@evomap/evolver-core 2.0.0-beta.5 → 2.0.0-beta.7

package/dist/algo/conversationSniffer.js

@@ -1,7 +1,11 @@
 import { createHash } from 'node:crypto';
 import { redactString } from '../hub/sanitize.js';
-const REUSABLE_RE = /\b(reusable|repeatable|workflow|playbook|runbook|capability|procedure|pattern|recipe|documented|future runs?|next time|can reuse|reuse this)\b|可复用|复用|能力|流程|工作流/i;
-const PROOF_RE = /\b(validated|verified|passed|green|success(?:ful|fully)?|succeeded|works?|completed|published|uploaded|recorded:true|exit code:?\s*0|all tests passed)\b|验证|通过|成功|已发布|可用/i;
+// The Chinese branches require compound/intentful phrases on purpose: everyday words (能力/流程/成功/通过)
+// occur in nearly every Chinese dev session, and matching them bare made this fallback the DOMINANT distill
+// path — 105 of 118 drafts in one bulk ingest (#562). English gets specificity from \b word boundaries;
+// Chinese has no \b, so specificity must come from the phrase itself.
+const REUSABLE_RE = /\b(reusable|repeatable|workflow|playbook|runbook|capability|procedure|pattern|recipe|documented|future runs?|next time|can reuse|reuse this)\b|复用|可重用|工作流|方法论|沉淀/i;
+const PROOF_RE = /\b(validated|verified|passed|green|success(?:ful|fully)?|succeeded|works?|completed|published|uploaded|recorded:true|exit code:?\s*0|all tests passed)\b|(?:验证|校验|测试|检查|构建|编译|运行|执行|部署|发布)(?:都|均|全部)?(?:通过|成功)|全部通过|跑通|已(?:验证|发布|上线)/i;
 const FAILURE_RE = /\b(failed|failure|error|exception|traceback|exit code:?\s*[1-9]|not working|unable to)\b|失败|错误|报错/i;
 const EXIT_ZERO_RE = /\bexit code:?\s*0\b/i;
 const EXIT_NON_ZERO_RE = /\bexit code:?\s*[1-9]\d*\b/i;

package/dist/events/ingest.js

@@ -1,4 +1,6 @@
+import { dirname, join } from 'node:path';
 import { EventStore } from './eventStore.js';
+import { createIssueDraftForEventBestEffort } from '../issueReporter/index.js';
 /** 已知事件类型 (军杰 §9; 可 registerEventType 扩展). */
 export const EVENT_TYPES = [
     'cycle.started', 'cycle.signals_collected', 'cycle.solidified', 'cycle.failed',
@@ -51,6 +53,11 @@ export class Ingestor {
         if (raw.actor?.kind === 'human' && !raw.actor.id)
             throw new IngestValidationError('actor.kind=human 必带 actor.id (审计, 军杰 §9.7)');
         const evt = await this.store.append(raw);
+        createIssueDraftForEventBestEffort(evt, {
+            rootDir: join(dirname(this.store.path), 'issue-reporter'),
+            workspaceScope: process.cwd(),
+            env: process.env,
+        });
         this.sink?.dispatch(evt);
         return evt;
     }

package/dist/events/paths.d.ts

@@ -1,22 +1,22 @@
 /** ~/.evomap, 可 EVOLVER_HOME/EVOMAP_HOME 覆盖. */
 export declare function evomapHome(env?: Readonly<Record<string, string | undefined>>): string;
-export declare function rootEventsPath(): string;
-export declare function mvDir(): string;
+export declare function rootEventsPath(env?: Readonly<Record<string, string | undefined>>): string;
+export declare function mvDir(env?: Readonly<Record<string, string | undefined>>): string;
 /** 可进化人格模型持久化文件 (五维向量 + 各键统计 + 变更历史). v1 personality_state.json 的 v2 落点. */
-export declare function personalityStatePath(): string;
-export declare function assetsDir(): string;
+export declare function personalityStatePath(env?: Readonly<Record<string, string | undefined>>): string;
+export declare function assetsDir(env?: Readonly<Record<string, string | undefined>>): string;
 /** M1 raw-material substrate (append-only jsonl consumed by the cycle). */
-export declare function materialDir(): string;
+export declare function materialDir(env?: Readonly<Record<string, string | undefined>>): string;
 /** MaterialStore backing file. */
-export declare function materialStorePath(): string;
+export declare function materialStorePath(env?: Readonly<Record<string, string | undefined>>): string;
 /** Per-source watermark cursor used to make re-ingest idempotent (file-level dedup). */
-export declare function materialWatermarkPath(): string;
+export declare function materialWatermarkPath(env?: Readonly<Record<string, string | undefined>>): string;
 /** Proxy LLM-trace day-files dir (`llm-trace-YYYYMMDD.jsonl`), the route-savings source for the value ledger.
  *  Mirrors the proxy's EVOLVER_LLM_TRACE_DIR default so the outreach layer reads what the proxy wrote. */
-export declare function tracesDir(): string;
+export declare function tracesDir(env?: Readonly<Record<string, string | undefined>>): string;
 /** Hub-asset audit trail (`asset_call_log.jsonl`): one JSONL line per hub-asset interaction (search hit/miss,
  *  reuse/reference, publish, review). Written best-effort by AssetCallLog; the desktop's RecallHistory / 召回历程
  *  reads it. Defaults to the evomap home root, beside assets/ + evolution/.
  *  NOTE(reuse/#234): confirm this matches where the proxy/RecallHistory reads — best-effort append, so a path
  *  mismatch degrades the audit line, never the reuse write itself. */
-export declare function assetCallLogPath(): string;
+export declare function assetCallLogPath(env?: Readonly<Record<string, string | undefined>>): string;

package/dist/events/paths.js

@@ -4,41 +4,41 @@ import { join } from 'node:path';
 export function evomapHome(env = process.env) {
     return env['EVOLVER_HOME'] ?? env['EVOMAP_HOME'] ?? join(homedir(), '.evomap');
 }
-export function rootEventsPath() {
-    return join(evomapHome(), 'evolution', 'root_events.jsonl');
+export function rootEventsPath(env = process.env) {
+    return join(evomapHome(env), 'evolution', 'root_events.jsonl');
 }
-export function mvDir() {
-    return join(evomapHome(), 'evolution', 'mv');
+export function mvDir(env = process.env) {
+    return join(evomapHome(env), 'evolution', 'mv');
 }
 /** 可进化人格模型持久化文件 (五维向量 + 各键统计 + 变更历史). v1 personality_state.json 的 v2 落点. */
-export function personalityStatePath() {
-    return join(evomapHome(), 'evolution', 'personality_state.json');
+export function personalityStatePath(env = process.env) {
+    return join(evomapHome(env), 'evolution', 'personality_state.json');
 }
-export function assetsDir() {
-    return join(evomapHome(), 'assets');
+export function assetsDir(env = process.env) {
+    return join(evomapHome(env), 'assets');
 }
 /** M1 raw-material substrate (append-only jsonl consumed by the cycle). */
-export function materialDir() {
-    return join(evomapHome(), 'evolution', 'material');
+export function materialDir(env = process.env) {
+    return join(evomapHome(env), 'evolution', 'material');
 }
 /** MaterialStore backing file. */
-export function materialStorePath() {
-    return join(materialDir(), 'material.jsonl');
+export function materialStorePath(env = process.env) {
+    return join(materialDir(env), 'material.jsonl');
 }
 /** Per-source watermark cursor used to make re-ingest idempotent (file-level dedup). */
-export function materialWatermarkPath() {
-    return join(materialDir(), 'watermark.json');
+export function materialWatermarkPath(env = process.env) {
+    return join(materialDir(env), 'watermark.json');
 }
 /** Proxy LLM-trace day-files dir (`llm-trace-YYYYMMDD.jsonl`), the route-savings source for the value ledger.
  *  Mirrors the proxy's EVOLVER_LLM_TRACE_DIR default so the outreach layer reads what the proxy wrote. */
-export function tracesDir() {
-    return process.env['EVOLVER_LLM_TRACE_DIR'] ?? join(evomapHome(), 'proxy', 'traces');
+export function tracesDir(env = process.env) {
+    return env['EVOLVER_LLM_TRACE_DIR'] ?? join(evomapHome(env), 'proxy', 'traces');
 }
 /** Hub-asset audit trail (`asset_call_log.jsonl`): one JSONL line per hub-asset interaction (search hit/miss,
  *  reuse/reference, publish, review). Written best-effort by AssetCallLog; the desktop's RecallHistory / 召回历程
  *  reads it. Defaults to the evomap home root, beside assets/ + evolution/.
  *  NOTE(reuse/#234): confirm this matches where the proxy/RecallHistory reads — best-effort append, so a path
  *  mismatch degrades the audit line, never the reuse write itself. */
-export function assetCallLogPath() {
-    return join(evomapHome(), 'asset_call_log.jsonl');
+export function assetCallLogPath(env = process.env) {
+    return join(evomapHome(env), 'asset_call_log.jsonl');
 }

package/dist/exec/claudeBridge.d.ts

@@ -4,13 +4,16 @@ import type { ExecutionResult } from '../algo/cycleEngine.js';
 import { type GeneStrategyInfo } from './prompt.js';
 import type { PersonalityStore } from '../personality/store.js';
 import { type AgentRunner, type AgentRunnerOptions, type RunnerName } from './runnerRegistry.js';
-export { resolveSpawnCommand, spawnCapture, UnboundedSkipPermissionsError, UnsupportedCursorSkipPermissionsError, UnsupportedGeminiPermissionOptionsError, claudeRunnerArgs, makeClaudeHeadlessRunner, claudeHeadlessRunner, codexRunnerArgs, makeCodexHeadlessRunner, cursorRunnerArgs, makeCursorHeadlessRunner, getRunnerSpec, geminiRunnerArgs, makeGeminiHeadlessRunner, } from './runnerRegistry.js';
+export { resolveSpawnCommand, spawnCapture, DEFAULT_MAX_CAPTURE_BYTES, UnboundedSkipPermissionsError, UnsupportedCursorSkipPermissionsError, UnsupportedGeminiPermissionOptionsError, claudeRunnerArgs, makeClaudeHeadlessRunner, claudeHeadlessRunner, codexRunnerArgs, makeCodexHeadlessRunner, cursorRunnerArgs, makeCursorHeadlessRunner, getRunnerSpec, geminiRunnerArgs, makeGeminiHeadlessRunner, classifyGeminiRunnerResult, } from './runnerRegistry.js';
 export type { AgentRunContext, AgentRunResult, AgentRunner, RunnerName, AgentRunnerOptions, ClaudeRunnerOptions, CodexRunnerOptions, AgentRunnerSpec, } from './runnerRegistry.js';
 export interface GitRunnerOptions {
     processSignalMode?: 'cancel' | 'ignore';
 }
 /** Run a git subcommand in cwd and return its stdout. */
 export type GitRunner = (args: readonly string[], cwd: string, signal?: AbortSignal, options?: GitRunnerOptions) => Promise<string>;
+export type GitPatchWriter = (args: readonly string[], cwd: string, destination: string, signal?: AbortSignal, 
+/** Call immediately after this writer exclusively creates `destination`. */
+onDestinationOpened?: () => void) => Promise<void>;
 /** Resolve the selected gene's learned strategy (for prompt enrichment). */
 export type GeneResolver = (geneId: string) => Promise<GeneStrategyInfo | null> | GeneStrategyInfo | null;
 /** Decide success from the post-run working tree (e.g. run the gene's validation plan). */
@@ -32,6 +35,12 @@ export interface ExecBridgeOptions {
     agentOptions?: AgentRunnerOptions;
     /** Default: spawns `git`. Inject a fake in tests. */
     git?: GitRunner;
+    /** Optional complete-patch sink. The default streams built-in git output directly to disk. */
+    gitPatchWriter?: GitPatchWriter;
+    /** Test seam for fallback patch persistence; production callers should use the exclusive private writer. */
+    writePatchFile?: (path: string, patch: string) => void;
+    /** Test seam for temporary patch cleanup; production callers should use the filesystem default. */
+    removePatchFile?: (path: string) => void;
     /** Default: EVOLVE_EXEC_BRIDGE === '1'. Set true to force-enable (e.g. integration tests). */
     enabled?: boolean;
     /**
@@ -99,6 +108,9 @@ export declare class ExecBridgeForbiddenError extends Error {
 export declare class UnsandboxedFullAccessRequiresIsolationError extends Error {
     constructor();
 }
+export declare class UnsafeWorktreePathError extends Error {
+    constructor(reason: string);
+}
 /**
  * Whitelist-filter `env` for a spawned agent/tool: keep ONLY the minimal runtime env + the caller-declared
  * extras (the runner's own auth via allowPrefixes/allowKeys); drop everything else. Fail-safe by construction —
@@ -108,8 +120,9 @@ export declare function scrubAgentEnv(env: NodeJS.ProcessEnv, opts?: {
     allowKeys?: readonly string[];
     allowPrefixes?: readonly string[];
 }): NodeJS.ProcessEnv;
-/** Default git runner: spawn `git <args>` in cwd, return stdout (empty string on error). Env scrubbed — git never needs evolver/hub secrets. */
+/** Default git runner: every incomplete command result fails closed. */
 export declare const defaultGitRunner: GitRunner;
+export declare const defaultGitPatchWriter: GitPatchWriter;
 /**
  * Build the `execute` function CycleEngine/runEvolutionCycle consume. Default-off: throws
  * ExecBridgeDisabledError on first call unless enabled.

package/dist/exec/claudeBridge.js

@@ -11,19 +11,20 @@
 // SAFETY: default-OFF. The factory throws ExecBridgeDisabledError unless explicitly enabled (opts.enabled)
 // or EVOLVE_EXEC_BRIDGE === '1'. Wiring it in by accident must fail loudly rather than silently spawn an
 // autonomous agent.
+import { randomUUID } from 'node:crypto';
 import { resolve as resolvePath, sep, join as joinPath } from 'node:path';
 import { tmpdir } from 'node:os';
-import { writeFileSync } from 'node:fs';
+import { closeSync, lstatSync, mkdtempSync, openSync, realpathSync, rmdirSync, rmSync, writeFileSync, } from 'node:fs';
 import { renderExecPrompt } from './prompt.js';
 import { parseGitShortstat, gitDiffProof } from './proofOfWork.js';
 // Policy enforcement core (#107): checkPolicy runs the always-on global guards (blast hard cap +
 // protected paths + destructive deletes) on EVERY exec — gene or not — plus the per-gene constraints when a
 // gene supplies them. It supersedes the old gene-gated `checkChangeConstraints` call (the no-gene-no-guard hole).
 import { checkPolicy, summarizeViolations } from './policy/index.js';
-import { spawnCapture, getRunnerSpec, DEFAULT_TIMEOUT_MS } from './runnerRegistry.js';
+import { spawnCapture, SpawnCaptureFinalizeError, getRunnerSpec, DEFAULT_TIMEOUT_MS } from './runnerRegistry.js';
 // Re-export the runner layer so existing importers of ./claudeBridge.js (and the `exec` namespace) keep their
 // surface after the #91-6 split — the registry simply has a clearer home now.
-export { resolveSpawnCommand, spawnCapture, UnboundedSkipPermissionsError, UnsupportedCursorSkipPermissionsError, UnsupportedGeminiPermissionOptionsError, claudeRunnerArgs, makeClaudeHeadlessRunner, claudeHeadlessRunner, codexRunnerArgs, makeCodexHeadlessRunner, cursorRunnerArgs, makeCursorHeadlessRunner, getRunnerSpec, geminiRunnerArgs, makeGeminiHeadlessRunner, } from './runnerRegistry.js';
+export { resolveSpawnCommand, spawnCapture, DEFAULT_MAX_CAPTURE_BYTES, UnboundedSkipPermissionsError, UnsupportedCursorSkipPermissionsError, UnsupportedGeminiPermissionOptionsError, claudeRunnerArgs, makeClaudeHeadlessRunner, claudeHeadlessRunner, codexRunnerArgs, makeCodexHeadlessRunner, cursorRunnerArgs, makeCursorHeadlessRunner, getRunnerSpec, geminiRunnerArgs, makeGeminiHeadlessRunner, classifyGeminiRunnerResult, } from './runnerRegistry.js';
 export class ExecBridgeDisabledError extends Error {
     constructor() {
         super('exec bridge is disabled — set EVOLVE_EXEC_BRIDGE=1 or pass { enabled: true } to enable agent execution');
@@ -54,6 +55,112 @@ export class UnsandboxedFullAccessRequiresIsolationError extends Error {
         this.name = 'UnsandboxedFullAccessRequiresIsolationError';
     }
 }
+export class UnsafeWorktreePathError extends Error {
+    constructor(reason) {
+        super(`worktree isolation refused: ${reason}`);
+        this.name = 'UnsafeWorktreePathError';
+    }
+}
+function errorCode(error) {
+    return typeof error === 'object' && error !== null && 'code' in error
+        ? String(error.code)
+        : undefined;
+}
+function assertPathAbsent(path) {
+    try {
+        lstatSync(path);
+    }
+    catch (error) {
+        if (errorCode(error) === 'ENOENT')
+            return;
+        throw error;
+    }
+    throw new UnsafeWorktreePathError('reserved destination already exists');
+}
+function reserveWorktreePath() {
+    // The random 0700 container is atomically created by the OS. The git destination remains absent inside it,
+    // so `git worktree add` cannot adopt an attacker-precreated path from the shared temp directory.
+    const container = mkdtempSync(joinPath(tmpdir(), 'evolver-wt-'));
+    const containerStat = lstatSync(container);
+    if (containerStat.isSymbolicLink() || !containerStat.isDirectory()) {
+        throw new UnsafeWorktreePathError('temporary reservation is not a real directory');
+    }
+    const workDir = joinPath(container, 'worktree');
+    assertPathAbsent(workDir);
+    return {
+        container,
+        containerDev: containerStat.dev,
+        containerIno: containerStat.ino,
+        workDir,
+        expectedRealPath: joinPath(realpathSync(container), 'worktree'),
+    };
+}
+function verifyWorktreePath(reservation) {
+    const stat = lstatSync(reservation.workDir);
+    if (stat.isSymbolicLink() || !stat.isDirectory()) {
+        throw new UnsafeWorktreePathError('git worktree destination is not a real directory');
+    }
+    if (realpathSync(reservation.workDir) !== reservation.expectedRealPath) {
+        throw new UnsafeWorktreePathError('git worktree destination resolves outside its reservation');
+    }
+    return { dev: stat.dev, ino: stat.ino };
+}
+function worktreePathStillOwned(reservation, identity) {
+    try {
+        const stat = lstatSync(reservation.workDir);
+        return !stat.isSymbolicLink()
+            && stat.isDirectory()
+            && stat.dev === identity.dev
+            && stat.ino === identity.ino
+            && realpathSync(reservation.workDir) === reservation.expectedRealPath;
+    }
+    catch {
+        return false;
+    }
+}
+function removeEmptyReservation(reservation) {
+    try {
+        const stat = lstatSync(reservation.container);
+        if (stat.isSymbolicLink() || !stat.isDirectory()
+            || stat.dev !== reservation.containerDev || stat.ino !== reservation.containerIno)
+            return;
+        rmdirSync(reservation.container);
+    }
+    catch (error) {
+        // Never recurse through a path that may have been replaced. Empty, owned reservations are the only thing
+        // removed directly; non-empty or already-gone containers are intentionally left for safe diagnosis.
+        if (!['ENOENT', 'ENOTEMPTY', 'EEXIST'].includes(errorCode(error) ?? ''))
+            throw error;
+    }
+}
+async function cleanupWorktreeReservation(reservation, identity, git, repoCwd) {
+    let cleanupIdentity = identity;
+    if (!cleanupIdentity) {
+        try {
+            cleanupIdentity = verifyWorktreePath(reservation);
+        }
+        catch (error) {
+            if (errorCode(error) !== 'ENOENT')
+                throw error;
+            // `git worktree add` may register metadata before failing without creating the destination. Give Git a
+            // signal-shielded chance to prune that partial registration, then reclaim only the still-empty container.
+            try {
+                await git(['worktree', 'remove', '--force', reservation.workDir], repoCwd, undefined, { processSignalMode: 'ignore' });
+            }
+            catch { /* no child exists, so an unregistered cleanup failure is harmless */ }
+            removeEmptyReservation(reservation);
+            return;
+        }
+    }
+    if (cleanupIdentity) {
+        if (!worktreePathStillOwned(reservation, cleanupIdentity)) {
+            throw new UnsafeWorktreePathError('verified worktree path changed before cleanup');
+        }
+        await git(['worktree', 'remove', '--force', reservation.workDir], repoCwd, undefined, { processSignalMode: 'ignore' });
+        assertPathAbsent(reservation.workDir);
+    }
+    removeEmptyReservation(reservation);
+}
 /** Whether `child` is the same as, or nested under, `root` (both resolved to absolute paths). */
 function isWithinRoot(child, root) {
     const c = resolvePath(child);
@@ -130,6 +237,18 @@ class ExecBridgeRunCancelledError extends Error {
         this.name = 'ExecBridgeRunCancelledError';
     }
 }
+class GitProofError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'GitProofError';
+    }
+}
+class GitOutputTruncatedError extends GitProofError {
+    constructor(bytes) {
+        super(`git output exceeded the capture limit (${String(bytes ?? 'unknown')} bytes)`);
+        this.name = 'GitOutputTruncatedError';
+    }
+}
 function cancelledExecutionResult(run) {
     return {
         outcome: { status: 'failed', score: 0.1, reason: 'execution cancelled' },
@@ -139,26 +258,85 @@ function cancelledExecutionResult(run) {
         ...(run ? { sessionLog: run.error ? `${run.output}\n${run.error}` : run.output } : {}),
     };
 }
-/** Default git runner: spawn `git <args>` in cwd, return stdout (empty string on error). Env scrubbed — git never needs evolver/hub secrets. */
+function failedProofExecutionResult(run, error, proofOfWork) {
+    return {
+        outcome: { status: 'failed', score: 0.1, reason: `execution proof failed: ${error.message}` },
+        ...(proofOfWork ? { proofOfWork } : {}),
+        strongEvidence: false,
+        failureKind: run.failureKind ?? 'runtime_error',
+        exitCode: run.exitCode ?? null,
+        sessionLog: run.error ? `${run.output}\n${run.error}` : run.output,
+    };
+}
+/** Default git runner: every incomplete command result fails closed. */
 export const defaultGitRunner = async (args, cwd, signal, options) => {
+    let result;
     try {
-        const r = await spawnCapture('git', args, {
+        result = await spawnCapture('git', args, {
             cwd,
             timeoutMs: 30_000,
             env: scrubAgentEnv(process.env),
             ...(signal ? { signal } : {}),
             ...(options?.processSignalMode ? { processSignalMode: options.processSignalMode } : {}),
         });
-        if (r.termination === 'cancelled')
-            throw new ExecBridgeRunCancelledError();
-        return r.stdout;
     }
-    catch (error) {
-        if (error instanceof ExecBridgeRunCancelledError)
-            throw error;
-        return '';
+    catch {
+        throw new GitProofError('git command failed to start or capture output');
     }
+    if (result.termination === 'cancelled')
+        throw new ExecBridgeRunCancelledError();
+    if (result.termination === 'timeout')
+        throw new GitProofError('git command timed out');
+    if (result.stdoutTruncated)
+        throw new GitOutputTruncatedError(result.stdoutBytes);
+    if (result.code !== 0)
+        throw new GitProofError(`git command exited with code ${result.code}`);
+    return result.stdout;
 };
+/** Stream a complete git patch to disk so large diffs never need to be retained in the Node heap. */
+async function writeDefaultGitPatch(args, cwd, destination, signal, onDestinationOpened) {
+    const result = await spawnCapture('git', args, {
+        cwd,
+        timeoutMs: 30_000,
+        env: scrubAgentEnv(process.env),
+        stdoutFile: destination,
+        ...(onDestinationOpened ? { onStdoutFileOpened: onDestinationOpened } : {}),
+        ...(signal ? { signal } : {}),
+    });
+    if (result.termination === 'cancelled')
+        throw new ExecBridgeRunCancelledError();
+    if (result.termination === 'timeout')
+        throw new GitProofError('git patch capture timed out');
+    if (result.code !== 0)
+        throw new GitProofError(`git patch capture exited with code ${result.code}`);
+}
+export const defaultGitPatchWriter = (args, cwd, destination, signal, onDestinationOpened) => (writeDefaultGitPatch(args, cwd, destination, signal, onDestinationOpened));
+function writePrivatePatchFile(path, patch) {
+    let fd;
+    let ownsFile = false;
+    try {
+        fd = openSync(path, 'wx', 0o600);
+        ownsFile = true;
+        writeFileSync(fd, patch, { encoding: 'utf8' });
+        closeSync(fd);
+        fd = undefined;
+    }
+    catch (error) {
+        if (fd !== undefined) {
+            try {
+                closeSync(fd);
+            }
+            catch { /* best-effort close before removing our artifact */ }
+        }
+        if (ownsFile) {
+            try {
+                rmSync(path, { force: true });
+            }
+            catch { /* preserve the persistence failure */ }
+        }
+        throw error;
+    }
+}
 /**
  * Build the `execute` function CycleEngine/runEvolutionCycle consume. Default-off: throws
  * ExecBridgeDisabledError on first call unless enabled.
@@ -168,6 +346,7 @@ export function makeClaudeExecBridge(opts) {
     const spec = getRunnerSpec(opts.runner); // #66: claude (default, byte-identical) | codex
     const agent = opts.agent ?? spec.makeRunner(opts.agentOptions);
     const git = opts.git ?? defaultGitRunner;
+    const gitPatchWriter = opts.gitPatchWriter ?? (git === defaultGitRunner ? defaultGitPatchWriter : undefined);
     const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
     // secure by default; only THIS runner's auth env reaches it (claude never gets OPENAI_, codex never ANTHROPIC_, #66)
     const agentEnv = opts.scrubEnv === false ? undefined : scrubAgentEnv(process.env, { allowPrefixes: spec.envAllow.prefixes, ...(spec.envAllow.keys ? { allowKeys: spec.envAllow.keys } : {}) });
@@ -205,23 +384,44 @@ export function makeClaudeExecBridge(opts) {
             // use-case ①: inject the personality style block from the state applySelectForRun just persisted.
             ...(opts.personality ? { personality: opts.personality.currentState() } : {}),
         });
-        // Isolation: run in a throwaway git worktree so the agent's edits never touch the real working tree.
+        // Isolation: atomically reserve an unpredictable private temp container, then let git create the absent
+        // worktree path inside it. Cleanup is armed only after git succeeds and the resulting directory is verified.
         const isolate = opts.isolation === 'worktree';
-        const workDir = isolate ? joinPath(tmpdir(), `evolver-wt-${mutation.id}`) : opts.cwd;
         if (opts.signal?.aborted)
             return cancelledExecutionResult(undefined);
+        const reservation = isolate ? reserveWorktreePath() : undefined;
+        const workDir = reservation?.workDir ?? opts.cwd;
+        let worktreeIdentity;
+        let result;
         let observedRun;
-        const proofGit = async (args, cwd) => {
+        let patchRef;
+        let ownsPatchRef = false;
+        let preservePatchRef = false;
+        let failedProof;
+        const proofGit = async (args, cwd, checkCancellationAfter = true) => {
             if (opts.signal?.aborted)
                 throw new ExecBridgeRunCancelledError();
-            const output = await git(args, cwd, opts.signal);
-            if (opts.signal?.aborted)
-                throw new ExecBridgeRunCancelledError();
-            return output;
+            try {
+                const output = await git(args, cwd, opts.signal);
+                if (checkCancellationAfter && opts.signal?.aborted)
+                    throw new ExecBridgeRunCancelledError();
+                return output;
+            }
+            catch (error) {
+                if (error instanceof ExecBridgeRunCancelledError || opts.signal?.aborted)
+                    throw error;
+                if (error instanceof GitProofError)
+                    throw error;
+                throw new GitProofError('git state proof failed');
+            }
         };
         try {
-            if (isolate)
-                await proofGit(['worktree', 'add', '--detach', workDir, 'HEAD'], opts.cwd);
+            if (reservation) {
+                await proofGit(['worktree', 'add', '--detach', workDir, 'HEAD'], opts.cwd, false);
+                worktreeIdentity = verifyWorktreePath(reservation);
+                if (opts.signal?.aborted)
+                    throw new ExecBridgeRunCancelledError();
+            }
             const run = await agent(prompt, {
                 cwd: workDir,
                 timeoutMs,
@@ -245,17 +445,69 @@ export function makeClaudeExecBridge(opts) {
             let changedFiles;
             let numstat;
             let patch = '';
+            const resetIntentToAdd = async () => {
+                if (untrackedFiles.length > 0) {
+                    await git(['reset', '--quiet', '--', ...untrackedFiles], workDir);
+                }
+            };
             try {
                 stat = parseGitShortstat(await proofGit(['diff', '--shortstat', 'HEAD'], workDir));
                 changedFiles = (await proofGit(['diff', '--name-only', 'HEAD'], workDir)).split('\n').map((s) => s.trim()).filter(Boolean);
                 numstat = await proofGit(['diff', '--numstat', 'HEAD'], workDir);
-                if (isolate && stat.files > 0)
-                    patch = await proofGit(['diff', '--binary', '--full-index', 'HEAD'], workDir);
+                if (isolate && stat.files > 0) {
+                    if (gitPatchWriter) {
+                        patchRef = joinPath(tmpdir(), `evolver-patch-${randomUUID()}.diff`);
+                        try {
+                            await gitPatchWriter(['diff', '--binary', '--full-index', 'HEAD'], workDir, patchRef, opts.signal, () => { ownsPatchRef = true; });
+                            // A successful writer owns its result even when an older injected implementation ignores the
+                            // optional callback. On rejection, only the callback can prove that a partial file is ours.
+                            ownsPatchRef = true;
+                        }
+                        catch (error) {
+                            if (error instanceof ExecBridgeRunCancelledError || opts.signal?.aborted)
+                                throw error;
+                            if (error instanceof SpawnCaptureFinalizeError) {
+                                if (error.result.termination === 'cancelled')
+                                    throw new ExecBridgeRunCancelledError();
+                                if (error.result.termination === 'timeout')
+                                    throw new GitProofError('git patch capture timed out');
+                            }
+                            if (error instanceof GitProofError)
+                                throw error;
+                            throw new GitProofError('git patch capture failed');
+                        }
+                    }
+                    else {
+                        patch = await proofGit(['diff', '--binary', '--full-index', 'HEAD'], workDir);
+                    }
+                }
             }
-            finally {
-                if (untrackedFiles.length > 0)
-                    await git(['reset', '--quiet', '--', ...untrackedFiles], workDir);
+            catch (error) {
+                try {
+                    await resetIntentToAdd();
+                }
+                catch (cleanupError) {
+                    if (cleanupError instanceof ExecBridgeRunCancelledError || opts.signal?.aborted) {
+                        throw new ExecBridgeRunCancelledError();
+                    }
+                    // Preserve the primary proof failure for non-cancellation cleanup errors.
+                }
+                throw error;
             }
+            try {
+                await resetIntentToAdd();
+            }
+            catch (error) {
+                if (error instanceof ExecBridgeRunCancelledError || opts.signal?.aborted)
+                    throw error;
+                if (patchRef && ownsPatchRef) {
+                    failedProof = gitDiffProof(stat, patchRef);
+                    preservePatchRef = true;
+                }
+                throw new GitProofError('git index cleanup failed');
+            }
+            if (opts.signal?.aborted)
+                throw new ExecBridgeRunCancelledError();
             // ENFORCE policy against the ACTUAL diff (finding: prompt.ts only ADVISES the agent "touch at most N
             // file(s) / never modify X"; this is the hard gate). checkPolicy ALWAYS runs the global guards — the
             // system blast hard cap (EVOLVER_HARD_CAP_FILES/LINES), the critical-protected paths (.env, MEMORY.md,
@@ -263,11 +515,19 @@ export function makeClaudeExecBridge(opts) {
             // constraints run is no longer un-guarded. The gene's max_files/max_lines/forbidden_paths layer on top.
             // Any violation fails the cycle no matter what the agent did — even when validation would pass.
             const violations = checkPolicy({ stat, changedFiles, numstat, ...(gene?.constraints ? { constraints: gene.constraints } : {}) });
-            let patchRef;
-            if (isolate && stat.files > 0) {
+            if (isolate && stat.files > 0 && !patchRef) {
                 // preserve the isolated edits as a patch (the worktree itself is removed); the real repo is untouched
-                patchRef = joinPath(tmpdir(), `evolver-patch-${mutation.id}.diff`);
-                writeFileSync(patchRef, patch);
+                const destination = joinPath(tmpdir(), `evolver-patch-${randomUUID()}.diff`);
+                try {
+                    (opts.writePatchFile ?? writePrivatePatchFile)(destination, patch);
+                    patchRef = destination;
+                    ownsPatchRef = true;
+                }
+                catch (error) {
+                    if (error instanceof GitProofError)
+                        throw error;
+                    throw new GitProofError('git patch persistence failed');
+                }
             }
             const proof = gitDiffProof(stat, patchRef);
             // Success: prefer the authoritative validation hook; otherwise "agent succeeded AND produced a diff".
@@ -290,7 +550,8 @@ export function makeClaudeExecBridge(opts) {
                 score = Math.min(score, 0.1);
                 reason = summarizeViolations(violations);
             }
-            return {
+            preservePatchRef = patchRef !== undefined && ownsPatchRef;
+            result = {
                 outcome: { status: passed ? 'success' : 'failed', score, ...(reason ? { reason } : {}) },
                 proofOfWork: proof,
                 strongEvidence: passed && stat.files > 0,
@@ -304,17 +565,42 @@ export function makeClaudeExecBridge(opts) {
         }
         catch (error) {
             if (error instanceof ExecBridgeRunCancelledError || opts.signal?.aborted) {
-                return cancelledExecutionResult(observedRun);
+                result = cancelledExecutionResult(observedRun);
+            }
+            else if (error instanceof GitProofError && observedRun) {
+                result = failedProofExecutionResult(observedRun, error, failedProof);
+            }
+            else {
+                if (reservation) {
+                    try {
+                        await cleanupWorktreeReservation(reservation, worktreeIdentity, git, opts.cwd);
+                    }
+                    catch {
+                        // Preserve the primary execution error. The abandoned reservation remains private and diagnosable.
+                    }
+                }
+                throw error;
             }
-            throw error;
         }
         finally {
-            if (isolate) {
+            if (!preservePatchRef && ownsPatchRef && patchRef) {
                 try {
-                    await git(['worktree', 'remove', '--force', workDir], opts.cwd, undefined, { processSignalMode: 'ignore' });
+                    (opts.removePatchFile ?? ((path) => rmSync(path, { force: true })))(patchRef);
                 }
-                catch { /* best-effort cleanup */ }
+                catch { /* best-effort cleanup must not replace the execution result or its primary failure */ }
+            }
+        }
+        if (reservation) {
+            try {
+                await cleanupWorktreeReservation(reservation, worktreeIdentity, git, opts.cwd);
+            }
+            catch (error) {
+                // A successful run must not hide abandoned edits/resources. Failed and cancelled results retain their
+                // primary classification; the private reservation remains available for diagnosis.
+                if (result.outcome.status === 'success')
+                    throw error;
             }
         }
+        return result;
     };
 }