@enterpriseai/cli 3.19.0 → 3.19.1

package/resources/gofer/node-scripts/gofer-acceptance-check.mjs

@@ -0,0 +1,143 @@
+import { spawn } from 'node:child_process';
+import { mkdir, realpath, open } from 'node:fs/promises';
+import path from 'node:path';
+import { randomUUID, createHash } from 'node:crypto';
+
+const positive = value => Number.isSafeInteger(value) && value > 0;
+const text = value => typeof value === 'string' && value.trim().length > 0;
+
+/** Commands must come from reviewed host configuration, never worker output. */
+export function createAcceptanceChecker({ workspaceRoot, evidenceDir, commands,
+  getInputRevision, verifyCleanup, timeoutMs = 60000, maxOutputBytes = 65536 }) {
+  if (!path.isAbsolute(workspaceRoot) || !path.isAbsolute(evidenceDir) ||
+      !positive(timeoutMs) || timeoutMs > 3600000 || !positive(maxOutputBytes) || maxOutputBytes > 1048576 ||
+      typeof getInputRevision !== 'function' || !commands || Array.isArray(commands)) throw new Error('INVALID_CHECK_CONFIGURATION');
+  const approved = structuredClone(commands);
+  for (const [id, command] of Object.entries(approved)) {
+    if (!text(id) || !command || !path.isAbsolute(command.program) || /\.(?:cmd|bat)$/i.test(command.program) ||
+        !Array.isArray(command.args) || command.args.length > 1000 ||
+        command.args.some(arg => typeof arg !== 'string' || arg.includes('\0') || arg.length > 65536)) throw new Error('INVALID_APPROVED_COMMAND');
+  }
+  return async function check(request) {
+    const { taskId, revision, inputRevision, signal, check: checkId } = request;
+    request = Object.freeze({ taskId, revision, inputRevision, signal, check: checkId });
+    if (!/^T\d+$/.test(taskId) || !text(revision) || !text(inputRevision) || !Object.hasOwn(approved, checkId)) throw new Error('UNAPPROVED_CHECK');
+    const command = approved[checkId];
+    const readRevision = async () => {
+      let timer;
+      try { return await Promise.race([
+        Promise.resolve().then(() => getInputRevision(request)),
+        new Promise((_, reject) => { timer = setTimeout(() => reject(new Error('INPUT_CHECK_TIMEOUT')), timeoutMs); }),
+      ]); } finally { clearTimeout(timer); }
+    };
+    const cwd = await realpath(workspaceRoot);
+    if (await readRevision() !== inputRevision) throw new Error('STALE_INPUT');
+    await mkdir(evidenceDir, { recursive: true, mode: 0o700 });
+    const evidenceRoot = await realpath(evidenceDir);
+    if (signal?.aborted) throw new Error('CANCELLED');
+    const startedAt = new Date().toISOString();
+    const result = await new Promise(resolve => {
+      let child;
+      let timer;
+      let killTimer;
+      let settlementTimer;
+      let reason = null;
+      let bytes = 0;
+      const captured = Buffer.alloc(maxOutputBytes);
+      let settled = false;
+      const stop = cause => {
+        if (reason) return;
+        reason = cause;
+        if (!child?.pid) return;
+        if (process.platform === 'win32') {
+          // Kill only the tree started by this check, never a port or process name.
+          const killer = spawn(path.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'taskkill.exe'),
+            ['/PID', String(child.pid), '/T', '/F'], { shell: false, stdio: 'ignore', windowsHide: true });
+          killer.on('error', () => { child.kill(); });
+          killer.unref();
+        } else {
+          try { process.kill(-child.pid, 'SIGTERM'); } catch { /* Already exited. */ }
+          killTimer ??= setTimeout(() => { try { process.kill(-child.pid, 'SIGKILL'); } catch { /* Already exited. */ } }, 250);
+        }
+        settlementTimer = setTimeout(() => {
+          child.stdout.destroy(); child.stderr.destroy(); child.unref();
+          finish(null, new Error('CLEANUP_UNVERIFIED'));
+        }, 1000);
+      };
+      const cancel = () => stop('cancelled');
+      const finish = (code, error) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        // After the parent exits, still terminate any surviving local descendants.
+        if (process.platform !== 'win32' && child?.pid) {
+          try { process.kill(-child.pid, 'SIGKILL'); } catch { /* Tree has exited. */ }
+        }
+        clearTimeout(killTimer);
+        clearTimeout(settlementTimer);
+        signal?.removeEventListener('abort', cancel);
+        resolve({ executed: !!child?.pid, pid: child?.pid ?? null, exitCode: reason || error ? 1 : code ?? 1,
+          reason: reason || (error ? 'spawn-failed' : code === 0 ? 'passed' : 'failed'),
+          output: captured.toString('utf8', 0, bytes), capturedBytes: bytes });
+      };
+      if (signal?.aborted) { reason = 'cancelled'; finish(null); return; }
+      // No shell, credential flags or inherited stdin. The reviewed process owns its side effects.
+      child = spawn(command.program, command.args, { cwd, shell: false, detached: process.platform !== 'win32',
+        windowsHide: true, stdio: ['ignore', 'pipe', 'pipe'] });
+      const collect = data => {
+        const remaining = Math.max(0, maxOutputBytes - bytes);
+        const accepted = Math.min(data.length, remaining);
+        if (accepted) { data.copy(captured, bytes, 0, accepted); bytes += accepted; }
+        if (data.length > remaining) stop('output-limit');
+      };
+      child.stdout.on('data', collect); child.stderr.on('data', collect);
+      child.on('error', error => finish(null, error));
+      child.on('close', code => finish(code));
+      signal?.addEventListener('abort', cancel, { once: true });
+      timer = setTimeout(() => stop('timeout'), timeoutMs);
+      if (signal?.aborted) cancel();
+    });
+    if (signal?.aborted) { result.exitCode = 1; result.reason = 'cancelled'; }
+    try {
+      if (await readRevision() !== inputRevision) { result.exitCode = 1; result.reason = 'stale-input'; }
+    } catch { result.exitCode = 1; result.reason = 'input-unverifiable'; }
+    // A closed parent does not prove detached descendants or remote work stopped.
+    let cleanup;
+    let cleanupTimer;
+    try {
+      cleanup = await Promise.race([
+        Promise.resolve().then(() => verifyCleanup?.({ ...request, pid: result.pid, startedAt })),
+        new Promise(resolve => { cleanupTimer = setTimeout(() => resolve(null), 1000); }),
+      ]);
+    } catch { cleanup = null; } finally { clearTimeout(cleanupTimer); }
+    const cleanupVerified = cleanup?.allStopped === true && cleanup.pid === result.pid &&
+      cleanup.startedAt === startedAt && text(cleanup.receipt);
+    if (!cleanupVerified && result.exitCode === 0) { result.exitCode = 1; result.reason = 'cleanup-unverified'; }
+    if (signal?.aborted) { result.exitCode = 1; result.reason = 'cancelled'; }
+    const record = { schemaVersion: 1, taskId, revision, inputRevision, check: checkId,
+      ...result, startedAt, finishedAt: new Date().toISOString(),
+      cleanupVerified, cleanupReceipt: cleanupVerified ? cleanup.receipt : null,
+      outputSha256: createHash('sha256').update(result.output).digest('hex'),
+      command: { program: command.program, args: command.args }, evidenceKind: 'local-command', nativeModelProof: false };
+    const receipt = path.join(evidenceRoot, `${taskId}-${randomUUID()}.json`);
+    const file = await open(receipt, 'wx', 0o600);
+    try {
+      await file.writeFile(JSON.stringify(record, null, 2));
+      await file.sync();
+      // Cancellation can arrive while evidence is being persisted. Rewrite the
+      // receipt so a successful result can never survive that cancellation.
+      if (signal?.aborted) {
+        record.exitCode = 1;
+        record.reason = 'cancelled';
+        const body = JSON.stringify(record, null, 2);
+        await file.truncate(0);
+        await file.write(body, 0, 'utf8');
+        await file.truncate(Buffer.byteLength(body));
+        await file.sync();
+      }
+    } finally { await file.close(); }
+    // Keep raw command output in the private receipt, not in the model context.
+    return { taskId, revision, inputRevision, check: checkId, executed: result.executed,
+      exitCode: result.exitCode, reason: result.reason, receipt, cleanupVerified, evidenceKind: 'local-command', nativeModelProof: false };
+  };
+}

package/resources/gofer/node-scripts/gofer-agent-catalog.mjs

@@ -0,0 +1,271 @@
+#!/usr/bin/env node
+/** Shared, read-only specialist assignments. No provider SDKs or model execution. */
+import { createHash } from 'node:crypto';
+import { readFile, realpath, stat } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const MODULE_ROOT = fileURLToPath(new URL('../../../', import.meta.url));
+const REFERENCE = '.specify/references/agent-catalog.json';
+const SURFACES = ['claude', 'codex', 'copilot', 'vscode', 'grok', 'antigravity', 'gemini'];
+const CAPABILITIES = ['independentReadIsolation', 'independentExecution'];
+const BODY_NOTICE = `## Assignment Authority
+
+Provider-specific examples within the role body, including Task(...) calls,
+model names, tool names and launch syntax, are advisory and non-authoritative.
+They do not select a model, grant tool access, authorize execution, or establish
+independence. Follow the caller-bound assignment fields, dispatchAllowed gate,
+and host-enforced permissions while preserving the role's responsibilities.
+Baseline work must never be described as independent. This assignment is not
+evidence that execution occurred.
+
+## Canonical Role Body
+
+`;
+const HELP = `Usage: node gofer-agent-catalog.mjs --list [--json]
+       node gofer-agent-catalog.mjs --help
+
+Read-only specialist catalogue. --list prints role IDs; --json includes neutral
+role bodies and surface declarations. Paths are relative to the installed helper,
+not the current directory. No models are selected or launched.
+API: readCatalogue({ root? }); resolveAssignment(request, { root?, verifyNativeProof? }).
+`;
+
+function requireValue(condition, message) {
+  if (!condition) throw new Error(`Agent catalogue: ${message}`);
+}
+
+function isRecord(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+function text(value, field, max = 4000) {
+  requireValue(typeof value === 'string' && value.trim().length > 0 &&
+    value === value.trim() && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value),
+  `${field} must be non-empty text without surrounding whitespace or control characters`);
+  return value;
+}
+
+function stringList(value, field, allowEmpty = false) {
+  requireValue(Array.isArray(value) && (allowEmpty || value.length > 0), `${field} must be an array${allowEmpty ? '' : ' with at least one entry'}`);
+  for (const item of value) text(item, field);
+  requireValue(new Set(value).size === value.length, `${field} must not contain duplicates`);
+  return value;
+}
+
+function validateCatalogue(catalogue) {
+  requireValue(isRecord(catalogue) && catalogue.schemaVersion === 1, 'unsupported schemaVersion');
+  stringList(catalogue.stages, 'stages');
+  requireValue(catalogue.stages.every(stage => /^(?:\d+[a-z]?_[a-z0-9_]+|gofer_[a-z0-9_]+|gofer:[a-z0-9-]+)$/.test(stage)), 'invalid stage ID');
+  requireValue(Array.isArray(catalogue.roles) && catalogue.roles.length > 0, 'roles must be a non-empty array');
+  const ids = [];
+  for (const role of catalogue.roles) {
+    requireValue(isRecord(role) && typeof role.id === 'string' && /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/.test(role.id), 'invalid role ID');
+    requireValue(role.body === `agents/${role.id}.md`, `invalid body reference for ${role.id}`);
+    requireValue(Object.keys(role).every(key => ['id', 'body'].includes(key)), `role ${role.id} must reference its body, not duplicate it`);
+    ids.push(role.id);
+  }
+  stringList(ids, 'role IDs');
+  requireValue(Array.isArray(catalogue.surfaces) && catalogue.surfaces.length === SURFACES.length, 'missing or duplicate surface records');
+  const seen = new Set();
+  for (const surface of catalogue.surfaces) {
+    requireValue(isRecord(surface) && SURFACES.includes(surface.id) && !seen.has(surface.id), 'invalid or duplicate surface');
+    seen.add(surface.id);
+    requireValue(surface.legacy === (surface.id === 'gemini') && surface.evidenceKind === 'self-declaration' &&
+      CAPABILITIES.every(key => surface[key] === 'unqualified'), `surface ${surface.id} must not claim native proof`);
+    requireValue(Object.keys(surface).every(key => ['id', 'legacy', 'evidenceKind', ...CAPABILITIES].includes(key)), `unexpected surface metadata for ${surface.id}`);
+  }
+}
+
+function contained(base, target) {
+  const relative = path.relative(base, target);
+  return relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+}
+
+async function safePath(base, target) {
+  const resolved = await realpath(target);
+  requireValue(contained(base, resolved), `path escapes outside canonical directory: ${target}`);
+  return resolved;
+}
+
+async function roleDirectory(root) {
+  // Choose one layout for the whole catalogue. Never hide a broken bundle by
+  // mixing packaged roles with repository copies or searching a parent checkout.
+  for (const directory of ['agents', '.claude/agents']) {
+    const candidate = path.join(root, directory);
+    let info;
+    try { info = await stat(candidate); }
+    catch (error) {
+      if (error.code === 'ENOENT') continue;
+      throw error;
+    }
+    requireValue(info.isDirectory(), `role source is not a directory: ${candidate}`);
+    return { directory, resolved: await safePath(root, candidate) };
+  }
+  throw new Error(`Agent catalogue: no canonical agents/ or .claude/agents/ directory in ${root}`);
+}
+
+function neutralBody(raw, source) {
+  const content = raw.replace(/^\uFEFF/, '');
+  if (!/^---[ \t]*(?:\r?\n|$)/.test(content)) {
+    requireValue(content.trim().length > 0, `empty role body: ${source}`);
+    return content;
+  }
+  // Remove the entire provider header, without interpreting YAML or carrying
+  // model/tool settings into another host. Preserve everything after the fence.
+  const match = content.match(/^---[ \t]*\r?\n(?:[\s\S]*?\r?\n)?---[ \t]*(?:\r?\n|$)/);
+  requireValue(match, `unclosed frontmatter: ${source}`);
+  const body = content.slice(match[0].length);
+  requireValue(body.trim().length > 0, `empty role body: ${source}`);
+  return body;
+}
+
+/**
+ * Load and validate the catalogue and every canonical role body.
+ * @param {{root?: string}} [options] Installation/repository root; defaults to
+ * the helper's own root, including in relocated bundles. Never defaults to cwd.
+ * @returns {Promise<{schemaVersion: number, stages: string[], surfaces: object[],
+ * roles: Array<{id: string, body: string, source: string, content: string, contentSha256: string}>}>}
+ */
+export async function readCatalogue(options = {}) {
+  requireValue(isRecord(options), 'options must be an object');
+  const root = await realpath(path.resolve(text(options.root ?? MODULE_ROOT, 'root')));
+  const catalogueFile = await safePath(root, path.join(root, REFERENCE));
+  const catalogue = JSON.parse(await readFile(catalogueFile, 'utf8'));
+  validateCatalogue(catalogue);
+  const { directory, resolved } = await roleDirectory(root);
+  const roles = [];
+  for (const role of catalogue.roles) {
+    const source = `${directory}/${role.id}.md`;
+    const file = await safePath(resolved, path.join(resolved, `${role.id}.md`));
+    const content = neutralBody(await readFile(file, 'utf8'), source);
+    roles.push({ ...role, source, content, contentSha256: createHash('sha256').update(content).digest('hex') });
+  }
+  return { schemaVersion: catalogue.schemaVersion, stages: catalogue.stages, surfaces: catalogue.surfaces, roles };
+}
+
+function validateScope(scope) {
+  stringList(scope, 'scope');
+  for (const entry of scope) {
+    requireValue(entry === '.' || (!/^[\/]/.test(entry) && !/[\\:*?"<>|]/.test(entry) &&
+      entry.split('/').every(part => part !== '' && part !== '.' && part !== '..')),
+    `scope must contain normalized repository-relative literal paths: ${entry}`);
+  }
+  return [...scope];
+}
+
+function proofMatches(proof, binding) {
+  return isRecord(proof) && proof.kind === 'native-proof' && isRecord(proof.binding) &&
+    Object.keys(proof.binding).length === Object.keys(binding).length &&
+    Object.keys(binding).every(key => Object.hasOwn(proof.binding, key) &&
+      JSON.stringify(proof.binding[key]) === JSON.stringify(binding[key])) &&
+    CAPABILITIES.every(key => typeof proof[key] === 'boolean') &&
+    Array.isArray(proof.evidence) && proof.evidence.length > 0 &&
+    proof.evidence.every(ref => typeof ref === 'string' && ref.trim().length > 0 && !/[\u0000-\u001f\u007f]/.test(ref));
+}
+
+/**
+ * Prepare an assignment, never execute it or enforce its filesystem scope.
+ * Stage is a catalogue command ID, task is a non-empty ID/description, revision
+ * is a caller-owned revision token (not resolved through Git), and scope is a
+ * non-empty array of normalized repo-relative literal paths ('.' means all).
+ * No role/stage routing policy is imposed here; the controller owns that policy.
+ *
+ * Native proof is untrusted input until verifyNativeProof returns exactly true.
+ * The controller must supply that trusted verifier, check original host evidence,
+ * freshness and actual isolation/execution, and reject self-reported assertions.
+ * This helper checks assignment binding only; it cannot authenticate host logs.
+ *
+ * @param {{role: string, stage: string, task: string, revision: string,
+ * scope: string[], requiredChecks: string[], surface: string, availableModels: string[], model?: string,
+ * mode?: 'baseline'|'independent', capabilities?: {independentReadIsolation?: boolean,
+ * independentExecution?: boolean}, nativeProof?: object}} request
+ * @param {{root?: string, verifyNativeProof?: (proof: object, binding: object) => boolean|Promise<boolean>}} [options]
+ * @returns {Promise<object>} Neutral roleContent with an authority notice, exact
+ * binding, requested/effective mode, status, dispatchAllowed, qualification,
+ * structured limitations, and executed:false. An unqualified independent request
+ * is blocked, never silently downgraded to baseline. Missing models block dispatch.
+ */
+export async function resolveAssignment(request, options = {}) {
+  requireValue(isRecord(request), 'request must be an object');
+  requireValue(isRecord(options), 'options must be an object');
+  requireValue(options.verifyNativeProof === undefined || typeof options.verifyNativeProof === 'function', 'verifyNativeProof must be a trusted host function');
+  const input = structuredClone(request);
+  const roleId = text(input.role, 'role', 100);
+  const stage = text(input.stage, 'stage', 100);
+  const task = text(input.task, 'task');
+  const revision = text(input.revision, 'revision', 200);
+  requireValue(/^[a-zA-Z0-9][a-zA-Z0-9._:/-]*$/.test(revision) && !revision.includes('..'), 'invalid revision token');
+  const scope = validateScope(input.scope);
+  requireValue(Array.isArray(input.requiredChecks) && input.requiredChecks.length <= 256,
+    'requiredChecks must contain at most 256 entries');
+  const requiredChecks = [...stringList(input.requiredChecks, 'requiredChecks')];
+  for (const check of requiredChecks) text(check, 'requiredChecks', 1024);
+  const surfaceId = text(input.surface, 'surface', 100);
+  stringList(input.availableModels, 'availableModels', true);
+  const model = input.model === undefined ? null : text(input.model, 'model', 200);
+  requireValue(model === null || input.availableModels.includes(model), 'model is not in caller-provided availableModels');
+  const requestedMode = input.mode === undefined ? 'baseline' : input.mode;
+  requireValue(['baseline', 'independent'].includes(requestedMode), 'mode must be baseline or independent');
+  const declarations = input.capabilities === undefined ? {} : input.capabilities;
+  requireValue(isRecord(declarations) && Object.entries(declarations).every(([key, value]) => CAPABILITIES.includes(key) && typeof value === 'boolean'), 'capabilities must contain only boolean self-declarations');
+
+  const catalogue = await readCatalogue({ root: options.root });
+  const role = catalogue.roles.find(entry => entry.id === roleId);
+  requireValue(role, `unknown role: ${roleId}`);
+  requireValue(catalogue.stages.includes(stage), `unknown stage: ${stage}`);
+  const surface = catalogue.surfaces.find(entry => entry.id === surfaceId);
+  requireValue(surface, `unknown surface: ${surfaceId}`);
+  const binding = { role: roleId, stage, task, revision, scope, requiredChecks, surface: surfaceId, model, contentSha256: role.contentSha256 };
+  const limitations = [];
+  let verified = false;
+  if (input.nativeProof !== undefined) {
+    if (proofMatches(input.nativeProof, binding) && options.verifyNativeProof) {
+      try {
+        verified = (await options.verifyNativeProof(structuredClone(input.nativeProof), structuredClone(binding))) === true;
+      } catch {
+        verified = false;
+      }
+    }
+    if (!verified) limitations.push({ code: 'NATIVE_PROOF_UNVERIFIED', message: 'Native proof is missing, stale, mismatched or not approved by a trusted host verifier; self-declarations are not native proof.' });
+  }
+  const qualification = {
+    evidenceKind: verified ? 'native-proof' : 'unqualified',
+    declarations,
+    independentReadIsolation: verified && input.nativeProof.independentReadIsolation === true,
+    independentExecution: verified && input.nativeProof.independentExecution === true,
+    evidence: verified ? [...input.nativeProof.evidence] : [],
+  };
+  if (!qualification.independentReadIsolation) limitations.push({ code: 'INDEPENDENT_READ_ISOLATION_UNQUALIFIED', message: 'Independent read isolation is unqualified. Baseline role work must not be described as an independent read.' });
+  if (!qualification.independentExecution) limitations.push({ code: 'INDEPENDENT_EXECUTION_UNQUALIFIED', message: 'Independent execution is unqualified. A role assignment or capability declaration does not prove a separate execution.' });
+  if (model === null) limitations.push({ code: 'MODEL_NOT_SELECTED', message: 'No model was selected by the caller. Role frontmatter and model-list order are not model selection authority.' });
+  const independent = requestedMode === 'independent' && model !== null &&
+    qualification.independentReadIsolation && qualification.independentExecution;
+  const dispatchAllowed = model !== null && (requestedMode === 'baseline' || independent);
+  const mode = requestedMode === 'independent' ? (independent ? 'independent' : 'blocked') : 'baseline';
+  return {
+    ...binding, binding: structuredClone(binding), schemaVersion: 1,
+    roleContent: `${BODY_NOTICE}${role.content}`, source: role.source, surfaceRecord: surface,
+    contentPolicy: { providerExamples: 'non-authoritative', modelSelection: 'caller-provided-only' },
+    requestedMode, mode, independent, status: dispatchAllowed ? 'ready' : 'blocked', dispatchAllowed,
+    qualification, limitations, executed: false, scopeEnforced: false,
+  };
+}
+
+async function main(args) {
+  if (args.length === 1 && args[0] === '--help') {
+    process.stdout.write(HELP);
+    return;
+  }
+  requireValue(args.includes('--list') && new Set(args).size === args.length &&
+    args.every(arg => ['--list', '--json'].includes(arg)), `unsupported arguments.\n${HELP}`);
+  const catalogue = await readCatalogue();
+  process.stdout.write(args.includes('--json') ? `${JSON.stringify(catalogue, null, 2)}\n` : `${catalogue.roles.map(role => role.id).join('\n')}\n`);
+}
+
+if (process.argv[1] && await realpath(process.argv[1]).catch(() => null) === fileURLToPath(import.meta.url)) {
+  main(process.argv.slice(2)).catch(error => {
+    process.stderr.write(`${error.message}\n`);
+    process.exitCode = 1;
+  });
+}

package/resources/gofer/node-scripts/gofer-benchmark-executor.mjs

@@ -0,0 +1,123 @@
+/**
+ * Run the pinned held-out corpus and write receipts in the layout the
+ * verifier, snapshot, and signer read. The executor holds no signing key and
+ * grants no authority. Dispatch and independent review are injected: a real
+ * native dispatch and a real reviewer must be supplied by the trusted caller,
+ * so this module cannot fabricate either.
+ */
+import { createHash } from 'node:crypto';
+import { constants } from 'node:fs';
+import { mkdir, mkdtemp, open, realpath, rm } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { capabilityReceiptHash } from './gofer-host-capability.mjs';
+import { runBenchmark } from './gofer-benchmark.mjs';
+import { loadTrustedHeldOutCorpus } from './gofer-trusted-evaluator.mjs';
+import { runHeldOutSandboxCheck, snapshotHeldOutWorktree } from './gofer-heldout-verifier.mjs';
+
+const text = value => typeof value === 'string' && value.trim().length > 0;
+const sha = value => createHash('sha256').update(value).digest('hex');
+const jsonHash = value => sha(JSON.stringify(value));
+const denied = () => new Error('BENCHMARK_EXECUTOR_REQUIRED');
+const ISOLATION = 'git-worktree+local-os-sandbox';
+const safeRelative = value => typeof value === 'string' && value.length > 0 &&
+  !path.posix.isAbsolute(value) && !value.includes('\\') &&
+  !value.split('/').some(part => !part || part === '.' || part === '..');
+
+async function writePrivate(filename, content) {
+  const file = await open(filename, constants.O_WRONLY | constants.O_CREAT |
+    constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+  try { await file.writeFile(content); await file.sync(); } finally { await file.close(); }
+}
+
+async function materialize(worktree, files) {
+  for (const [name, content] of Object.entries(files)) {
+    if (!safeRelative(name) || typeof content !== 'string') throw denied();
+    const target = path.join(worktree, name);
+    await mkdir(path.dirname(target), { recursive: true, mode: 0o700 });
+    await writePrivate(target, content);
+  }
+}
+
+/**
+ * `dispatchCase({ caseId, run, prompt, allowedWriteScope, worktree })` runs the
+ * model against one prepared worktree and returns
+ * `{ modelId, costUsd, durationMs, isolation }`. `review({ caseId, run,
+ * inputHash, executionReceipt, passed, prompt, worktree, baselineFiles })`
+ * returns `{ receipt, approved }` from a party other than the executor. A
+ * rejected review fails the case even when the protected check passed. `trustRoot` exists for isolated tests only.
+ */
+export async function runHeldOutBenchmark({ workspaceRoot, trustRoot, capabilityReceipt,
+  modelId, harnessId, dispatchCase, review } = {}) {
+  let worktreesRoot;
+  try {
+    if (!text(workspaceRoot) || !path.isAbsolute(workspaceRoot) || !text(modelId) ||
+        !text(harnessId) || capabilityReceipt?.host !== 'codex' ||
+        typeof dispatchCase !== 'function' || typeof review !== 'function') throw denied();
+    const corpus = await loadTrustedHeldOutCorpus({ workspaceRoot, trustRoot });
+    const receipts = path.join(corpus.corpusRoot, 'receipts');
+    await mkdir(receipts, { mode: 0o700 });
+    worktreesRoot = await realpath(await mkdtemp(path.join(os.tmpdir(), 'gofer-heldout-run-')));
+    const receiptHash = capabilityReceiptHash(capabilityReceipt);
+    const cases = new Map(corpus.cases.map(item => [item.id, item]));
+
+    const report = await runBenchmark({
+      cases: corpus.cases,
+      repetitions: 3,
+      provenance: { harnessId, modelId, corpusHash: corpus.corpusHash,
+        capabilityReceiptHash: receiptHash },
+      async execute({ id, run }) {
+        const input = cases.get(id).input;
+        const worktree = path.join(worktreesRoot, `${id}-${run}`);
+        await mkdir(worktree, { mode: 0o700 });
+        await materialize(worktree, input.files);
+        const result = await dispatchCase({ caseId: id, run, prompt: input.prompt,
+          allowedWriteScope: [...input.allowedWriteScope], worktree });
+        if (result?.modelId !== modelId || result.isolation !== ISOLATION ||
+            !Number.isFinite(result.costUsd) || result.costUsd < 0 ||
+            !Number.isFinite(result.durationMs) || result.durationMs < 0) throw denied();
+        const payload = { id, run, worktree, native: { isolation: ISOLATION } };
+        const receipt = jsonHash(payload);
+        await writePrivate(path.join(receipts, `${id}-${run}.execution.json`),
+          JSON.stringify({ ...payload, executionReceipt: receipt }));
+        return { modelId, costUsd: result.costUsd, durationMs: result.durationMs, receipt };
+      },
+      async verify({ caseId, run, inputHash, execution }) {
+        const input = cases.get(caseId).input;
+        const worktree = path.join(worktreesRoot, `${caseId}-${run}`);
+        // A worker that touched anything outside its scope fails the case.
+        let passed = false;
+        let failureClassification = 'none';
+        try {
+          const before = await snapshotHeldOutWorktree(worktree, input);
+          passed = runHeldOutSandboxCheck(worktree);
+          const after = await snapshotHeldOutWorktree(worktree, input);
+          if (before !== after) { passed = false; failureClassification = 'check-mutated-worktree'; }
+          else if (!passed) failureClassification = 'functional-check-failed';
+        } catch { passed = false; failureClassification = 'scope-violation'; }
+        const reviewed = await review({ caseId, run, inputHash,
+          executionReceipt: execution.receipt, passed, prompt: input.prompt, worktree,
+          baselineFiles: { ...input.files } });
+        if (!/^[a-f0-9]{64}$/.test(reviewed?.receipt ?? '') ||
+            typeof reviewed.approved !== 'boolean') throw denied();
+        if (passed && !reviewed.approved) { passed = false; failureClassification = 'review-rejected'; }
+        // The verification receipt binds the final verdict, review included.
+        const receipt = jsonHash({ caseId, run, inputHash, executionReceipt: execution.receipt,
+          passed, kind: 'verification' });
+        await writePrivate(path.join(receipts, `${caseId}-${run}.verification.json`),
+          JSON.stringify({ caseId, run, inputHash, executionReceipt: execution.receipt,
+            receipt, passed }));
+        return { caseId, run, inputHash, executionReceipt: execution.receipt, passed, receipt,
+          verifierId: 'gofer-heldout-sandbox-check', failureClassification,
+          reviewReceipt: reviewed.receipt };
+      },
+    });
+    await writePrivate(path.join(receipts, 'benchmark-report.json'),
+      JSON.stringify({ corpusHash: corpus.corpusHash, report }));
+    const leftover = worktreesRoot;
+    worktreesRoot = undefined;
+    return Object.freeze({ report, corpusHash: corpus.corpusHash, corpusRoot: corpus.corpusRoot,
+      worktreesRoot: leftover });
+  } catch { throw denied(); }
+  finally { if (worktreesRoot) await rm(worktreesRoot, { recursive: true, force: true }); }
+}

package/resources/gofer/node-scripts/gofer-benchmark-sign.mjs

@@ -0,0 +1,62 @@
+#!/usr/bin/env node
+/**
+ * Human-gated signing. It re-runs the protected checks itself, then asks for
+ * the verifier passphrase at a terminal. It refuses to run without one, so an
+ * agent, a script, or a worker cannot sign. Output is written once, private.
+ */
+import { constants } from 'node:fs';
+import { open } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { signHeldOutBenchmarkAttestation } from './gofer-benchmark-signer.mjs';
+import { resolveTrustedEvaluatorPublicKey } from './gofer-trusted-evaluator.mjs';
+import { promptHidden } from './gofer-tty-prompt.mjs';
+
+const denied = () => new Error('BENCHMARK_SIGN_COMMAND_REQUIRED');
+
+export function parseSignArguments(argv) {
+  const flags = new Map();
+  for (let index = 0; index < argv.length; index += 2) {
+    if (!['--workspace-root', '--snapshot-id', '--capability-receipt', '--out', '--ttl-minutes'].includes(argv[index]) ||
+        typeof argv[index + 1] !== 'string' || flags.has(argv[index])) throw denied();
+    flags.set(argv[index], argv[index + 1]);
+  }
+  const args = { workspaceRoot: flags.get('--workspace-root'), snapshotId: flags.get('--snapshot-id'),
+    receiptPath: flags.get('--capability-receipt'), out: flags.get('--out') };
+  // Optional: how long the attestation stays valid. The signer allows up to 24
+  // hours; this command allows up to 4, never more than a receipt's own life.
+  const lifetime = flags.get('--ttl-minutes');
+  if (lifetime !== undefined && (!/^\d{1,3}$/.test(lifetime) || Number(lifetime) < 1 || Number(lifetime) > 240)) throw denied();
+  args.ttlMs = lifetime === undefined ? undefined : Number(lifetime) * 60 * 1000;
+  if (flags.size !== (lifetime === undefined ? 4 : 5) || !path.isAbsolute(args.workspaceRoot) || !path.isAbsolute(args.receiptPath) ||
+      !path.isAbsolute(args.out) || !/^[a-f0-9]{64}$/.test(args.snapshotId)) throw denied();
+  return args;
+}
+
+async function main() {
+  const args = parseSignArguments(process.argv.slice(2));
+  // Checked first, before any work: a person must be at this terminal.
+  if (!process.stdin.isTTY || !process.stdout.isTTY) throw new Error('INTERACTIVE_TERMINAL_REQUIRED');
+  const file = await open(args.receiptPath, constants.O_RDONLY | constants.O_NOFOLLOW);
+  let capabilityReceipt;
+  try {
+    const info = await file.stat();
+    if (!info.isFile() || info.size > 65536) throw denied();
+    capabilityReceipt = JSON.parse(await file.readFile('utf8'));
+  } finally { await file.close(); }
+  const capabilityPublicKey = await resolveTrustedEvaluatorPublicKey(capabilityReceipt,
+    { workspaceRoot: args.workspaceRoot });
+  const signed = await signHeldOutBenchmarkAttestation({ workspaceRoot: args.workspaceRoot,
+    capabilityReceipt, capabilityPublicKey, snapshotId: args.snapshotId,
+    ...(args.ttlMs === undefined ? {} : { ttlMs: args.ttlMs }),
+    getPassphrase: () => promptHidden('Verifier passphrase: ') });
+  const out = await open(args.out, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL |
+    constants.O_NOFOLLOW, 0o600);
+  try { await out.writeFile(`${JSON.stringify({ attestation: signed.attestation, evidence: signed.evidence })}\n`); }
+  finally { await out.close(); }
+  process.stdout.write(`Signed ${signed.checks} re-run checks. Attestation written to ${args.out}\n`);
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === path.resolve(process.argv[1])) {
+  main().catch(error => { process.stderr.write(`${error.message}\n`); process.exitCode = 1; });
+}