@evomap/evolver-core 2.0.0-beta.19 → 2.0.0-beta.22

package/dist/events/ingest.d.ts

@@ -2,7 +2,7 @@ import { EventStore, type EventStoreOptions } from './eventStore.js';
 import type { RawEvent, RootEvent } from './eventSchema.js';
 import type { EventSink } from './sink.js';
 /** 已知事件类型 (军杰 §9; 可 registerEventType 扩展). */
-export declare const EVENT_TYPES: readonly ["cycle.started", "cycle.signals_collected", "cycle.solidified", "cycle.failed", "cycle.aborted", "cycle.heartbeat", "cycle.consumed", "decision.gene_selected", "decision.triggered", "decision.suppressed", "personality.selected", "personality.risk_gated", "personality.mutated", "personality.stats_updated", "personality.pivoted", "signals.extracted", "mutation.built", "capsule.produced", "evolution_event.projected", "observer.quarantined", "observer.dead_letter", "actor.human.nudge", "actor.human.intervene", "actor.human.teach", "actor.human.observe", "actor.human.review.approve", "actor.human.review.reject", "actor.human.trust.promote", "actor.human.trust.revoke", "actor.human.sidecar.recover", "gene.distilled", "gene.distill_shadowed", "anti_gene.distilled", "anti_gene.distill_shadowed", "anti_gene.benchmark_result", "anti_gene.rollout_result", "reflection.recorded", "material.batch_ready", "value.reuse_hit", "value.inject", "value.reuse_outcome", "value.recall"];
+export declare const EVENT_TYPES: readonly ["cycle.started", "cycle.signals_collected", "cycle.solidified", "cycle.failed", "cycle.aborted", "cycle.heartbeat", "cycle.consumed", "decision.gene_selected", "decision.triggered", "decision.suppressed", "personality.selected", "personality.risk_gated", "personality.mutated", "personality.stats_updated", "personality.pivoted", "signals.extracted", "mutation.built", "capsule.produced", "evolution_event.projected", "observer.quarantined", "observer.dead_letter", "actor.human.nudge", "actor.human.intervene", "actor.human.teach", "actor.human.observe", "actor.human.review.approve", "actor.human.review.reject", "actor.human.trust.promote", "actor.human.trust.revoke", "actor.human.sidecar.recover", "gene.distilled", "gene.distill_shadowed", "anti_gene.distilled", "anti_gene.distill_shadowed", "anti_gene.benchmark_result", "anti_gene.rollout_result", "reflection.recorded", "material.batch_ready", "value.reuse_hit", "value.inject", "value.reuse_outcome", "value.recall", "execution.binding.created", "execution.started", "execution.decision", "execution.terminal", "execution.recovered", "governance.projection.revoked", "governance.projection.reinstated"];
 export type EventType = (typeof EVENT_TYPES)[number];
 export declare function registerEventType(t: string): void;
 export declare function isKnownEventType(t: string): boolean;
@@ -25,6 +25,7 @@ export declare class Ingestor {
     constructor(opts: IngestorOptions);
     ingest(raw: RawEvent): Promise<RootEvent>;
     readAll(): RootEvent[];
+    readAllStrict(): RootEvent[];
     iterate(fromSeq?: number): Generator<RootEvent>;
     tail(n?: number): RootEvent[];
     recover(): {

package/dist/events/ingest.js

@@ -20,6 +20,11 @@ export const EVENT_TYPES = [
     'reflection.recorded',
     'material.batch_ready',
     'value.reuse_hit', 'value.inject', 'value.reuse_outcome', 'value.recall',
+    'execution.binding.created', 'execution.started', 'execution.decision', 'execution.terminal', 'execution.recovered',
+    // K_auto EvidenceProjection: coordinate-level partial revocation over (version, claim, scope, runtime,
+    // verifier). A revoked event distrusts one (coordinate, value) pair; a reinstated event withdraws it. The
+    // authoritative root-event stream is the single source of truth (see algo/kautoProjection.projectRevocations).
+    'governance.projection.revoked', 'governance.projection.reinstated',
 ];
 const knownTypes = new Set(EVENT_TYPES);
 export function registerEventType(t) { knownTypes.add(t); }
@@ -63,6 +68,7 @@ export class Ingestor {
     }
     // 读 passthrough (写只能经 ingest)
     readAll() { return this.store.readAll(); }
+    readAllStrict() { return this.store.readAllStrict(); }
     iterate(fromSeq = 0) { return this.store.iterate(fromSeq); }
     tail(n = 1) { return this.store.tail(n); }
     recover() { return this.store.recover(); }

package/dist/exec/autoExec.d.ts

@@ -1,8 +1,8 @@
 import type { AssetStoreProvider } from '../assetstore/provider.js';
 import { type ProvenanceStore } from '../assetstore/provenance.js';
 import type { ReviewLedger } from '../assetstore/reviewLedger.js';
-import type { GeneCandidateInput } from '../algo/geneSelection.js';
-import type { CycleEngine, ExecutionFailureKind, SolidifyPermitGate } from '../algo/cycleEngine.js';
+import type { GeneCandidateInput, SelectionGuardMode } from '../algo/geneSelection.js';
+import type { CycleEngine, ExecutionFailureKind, ExecutionResult, SolidifyPermitGate } from '../algo/cycleEngine.js';
 import { type AutonomousSafety } from './autonomousCycle.js';
 import { type GitRunner, type ValidateHook } from './claudeBridge.js';
 import type { AgentRunner } from './runnerRegistry.js';
@@ -10,8 +10,10 @@ import { type OpenPrLister } from './openPrRegistry.js';
 import type { ReuseOutcomeSummary, ReuseOutcomeEvent } from '../ops/reuseOutcomes.js';
 import type { PersonalityStore } from '../personality/store.js';
 import type { MemoryGraphProvider } from '../algo/memoryGraph.js';
+import type { SelectionPolicy } from '../algo/ucb1.js';
 import { type LearningPacketSink, type TraceSink } from '../trace/learningTrace.js';
 import type { TraceReadOptions } from '../trace/trajectoryExport.js';
+import { ExecutionBindingJournal, type BindingAuthorityChecks, type ExecutionBindingInput } from './executionBinding.js';
 export interface AutoExecTask {
     id: string;
     repo: string;
@@ -31,10 +33,18 @@ export interface AutoExecTask {
     /** Optional explicit strategy preset name for this task; wins over daemon default and meta-signal auto-detection. */
     strategyName?: string;
     validationCmds?: readonly string[];
+    /** Frozen external execution binding; bound tasks never fall back to unbound execution. */
+    execution_binding?: ExecutionBindingInput;
 }
 export interface AutoExecVerdict {
     taskId: string;
-    status: 'refused' | 'skipped' | 'solidified' | 'failed' | 'innovated';
+    status: 'refused' | 'skipped' | 'solidified' | 'failed' | 'innovated' | 'unsafe_to_replay';
+    binding_digest?: `sha256:${string}`;
+    run_id?: string;
+    execution_terminal?: ExecutionResult['executionTerminal'];
+    hub_lifecycle?: {
+        state: 'not_submitted';
+    };
     reason?: string;
     finalStage?: string;
     outcome?: {
@@ -85,6 +95,15 @@ export interface AutoExecDeps {
     validate?: (task: AutoExecTask) => ValidateHook;
     /** Optional adapter/runtime permit gate. Core owns only the seam; adapters own the verification policy. */
     solidifyPermit?: SolidifyPermitGate;
+    /** Bound execution uses the existing root-event journal; composition supplies its authoritative external checks. */
+    executionBinding?: {
+        journal: ExecutionBindingJournal;
+        authority: BindingAuthorityChecks;
+        now?: () => number;
+        maxRuntimeMs?: number;
+        maxFiles?: number;
+        maxLines?: number;
+    };
     /**
      * Optional open-PR dedup: when set, before spawning an agent the task's signals are compared against open PR
      * titles/branches; a strong overlap yields a 'skipped' verdict so the daemon never re-implements work that is
@@ -106,6 +125,14 @@ export interface AutoExecDeps {
     memoryGraph?: MemoryGraphProvider;
     /** Optional daemon-level explicit strategy preset name, e.g. EVOLVE_STRATEGY. */
     strategyName?: string;
+    /** Emergency rollback for semantic IDF selection. Omit to keep IDF enabled. */
+    disableSemanticIdf?: boolean;
+    /** Experimental plateau selection policy. Omit to preserve engine-health + legacy drift. */
+    selectionPolicy?: SelectionPolicy;
+    /** Production relevance-guard rollout. Omit only for legacy/custom composition. */
+    selectionGuard?: SelectionGuardMode;
+    /** Optional score floor canary. Omit to keep the selector default of zero. */
+    selectionFloor?: number;
     /** Optional evolvable personality store shared with CycleEngine and the exec prompt. */
     personality?: PersonalityStore;
     /** Test/custom seam: inject a runner instead of spawning a real agent. */

package/dist/exec/autoExec.js

@@ -4,10 +4,12 @@ import { mergePendingSignalsForStore } from '../assetstore/pendingSignals.js';
 import { intakeGene } from '../algo/geneIntake.js';
 import { runEvolutionCycle } from '../algo/orchestrator.js';
 import { makeSafeExecute, makeTrustedGeneResolver } from './autonomousCycle.js';
-import { isWithinRoot } from './claudeBridge.js';
+import { defaultGitRunner, isWithinRoot } from './claudeBridge.js';
 import { findSignalHints } from './openPrRegistry.js';
 import { AgentRunTraceRecorder, buildLearningPacketDraft } from '../trace/learningTrace.js';
 import { collectRunLlmTurns } from '../trace/proxyTurns.js';
+import { uniqueSessionId } from '../trace/trajectory.js';
+import { ExecutionBindingError, ExecutionBindingJournal, freezeExecutionBinding, preflightExecutionBinding, } from './executionBinding.js';
 /** Same path-containment as the bridge guard — used here to refuse before running anything (clean verdict). */
 function withinAllowlist(repo, roots) {
     return roots.some((root) => isWithinRoot(repo, root));
@@ -92,6 +94,78 @@ export async function runAutoExecTask(deps, rawTask, safety) {
     if (!withinAllowlist(task.repo, safety.allowedRoots)) {
         return { taskId: task.id, status: 'refused', reason: `repo not in allowlist: ${task.repo}` };
     }
+    const cycleId = `autoexec-${task.id}`;
+    let binding;
+    let bindingClaimed = false;
+    let baseValidate;
+    if (task.execution_binding !== undefined) {
+        try {
+            binding = freezeExecutionBinding(task.execution_binding);
+            if (!deps.executionBinding)
+                throw new ExecutionBindingError('binding_missing', 'execution binding journal and authority checks are required');
+            const recovery = deps.executionBinding.journal.recover(task.id, binding.binding_digest);
+            if (recovery.kind === 'terminal') {
+                const recoveredStatus = recovery.terminal.disposition === 'unsafe_to_replay'
+                    ? 'unsafe_to_replay'
+                    : recovery.terminal.disposition === 'completed' && recovery.terminal.final_stage === 'solidified'
+                        ? 'solidified'
+                        : recovery.terminal.disposition === 'completed' && recovery.terminal.final_stage === 'innovated'
+                            ? 'innovated'
+                            : recovery.terminal.disposition === 'denied'
+                                ? 'refused'
+                                : 'failed';
+                return {
+                    taskId: task.id,
+                    status: recoveredStatus,
+                    binding_digest: recovery.binding_digest,
+                    run_id: binding.correlation.run_id,
+                    execution_terminal: {
+                        status: recovery.terminal.outcome?.status === 'success' ? 'success' : 'failed',
+                        disposition: recovery.terminal.disposition,
+                    },
+                    hub_lifecycle: { state: 'not_submitted' },
+                    ...(recovery.terminal.outcome ? { outcome: recovery.terminal.outcome } : {}),
+                };
+            }
+            if (recovery.kind === 'unsafe_to_replay' || recovery.kind === 'mismatched') {
+                return { taskId: task.id, status: 'unsafe_to_replay', binding_digest: recovery.binding_digest, run_id: binding.correlation.run_id, reason: recovery.reason };
+            }
+            await preflightExecutionBinding(binding, {
+                taskId: task.id,
+                runId: binding.correlation.run_id,
+                cycleId,
+                repoPath: task.repo,
+                target: task.target,
+                expectedEffect: task.expectedEffect,
+                allowedRoots: safety.allowedRoots,
+                now: deps.executionBinding.now ?? Date.now,
+                currentRevision: binding.target_descriptor.base_revision === null
+                    ? null
+                    : (deps.git ?? defaultGitRunner)(['rev-parse', 'HEAD'], task.repo).then((revision) => revision.trim() || null),
+                maxRuntimeMs: deps.executionBinding.maxRuntimeMs ?? safety.timeoutMs,
+                maxFiles: deps.executionBinding.maxFiles,
+                maxLines: deps.executionBinding.maxLines,
+                requiredConsentScope: 'execution',
+                authoritative: deps.executionBinding.authority,
+            });
+            if (!deps.validate && binding.resource_grant.validation_commands.length > 0) {
+                throw new ExecutionBindingError('binding_acceptance_invalid', 'bound execution requires the declared validation plan to be wired to a validator');
+            }
+            baseValidate = deps.validate?.({ ...task, validationCmds: binding.resource_grant.validation_commands });
+            if (baseValidate && baseValidate.length < 4) {
+                throw new ExecutionBindingError('binding_acceptance_invalid', 'bound execution validator must accept AbortSignal');
+            }
+            if (recovery.kind === 'new')
+                await deps.executionBinding.journal.recordCreated(binding);
+            if (recovery.kind === 'claimed')
+                bindingClaimed = true;
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            const unsafe = error instanceof ExecutionBindingError && error.unsafeToReplay;
+            return { taskId: task.id, status: unsafe ? 'unsafe_to_replay' : 'refused', ...(binding ? { binding_digest: binding.binding_digest, run_id: binding.correlation.run_id } : {}), reason: detail };
+        }
+    }
     // Open-PR dedup (opt-in): if an open PR already covers this task's signals, skip before spawning an agent
     // so the daemon doesn't re-implement in-flight work. Graceful — a lister that returns [] is a no-op.
     if (deps.prLister) {
@@ -131,7 +205,6 @@ export async function runAutoExecTask(deps, rawTask, safety) {
     // in the same selection pool as local genes. Reuse is an optimization, never a hard dependency — a seam
     // that throws degrades to solving fresh (no hub candidates) rather than failing the task.
     let hubCandidates = [];
-    const cycleId = `autoexec-${task.id}`;
     // Learning trace (slice 2): one recorder per task run, traceId = cycleId so the trace joins the event log.
     // Purely observational — every recorder call and the packet submit are wrapped so they can never change
     // the verdict or fail the task.
@@ -164,15 +237,26 @@ export async function runAutoExecTask(deps, rawTask, safety) {
     // (verifier 'automated_test'). Observation is a pass-through wrapper: the hook's result reaches the
     // bridge unchanged, and a run where validation never fired keeps the evaluation placeholder.
     let observedVerification;
-    const baseValidate = deps.validate?.(task);
+    baseValidate ??= deps.validate?.(task);
     const observingValidate = baseValidate
-        ? async (mutation, decision, cwd) => {
-            const v = await baseValidate(mutation, decision, cwd);
+        ? async (mutation, decision, cwd, signal) => {
+            const v = await baseValidate(mutation, decision, cwd, signal);
             observedVerification = { verifier: 'automated_test', passed: v.passed, ...(v.score !== undefined ? { score: v.score } : {}) };
             return v;
         }
         : undefined;
-    const execute = makeSafeExecute(task.repo, deps.store, safety, {
+    const observedProvenance = {
+        gene_ids: [], capsule_ids: [], tool_decisions: [],
+        policy_decisions: [], validator: null,
+        result_asset_refs: [], proof_refs: [], terminal_disposition: 'crashed',
+    };
+    const executionObserver = binding ? {
+        onToolDecision: (decision) => { observedProvenance.tool_decisions.push(decision); },
+        onPolicyDecision: (decision) => { observedProvenance.policy_decisions.push(decision); },
+        onValidatorDecision: (decision) => { observedProvenance.validator = decision; },
+        onProofReference: (reference) => { observedProvenance.proof_refs.push(reference); },
+    } : undefined;
+    const safeExecute = makeSafeExecute(task.repo, deps.store, safety, {
         ...(deps.provenance ? { provenance: deps.provenance } : {}),
         ...(deps.review ? { review: deps.review } : {}),
         ...(deps.includeProbation ? { includeProbation: true } : {}),
@@ -182,7 +266,84 @@ export async function runAutoExecTask(deps, rawTask, safety) {
         ...(deps.agent ? { agent: deps.agent } : {}),
         ...(deps.git ? { git: deps.git } : {}),
         ...(traceRecorder ? { traceRecorder } : {}),
+        ...(executionObserver ? { executionObserver } : {}),
+        ...(binding ? { executionLimits: {
+                maxRuntimeMs: binding.resource_grant.max_runtime_ms,
+                maxFiles: binding.resource_grant.max_files,
+                maxLines: binding.resource_grant.max_lines,
+            } } : {}),
     });
+    const execute = binding && deps.executionBinding
+        ? async (mutation, decision) => {
+            const selectedContext = binding.selected_context;
+            try {
+                if (selectedContext.capsule_id !== null || selectedContext.capsule_asset_id !== null) {
+                    throw new ExecutionBindingError('binding_mismatched', 'preselected capsule context is not supported by the CycleEngine execution seam');
+                }
+                if (selectedContext.gene_id !== null && decision.selectedGeneId !== selectedContext.gene_id) {
+                    throw new ExecutionBindingError('binding_mismatched', 'selected gene_id does not match frozen binding context');
+                }
+                if (selectedContext.gene_asset_id !== null && decision.selectedAssetId !== selectedContext.gene_asset_id) {
+                    throw new ExecutionBindingError('binding_mismatched', 'selected gene_asset_id does not match frozen binding context');
+                }
+                if (!bindingClaimed) {
+                    await preflightExecutionBinding(binding, {
+                        taskId: task.id,
+                        runId: binding.correlation.run_id,
+                        cycleId,
+                        repoPath: task.repo,
+                        target: task.target,
+                        expectedEffect: task.expectedEffect,
+                        allowedRoots: safety.allowedRoots,
+                        now: deps.executionBinding.now ?? Date.now,
+                        currentRevision: binding.target_descriptor.base_revision === null
+                            ? null
+                            : (deps.git ?? defaultGitRunner)(['rev-parse', 'HEAD'], task.repo).then((revision) => revision.trim() || null),
+                        maxRuntimeMs: deps.executionBinding.maxRuntimeMs ?? safety.timeoutMs,
+                        maxFiles: deps.executionBinding.maxFiles,
+                        maxLines: deps.executionBinding.maxLines,
+                        requiredConsentScope: 'execution',
+                        authoritative: deps.executionBinding.authority,
+                    });
+                    const started = await deps.executionBinding.journal.claim(binding);
+                    if (started.kind !== 'claimed')
+                        throw new ExecutionBindingError('binding_replay_unsafe', `binding execution claim ended in ${started.kind}`, true);
+                    bindingClaimed = true;
+                }
+                const result = await safeExecute(mutation, decision);
+                const policyDenied = observedProvenance.policy_decisions.some((policy) => !policy.allowed);
+                const disposition = result.outcome.status === 'success'
+                    ? 'completed'
+                    : result.failureKind === 'timeout'
+                        ? 'timed_out'
+                        : result.failureKind === 'cancelled'
+                            ? 'cancelled'
+                            : policyDenied ? 'denied' : 'rejected';
+                observedProvenance.terminal_disposition = disposition;
+                return {
+                    ...result,
+                    provenance: { ...observedProvenance, terminal_disposition: disposition },
+                    bindingCorrelation: { bindingDigest: binding.binding_digest, runId: binding.correlation.run_id },
+                    executionTerminal: { status: result.outcome.status, disposition },
+                    hubLifecycle: { state: 'not_submitted' },
+                };
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                const disposition = error instanceof ExecutionBindingError
+                    ? error.unsafeToReplay ? 'unsafe_to_replay' : 'denied'
+                    : 'crashed';
+                observedProvenance.terminal_disposition = disposition;
+                return {
+                    outcome: { status: 'failed', score: 0, reason: message },
+                    bindingCorrelation: { bindingDigest: binding.binding_digest, runId: binding.correlation.run_id },
+                    executionTerminal: { status: 'failed', disposition },
+                    provenance: { ...observedProvenance, terminal_disposition: disposition },
+                    hubLifecycle: { state: 'not_submitted' },
+                };
+            }
+        }
+        : safeExecute;
     const strategyName = task.strategyName ?? deps.strategyName;
     // Intentional semantics (see #308 review M1): a task carrying `strategy` — even without an
     // explicit forcedGeneId — force-selects the gene seeded from that strategy above, rather than
@@ -199,29 +360,119 @@ export async function runAutoExecTask(deps, rawTask, safety) {
             memoryGraphAdvice = undefined;
         }
     }
-    const res = await runEvolutionCycle(deps.engine, deps.store, {
-        ...(deps.provenance ? { provenance: deps.provenance } : {}),
-        ...(deps.review ? { review: deps.review } : {}),
-        ...(deps.includeProbation ? { includeProbation: true } : {}),
-        ...(hubCandidates.length > 0 ? { hubCandidates } : {}),
-        ...(deps.solidifyPermit ? { solidifyPermit: deps.solidifyPermit } : {}),
-        ...(deps.reuseOutcomes ? { reuseOutcomes: deps.reuseOutcomes } : {}),
-        ...(deps.recallEvents ? { recallEvents: deps.recallEvents } : {}),
-        ...(memoryGraphAdvice ? { memoryGraphAdvice } : {}),
-        ...(strategyName !== undefined ? { strategyName } : {}),
-        ...(cycleForcedGeneId !== undefined ? { forcedGeneId: cycleForcedGeneId } : {}),
-        cycleId,
-        problem: {
-            id: task.id, signature: `sig:${task.id}`, signatureV: 1,
-            firstSeenAt: new Date(0).toISOString(), lastSeenAt: new Date(0).toISOString(),
-            occurrences: 1, linkedSignals: cycleSignals, resolvedBy: null, status: 'open',
-            value: { severity: 0.7, reach: 1, strategicFit: 0.9, novelty: 0, costEst: 0.2 },
-            consecutiveFailures: 0, cooldownUntil: null, extensions: {},
-        },
-        signals: cycleSignals, category: 'repair', target: task.target, expectedEffect: task.expectedEffect,
-        summary: `autonomous: ${task.id}`, confidence: 0.85, execute, consumePendingSignals: false,
-    });
-    const status = res.finalStage === 'solidified' ? 'solidified' : res.finalStage === 'failed' ? 'failed' : 'innovated';
+    let res;
+    try {
+        res = await runEvolutionCycle(deps.engine, deps.store, {
+            ...(deps.provenance ? { provenance: deps.provenance } : {}),
+            ...(deps.review ? { review: deps.review } : {}),
+            ...(deps.includeProbation ? { includeProbation: true } : {}),
+            ...(hubCandidates.length > 0 ? { hubCandidates } : {}),
+            ...(deps.solidifyPermit ? { solidifyPermit: deps.solidifyPermit } : {}),
+            ...(binding ? { executionBinding: binding } : {}),
+            ...(deps.reuseOutcomes ? { reuseOutcomes: deps.reuseOutcomes } : {}),
+            ...(deps.recallEvents ? { recallEvents: deps.recallEvents } : {}),
+            ...(memoryGraphAdvice ? { memoryGraphAdvice } : {}),
+            ...(strategyName !== undefined ? { strategyName } : {}),
+            ...(deps.disableSemanticIdf ? { disableSemanticIdf: true } : {}),
+            ...(deps.selectionPolicy ? { selectionPolicy: deps.selectionPolicy } : {}),
+            ...(deps.selectionGuard ? { selectionGuard: deps.selectionGuard } : {}),
+            ...(deps.selectionFloor !== undefined ? { selectionFloor: deps.selectionFloor } : {}),
+            ...(cycleForcedGeneId !== undefined ? { forcedGeneId: cycleForcedGeneId } : {}),
+            cycleId,
+            problem: {
+                id: task.id, signature: `sig:${task.id}`, signatureV: 1,
+                firstSeenAt: new Date(0).toISOString(), lastSeenAt: new Date(0).toISOString(),
+                occurrences: 1, linkedSignals: cycleSignals, resolvedBy: null, status: 'open',
+                value: { severity: 0.7, reach: 1, strategicFit: 0.9, novelty: 0, costEst: 0.2 },
+                consecutiveFailures: 0, cooldownUntil: null, extensions: {},
+            },
+            signals: cycleSignals, category: 'repair', target: task.target, expectedEffect: task.expectedEffect,
+            summary: `autonomous: ${task.id}`, confidence: 0.85, execute, consumePendingSignals: false,
+        });
+    }
+    catch (error) {
+        if (binding && deps.executionBinding) {
+            const recovery = deps.executionBinding.journal.recover(task.id, binding.binding_digest);
+            if (recovery.kind === 'unsafe_to_replay') {
+                try {
+                    await deps.executionBinding.journal.recordTerminal({
+                        binding_digest: binding.binding_digest,
+                        task_id: task.id,
+                        run_id: binding.correlation.run_id,
+                        disposition: 'unsafe_to_replay',
+                        outcome: { status: 'failed', score: 0, reason: recovery.reason },
+                        provenance: { ...observedProvenance, terminal_disposition: 'unsafe_to_replay' },
+                    });
+                }
+                catch { /* the existing started marker remains fail-closed on recovery */ }
+                return { taskId: task.id, status: 'unsafe_to_replay', binding_digest: binding.binding_digest, run_id: binding.correlation.run_id, reason: `binding_replay_unsafe: ${recovery.reason}` };
+            }
+        }
+        const detail = error instanceof Error ? error.message : String(error);
+        return { taskId: task.id, status: 'failed', ...(binding ? { binding_digest: binding.binding_digest, run_id: binding.correlation.run_id } : {}), reason: detail };
+    }
+    if (binding && deps.executionBinding) {
+        const execution = res.execution;
+        if (!execution?.provenance || !execution.executionTerminal) {
+            const deniedReason = res.reasons.join('; ') || `cycle ended at ${res.finalStage} before execution`;
+            try {
+                await deps.executionBinding.journal.recordTerminal({
+                    binding_digest: binding.binding_digest,
+                    task_id: task.id,
+                    run_id: binding.correlation.run_id,
+                    disposition: 'denied',
+                    final_stage: res.finalStage,
+                    outcome: { status: 'failed', score: 0, reason: deniedReason },
+                    provenance: { ...observedProvenance, terminal_disposition: 'denied' },
+                });
+            }
+            catch (error) {
+                const detail = error instanceof Error ? error.message : String(error);
+                return { taskId: task.id, status: 'failed', binding_digest: binding.binding_digest, run_id: binding.correlation.run_id, reason: `binding_provenance_unavailable: ${detail}` };
+            }
+            return {
+                taskId: task.id,
+                status: 'refused',
+                binding_digest: binding.binding_digest,
+                run_id: binding.correlation.run_id,
+                execution_terminal: { status: 'failed', disposition: 'denied' },
+                hub_lifecycle: { state: 'not_submitted' },
+                reason: deniedReason,
+            };
+        }
+        const terminal = {
+            binding_digest: binding.binding_digest,
+            task_id: task.id,
+            run_id: binding.correlation.run_id,
+            disposition: execution.executionTerminal.disposition,
+            final_stage: res.finalStage,
+            outcome: execution.outcome,
+            ...(execution.proofOfWork ? { proof_of_work: execution.proofOfWork } : {}),
+            provenance: {
+                ...execution.provenance,
+                gene_ids: res.decision?.selectedGeneId ? [res.decision.selectedGeneId] : [],
+                capsule_ids: res.capsule?.asset_id ? [res.capsule.asset_id] : [],
+                result_asset_refs: res.capsule?.asset_id ? [res.capsule.asset_id] : [],
+                proof_refs: execution.provenance.proof_refs.length > 0
+                    ? execution.provenance.proof_refs
+                    : execution.proofOfWork?.kind === 'git_diff' && execution.proofOfWork.git_diff?.patch_ref
+                        ? [{ kind: 'git_diff', ref: execution.proofOfWork.git_diff.patch_ref }]
+                        : execution.provenance.proof_refs,
+            },
+        };
+        try {
+            await deps.executionBinding.journal.recordTerminal(terminal);
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            return { taskId: task.id, status: 'failed', binding_digest: binding.binding_digest, run_id: binding.correlation.run_id, reason: `binding_provenance_unavailable: ${detail}` };
+        }
+    }
+    const status = res.execution?.executionTerminal?.disposition === 'unsafe_to_replay'
+        ? 'unsafe_to_replay'
+        : res.execution?.executionTerminal?.disposition === 'denied'
+            ? 'refused'
+            : res.finalStage === 'solidified' ? 'solidified' : res.finalStage === 'failed' ? 'failed' : res.finalStage === 'aborted' ? 'refused' : 'innovated';
     const cap = res.capsule;
     if (traceRecorder && deps.learningTrace) {
         // Proxy llm_turn fold (slice 5): fold the run window's per-request turns BEFORE run.completed so the
@@ -231,6 +482,16 @@ export async function runAutoExecTask(deps, rawTask, safety) {
             const proxyTraces = deps.learningTrace.proxyTraces;
             if (proxyTraces) {
                 const turns = collectRunLlmTurns(proxyTraces.dir, { startMs: runStartMs, endMs: proxyTraceClock() }, proxyTraces.readOptions ? { readOptions: proxyTraces.readOptions } : {});
+                // Exact-join key for Darwin: bind the unique proxy session before folding turns so
+                // every subsequent event (and backfilled earlier ones) carries the same sessionId.
+                // Fail closed when 0 or >1 sessions appear — never invent a correlation key.
+                const sid = uniqueSessionId(turns);
+                if (sid !== null) {
+                    try {
+                        traceRecorder.bindSessionId(sid);
+                    }
+                    catch { /* observability only */ }
+                }
                 for (const turn of turns)
                     traceRecorder.recordLlmTurn(turn);
             }
@@ -286,6 +547,10 @@ export async function runAutoExecTask(deps, rawTask, safety) {
         ...(cap?.proof_of_work ? { proofOfWork: cap.proof_of_work } : {}),
         ...(res.failureKind !== undefined ? { failureKind: res.failureKind } : {}),
         ...(res.exitCode !== undefined ? { exitCode: res.exitCode } : {}),
+        ...(res.bindingDigest ? { binding_digest: res.bindingDigest } : {}),
+        ...(res.runId ? { run_id: res.runId } : {}),
+        ...(res.execution ? { execution_terminal: res.execution.executionTerminal } : {}),
+        ...(res.execution?.hubLifecycle ? { hub_lifecycle: res.execution.hubLifecycle } : {}),
         ...(usedAssetIds.length > 0 ? { usedAssetIds } : {}),
     };
 }

package/dist/exec/autonomousCycle.d.ts

@@ -7,6 +7,7 @@ import type { ExecutionResult } from '../algo/cycleEngine.js';
 import { type GeneResolver, type ValidateHook, type AgentRunnerOptions, type AgentSessionResume, type RunnerName, type AgentRunner, type GitRunner } from './claudeBridge.js';
 import type { PersonalityStore } from '../personality/store.js';
 import type { AgentRunTraceRecorder } from '../trace/learningTrace.js';
+import type { ExecutionObserver } from './claudeBridge.js';
 /**
  * Resolve a gene's strategy from the store and whether it is safe to EMBED into an autonomous agent's prompt —
  * the exec-side link from #30 (provenance ledger) and the review-state gate to #45 (requireTrustedGene gate). A
@@ -65,4 +66,10 @@ export declare function makeSafeExecute(repo: string, store: AssetStoreProvider,
     git?: GitRunner;
     /** Optional learning-trace recorder forwarded to the exec bridge (Learning Ops slice 2). */
     traceRecorder?: AgentRunTraceRecorder;
+    executionObserver?: ExecutionObserver;
+    executionLimits?: {
+        maxRuntimeMs: number;
+        maxFiles: number;
+        maxLines: number;
+    };
 }): (mutation: Mutation, decision: GeneDecision) => Promise<ExecutionResult>;

package/dist/exec/autonomousCycle.js

@@ -117,6 +117,8 @@ export function makeSafeExecute(repo, store, safety, opts = {}) {
         ...(opts.agent ? { agent: opts.agent } : {}),
         ...(opts.git ? { git: opts.git } : {}),
         ...(opts.traceRecorder ? { traceRecorder: opts.traceRecorder } : {}),
+        ...(opts.executionObserver ? { executionObserver: opts.executionObserver } : {}),
+        ...(opts.executionLimits ? { executionLimits: opts.executionLimits } : {}),
         allowedRoots: safety.allowedRoots,
         ...(runner ? { runner } : {}),
         ...(safety.resume ? { resume: safety.resume } : {}),

package/dist/exec/claudeBridge.d.ts

@@ -4,6 +4,7 @@ import type { ExecutionResult } from '../algo/cycleEngine.js';
 import { type GeneStrategyInfo } from './prompt.js';
 import type { PersonalityStore } from '../personality/store.js';
 import type { AgentRunTraceRecorder } from '../trace/learningTrace.js';
+import type { PolicyDecision, ProofReference, ToolDecision, ValidatorEvidence } from './executionBinding.js';
 import { type AgentRunner, type AgentRunnerOptions, type AgentSessionResume, type RunnerName } from './runnerRegistry.js';
 export { resolveSpawnCommand, spawnCapture, DEFAULT_MAX_CAPTURE_BYTES, MAX_AGENT_SESSION_ID_CHARS, AgentSessionResumeError, validateAgentSessionResume, UnboundedSkipPermissionsError, UnsupportedCodexPermissionOptionsError, UnsupportedCursorAllowedToolsError, UnsupportedCursorSkipPermissionsError, UnsupportedCursorWorkspaceTrustError, UnsupportedGeminiPermissionOptionsError, claudeRunnerArgs, makeClaudeHeadlessRunner, claudeHeadlessRunner, codexRunnerArgs, makeCodexHeadlessRunner, cursorRunnerArgs, makeCursorHeadlessRunner, getRunnerSpec, hasBoundedClaudeFileAccess, CLAUDE_SAFE_AUTONOMOUS_TOOLS, geminiRunnerArgs, makeGeminiHeadlessRunner, classifyGeminiRunnerResult, } from './runnerRegistry.js';
 export type { AgentRunContext, AgentRunResult, AgentRunner, RunnerName, AgentRunnerOptions, ClaudeRunnerOptions, CodexRunnerOptions, AgentRunnerSpec, AgentSessionResume, } from './runnerRegistry.js';
@@ -18,13 +19,18 @@ onDestinationOpened?: () => void) => Promise<void>;
 /** Resolve the selected gene's learned strategy (for prompt enrichment). */
 export type GeneResolver = (geneId: string) => Promise<GeneStrategyInfo | null> | GeneStrategyInfo | null;
 /** Decide success from the post-run working tree (e.g. run the gene's validation plan). */
-export type ValidateHook = (mutation: Mutation, decision: GeneDecision, cwd: string) => Promise<{
+export interface ValidateHookResult {
     passed: boolean;
     score?: number;
-}> | {
-    passed: boolean;
-    score?: number;
-};
+    validator?: ValidatorEvidence;
+}
+export type ValidateHook = (mutation: Mutation, decision: GeneDecision, cwd: string, signal: AbortSignal) => Promise<ValidateHookResult> | ValidateHookResult;
+export interface ExecutionObserver {
+    onToolDecision?(decision: ToolDecision, signal?: AbortSignal): Promise<void> | void;
+    onPolicyDecision?(decision: PolicyDecision, signal?: AbortSignal): Promise<void> | void;
+    onValidatorDecision?(decision: ValidatorEvidence, signal?: AbortSignal): Promise<void> | void;
+    onProofReference?(reference: ProofReference, signal?: AbortSignal): Promise<void> | void;
+}
 export interface ExecBridgeOptions {
     /** Working directory the agent edits and git is measured in. */
     cwd: string;
@@ -60,7 +66,7 @@ export interface ExecBridgeOptions {
     /**
      * Run the agent in a throwaway git worktree of `cwd` instead of the repo's real working tree (finding #39.4):
      * the agent's edits land in an isolated checkout, never touching the user's working tree. The diff is measured
-     * there, captured as a patch (proof.gitDiff.patchRef), and the worktree is removed. `cwd` must be a git repo.
+     * there, captured as a patch (proof.git_diff.patch_ref), and the worktree is removed. `cwd` must be a git repo.
      */
     isolation?: 'worktree';
     /**
@@ -74,12 +80,20 @@ export interface ExecBridgeOptions {
     timeoutMs?: number;
     /** Cooperative cancellation propagated to the runner process tree. */
     signal?: AbortSignal;
+    /** Binding hard limits are intersected with the existing policy/runner controls; never widen local safety. */
+    executionLimits?: {
+        maxRuntimeMs: number;
+        maxFiles: number;
+        maxLines: number;
+    };
     /** Optional: enrich the prompt with the selected gene's strategy. */
     resolveGene?: GeneResolver;
     /** Optional: validation commands surfaced in the prompt's done-criteria. */
     validationCmds?: readonly string[];
     /** Optional: authoritative success decision after the agent runs. Falls back to "agent ok + produced a diff". */
     validate?: ValidateHook;
+    /** Bound execution provenance observer. Failures are authoritative and fail the execution closed. */
+    executionObserver?: ExecutionObserver;
     /**
      * Optional evolvable personality (use-case ①): when set, the agent prompt gets a behavioral-style block
      * rendered from the store's CURRENT persisted state. CycleEngine's applySelectForRun has already run and
@@ -143,6 +157,14 @@ export declare function scrubAgentEnv(env: NodeJS.ProcessEnv, opts?: {
     allowKeys?: readonly string[];
     allowPrefixes?: readonly string[];
 }): NodeJS.ProcessEnv;
+/**
+ * 绑定执行不能接受无法收到权威截止时间取消信号的旧验证器或写入器。
+ * AbortSignal 本身是协作式的；先拒绝不暴露该信号的回调，避免旧 hook
+ * 被静默地当作无界工作运行。
+ */
+export declare class ExecBridgeCancellationContractError extends Error {
+    constructor(hook: 'validate' | 'gitPatchWriter');
+}
 /** Default git runner: every incomplete command result fails closed. */
 export declare const defaultGitRunner: GitRunner;
 export declare const defaultGitPatchWriter: GitPatchWriter;