@enterpriseai/cli 3.19.0 → 3.19.1

package/resources/gofer/node-scripts/gofer-run-verified-task.mjs

@@ -0,0 +1,330 @@
+#!/usr/bin/env node
+/**
+ * Production entrypoint for the verified native runtime. Composes the real
+ * capability issuer, the real append-only ledger, and `createVerifiedNativeRuntime`
+ * to run one bounded, ledger-authorized native task in an isolated worktree.
+ *
+ * This is deliberately the only command that calls `createVerifiedNativeRuntime`
+ * outside of a test. It fails closed with TRUSTED_EVALUATOR_REQUIRED when no
+ * local trust identity is registered — that is expected until the account
+ * trust store is provisioned; it is not a sign the wiring is missing.
+ */
+import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { constants } from 'node:fs';
+import { promises as fs } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+import process from 'process';
+import { createVerifiedNativeRuntime } from './gofer-native-runtime.mjs';
+import { createVerifiedWorktree, disposeVerifiedWorktree } from './gofer-native-adapter.mjs';
+import { createRuntimeLedger } from './gofer-runtime-ledger.mjs';
+import { issueLocalCapabilityReceipt } from './gofer-local-capability-issuer.mjs';
+import { inspectEaiLocalIsolation } from './gofer-local-isolation.mjs';
+
+const SMOKE_TASK_ID = 'T001';
+const SMOKE_CHECK_NAME = 'smoke-file-check';
+const SMOKE_FILE_NAME = 'NATIVE_SMOKE_PROOF.md';
+const SMOKE_FILE_CONTENT = 'native wiring smoke test passed.\n';
+const noFollowFlag = process.platform === 'win32' ? 0 : constants.O_NOFOLLOW;
+
+function parseArgs(argv) {
+  const args = { workspace: '', featureDir: '', capabilityReceipt: '', benchmark: '' };
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === '--workspace') args.workspace = argv[++index] || '';
+    else if (arg === '--feature-dir') args.featureDir = argv[++index] || '';
+    else if (arg === '--capability-receipt') args.capabilityReceipt = argv[++index] || '';
+    else if (arg === '--benchmark') args.benchmark = argv[++index] || '';
+    else throw new Error(`Unknown argument: ${arg}`);
+  }
+  if (!path.isAbsolute(args.workspace)) throw new Error('--workspace <absolute-path> is required');
+  // A receipt and a signed benchmark only make sense together.
+  if (Boolean(args.capabilityReceipt) !== Boolean(args.benchmark) ||
+      [args.capabilityReceipt, args.benchmark].some(value => value && !path.isAbsolute(value))) {
+    throw new Error('--capability-receipt and --benchmark need absolute paths and must be given together');
+  }
+  return args;
+}
+
+async function readJsonFile(filename) {
+  const file = await fs.open(filename, constants.O_RDONLY | constants.O_NOFOLLOW);
+  try {
+    const info = await file.stat();
+    if (!info.isFile() || info.size > 1024 * 1024) throw new Error('JSON input must be a regular file under 1 MiB');
+    return JSON.parse(await file.readFile('utf8'));
+  } finally { await file.close(); }
+}
+
+export function gitHead(workspaceRoot) {
+  return execFileSync('git', ['-C', workspaceRoot, 'rev-parse', 'HEAD'], { encoding: 'utf8' }).trim();
+}
+
+async function confinedFeatureDirectory(workspace, requested) {
+  const root = await fs.realpath(workspace);
+  const target = path.resolve(requested || path.join(root, '.specify', 'specs', 'native-runtime-smoke'));
+  const relative = path.relative(root, target);
+  if (relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+    throw new Error('FEATURE_DIRECTORY_OUTSIDE_WORKSPACE');
+  }
+  let current = root;
+  for (const component of relative.split(path.sep).filter(Boolean)) {
+    current = path.join(current, component);
+    const info = await fs.lstat(current).catch((error) => {
+      if (error?.code === 'ENOENT') return null;
+      throw error;
+    });
+    if (!info) break;
+    if (info.isSymbolicLink()) throw new Error('FEATURE_DIRECTORY_SYMLINK');
+  }
+  return target;
+}
+
+/** Build the minimal set of controller documents `reviewPriority` requires,
+ * describing exactly one bounded, inert smoke task. Kept in the controller's
+ * source-side feature directory, never the isolated task worktree (D029). */
+export async function prepareSmokeFeature(featureDir, revision) {
+  await fs.mkdir(featureDir, { recursive: true, mode: 0o700 });
+  await fs.writeFile(path.join(featureDir, 'spec.md'),
+    '# Native Runtime Smoke Task\n\n' +
+    '- FR-001: Create one fixed-content proof file and change nothing else.\n', { mode: 0o600 });
+  await fs.writeFile(path.join(featureDir, 'decisions.md'),
+    '## D001 - Run one bounded native smoke task\n\n' +
+    'The user approved wiring the verified native runtime into a real command ' +
+    'and running one bounded, inert smoke task to prove the dispatch path.\n', { mode: 0o600 });
+  await fs.writeFile(path.join(featureDir, 'plan.md'),
+    '# Plan\n\nRun one bounded native task in a verified local worktree.\n', { mode: 0o600 });
+  await fs.writeFile(path.join(featureDir, 'loop-contract.json'), `${JSON.stringify({
+    schemaVersion: 1, requirePriorityPlan: true, loopId: 'native-runtime-smoke',
+    profile: 'standard', objective: 'Prove the verified native runtime dispatches one real task end to end.',
+    entryStage: '0_gofer_start', maxIterations: 2, budget: {}, evalCommands: [],
+    successCriteria: [], stopConditions: [],
+    humanEscalation: { maxFailedIterations: 1, owner: 'Gofer maintainers', escalateWhen: ['native host authority is unavailable'] },
+  }, null, 2)}\n`, { mode: 0o600 });
+  await fs.writeFile(path.join(featureDir, 'tasks.md'),
+    `- [ ] **${SMOKE_TASK_ID}** Create ${SMOKE_FILE_NAME} with fixed content.\n`, { mode: 0o600 });
+  await fs.writeFile(path.join(featureDir, 'traceability.md'),
+    '| Requirement | Task |\n| --- | --- |\n' +
+    `| FR-001 | ${SMOKE_TASK_ID} |\n`, { mode: 0o600 });
+  const plan = {
+    schemaVersion: 2,
+    revision,
+    objective: 'Prove the verified native runtime dispatches one real task end to end.',
+    lastInstruction: { id: 'D001', text: 'The user approved wiring the verified native runtime into a real command and running one bounded, inert smoke task to prove the dispatch path.' },
+    decisionPolicy: { mode: 'goal-led', askOnlyFor: ['goal-change', 'irreversible-action', 'missing-authority'] },
+    criticalPath: [SMOKE_TASK_ID],
+    tasks: { [SMOKE_TASK_ID]: { dependsOn: [], allowedEditScope: [SMOKE_FILE_NAME] } },
+    outcome: {
+      id: 'OUTCOME-SMOKE-001',
+      statement: 'A native host performs one scoped, ledger-governed smoke task in verified isolation.',
+      requirements: ['FR-001'],
+      target: { environment: 'local-native-host', revision },
+      receipt: 'evidence/outcome.json',
+    },
+  };
+  await fs.writeFile(path.join(featureDir, 'priority-plan.json'), `${JSON.stringify(plan, null, 2)}\n`, { mode: 0o600 });
+}
+
+/** The worker-facing adapter. `reserve`/`lease` delegate straight to the same
+ * ledger the graph engine authorizes and commits against; `check`/`verified`
+ * inspect the isolated worktree directly rather than trusting worker claims. */
+export function createSmokeAdapter({ ledger }) {
+  return {
+    bindWorkspace({ workspaceRoot }) {
+      return {
+        workspaceRoot,
+        reserve: request => ledger.reserve(request),
+        lease: request => ledger.lease(request),
+        async inputRevision() { return gitHead(workspaceRoot); },
+        async check({ taskId, revision, inputRevision, check }) {
+          const target = path.join(workspaceRoot, SMOKE_FILE_NAME);
+          const actual = await fs.readFile(target, 'utf8').catch(() => null);
+          const executed = true;
+          const exitCode = actual === SMOKE_FILE_CONTENT ? 0 : 1;
+          return { taskId, revision, inputRevision, check, exitCode, executed,
+            receipt: createHash('sha256').update(`${taskId}:${inputRevision}:${actual ?? ''}`).digest('hex') };
+        },
+        async verified({ taskId, revision, inputRevision }) {
+          const target = path.join(workspaceRoot, SMOKE_FILE_NAME);
+          const actual = await fs.readFile(target, 'utf8').catch(() => null);
+          if (actual !== SMOKE_FILE_CONTENT) throw new Error('SMOKE_TASK_OUTPUT_MISMATCH');
+          return { committed: true, taskId, revision, inputRevision,
+            receipt: createHash('sha256').update(`verified:${taskId}:${inputRevision}`).digest('hex') };
+        },
+      };
+    },
+  };
+}
+
+/** Capability issuance needs an already-isolated worktree to probe, but the
+ * receipt itself attests host/model capability, not a specific worktree's
+ * identity. Issue it against a disposable probe worktree, exactly like the
+ * live capability diagnostic already recorded for this feature, then reuse
+ * the receipt for the separate, real task worktree below. */
+async function issueDisposableCapabilityReceipt(workspace, host) {
+  const probe = await createVerifiedWorktree({ workspaceRoot: workspace, host,
+    localIsolation: inspectEaiLocalIsolation });
+  try {
+    return await issueLocalCapabilityReceipt({ workspaceRoot: probe.isolatedWorkspace });
+  } finally {
+    await disposeVerifiedWorktree({ workspaceRoot: probe.workspace,
+      isolatedWorkspace: probe.isolatedWorkspace, revision: probe.revision,
+      receipt: probe.receipt }).catch(() => {});
+  }
+}
+
+/** `capabilityReceipt` and `benchmark` ({ evidence, attestation }) may be supplied
+ * together to route by a signed independent benchmark. Without them the runner
+ * issues its own receipt and the routing gate correctly refuses to route. */
+export async function runVerifiedSmokeTask({ workspace, featureDir, host = 'codex',
+  capabilityReceipt: suppliedReceipt, benchmark }) {
+  const revision = gitHead(workspace);
+  const resolvedFeatureDir = await confinedFeatureDirectory(workspace, featureDir);
+  // Complete every path-based controller write before any native worker can
+  // start. The worker receives only its isolated worktree and cannot reach the
+  // controller feature directory.
+  await prepareSmokeFeature(resolvedFeatureDir, revision);
+  // Bind every controller-side read and write to the same canonical directory.
+  // This prevents a caller-controlled symlink from redirecting evidence after
+  // the runtime has validated its feature root.
+  const controllerFeatureDir = await fs.realpath(resolvedFeatureDir);
+  const capabilityReceipt = suppliedReceipt ?? await issueDisposableCapabilityReceipt(workspace, host);
+  const ledger = await createRuntimeLedger({ ledgerPath: path.join(controllerFeatureDir, 'runtime-ledger.jsonl') });
+  const runtime = await createVerifiedNativeRuntime({
+    workspaceRoot: workspace,
+    host,
+    localIsolation: inspectEaiLocalIsolation,
+    capabilityReceipt,
+    requiredCapabilities: { isolationClass: 'git-worktree+local-os-sandbox' },
+    ledger,
+    promptForRequest: async () => `Create a file named ${SMOKE_FILE_NAME} in the repository root ` +
+      `containing exactly this one line: "${SMOKE_FILE_CONTENT.trim()}". Make no other change.`,
+    adapter: createSmokeAdapter({ ledger }),
+  });
+  // Create and retain the final evidence file descriptor before dispatch.
+  // Retirement writes through this descriptor and never resolves a path that
+  // a concurrent process could replace after the worker starts.
+  const evidenceSink = await openEvidenceSink(controllerFeatureDir);
+  let result;
+  try {
+    result = await runtime.run({
+      featureDir: controllerFeatureDir,
+      checks: { [SMOKE_TASK_ID]: [SMOKE_CHECK_NAME] },
+      approvalReceipt: 'local-smoke-approval',
+      benchmarkEvidence: benchmark?.evidence,
+      benchmarkAttestation: benchmark?.attestation,
+      maxCalls: 12,
+      maxConcurrent: 1,
+      deadlineMs: Date.now() + 300_000,
+    });
+  } catch (error) {
+    await evidenceSink.close().catch(() => {});
+    // A failed run keeps its worktree for recovery; say where it is instead of hiding it.
+    await runtime.dispose().catch(disposeError => process.stderr.write(
+      `Worktree kept at ${runtime.isolation.isolatedWorkspace}: ${disposeError.message}\n`));
+    throw error;
+  }
+  // A verified run must not leave a worktree behind, so disposal errors surface.
+  if (result.status !== 'verified' || result.adapterCallsSettled !== true) {
+    await evidenceSink.close().catch(() => {});
+    const location = runtime.isolation.isolatedWorkspace;
+    process.stderr.write(`Worktree kept at ${location}: native task requires recovery\n`);
+    throw new Error(`NATIVE_RUNTIME_REQUIRES_RECOVERY:${location}`);
+  }
+  try {
+    await retireVerifiedOutput({ isolatedWorkspace: runtime.isolation.isolatedWorkspace,
+      evidenceSink });
+    await evidenceSink.close();
+    await runtime.dispose();
+  } catch (error) {
+    await evidenceSink.close().catch(() => {});
+    process.stderr.write(
+      `Worktree kept at ${runtime.isolation.isolatedWorkspace}: ${error.message}\n`);
+    throw error;
+  }
+  return result;
+}
+
+function sameIdentity(left, right) {
+  if (left.dev === undefined || left.ino === undefined ||
+      right.dev === undefined || right.ino === undefined) return true;
+  return left.dev === right.dev && left.ino === right.ino;
+}
+
+async function openEvidenceSink(featureDirectory) {
+  const evidenceDirectory = path.join(featureDirectory, 'evidence');
+  const featureHandle = await fs.open(featureDirectory,
+    constants.O_RDONLY | (constants.O_DIRECTORY ?? 0) | noFollowFlag);
+  let evidenceHandle;
+  try {
+    const featureIdentity = await featureHandle.stat();
+    const featureAfterOpen = await fs.lstat(featureDirectory);
+    if (!featureIdentity.isDirectory() || featureAfterOpen.isSymbolicLink() ||
+        !sameIdentity(featureIdentity, featureAfterOpen)) {
+      throw new Error('CONTROLLER_FEATURE_DIRECTORY_CHANGED');
+    }
+    // Exclusive creation rejects every pre-existing path, including a symlink.
+    await fs.mkdir(evidenceDirectory, { mode: 0o700 });
+    evidenceHandle = await fs.open(evidenceDirectory,
+      constants.O_RDONLY | (constants.O_DIRECTORY ?? 0) | noFollowFlag);
+    const evidenceIdentity = await evidenceHandle.stat();
+    const [featureAfterCreate, evidenceAfterOpen] = await Promise.all([
+      fs.lstat(featureDirectory), fs.lstat(evidenceDirectory),
+    ]);
+    if (!evidenceIdentity.isDirectory() || evidenceAfterOpen.isSymbolicLink() ||
+        !sameIdentity(evidenceIdentity, evidenceAfterOpen) ||
+        !sameIdentity(featureIdentity, featureAfterCreate)) {
+      throw new Error('CONTROLLER_EVIDENCE_DIRECTORY_CHANGED');
+    }
+    const evidencePath = path.join(evidenceDirectory, SMOKE_FILE_NAME);
+    const sink = await fs.open(evidencePath,
+      constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | noFollowFlag, 0o600);
+    const [featureAfterSinkOpen, evidenceAfterSinkOpen] = await Promise.all([
+      fs.lstat(featureDirectory), fs.lstat(evidenceDirectory),
+    ]);
+    if (!sameIdentity(featureIdentity, featureAfterSinkOpen) ||
+        !sameIdentity(evidenceIdentity, evidenceAfterSinkOpen)) {
+      await sink.close();
+      throw new Error('CONTROLLER_EVIDENCE_DIRECTORY_CHANGED');
+    }
+    return sink;
+  } finally {
+    await evidenceHandle?.close();
+    await featureHandle.close();
+  }
+}
+
+/** Keep the verified proof file as controller evidence, then remove it from the task
+ * worktree so the strict clean-state disposal check stays unchanged. */
+async function retireVerifiedOutput({ isolatedWorkspace, evidenceSink }) {
+  const source = path.join(isolatedWorkspace, SMOKE_FILE_NAME);
+  const sourceHandle = await fs.open(source, constants.O_RDONLY | noFollowFlag);
+  let actual;
+  try {
+    const sourceInfo = await sourceHandle.stat();
+    if (!sourceInfo.isFile()) throw new Error('SMOKE_TASK_OUTPUT_INVALID');
+    actual = await sourceHandle.readFile('utf8');
+  } finally { await sourceHandle.close(); }
+  if (actual !== SMOKE_FILE_CONTENT) throw new Error('SMOKE_TASK_OUTPUT_MISMATCH');
+  const sinkInfo = await evidenceSink.stat();
+  if (!sinkInfo.isFile()) throw new Error('CONTROLLER_EVIDENCE_FILE_INVALID');
+  await evidenceSink.writeFile(actual);
+  await evidenceSink.sync();
+  await fs.rm(source);
+}
+
+async function main(argv) {
+  const args = parseArgs(argv);
+  const capabilityReceipt = args.capabilityReceipt ? await readJsonFile(args.capabilityReceipt) : undefined;
+  const benchmark = args.benchmark ? await readJsonFile(args.benchmark) : undefined;
+  const result = await runVerifiedSmokeTask({ workspace: args.workspace,
+    featureDir: args.featureDir || undefined, capabilityReceipt, benchmark });
+  process.stdout.write(`${JSON.stringify(result)}\n`);
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === path.resolve(process.argv[1])) {
+  main(process.argv.slice(2)).catch(error => {
+    process.stderr.write(`${error.message}\n`);
+    process.exitCode = 1;
+  });
+}

package/resources/gofer/node-scripts/gofer-runtime-ledger.mjs

@@ -0,0 +1,289 @@
+/** Durable, append-only authority ledger for a single verified runtime. */
+import { createHash, randomUUID } from 'node:crypto';
+import { chmod, link, lstat, mkdir, open, readFile, unlink } from 'node:fs/promises';
+import path from 'node:path';
+import { DatabaseSync } from 'node:sqlite';
+
+const text = value => typeof value === 'string' && value.trim().length > 0;
+const digest = value => createHash('sha256').update(JSON.stringify(value)).digest('hex');
+const sameList = (left, right) => Array.isArray(left) && Array.isArray(right) &&
+  left.length === right.length && left.every((value, index) => value === right[index]);
+
+export async function acquireLedgerLock(lockPath) {
+  let metadata = await lstat(lockPath).catch(error => {
+    if (error.code === 'ENOENT') return null;
+    throw error;
+  });
+  if (!metadata) {
+    const temporary = `${lockPath}.${randomUUID()}.init`;
+    try {
+      const initial = new DatabaseSync(temporary, { timeout: 0 });
+      try { initial.exec('CREATE TABLE lock_identity (id INTEGER PRIMARY KEY)'); }
+      finally { initial.close(); }
+      await chmod(temporary, 0o600);
+      try { await link(temporary, lockPath); }
+      catch (error) { if (error.code !== 'EEXIST') throw error; }
+    } finally { await unlink(temporary).catch(() => {}); }
+    metadata = await lstat(lockPath);
+  }
+  // A legacy, empty .lock file may still belong to an older live controller.
+  // Do not reinterpret it as an unlocked database during an upgrade.
+  if (!metadata.isFile() || metadata.size === 0 ||
+      (process.platform !== 'win32' && (metadata.mode & 0o077) !== 0)) {
+    throw new Error('LEDGER_LOCK_MIGRATION_REQUIRED');
+  }
+  let database;
+  try {
+    database = new DatabaseSync(lockPath, { timeout: 0 });
+    database.exec('BEGIN IMMEDIATE');
+    return database;
+  } catch (error) {
+    database?.close();
+    throw new Error(/database is locked|SQLITE_BUSY/i.test(error.message) ? 'LEDGER_BUSY' : 'LEDGER_LOCK_UNAVAILABLE');
+  }
+}
+
+export async function createRuntimeLedger({ ledgerPath, now = () => new Date(), verifyCancellation,
+  verifyBenchmarkCapture } = {}) {
+  if (!path.isAbsolute(ledgerPath)) throw new Error('LEDGER_PATH_REQUIRED');
+  await mkdir(path.dirname(ledgerPath), { recursive: true, mode: 0o700 });
+  const lockPath = `${ledgerPath}.lock`;
+  const events = async () => (await readFile(ledgerPath, 'utf8').catch(error => {
+    if (error.code === 'ENOENT') return '';
+    throw error;
+  })).split('\n')
+    .filter(Boolean).map(line => JSON.parse(line));
+  const transact = async (event, evaluate) => {
+    const lock = await acquireLedgerLock(lockPath);
+    try {
+      const history = await events();
+      const result = await evaluate(history);
+      if (result?.allowed !== true) return result;
+      const record = { schemaVersion: 1, eventId: randomUUID(), at: now().toISOString(), ...event, ...result };
+      const append = await open(ledgerPath, 'a', 0o600);
+      try { await append.writeFile(`${JSON.stringify(record)}\n`); await append.sync(); } finally { await append.close(); }
+      return result;
+    } finally {
+      try { lock.exec('ROLLBACK'); } finally { lock.close(); }
+    }
+  };
+  const reservation = request => ({ taskId: request?.taskId, revision: request?.revision, attempt: request?.attempt,
+    budgetReservation: `reservation:${digest(request).slice(0, 24)}` });
+  return Object.freeze({
+    reserve: request => transact({ type: 'reserve', request }, async history => text(request?.taskId) && text(request?.revision) &&
+      Number.isSafeInteger(request?.attempt) && request.attempt > 0 &&
+      !history.some(item => item.type === 'reserve' && item.taskId === request.taskId &&
+        item.revision === request.revision && item.attempt >= request.attempt) &&
+      !history.some(item => item.type === 'lease' && item.taskId === request.taskId &&
+        !history.some(closed => closed.type === 'cancel-reconciled' && closed.leaseId === item.leaseId))
+      ? { allowed: true, ...reservation(request) } : { allowed: false }),
+    lease: request => transact({ type: 'lease', request }, async history => {
+      const reserved = reservation(request);
+      if (!history.some(item => item.type === 'reserve' && item.budgetReservation === reserved.budgetReservation) ||
+          history.some(item => item.type === 'lease' && item.budgetReservation === reserved.budgetReservation)) return { allowed: false };
+      if (history.some(item => item.type === 'lease' && item.taskId === request.taskId &&
+          !history.some(closed => closed.type === 'cancel-reconciled' && closed.leaseId === item.leaseId))) return { allowed: false };
+      return { allowed: true, taskId: request.taskId, revision: request.revision, attempt: request.attempt,
+        budgetReservation: reserved.budgetReservation,
+        leaseId: `lease:${randomUUID()}`, expiresAt: new Date(now().getTime() + 300000).toISOString() };
+    }),
+    authorize: request => transact({ type: 'authorize', request }, async history => {
+      if (!text(request?.leaseId) || !text(request?.budgetReservation) || !text(request?.approvalReceipt) ||
+          !Array.isArray(request?.dependencies)) return { allowed: false };
+      const lease = history.find(item => item.type === 'lease' && item.leaseId === request.leaseId);
+      const reserved = history.find(item => item.type === 'reserve' &&
+        item.budgetReservation === request.budgetReservation);
+      const replacement = history.filter(item => item.type === 'cancel-reconciled' &&
+        item.taskId === request.taskId && item.revision === request.revision).at(-1);
+      if (!lease || !reserved || lease.taskId !== request.taskId || lease.revision !== request.revision ||
+          lease.attempt !== request.attempt || lease.budgetReservation !== request.budgetReservation ||
+          reserved.taskId !== request.taskId || reserved.revision !== request.revision ||
+          reserved.attempt !== request.attempt ||
+          digest(reserved.request?.dependencies) !== digest(request.dependencies) ||
+          reserved.request?.worktreeReceipt !== request.worktreeReceipt ||
+          !sameList(reserved.request?.allowedEditScope, request.allowedEditScope) ||
+          !sameList(reserved.request?.requiredChecks, request.requiredChecks) ||
+          reserved.request?.capabilityReceiptHash !== request.capabilityReceiptHash ||
+          reserved.request?.approvalReceipt !== request.approvalReceipt ||
+          reserved.request?.selectedModel !== request.selectedModel ||
+          reserved.request?.benchmarkReceipt !== request.benchmarkReceipt ||
+          Date.parse(lease.expiresAt) <= now().getTime() ||
+          (replacement && request.worktreeReceipt !== replacement.replacementWorktreeReceipt) ||
+          history.some(item => item.leaseId === request.leaseId &&
+            ['authorize', 'cancel-reconciled'].includes(item.type))) return { allowed: false };
+      return { allowed: true, ...request, receipt: `authority:${digest(request).slice(0, 32)}` };
+    }),
+    authorizeNative: request => transact({ type: 'native-authorize', request }, async history => {
+      const authority = history.find(item => item.type === 'authorize' && item.leaseId === request?.leaseId && item.receipt === request?.ledgerAuthorityReceipt);
+      const lease = history.find(item => item.type === 'lease' && item.leaseId === request?.leaseId);
+      if (!authority || !lease || Date.parse(lease.expiresAt) <= now().getTime() ||
+          history.some(item => item.leaseId === request?.leaseId &&
+            ['native-authorize', 'commit-authorize', 'cancel-reconciled'].includes(item.type)) ||
+          authority.taskId !== request.taskId || authority.revision !== request.objectiveRevision ||
+          authority.attempt !== request.attempt ||
+          authority.budgetReservation !== request.budgetReservation || authority.approvalReceipt !== request.approvalReceipt ||
+          authority.worktreeReceipt !== request.worktreeReceipt ||
+          authority.capabilityReceiptHash !== request.capabilityReceiptHash || digest(authority.dependencies) !== digest(request.dependencies) ||
+          authority.selectedModel !== request.selectedModel ||
+          !sameList(authority.allowedEditScope, request.allowedWriteScope)) return { allowed: false };
+      return { allowed: true, ...request, isolation: 'git-worktree+local-os-sandbox', receipt: authority.receipt };
+    }),
+    authorizeCommit: request => transact({ type: 'commit-authorize', request }, async history => {
+      const authority = history.find(item => item.type === 'authorize' && item.leaseId === request?.leaseId);
+      const lease = history.find(item => item.type === 'lease' && item.leaseId === request?.leaseId);
+      const native = history.find(item => item.type === 'native-authorize' && item.leaseId === request?.leaseId);
+      const requiredChecks = authority?.requiredChecks;
+      const validation = request?.validation;
+      if (!authority || !lease || !native || Date.parse(lease.expiresAt) <= now().getTime() ||
+          history.some(item => item.leaseId === request?.leaseId &&
+            ['commit-authorize', 'cancel-reconciled'].includes(item.type)) ||
+          authority.taskId !== request.taskId || authority.revision !== request.revision ||
+          authority.attempt !== request.attempt || authority.budgetReservation !== request.budgetReservation ||
+          authority.approvalReceipt !== request.approvalReceipt || authority.capabilityReceiptHash !== request.capabilityReceiptHash ||
+          authority.worktreeReceipt !== request.worktreeReceipt ||
+          digest(authority.dependencies) !== digest(request.dependencies) || !text(request.inputRevision) ||
+          !Array.isArray(requiredChecks) || !requiredChecks.length ||
+          !Array.isArray(validation) || validation.length !== requiredChecks.length ||
+          new Set(validation.map(item => item?.check)).size !== requiredChecks.length ||
+          validation.some(item => !requiredChecks.includes(item?.check) || item?.passed !== true ||
+            item?.inputRevision !== request.inputRevision || !text(item?.receipt))) return { allowed: false };
+      return { allowed: true, taskId: request.taskId, revision: request.revision, inputRevision: request.inputRevision,
+        leaseId: request.leaseId, capabilityReceiptHash: request.capabilityReceiptHash, receipt: `commit:${digest(request).slice(0, 32)}` };
+    }),
+    authorizeBenchmarkCapture: request => transact({ type: 'benchmark-capture-authorize', request }, async history => {
+      const runs = request?.runs;
+      if (typeof verifyBenchmarkCapture !== 'function' || !text(request?.revision) ||
+          !text(request?.journalHash) || !text(request?.workerStopReceipt) ||
+          !/^[a-f0-9]{64}$/.test(request?.corpusHash ?? '') ||
+          !/^[a-f0-9]{64}$/.test(request?.reportSha256 ?? '') ||
+          !Array.isArray(runs) || runs.length < 12 || runs.length > 3000 ||
+          history.some(item => item.type === 'benchmark-capture-authorize' &&
+            item.corpusHash === request.corpusHash && item.reportSha256 === request.reportSha256)) return { allowed: false };
+      const cases = new Map();
+      const leases = new Set();
+      for (const run of runs) {
+        if (!text(run?.caseId) || ![1, 2, 3].includes(run?.run) ||
+            ![run.taskId, run.leaseId, run.worktreeReceipt, run.capabilityReceiptHash,
+              run.ledgerAuthorityReceipt, run.budgetReservation, run.approvalReceipt,
+              run.isolatedWorkspace].every(text) || leases.has(run.leaseId)) return { allowed: false };
+        leases.add(run.leaseId);
+        const repetitions = cases.get(run.caseId) ?? new Set();
+        if (repetitions.has(run.run)) return { allowed: false };
+        repetitions.add(run.run);
+        cases.set(run.caseId, repetitions);
+        const lease = history.find(item => item.type === 'lease' && item.leaseId === run.leaseId);
+        const authority = history.find(item => item.type === 'authorize' && item.leaseId === run.leaseId &&
+          item.receipt === run.ledgerAuthorityReceipt);
+        const native = history.find(item => item.type === 'native-authorize' && item.leaseId === run.leaseId &&
+          item.receipt === run.ledgerAuthorityReceipt);
+        if (!lease || !authority || !native || lease.taskId !== run.taskId ||
+            lease.revision !== request.revision || authority.taskId !== run.taskId ||
+            authority.revision !== request.revision || authority.worktreeReceipt !== run.worktreeReceipt ||
+            authority.capabilityReceiptHash !== run.capabilityReceiptHash ||
+            authority.budgetReservation !== run.budgetReservation ||
+            authority.approvalReceipt !== run.approvalReceipt ||
+            native.worktreeReceipt !== run.worktreeReceipt ||
+            native.capabilityReceiptHash !== run.capabilityReceiptHash ||
+            native.isolation !== 'git-worktree+local-os-sandbox' ||
+            history.some(item => item.type === 'cancel-reconciled' && item.leaseId === run.leaseId)) {
+          return { allowed: false };
+        }
+      }
+      if (cases.size < 4 || [...cases.values()].some(repetitions => repetitions.size !== 3)) return { allowed: false };
+      const proof = await verifyBenchmarkCapture(structuredClone(request));
+      if (proof?.allStopped !== true || proof.revision !== request.revision ||
+          proof.journalHash !== request.journalHash || proof.workerCount !== runs.length ||
+          proof.receipt !== request.workerStopReceipt ||
+          !Array.isArray(proof.cancelledLeases) || proof.cancelledLeases.length !== 0) return { allowed: false };
+      return { allowed: true, revision: request.revision, corpusHash: request.corpusHash,
+        reportSha256: request.reportSha256, workerStopReceipt: request.workerStopReceipt,
+        runs, receipt: `benchmark-capture:${digest(request).slice(0, 32)}` };
+    }),
+    inspectBenchmarkCapture: async request => {
+      if (!text(request?.receipt) || !text(request?.revision) ||
+          !/^[a-f0-9]{64}$/.test(request?.corpusHash ?? '') ||
+          !/^[a-f0-9]{64}$/.test(request?.reportSha256 ?? '') ||
+          !text(request?.workerStopReceipt)) return { valid: false };
+      const history = await events();
+      const record = history.find(item => item.type === 'benchmark-capture-authorize' &&
+        item.receipt === request.receipt && item.revision === request.revision &&
+        item.corpusHash === request.corpusHash && item.reportSha256 === request.reportSha256 &&
+        item.workerStopReceipt === request.workerStopReceipt);
+      return record ? { valid: true, receipt: record.receipt, runs: record.runs } : { valid: false };
+    },
+    recordBenchmarkSnapshot: request => transact({ type: 'benchmark-snapshot', request }, async history => {
+      if (!text(request?.captureReceipt) || !/^[a-f0-9]{64}$/.test(request?.corpusHash ?? '') ||
+          !/^[a-f0-9]{64}$/.test(request?.reportSha256 ?? '') ||
+          !/^[a-f0-9]{64}$/.test(request?.snapshotId ?? '')) return { allowed: false };
+      const capture = history.find(item => item.type === 'benchmark-capture-authorize' &&
+        item.receipt === request.captureReceipt && item.corpusHash === request.corpusHash &&
+        item.reportSha256 === request.reportSha256);
+      if (!capture || history.some(item => item.type === 'benchmark-snapshot' &&
+          item.captureReceipt === request.captureReceipt)) return { allowed: false };
+      return { allowed: true, ...request, receipt: `benchmark-snapshot:${digest(request).slice(0, 32)}` };
+    }),
+    reconcileCancelledLease: request => transact({ type: 'cancel-reconciled', request }, async history => {
+      if (typeof verifyCancellation !== 'function' || !text(request?.taskId) || !text(request?.revision) ||
+          !Number.isSafeInteger(request?.attempt) || !text(request?.leaseId) || !text(request?.journalHash) ||
+          !text(request?.workerStopReceipt) || !text(request?.abandonedWorktreeReceipt) ||
+          !text(request?.replacementWorktreeReceipt) ||
+          request.abandonedWorktreeReceipt === request.replacementWorktreeReceipt ||
+          !text(request?.inputRevision) || !text(request?.approvalReceipt) ||
+          !text(request?.capabilityReceiptHash) || !text(request?.budgetReservation)) return { allowed: false };
+      const lease = history.find(item => item.type === 'lease' && item.leaseId === request.leaseId);
+      const authority = history.find(item => item.type === 'authorize' && item.leaseId === request.leaseId);
+      const native = history.find(item => item.type === 'native-authorize' && item.leaseId === request.leaseId);
+      if (!lease || !authority || !native || lease.taskId !== request.taskId ||
+          lease.revision !== request.revision || lease.attempt !== request.attempt ||
+          authority.budgetReservation !== request.budgetReservation ||
+          authority.approvalReceipt !== request.approvalReceipt ||
+          authority.capabilityReceiptHash !== request.capabilityReceiptHash ||
+          authority.worktreeReceipt !== request.abandonedWorktreeReceipt ||
+          native.worktreeReceipt !== request.abandonedWorktreeReceipt ||
+          history.some(item => item.leaseId === request.leaseId &&
+            ['commit-authorize', 'cancel-reconciled'].includes(item.type))) return { allowed: false };
+      const proof = await verifyCancellation(structuredClone(request));
+      if (proof?.valid !== true || Object.entries(request).some(([key, value]) => proof[key] !== value)) return { allowed: false };
+      return { allowed: true, ...request, receipt: `cancellation:${digest(request).slice(0, 32)}` };
+    }),
+    inspectCancellation: async request => {
+      if (!text(request?.taskId) || !text(request?.revision) || !text(request?.leaseId) ||
+          !text(request?.receipt) || !text(request?.journalHash)) return { valid: false };
+      const history = await events();
+      const valid = history.some(item => item.type === 'cancel-reconciled' &&
+        item.taskId === request.taskId && item.revision === request.revision &&
+        item.leaseId === request.leaseId && item.receipt === request.receipt &&
+        item.journalHash === request.journalHash &&
+        Object.entries(request).every(([key, value]) => key === 'receipt' || item.request?.[key] === value));
+      return { valid, ...request };
+    },
+    readCancellation: async request => {
+      if (!text(request?.taskId) || !text(request?.revision) || !text(request?.leaseId) ||
+          !text(request?.journalHash)) return { found: false };
+      const history = await events();
+      const record = history.find(item => item.type === 'cancel-reconciled' &&
+        item.taskId === request.taskId && item.revision === request.revision &&
+        item.leaseId === request.leaseId && item.journalHash === request.journalHash);
+      return record ? { found: true, receipt: record.receipt, request: record.request } : { found: false };
+    },
+    // Recovery is read-only. It proves that journaled execution facts came from
+    // this ledger before a caller may consider any work reusable.
+    inspectRecovery: async request => {
+      if (!text(request?.revision) || !text(request?.journalHash) || !Array.isArray(request?.authorizations) ||
+          !Array.isArray(request?.commits)) return { allowed: false };
+      const history = await events();
+      const authorized = request.authorizations.every(proof => text(proof?.taskId) && text(proof?.leaseId) &&
+        text(proof?.receipt) && text(proof?.capabilityReceiptHash) && history.some(event =>
+          event.type === 'authorize' && event.taskId === proof.taskId && event.revision === request.revision &&
+          event.leaseId === proof.leaseId && event.receipt === proof.receipt &&
+          event.capabilityReceiptHash === proof.capabilityReceiptHash));
+      const committed = request.commits.every(proof => text(proof?.taskId) && text(proof?.leaseId) &&
+        text(proof?.receipt) && text(proof?.inputRevision) && text(proof?.capabilityReceiptHash) && history.some(event =>
+          event.type === 'commit-authorize' && event.taskId === proof.taskId && event.revision === request.revision &&
+          event.leaseId === proof.leaseId && event.receipt === proof.receipt &&
+          event.inputRevision === proof.inputRevision &&
+          event.capabilityReceiptHash === proof.capabilityReceiptHash));
+      return { allowed: authorized && committed, revision: request.revision, journalHash: request.journalHash };
+    },
+  });
+}