanceId, controlLock.sourceStateRootDigest, next[0].sequence, next.at(-1).sequence, next.length, highWater, previousDigest);
+                    const provisional = makeManifest(controlLock.archiveInstanceId, controlLock.sourceStateRootDigest, next[0].sequence, next.at(-1).sequence, next.length, highWater, previousDigest, ledgerSchema);
                     if (encodeFile(provisional, next).byteLength > MAX_ARCHIVE_FILE_BYTES) {
                         if (records.length === 0)
                             fail('invalid-source', 'one audit record exceeds the archive file bound');
@@ -728,7 +746,7 @@ export function archiveIsolationAudit(options) {
                     records.push(candidate);
                     cursor += 1;
                 }
-                const manifest = makeManifest(controlLock.archiveInstanceId, controlLock.sourceStateRootDigest, records[0].sequence, records.at(-1).sequence, records.length, highWater, previousDigest);
+                const manifest = makeManifest(controlLock.archiveInstanceId, controlLock.sourceStateRootDigest, records[0].sequence, records.at(-1).sequence, records.length, highWater, previousDigest, ledgerSchema);
                 const publication = publish(archive, encodeFile(manifest, records));
                 if (publication.created) {
                     createdFiles.push(publication.name);