@evomap/evolver-proxy 2.0.0-beta.19 → 2.0.0-beta.22

package/dist/bin/evolver-proxy.d.ts

@@ -2,12 +2,14 @@
 import { mailbox } from '@evomap/evolver-core';
 import { PrivateNodeCredentialStore } from '../private/nodeCredentialStore.js';
 import { loadEnvFileFromEnv } from './envFile.js';
+import { type DegradedStartupBootstrapResult } from '../selfUpdate/bootstrap.js';
 import { type SelfUpdatePolicy } from '../selfUpdate/policy.js';
 import { type ReleaseBinaryOptions } from '../selfUpdate/releaseBinary.js';
 import { rollbackDurableSelfUpdate, type SelfUpdateRecoveryOptions, type SelfUpdateRecoveryResult, type StagedBinaryProbe } from '../selfUpdate/transaction.js';
 import { maybeRunWindowsUpdaterWorkerFromArgv } from '../selfUpdate/windowsUpdater.js';
 import { maybeRunUnixRecoveryController } from '../selfUpdate/unixController.js';
 import { maybeRunWindowsRecoveryController } from '../selfUpdate/windowsController.js';
+import { consumeRecoveryChildStartGate } from '../selfUpdate/recoveryChildStartGate.js';
 import type { AtpProxyClient, ProxyDaemonDeps, ProxyTickReport } from '../daemon/proxyDaemon.js';
 import type { HelloLifecycleMode, HelloResult, HeartbeatOptions, HeartbeatResult } from '../lifecycle/manager.js';
 import type { InboundResult } from '../sync/engine.js';
@@ -15,7 +17,16 @@ import type { InboundResult } from '../sync/engine.js';
 export interface RunProxyMainOptions {
     environmentPrepared?: boolean;
     recoveryPrepared?: SelfUpdateRecoveryResult;
+    requireLifecycleBootstrapState?: boolean;
+    /** Test-only transport seam. Production always resolves the configured hub runtime. */
+    connectRuntime?: typeof connectHubRuntime;
+    /** Test-only bounded loop seam. Production always runs the managed proxy loop. */
+    runLoop?: Parameters<typeof runManagedProxyLoop>[0]['runLoop'];
 }
+export declare function writeBootstrapStartupResult(result: DegradedStartupBootstrapResult, writers?: {
+    stdout?: (text: string) => void;
+    stderr?: (text: string) => void;
+}): 0 | 1 | undefined;
 export declare function runProxyMain(options?: RunProxyMainOptions): Promise<void>;
 export declare function recoverBoundDurableSelfUpdate(options: Omit<SelfUpdateRecoveryOptions, 'beforeJournalMutation'>): Promise<SelfUpdateRecoveryResult>;
 export declare function loadProxyEnvFile(env: NodeJS.ProcessEnv): ReturnType<typeof loadEnvFileFromEnv>;
@@ -52,6 +63,7 @@ export interface RunProxyCliOptions {
     runUnixRecoveryController?: typeof maybeRunUnixRecoveryController;
     runWindowsRecoveryController?: typeof maybeRunWindowsRecoveryController;
     runWindowsUpdaterWorker?: typeof maybeRunWindowsUpdaterWorkerFromArgv;
+    consumeChildStartGate?: typeof consumeRecoveryChildStartGate;
 }
 export interface ProxyCliPathOptions {
     home?: string;

package/dist/bin/evolver-proxy.js

@@ -2,9 +2,9 @@
 import { createHash, randomBytes } from 'node:crypto';
 import { readFileSync, realpathSync, rmSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { join, resolve, win32 } from 'node:path';
+import { join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { daemon, hub as hubNs, mailbox } from '@evomap/evolver-core';
+import { bootstrap as coreBootstrap, daemon, hub as hubNs, mailbox, util, verify } from '@evomap/evolver-core';
 import { AtpHubClient, connectPublicHub, globalFetchLike, isNodeSecret, parseNodeSecretVersion } from '@evomap/evolver-adapter-public';
 import { ProxyDaemon } from '../daemon/proxyDaemon.js';
 import { resolveHubMode, resolveHubUrl } from '../daemon/selectHub.js';
@@ -19,25 +19,47 @@ import { publishProxySettings } from './proxySettings.js';
 import { expandHomePath, loadEnvFileFromEnv } from './envFile.js';
 import { readLegacyNodeId, resolveProxyNodeId } from '../lifecycle/legacyNodeId.js';
 import { createClaimNudge, wrapHelloWithClaimNudge } from '../lifecycle/claimNudge.js';
+import { acquireLifecycleBootstrapOwnerLease, assertSupervisedLifecycleBootstrapState, bootstrapDegradedSelfUpdateStartup, clearRecoveryControllerLifecycleOwnerCapability, lifecycleBootstrapStatePresent, publishRecoveryControllerLifecycleStartupAttestation, RECOVERY_CONTROLLER_LIFECYCLE_OWNER_CAPABILITY_ENV, } from '../selfUpdate/bootstrap.js';
 import { getCurrentVersion } from '../selfUpdate/version.js';
-import { resolveSelfUpdatePolicy } from '../selfUpdate/policy.js';
-import { atomicReplaceExecutable, downloadGithubReleaseArtifact, resolveGithubReleaseManifest, resolveSelfUpdateTarget, } from '../selfUpdate/releaseBinary.js';
+import { resolveEffectiveSelfUpdatePolicy, selfUpdateSupervisorAttested, } from '../selfUpdate/policy.js';
+import { resolveSelfUpdatePublicKey } from '../selfUpdate/builtinKey.js';
+import { atomicReplaceExecutable, assertSelfUpdateProcessTargetBound as assertReleaseSelfUpdateProcessTargetBound, downloadGithubReleaseArtifact, resolveGithubReleaseManifest, } from '../selfUpdate/releaseBinary.js';
 import { beginDurableSelfUpdate, confirmDurableSelfUpdate, recoverDurableSelfUpdate, rollbackDurableSelfUpdate, } from '../selfUpdate/transaction.js';
-import { SELF_UPDATE_FAILURE_CODES } from '../selfUpdate/failureCodes.js';
-import { maybeRunWindowsUpdaterWorkerFromArgv } from '../selfUpdate/windowsUpdater.js';
+import { SELF_UPDATE_FAILURE_CODES, selfUpdateFailure } from '../selfUpdate/failureCodes.js';
+import { maybeRunWindowsUpdaterWorkerFromArgv, WINDOWS_UPDATER_WORKER_ARG, } from '../selfUpdate/windowsUpdater.js';
 import { maybeRunUnixRecoveryController } from '../selfUpdate/unixController.js';
 import { maybeRunWindowsRecoveryController } from '../selfUpdate/windowsController.js';
+import { consumeRecoveryChildStartGate, RECOVERY_CHILD_START_GATE_ENV, } from '../selfUpdate/recoveryChildStartGate.js';
+import { publishLifecycleBootstrapReadiness } from '../selfUpdate/bootstrapReadiness.js';
 import { finalizeSelfUpdateRecoveryLastUpdate } from '../selfUpdate/lastUpdate.js';
+export function writeBootstrapStartupResult(result, writers = {}) {
+    const line = `${result.message}\n`;
+    if (result.disposition === 'handoff') {
+        (writers.stdout ?? ((text) => { process.stdout.write(text); }))(line);
+        return result.exitCode;
+    }
+    (writers.stderr ?? ((text) => { process.stderr.write(text); }))(line);
+    return result.disposition === 'fail_closed' ? result.exitCode : undefined;
+}
 export async function runProxyMain(options = {}) {
+    if (process.env[RECOVERY_CHILD_START_GATE_ENV] !== undefined) {
+        throw new Error('self_update_recovery_child_start_gate_unconsumed');
+    }
     if (process.argv.includes('--help') || process.argv.includes('-h')) {
         process.stdout.write(proxyUsage());
         return;
     }
     // Recovery must run before any hub/store/runtime initialization. In particular,
     // a broken store or env-file pointer must not prevent a pending-health update from restoring the old binary.
+    const requireLifecycleBootstrapState = options.requireLifecycleBootstrapState
+        ?? unpinnedLegacySupervisorRequiresLifecycleState(process.env);
+    const recoveryEnvironment = proxyRecoveryEnvironment(process.env);
+    assertSupervisedLifecycleBootstrapState(recoveryEnvironment, {
+        requireLifecycleState: requireLifecycleBootstrapState,
+    });
     const recovery = options.recoveryPrepared
         ?? await recoverBoundDurableSelfUpdate({
-            env: proxyRecoveryEnvironment(process.env),
+            env: recoveryEnvironment,
             processExecPath: process.execPath,
         });
     if (recovery.outcome === 'blocked') {
@@ -50,6 +72,15 @@ export async function runProxyMain(options = {}) {
         if (envFile.error)
             throw new Error(`failed to load EVOLVER_ENV_FILE: ${safeLoopMessage(envFile.error)}`);
     }
+    assertSupervisedLifecycleBootstrapState(process.env, {
+        requireLifecycleState: requireLifecycleBootstrapState,
+    });
+    try {
+        publishRecoveryControllerLifecycleStartupAttestation(process.env);
+    }
+    finally {
+        clearRecoveryControllerLifecycleOwnerCapability(process.env);
+    }
     let storePath;
     let store;
     let proxyDaemon;
@@ -83,7 +114,18 @@ export async function runProxyMain(options = {}) {
         // same owner. See lifecycle/legacyNodeId.ts for the duplicate-node rationale.
         const senderId = () => resolveProxyNodeId({ storedNodeId: store.getState('node_id'), configuredNodeId });
         evolverVersion = getCurrentVersion();
-        selfUpdatePolicy = resolveSelfUpdatePolicy(process.env);
+        // Default (unset) 'auto' without a durable supervisor attestation degrades to 'off' so
+        // unsupervised foreground runs keep starting; explicit 'auto' stays fail-closed at assembly below.
+        const effectiveSelfUpdate = resolveEffectiveSelfUpdatePolicy(process.env);
+        selfUpdatePolicy = effectiveSelfUpdate.policy;
+        const recoverLifecycleBootstrap = !selfUpdateSupervisorAttested(process.env)
+            && lifecycleBootstrapStatePresent(process.env);
+        if (effectiveSelfUpdate.degraded || recoverLifecycleBootstrap) {
+            const bootstrap = await bootstrapDegradedSelfUpdateStartup(process.env, process.platform);
+            const bootstrapExitCode = writeBootstrapStartupResult(bootstrap);
+            if (bootstrapExitCode !== undefined)
+                process.exit(bootstrapExitCode);
+        }
         const proxyStartedAt = new Date().toISOString();
         publishLocalProxySettings = () => {
             if (!proxySettingsState.url)
@@ -102,7 +144,7 @@ export async function runProxyMain(options = {}) {
         const privateNodeCredentialStore = mode === 'private'
             ? new PrivateNodeCredentialStore(storePath)
             : undefined;
-        const runtime = await connectHubRuntime({
+        const runtime = await (options.connectRuntime ?? connectHubRuntime)({
             mode,
             hubUrl,
             senderId,
@@ -134,6 +176,11 @@ export async function runProxyMain(options = {}) {
                 throw new Error(`self_update_confirmation_failed:${confirmation.outcome}`);
             }
         }
+        publishLifecycleBootstrapReadiness({
+            env: process.env,
+            startedAt: proxyStartedAt,
+            ipcUrl: `http://127.0.0.1:${port}`,
+        });
     }
     catch (error) {
         if (recovery.outcome === 'pending_health') {
@@ -164,6 +211,7 @@ export async function runProxyMain(options = {}) {
         store: store,
         notifier: systemdNotifier,
         logger: process.stderr,
+        ...(options.runLoop ? { runLoop: options.runLoop } : {}),
     });
 }
 export async function recoverBoundDurableSelfUpdate(options) {
@@ -176,8 +224,12 @@ export async function recoverBoundDurableSelfUpdate(options) {
 }
 export function loadProxyEnvFile(env) {
     const supervisor = env['EVOLVER_SELF_UPDATE_SUPERVISOR'];
+    const lifecycleStateDir = env['EVOLVER_LIFECYCLE_STATE_DIR'];
     const stateDir = env['EVOLVER_SELF_UPDATE_STATE_DIR'];
     const targetPath = env['EVOLVER_SELF_UPDATE_TARGET_PATH'];
+    const bootstrapTransactionId = env[coreBootstrap.LIFECYCLE_BOOTSTRAP_TRANSACTION_ENV];
+    const recoveryControllerOwnerCapability = env[RECOVERY_CONTROLLER_LIFECYCLE_OWNER_CAPABILITY_ENV];
+    const recoveryChildStartGate = env[RECOVERY_CHILD_START_GATE_ENV];
     const systemRootBindings = Object.entries(env)
         .filter(([key]) => key.toLowerCase() === 'systemroot');
     const result = loadEnvFileFromEnv(env);
@@ -189,15 +241,37 @@ export function loadProxyEnvFile(env) {
         if (value !== undefined)
             env[key] = value;
     }
+    if (recoveryControllerOwnerCapability === undefined) {
+        delete env[RECOVERY_CONTROLLER_LIFECYCLE_OWNER_CAPABILITY_ENV];
+    }
+    else {
+        env[RECOVERY_CONTROLLER_LIFECYCLE_OWNER_CAPABILITY_ENV] =
+            recoveryControllerOwnerCapability;
+    }
+    if (recoveryChildStartGate === undefined) {
+        delete env[RECOVERY_CHILD_START_GATE_ENV];
+    }
+    else {
+        env[RECOVERY_CHILD_START_GATE_ENV] = recoveryChildStartGate;
+    }
     if (supervisor === undefined) {
         delete env['EVOLVER_SELF_UPDATE_SUPERVISOR'];
+        delete env[coreBootstrap.LIFECYCLE_BOOTSTRAP_TRANSACTION_ENV];
     }
     else {
         env['EVOLVER_SELF_UPDATE_SUPERVISOR'] = supervisor;
+        if (lifecycleStateDir !== undefined)
+            env['EVOLVER_LIFECYCLE_STATE_DIR'] = lifecycleStateDir;
         if (stateDir !== undefined)
             env['EVOLVER_SELF_UPDATE_STATE_DIR'] = stateDir;
         if (targetPath !== undefined)
             env['EVOLVER_SELF_UPDATE_TARGET_PATH'] = targetPath;
+        if (bootstrapTransactionId !== undefined) {
+            env[coreBootstrap.LIFECYCLE_BOOTSTRAP_TRANSACTION_ENV] = bootstrapTransactionId;
+        }
+        else {
+            delete env[coreBootstrap.LIFECYCLE_BOOTSTRAP_TRANSACTION_ENV];
+        }
     }
     return result;
 }
@@ -206,6 +280,11 @@ function proxyRecoveryEnvironment(env) {
     loadProxyEnvFile(recoveryEnv);
     return recoveryEnv;
 }
+function unpinnedLegacySupervisorRequiresLifecycleState(env) {
+    return selfUpdateSupervisorAttested(env)
+        && !env['EVOLVER_LIFECYCLE_STATE_DIR']?.trim()
+        && Boolean(env['EVOLVER_ENV_FILE']?.trim());
+}
 function finalizeRecoveryTelemetry(store, recovery) {
     try {
         finalizeSelfUpdateRecoveryLastUpdate(store, recovery);
@@ -303,6 +382,7 @@ export function proxyUsage(command = 'evolver-proxy') {
         '',
         'Useful options are configured through env or EVOLVER_ENV_FILE:',
         '  EVOLVER_IPC_PORT, EVOLVER_IPC_TOKEN, EVOLVER_PROXY_SETTINGS_FILE',
+        '  EVOLVER_NATIVE_PUBLISH_VERIFIER=1, EVOLVER_PUBLISH_VALIDATION_ROOT=<dir> (必须显式设置)',
         '  EVOLVER_SELF_UPDATE, EVOLVER_LLM_TRACE_CAPTURE_BODIES',
         '',
     ].join('\n');
@@ -369,27 +449,44 @@ function applyProxyCliPathOptions(options, env) {
 export async function runProxyCli(options = {}) {
     const argv = options.argv ?? process.argv.slice(2);
     const env = options.env ?? process.env;
+    const platform = options.platform ?? process.platform;
+    const processExecPath = options.processExecPath ?? process.execPath;
+    const startupGateRole = recoveryChildStartGateRole(argv);
+    let startupGateConsumed = false;
+    try {
+        startupGateConsumed = await (options.consumeChildStartGate ?? consumeRecoveryChildStartGate)(env, startupGateRole);
+        if (!startupGateConsumed
+            && (startupGateRole === 'windows-updater'
+                || env[RECOVERY_CONTROLLER_LIFECYCLE_OWNER_CAPABILITY_ENV] !== undefined)) {
+            throw new Error('self_update_recovery_child_start_gate_required');
+        }
+    }
+    catch (error) {
+        process.stderr.write(`[evolver-proxy] fatal: ${safeLoopErrorMessage(error)}\n`);
+        return 1;
+    }
     const unixControllerExitCode = await (options.runUnixRecoveryController ?? maybeRunUnixRecoveryController)({
         argv,
         env,
-        platform: options.platform ?? process.platform,
-        processExecPath: options.processExecPath ?? process.execPath,
+        platform,
+        processExecPath,
     });
     if (unixControllerExitCode !== undefined)
         return unixControllerExitCode;
     const windowsControllerExitCode = await (options.runWindowsRecoveryController ?? maybeRunWindowsRecoveryController)({
         argv,
         env,
-        platform: options.platform ?? process.platform,
-        processExecPath: options.processExecPath ?? process.execPath,
+        platform,
+        processExecPath,
     });
     if (windowsControllerExitCode !== undefined)
         return windowsControllerExitCode;
     const workerExitCode = await (options.runWindowsUpdaterWorker ?? maybeRunWindowsUpdaterWorkerFromArgv)({
         argv,
         env,
-        platform: options.platform ?? process.platform,
-        processExecPath: options.processExecPath ?? process.execPath,
+        platform,
+        processExecPath,
+        startupGateConsumed,
     });
     if (workerExitCode !== undefined)
         return workerExitCode;
@@ -403,9 +500,14 @@ export async function runProxyCli(options = {}) {
         if (cliOptions.envFile)
             env['EVOLVER_ENV_FILE'] = cliOptions.envFile;
         applyProxyCliPathOptions(cliOptions, env);
+        const requireLifecycleBootstrapState = unpinnedLegacySupervisorRequiresLifecycleState(env);
+        const recoveryEnvironment = proxyRecoveryEnvironment(env);
+        assertSupervisedLifecycleBootstrapState(recoveryEnvironment, {
+            requireLifecycleState: requireLifecycleBootstrapState,
+        });
         const recovery = options.recoverStartup || !options.runMain
             ? await (options.recoverStartup ?? recoverBoundDurableSelfUpdate)({
-                env: proxyRecoveryEnvironment(env),
+                env: recoveryEnvironment,
                 processExecPath: options.processExecPath ?? process.execPath,
             })
             : undefined;
@@ -420,6 +522,7 @@ export async function runProxyCli(options = {}) {
         }
         await (options.runMain ?? runProxyMain)({
             environmentPrepared: true,
+            requireLifecycleBootstrapState,
             ...(recovery ? { recoveryPrepared: recovery } : {}),
         });
         return 0;
@@ -432,6 +535,16 @@ export async function runProxyCli(options = {}) {
         uninstallUnhandledRejectionGuard();
     }
 }
+function recoveryChildStartGateRole(argv) {
+    if (argv.length === 1 && argv[0] === 'proxy')
+        return 'proxy-target';
+    if (argv.length === 2
+        && argv[0] === 'proxy'
+        && argv[1] === WINDOWS_UPDATER_WORKER_ARG) {
+        return 'windows-updater';
+    }
+    return undefined;
+}
 if (isDirectRun(import.meta.url, process.argv[1])) {
     void runProxyCli().then((exitCode) => {
         process.exitCode = exitCode;
@@ -544,6 +657,7 @@ export function createProxyDaemonDeps(options) {
     const env = options.env ?? process.env;
     const traceBackfill = resolveTraceBackfillConfig(env);
     const heartbeatIntervalMs = positiveIntegerEnv(env['HEARTBEAT_INTERVAL_MS']);
+    const publishExecutionVerifier = resolveNativePublishExecutionVerifier(env);
     return {
         hub: options.runtime.hub,
         ...(options.hubMode ? { hubMode: options.hubMode } : {}),
@@ -561,6 +675,57 @@ export function createProxyDaemonDeps(options) {
         ...(options.runtime.helloMode ? { helloMode: options.runtime.helloMode } : {}),
         ...(selfUpdate ? { selfUpdate } : {}),
         ...(traceBackfill ? { traceBackfill } : {}),
+        ...(publishExecutionVerifier ? { publishExecutionVerifier } : {}),
+    };
+}
+/**
+ * 仅在显式启用且具备完整 OS 隔离时接入本地发布验证器；默认仍保持 draft-only。
+ * 这样不会把普通桌面进程意外变成可发布执行器，也不会在 Windows/macOS 上静默降级为弱隔离。
+ */
+function resolveNativePublishExecutionVerifier(env) {
+    if (env['EVOLVER_NATIVE_PUBLISH_VERIFIER']?.trim() !== '1')
+        return undefined;
+    // 原生发布验证器只能在完整的 OS 隔离可用时装配。Windows/macOS 目前没有
+    // 与 Linux namespace、只读文件系统和 cgroup 等价的实现，必须保持 draft-only，
+    // 不能先暴露一个运行时必然失败的“验证器”能力。
+    try {
+        if (!verify.readOnlyIsolationAvailable())
+            return undefined;
+    }
+    catch {
+        // 隔离探测本身失败也必须保持 fail-closed，而不能阻止代理启动。
+        return undefined;
+    }
+    // 发布验证必须绑定到调用方明确配置的项目根目录；回退到 daemon 当前目录会让验证对象与发布对象脱钩。
+    const configuredRoot = env['EVOLVER_PUBLISH_VALIDATION_ROOT']?.trim();
+    if (!configuredRoot)
+        return undefined;
+    const validationRoot = resolve(configuredRoot);
+    return async (input, signal) => {
+        const commands = Array.isArray(input.validation)
+            ? input.validation.filter((value) => typeof value === 'string').map((value) => value.trim()).filter(Boolean)
+            : [];
+        if (commands.length === 0
+            || commands.length > 8
+            || !Array.isArray(input.validation)
+            || input.validation.length !== commands.length
+            || commands.some((command) => command.length > 180 || !verify.isValidationCommandAllowed(command))
+            || signal.aborted)
+            return null;
+        const result = await verify.runSandboxedValidation(commands, validationRoot, {
+            requireIsolation: true,
+            signal,
+        });
+        if (signal.aborted || !result.passed || result.results.length !== commands.length)
+            return null;
+        return {
+            validation: commands,
+            trace: result.results.map((row) => ({
+                command: row.cmd,
+                exit: row.exitCode ?? 1,
+                ...(row.stdoutSummary ? { summary: row.stdoutSummary } : {}),
+            })),
+        };
     };
 }
 function positiveIntegerEnv(value) {
@@ -698,7 +863,7 @@ export function createSelfUpdateDeps(policy, currentVersion, env = process.env,
     if (!supervisorAttested && !selfUpdateSupervisorAttested(env)) {
         throw new Error('self_update_supervisor_required');
     }
-    const publicKey = env['EVOLVER_SELF_UPDATE_PUBLIC_KEY']?.trim();
+    const publicKey = resolveSelfUpdatePublicKey(env);
     if (!publicKey)
         throw new Error('self_update_public_key_required');
     const releaseOpts = {
@@ -708,24 +873,77 @@ export function createSelfUpdateDeps(policy, currentVersion, env = process.env,
         requireSignedManifest: true,
     };
     const assertBound = () => assertSelfUpdateProcessTargetBound(releaseOpts);
+    let activeLifecycleLease;
+    const acquireLifecycleLease = () => {
+        assertBound();
+        if (activeLifecycleLease) {
+            throw selfUpdateFailure(SELF_UPDATE_FAILURE_CODES.UPDATE_LOCKED, 'self_update_lifecycle_owner_lease_already_active');
+        }
+        let acquired;
+        try {
+            acquired = acquireLifecycleBootstrapOwnerLease(env);
+        }
+        catch (error) {
+            if (error instanceof util.LockTimeoutError) {
+                throw selfUpdateFailure(SELF_UPDATE_FAILURE_CODES.UPDATE_LOCKED, 'self_update_lifecycle_owner_lock_busy', { cause: error });
+            }
+            throw selfUpdateFailure(SELF_UPDATE_FAILURE_CODES.RECOVERY_REQUIRED, `self_update_lifecycle_owner_lease_acquire_failed:${safeLoopErrorMessage(error)}`, { cause: error });
+        }
+        let released = false;
+        const lease = {
+            assertOwned: () => {
+                if (released || activeLifecycleLease !== lease) {
+                    throw selfUpdateFailure(SELF_UPDATE_FAILURE_CODES.RECOVERY_REQUIRED, 'self_update_lifecycle_owner_lease_not_active');
+                }
+                assertBound();
+                try {
+                    acquired.assertOwned();
+                }
+                catch (error) {
+                    throw selfUpdateFailure(SELF_UPDATE_FAILURE_CODES.RECOVERY_REQUIRED, `self_update_lifecycle_owner_lease_lost:${safeLoopErrorMessage(error)}`, { cause: error });
+                }
+            },
+            release: () => {
+                if (released)
+                    return;
+                try {
+                    acquired.release();
+                }
+                finally {
+                    released = true;
+                    if (activeLifecycleLease === lease)
+                        activeLifecycleLease = undefined;
+                }
+            },
+        };
+        activeLifecycleLease = lease;
+        return lease;
+    };
+    const assertOperationAllowed = () => {
+        if (!activeLifecycleLease) {
+            throw selfUpdateFailure(SELF_UPDATE_FAILURE_CODES.RECOVERY_REQUIRED, 'self_update_lifecycle_owner_lease_required');
+        }
+        activeLifecycleLease.assertOwned();
+    };
     assertBound();
     return {
         policy,
         currentVersion,
+        acquireLifecycleLease,
         resolveManifest: (directive) => {
-            assertBound();
+            assertOperationAllowed();
             return resolveGithubReleaseManifest(directive, releaseOpts);
         },
         download: (targetVersion, directive) => {
-            assertBound();
+            assertOperationAllowed();
             return downloadGithubReleaseArtifact(targetVersion, directive, releaseOpts);
         },
         atomicReplace: (stagedPath) => {
-            assertBound();
+            assertOperationAllowed();
             return atomicReplaceExecutable(stagedPath, releaseOpts);
         },
         beginTransaction: async (targetVersion) => {
-            assertBound();
+            assertOperationAllowed();
             const transaction = await beginDurableSelfUpdate(targetVersion, {
                 ...releaseOpts,
                 currentVersion,
@@ -733,50 +951,33 @@ export function createSelfUpdateDeps(policy, currentVersion, env = process.env,
             });
             return {
                 ...transaction,
+                adoptDownloaded: async (download) => {
+                    assertOperationAllowed();
+                    return transaction.adoptDownloaded(download);
+                },
+                markVerified: async (artifacts) => {
+                    assertOperationAllowed();
+                    await transaction.markVerified(artifacts);
+                },
                 install: async () => {
-                    assertBound();
+                    assertOperationAllowed();
                     await transaction.install();
                 },
+                markRestartRequested: async () => {
+                    assertOperationAllowed();
+                    await transaction.markRestartRequested();
+                },
             };
         },
-        restart: restart ?? (() => { process.exit(78); }),
+        restart: () => {
+            assertOperationAllowed();
+            (restart ?? (() => { process.exit(78); }))();
+        },
         publicKey,
     };
 }
 export function assertSelfUpdateProcessTargetBound(options, allowUnresolvedTarget = false) {
-    let targetPath;
-    try {
-        targetPath = resolveSelfUpdateTarget(options).path;
-    }
-    catch {
-        if (allowUnresolvedTarget)
-            return;
-        throw new Error('self_update_process_target_mismatch');
-    }
-    const processExecPath = options.processExecPath ?? process.execPath;
-    try {
-        if (canonicalExecutablePath(processExecPath) !== canonicalExecutablePath(targetPath)) {
-            throw new Error('self_update_process_target_mismatch');
-        }
-    }
-    catch {
-        throw new Error('self_update_process_target_mismatch');
-    }
-}
-function canonicalExecutablePath(path) {
-    const canonical = realpathSync.native(path);
-    if (process.platform !== 'win32')
-        return resolve(canonical);
-    const withoutNamespace = canonical
-        .replace(/^\\\\\?\\UNC\\/i, '\\\\')
-        .replace(/^\\\\\?\\/i, '');
-    return win32.normalize(withoutNamespace).toLowerCase();
-}
-function selfUpdateSupervisorAttested(env) {
-    const supervisor = env['EVOLVER_SELF_UPDATE_SUPERVISOR']?.trim();
-    return supervisor === 'systemd'
-        || supervisor === 'launchd'
-        || supervisor === 'windows-scheduled-task';
+    assertReleaseSelfUpdateProcessTargetBound(options, allowUnresolvedTarget);
 }
 export function resolvePublicNodeSecret(deps) {
     const explicit = resolveExplicitPublicNodeCredentials(process.env);

package/dist/daemon/proxyDaemon.d.ts

@@ -6,6 +6,7 @@ import type { AtpOrderConsentGate } from './atpConsent.js';
 import { type PublishRecallVerifierPort } from './publishRecallVerifier.js';
 type HubCapability = hubNs.HubCapability;
 type AssetStoreProvider = assetstore.AssetStoreProvider;
+type ConversationDistillExecutionVerifier = (input: hubNs.ConversationDistillInput, signal: AbortSignal) => Promise<hubNs.ConversationDistillVerifiedExecution | null>;
 export declare const DEFAULT_IPC_PORT = 19820;
 export interface ProxyDaemonDeps {
     hub: HubCapability;
@@ -75,6 +76,12 @@ export interface ProxyDaemonDeps {
     publishRecallVerifier?: PublishRecallVerifierPort;
     /** Optional deterministic sanitizer environment for composition tests. Production omits this to scan process.env. */
     publishSanitizeEnv?: Record<string, string | undefined>;
+    /**
+     * 宿主专属的真实执行验证器。缺失时，conversation distill 只能返回草稿，绝不持久化或排队发布。
+     */
+    publishExecutionVerifier?: ConversationDistillExecutionVerifier;
+    /** 验证器响应的硬超时，防止发布请求因宿主执行器挂起而永久占用连接。 */
+    publishExecutionVerifierTimeoutMs?: number;
 }
 export interface ProxyTickReport {
     outbound: OutboundResult;
@@ -144,6 +151,8 @@ export declare class ProxyDaemon {
     private readonly collaborationFacade;
     private readonly publishRecallVerifier;
     private readonly proxyHandler;
+    private readonly hub;
+    private readonly recipeComposeStarted;
     private ipc;
     private readonly now;
     private readonly random;
@@ -178,6 +187,8 @@ export declare class ProxyDaemon {
     private scheduledForceUpdateKey;
     private traceBackfillDraining;
     private loopWakeHandler;
+    /** 守护进程停止时取消宿主验证。 */
+    private publishAbortController;
     constructor(deps: ProxyDaemonDeps);
     /**
      * core handler(确定性, 不经 agent): 目前只接 force_update(#108). 其他 core 类型(asset_publish_result/
@@ -231,6 +242,7 @@ export declare class ProxyDaemon {
     private cacheRemoteAssetSearch;
     private publishAssetSubmitSynchronously;
     private createSynchronousAssetSubmitEnvelope;
+    private composeRecipeAfterAcceptedSubmit;
     private currentHubMode;
     private handleHubModeBoundOutbound;
     private publishSynchronousBundle;