@evomap/evolver-proxy 2.0.19 → 2.0.24

package/dist/bin/evolver-proxy.js

@@ -4,7 +4,7 @@ import { readFileSync, realpathSync, rmSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { bootstrap as coreBootstrap, daemon, hub as hubNs, mailbox, util } from '@evomap/evolver-core';
+import { bootstrap as coreBootstrap, daemon, hub as hubNs, mailbox, util, verify } from '@evomap/evolver-core';
 import { AtpHubClient, connectPublicHub, globalFetchLike, isNodeSecret, parseNodeSecretVersion } from '@evomap/evolver-adapter-public';
 import { ProxyDaemon } from '../daemon/proxyDaemon.js';
 import { resolveHubMode, resolveHubUrl } from '../daemon/selectHub.js';
@@ -382,6 +382,7 @@ export function proxyUsage(command = 'evolver-proxy') {
         '',
         'Useful options are configured through env or EVOLVER_ENV_FILE:',
         '  EVOLVER_IPC_PORT, EVOLVER_IPC_TOKEN, EVOLVER_PROXY_SETTINGS_FILE',
+        '  EVOLVER_NATIVE_PUBLISH_VERIFIER=1, EVOLVER_PUBLISH_VALIDATION_ROOT=<dir> (必须显式设置)',
         '  EVOLVER_SELF_UPDATE, EVOLVER_LLM_TRACE_CAPTURE_BODIES',
         '',
     ].join('\n');
@@ -656,6 +657,7 @@ export function createProxyDaemonDeps(options) {
     const env = options.env ?? process.env;
     const traceBackfill = resolveTraceBackfillConfig(env);
     const heartbeatIntervalMs = positiveIntegerEnv(env['HEARTBEAT_INTERVAL_MS']);
+    const publishExecutionVerifier = resolveNativePublishExecutionVerifier(env);
     return {
         hub: options.runtime.hub,
         ...(options.hubMode ? { hubMode: options.hubMode } : {}),
@@ -673,6 +675,59 @@ export function createProxyDaemonDeps(options) {
         ...(options.runtime.helloMode ? { helloMode: options.runtime.helloMode } : {}),
         ...(selfUpdate ? { selfUpdate } : {}),
         ...(traceBackfill ? { traceBackfill } : {}),
+        ...(publishExecutionVerifier ? { publishExecutionVerifier } : {}),
+    };
+}
+/**
+ * 仅在显式启用且具备完整 OS 隔离时接入本地发布验证器；默认仍保持 draft-only。
+ * 这样不会把普通桌面进程意外变成可发布执行器，也不会在 Windows/macOS 上静默降级为弱隔离。
+ */
+function resolveNativePublishExecutionVerifier(env) {
+    if (env['EVOLVER_NATIVE_PUBLISH_VERIFIER']?.trim() !== '1')
+        return undefined;
+    // 原生发布验证器只能在完整的 OS 隔离可用时装配。Windows/macOS 目前没有
+    // 与 Linux namespace、只读文件系统和 cgroup 等价的实现，必须保持 draft-only，
+    // 不能先暴露一个运行时必然失败的“验证器”能力。
+    try {
+        if (!verify.readOnlyIsolationAvailable())
+            return undefined;
+    }
+    catch {
+        // 隔离探测本身失败也必须保持 fail-closed，而不能阻止代理启动。
+        return undefined;
+    }
+    // 发布验证必须绑定到调用方明确配置的项目根目录；回退到 daemon 当前目录会让验证对象与发布对象脱钩。
+    const configuredRoot = env['EVOLVER_PUBLISH_VALIDATION_ROOT']?.trim();
+    if (!configuredRoot)
+        return undefined;
+    const validationRoot = resolve(configuredRoot);
+    return async (input, signal) => {
+        const commands = Array.isArray(input.validation)
+            ? input.validation.filter((value) => typeof value === 'string').map((value) => value.trim()).filter(Boolean)
+            : [];
+        if (commands.length === 0
+            || commands.length > 8
+            || !Array.isArray(input.validation)
+            || input.validation.length !== commands.length
+            || commands.some((command) => command.length > 180
+                || !verify.isValidationCommandAllowed(command)
+                || verify.sanitizeExecutionCommand(command).blocked)
+            || signal.aborted)
+            return null;
+        const result = await verify.runSandboxedValidation(commands, validationRoot, {
+            requireIsolation: true,
+            signal,
+        });
+        if (signal.aborted || !result.passed || result.results.length !== commands.length)
+            return null;
+        return {
+            validation: commands,
+            trace: result.results.map((row) => ({
+                command: row.cmd,
+                exit: row.exitCode ?? 1,
+                ...(row.stdoutSummary ? { summary: row.stdoutSummary } : {}),
+            })),
+        };
     };
 }
 function positiveIntegerEnv(value) {

package/dist/daemon/proxyDaemon.d.ts

@@ -6,6 +6,7 @@ import type { AtpOrderConsentGate } from './atpConsent.js';
 import { type PublishRecallVerifierPort } from './publishRecallVerifier.js';
 type HubCapability = hubNs.HubCapability;
 type AssetStoreProvider = assetstore.AssetStoreProvider;
+type ConversationDistillExecutionVerifier = (input: hubNs.ConversationDistillInput, signal: AbortSignal) => Promise<hubNs.ConversationDistillVerifiedExecution | null>;
 export declare const DEFAULT_IPC_PORT = 19820;
 export interface ProxyDaemonDeps {
     hub: HubCapability;
@@ -75,6 +76,12 @@ export interface ProxyDaemonDeps {
     publishRecallVerifier?: PublishRecallVerifierPort;
     /** Optional deterministic sanitizer environment for composition tests. Production omits this to scan process.env. */
     publishSanitizeEnv?: Record<string, string | undefined>;
+    /**
+     * 宿主专属的真实执行验证器。缺失时，conversation distill 只能返回草稿，绝不持久化或排队发布。
+     */
+    publishExecutionVerifier?: ConversationDistillExecutionVerifier;
+    /** 验证器响应的硬超时，防止发布请求因宿主执行器挂起而永久占用连接。 */
+    publishExecutionVerifierTimeoutMs?: number;
 }
 export interface ProxyTickReport {
     outbound: OutboundResult;
@@ -144,6 +151,8 @@ export declare class ProxyDaemon {
     private readonly collaborationFacade;
     private readonly publishRecallVerifier;
     private readonly proxyHandler;
+    private readonly hub;
+    private readonly recipeComposeStarted;
     private ipc;
     private readonly now;
     private readonly random;
@@ -178,6 +187,8 @@ export declare class ProxyDaemon {
     private scheduledForceUpdateKey;
     private traceBackfillDraining;
     private loopWakeHandler;
+    /** 守护进程停止时取消宿主验证。 */
+    private publishAbortController;
     constructor(deps: ProxyDaemonDeps);
     /**
      * core handler(确定性, 不经 agent): 目前只接 force_update(#108). 其他 core 类型(asset_publish_result/
@@ -231,6 +242,7 @@ export declare class ProxyDaemon {
     private cacheRemoteAssetSearch;
     private publishAssetSubmitSynchronously;
     private createSynchronousAssetSubmitEnvelope;
+    private composeRecipeAfterAcceptedSubmit;
     private currentHubMode;
     private handleHubModeBoundOutbound;
     private publishSynchronousBundle;

package/dist/daemon/proxyDaemon.js

@@ -1,6 +1,6 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { dirname, join } from 'node:path';
-import { mailbox, hub as hubNs, shadow as shadow_, assetstore, wire, util } from '@evomap/evolver-core';
+import { mailbox, hub as hubNs, shadow as shadow_, assetstore, wire, util, verify } from '@evomap/evolver-core';
 import { AuthError, HubClientError, HubUnreachableError } from '@evomap/evolver-adapter-public';
 import { SyncEngine, SYNC_INTERVALS } from '../sync/engine.js';
 import { LifecycleManager } from '../lifecycle/manager.js';
@@ -10,6 +10,7 @@ import { backfillProxyTraceUploads } from '../llm/traceBackfill.js';
 import { hubAuthFailureHint } from './selectHub.js';
 import { CollaborationFacade } from './collaborationFacade.js';
 import { PublishRecallVerifier, resolvePublishRecallConfig, } from './publishRecallVerifier.js';
+const DEFAULT_PUBLISH_EXECUTION_VERIFY_TIMEOUT_MS = 30_000;
 export const DEFAULT_IPC_PORT = 19820;
 // V1 local-proxy compatibility contract; independent of the V2 mailbox envelope schema.
 const PROXY_PROTOCOL_VERSION = '0.1.0';
@@ -35,6 +36,27 @@ const SYNC_ASSET_SUBMIT_TYPE_RANK = {
 const SYNC_ASSET_SUBMIT_SCOPE_STATE_KEY = 'sync_asset_submit:idempotency_scope:v1';
 const SYNC_ASSET_SUBMIT_DIRECT_RETRY_GRACE_MS = 30_000;
 const DEFAULT_SYNC_ASSET_SUBMIT_RESPONSE_TIMEOUT_MS = 15_000;
+function withSynchronousPublishStatus(value, publishStatus) {
+    const body = isRecordValue(value) ? { ...value } : { receipt: value };
+    return { ...body, publish_status: publishStatus, queued: false };
+}
+function legacySynchronousResultStatus(result) {
+    if (result.ok)
+        return 'accepted';
+    // 202 表示兼容层已持久化但尚未完成；校验或终态/传输失败即使在 mailbox
+    // 中保留可重试意图，聚合仍归类为 failed。
+    return result.statusCode === 202 || result.error === 'publish_pending' ? 'pending' : 'failed';
+}
+function summarizeLegacySynchronousResults(results) {
+    const statuses = new Set(results.map(legacySynchronousResultStatus));
+    // publish_status 表示聚合终态，而 queued 独立表示是否仍有 durable mailbox 工作。
+    // 因此 pending+failed 必须是 failed/true：不能掩盖失败，也不能谎报没有排队。
+    if (statuses.has('failed') || statuses.size === 0)
+        return { publishStatus: 'failed', queued: statuses.has('pending') };
+    if (statuses.has('pending'))
+        return { publishStatus: 'pending', queued: true };
+    return { publishStatus: 'accepted', queued: false };
+}
 class OutboundHubModeMismatchError extends Error {
     retryable = true;
     retryAfterMs = 1_000;
@@ -64,6 +86,8 @@ export class ProxyDaemon {
     collaborationFacade;
     publishRecallVerifier;
     proxyHandler;
+    hub;
+    recipeComposeStarted = new Set();
     ipc;
     now;
     random;
@@ -98,6 +122,8 @@ export class ProxyDaemon {
     scheduledForceUpdateKey;
     traceBackfillDraining = false;
     loopWakeHandler;
+    /** 守护进程停止时取消宿主验证。 */
+    publishAbortController = new AbortController();
     constructor(deps) {
         this.deps = deps;
         this.now = deps.now ?? (() => Date.now());
@@ -124,6 +150,7 @@ export class ProxyDaemon {
         this.assetStore = deps.assetStore ?? (assetStoreDir ? new assetstore.LocalJsonlProvider(assetStoreDir) : undefined);
         this.atp = deps.atp;
         const hubToUse = shadow ? shadow_.shadowHubCapability(deps.hub, deps.shadowSink, 'shadow') : deps.hub;
+        this.hub = hubToUse;
         const hubBindings = hubNs.makeHubBindings(hubToUse, deps.publishSanitizeEnv
             ? { sanitize: { env: deps.publishSanitizeEnv } }
             : {});
@@ -196,9 +223,7 @@ export class ProxyDaemon {
                     catch { /* best-effort */ }
                 }
                 // Recipe is the preferred public artifact. Failure here must not retry the already-accepted asset publish.
-                if (envelope.type === 'asset_submit') {
-                    void hubNs.composeRecipeAfterAssetPublish(hubToUse, asRecord(envelope.payload)).catch(() => { });
-                }
+                this.composeRecipeAfterAcceptedSubmit(envelope);
             },
             onOutboundTerminal: (envelope, error) => {
                 this.collaborationFacade.handleOutboundTerminal(envelope, error);
@@ -264,6 +289,8 @@ export class ProxyDaemon {
     async start() {
         if (this.started)
             throw new Error('ProxyDaemon 已启动');
+        if (this.publishAbortController.signal.aborted)
+            this.publishAbortController = new AbortController();
         try {
             this.daemon.start();
             this.ipc = new mailbox.MailboxIpcServer({
@@ -511,6 +538,9 @@ export class ProxyDaemon {
     async stop() {
         this.started = false;
         this.lifecycleArmed = false;
+        if (!this.publishAbortController.signal.aborted) {
+            this.publishAbortController.abort(new Error('proxy_daemon_stopped'));
+        }
         this.nextTickDueAt = undefined;
         if (this.forceUpdateTimer) {
             clearTimeout(this.forceUpdateTimer);
@@ -813,6 +843,65 @@ export class ProxyDaemon {
             ctx.json(200, { results, assets: results, query: body });
             return true;
         }
+        if (ctx.route === 'POST /recipe/search') {
+            const body = (await ctx.readJson());
+            if (hubModeMismatch(body.expected_hub_mode, this.deps.hubMode)) {
+                ctx.json(409, { error: 'proxy_hub_mode_mismatch' });
+                return true;
+            }
+            const recipes = this.hub.recipes;
+            if (!recipes) {
+                ctx.json(501, { error: 'recipe_unsupported' });
+                return true;
+            }
+            const limit = boundedRequestLimit(body.limit, 10, 50);
+            if (limit === undefined) {
+                ctx.json(400, { error: 'invalid_limit' });
+                return true;
+            }
+            const q = [body.q, body.query, body.text].find((value) => typeof value === 'string' && value.trim().length > 0);
+            const cursor = typeof body.cursor === 'string' && body.cursor.trim() ? body.cursor.trim() : undefined;
+            const sort = typeof body.sort === 'string' && body.sort.trim() ? body.sort.trim() : undefined;
+            const request = {
+                ...(q ? { q } : {}),
+                limit,
+                ...(cursor ? { cursor } : {}),
+                ...(sort ? { sort } : {}),
+            };
+            const receipt = q ? await recipes.search(request) : await recipes.list(request);
+            ctx.json(200, {
+                recipes: receipt.recipes,
+                ...(receipt.nextCursor ? { nextCursor: receipt.nextCursor } : {}),
+                ...(receipt.hasMore !== undefined ? { hasMore: receipt.hasMore } : {}),
+                query: body,
+            });
+            return true;
+        }
+        if (ctx.route === 'POST /recipe/express') {
+            const body = asRecord(await ctx.readJson());
+            if (hubModeMismatch(body['expected_hub_mode'], this.deps.hubMode)) {
+                ctx.json(409, { error: 'proxy_hub_mode_mismatch' });
+                return true;
+            }
+            const recipes = this.hub.recipes;
+            if (!recipes) {
+                ctx.json(501, { error: 'recipe_unsupported' });
+                return true;
+            }
+            const recipeId = typeof body['recipe_id'] === 'string'
+                ? body['recipe_id']
+                : typeof body['recipeId'] === 'string'
+                    ? body['recipeId']
+                    : '';
+            if (!recipeId.trim()) {
+                ctx.json(400, { error: 'recipe_id_required' });
+                return true;
+            }
+            const inputPayload = asRecord(body['input_payload']) ?? asRecord(body['inputPayload']) ?? {};
+            const receipt = await recipes.express(recipeId.trim(), { inputPayload });
+            ctx.json(200, receipt);
+            return true;
+        }
         if (ctx.route === 'POST /asset/fetch') {
             const body = (await ctx.readJson());
             if (hubModeMismatch(body.expected_hub_mode, this.deps.hubMode)) {
@@ -885,11 +974,12 @@ export class ProxyDaemon {
                     ctx.json(400, { error: 'mode=sync requires a full asset bundle' });
                     return true;
                 }
-                await this.publishAssetSubmitSynchronously(ctx, outboundBundle);
+                await this.publishAssetSubmitSynchronously(ctx, outboundBundle, hubNs.recipeComposeRequested(body));
                 return true;
             }
             const payload = {
                 assets: outboundBundle,
+                compose_recipe: hubNs.recipeComposeRequested(body),
                 [OUTBOUND_HUB_MODE_FIELD]: this.currentHubMode(),
             };
             const requestId = typeof body['request_id'] === 'string' && ASYNC_ASSET_SUBMIT_REQUEST_ID.test(body['request_id'])
@@ -968,17 +1058,66 @@ export class ProxyDaemon {
         }
         if (ctx.route === 'POST /conversation/distill') {
             const body = (await ctx.readJson());
+            const publishRequested = body['publish'] === true;
+            const abortPublish = () => {
+                if (ctx.signal?.aborted)
+                    return true;
+                if (!this.publishAbortController.signal.aborted)
+                    return false;
+                // 守护进程停止时仍需结束开放的响应，否则 IPC server.close() 会等待该连接而无法完成停机。
+                if (!ctx.res.destroyed && !ctx.res.writableEnded) {
+                    // 'blocked' (not 'failed'): the request was never queued, it was intercepted by
+                    // shutdown; the 503 + error field already explains why.
+                    ctx.json(503, { error: 'proxy_shutting_down', publish_status: 'blocked', queued: false });
+                }
+                return true;
+            };
             if (hubModeMismatch(body.expected_hub_mode, this.deps.hubMode)) {
                 ctx.json(409, { error: 'proxy_hub_mode_mismatch' });
                 return true;
             }
-            const distill = await hubNs.distillConversation(body, { persist: body.persist === true, store: this.assetStore });
+            // 请求已取消时禁止继续生成或持久化发布草稿，避免把取消前的陈旧状态留下。
+            if (publishRequested && abortPublish())
+                return true;
+            const verifiedExecution = publishRequested
+                ? await resolveVerifiedExecutionAfterPreflight(this.deps.publishExecutionVerifier, body, this.deps.publishExecutionVerifierTimeoutMs, [this.publishAbortController.signal, ...(ctx.signal ? [ctx.signal] : [])])
+                : undefined;
+            if (publishRequested && abortPublish())
+                return true;
+            const distill = await hubNs.distillConversation(body, {
+                // 调用方明确要求持久化时，即使发布被证据或质量闸门拦截，也保留可审查草稿；永不因此进入队列。
+                persist: body.persist === true,
+                store: this.assetStore,
+                ...(verifiedExecution ? { verifiedExecution } : {}),
+            });
+            if (publishRequested && abortPublish())
+                return true;
             if (!distill.ok) {
-                ctx.json(200, { ...distill, queued: false, submission: null });
+                ctx.json(200, {
+                    ...distill,
+                    queued: false,
+                    submission: null,
+                    publish_status: publishRequested ? 'blocked' : 'not_requested',
+                });
                 return true;
             }
             let submission = null;
-            if (body['publish'] === true) {
+            if (publishRequested) {
+                if (abortPublish())
+                    return true;
+                // 未达到可复用质量阈值的蒸馏结果仍可作为有用草稿，
+                // 但不得进入出站发布队列。安全与内容完整性闸门保持严格，质量负责晋级。
+                if (distill.publishable !== true) {
+                    const reason = distill.quality.ok && verifiedExecution === undefined ? 'execution_evidence' : 'quality_gate';
+                    ctx.json(200, {
+                        ...distill,
+                        queued: false,
+                        submission: null,
+                        publish_blocked: reason,
+                        publish_status: 'blocked',
+                    });
+                    return true;
+                }
                 const env = mailbox.createEnvelope({
                     type: 'asset_submit',
                     payload: {
@@ -998,7 +1137,12 @@ export class ProxyDaemon {
                     this.notifyNewOutbound();
                 submission = { id: env.id, message_id: env.id, receiptId: r.receiptId, status: 'pending', stored: r.stored };
             }
-            ctx.json(200, { ...distill, queued: submission !== null, submission });
+            ctx.json(200, {
+                ...distill,
+                queued: submission !== null,
+                submission,
+                publish_status: publishRequested ? 'queued' : 'not_requested',
+            });
             return true;
         }
         if (ctx.route === 'POST /agent/search') {
@@ -1145,25 +1289,39 @@ export class ProxyDaemon {
             staleUntil: now + this.assetSearchCacheTtlMs + this.assetSearchStaleGraceMs,
         });
     }
-    async publishAssetSubmitSynchronously(ctx, items) {
+    async publishAssetSubmitSynchronously(ctx, items, composeRecipe = true) {
+        const abortSynchronousPublish = () => {
+            if (ctx.signal?.aborted)
+                return true;
+            if (!this.publishAbortController.signal.aborted)
+                return false;
+            if (!ctx.res.destroyed && !ctx.res.writableEnded) {
+                ctx.json(503, { error: 'proxy_shutting_down', publish_status: 'failed', queued: false });
+            }
+            return true;
+        };
         const classified = classifySynchronousAssetSubmit(items);
         if (!classified.ok) {
             ctx.json(422, { error: classified.error, code: 'invalid_asset_submit' });
             return;
         }
         if (classified.kind === 'wire') {
-            const envelope = this.createSynchronousAssetSubmitEnvelope(classified.bundle, undefined, ctx.now);
+            if (abortSynchronousPublish())
+                return;
+            const envelope = this.createSynchronousAssetSubmitEnvelope(classified.bundle, undefined, ctx.now, composeRecipe);
             this.writeSynchronousAssetSubmitOutcome(ctx, await this.publishSynchronousBundle(envelope));
             return;
         }
         const results = [];
         for (const item of classified.items) {
-            const converted = await convertLegacyLooseAsset(item);
+            const converted = await convertLegacyLooseAsset(item, this.deps.publishExecutionVerifier, this.deps.publishExecutionVerifierTimeoutMs, ctx.signal, this.publishAbortController.signal);
             if (!converted.ok) {
                 results.push({ ok: false, error: converted.error, statusCode: 422 });
                 continue;
             }
-            const envelope = this.createSynchronousAssetSubmitEnvelope(converted.bundle, 'v1_loose_asset_compat', ctx.now);
+            if (abortSynchronousPublish())
+                return;
+            const envelope = this.createSynchronousAssetSubmitEnvelope(converted.bundle, 'v1_loose_asset_compat', ctx.now, composeRecipe);
             const outcome = await this.publishSynchronousBundle(envelope);
             if (outcome.kind === 'accepted') {
                 const receipt = outcome.receipt;
@@ -1192,13 +1350,16 @@ export class ProxyDaemon {
                 });
             }
         }
+        const summary = summarizeLegacySynchronousResults(results);
         ctx.json(200, {
             published: results.filter((result) => result.ok).length,
             total: results.length,
             results,
+            publish_status: summary.publishStatus,
+            queued: summary.queued,
         });
     }
-    createSynchronousAssetSubmitEnvelope(bundle, source, now) {
+    createSynchronousAssetSubmitEnvelope(bundle, source, now, composeRecipe = true) {
         const canonicalBundle = [...bundle].sort(compareSynchronousAssetSubmitAssets);
         const runtimeNamespace = this.deps.runtimeNamespace ?? 'default';
         const idempotencyKey = synchronousAssetSubmitKey(this.synchronousAssetSubmitScope, runtimeNamespace, this.currentHubMode(), canonicalBundle);
@@ -1208,6 +1369,7 @@ export class ProxyDaemon {
             payload: {
                 ...(source ? { source } : {}),
                 assets: canonicalBundle,
+                compose_recipe: composeRecipe,
                 [OUTBOUND_HUB_MODE_FIELD]: this.currentHubMode(),
             },
             idempotencyKey,
@@ -1215,6 +1377,15 @@ export class ProxyDaemon {
             now,
         });
     }
+    composeRecipeAfterAcceptedSubmit(envelope) {
+        if (envelope.type !== 'asset_submit')
+            return;
+        const key = envelope.idempotencyKey || envelope.id;
+        if (this.recipeComposeStarted.has(key))
+            return;
+        this.recipeComposeStarted.add(key);
+        void hubNs.composeRecipeAfterAssetPublish(this.hub, asRecord(envelope.payload)).catch(() => { });
+    }
     currentHubMode() {
         return this.deps.hubMode ?? 'public';
     }
@@ -1284,6 +1455,7 @@ export class ProxyDaemon {
                     this.publishRecallVerifier.observeAcceptedPublish(envelope, receipt);
                 }
                 catch { /* best-effort */ }
+                this.composeRecipeAfterAcceptedSubmit(envelope);
             }
             if (this.store.getById(envelope.id)?.status !== 'in_flight')
                 this.store.complete(envelope.id, this.now());
@@ -1365,6 +1537,7 @@ export class ProxyDaemon {
                     this.publishRecallVerifier.observeAcceptedPublish(envelope, receipt);
                 }
                 catch { /* best-effort */ }
+                this.composeRecipeAfterAcceptedSubmit(envelope);
             }
             return receipt;
         }
@@ -1437,13 +1610,19 @@ export class ProxyDaemon {
     }
     writeSynchronousAssetSubmitOutcome(ctx, outcome) {
         if (outcome.kind === 'accepted') {
-            ctx.json(200, outcome.receipt);
+            ctx.json(200, withSynchronousPublishStatus(outcome.receipt, 'accepted'));
         }
         else if (outcome.kind === 'failed') {
-            ctx.json(outcome.statusCode, outcome.body);
+            ctx.json(outcome.statusCode, withSynchronousPublishStatus(outcome.body, 'failed'));
         }
         else {
-            ctx.json(202, { status: 'pending', message_id: outcome.messageId, durable: true });
+            ctx.json(202, {
+                status: 'pending',
+                message_id: outcome.messageId,
+                durable: true,
+                publish_status: 'pending',
+                queued: true,
+            });
         }
     }
     async handleAtpRoute(ctx) {
@@ -1687,14 +1866,119 @@ function isClearlyLegacyLooseAsset(value) {
         return false;
     return ['content', 'summary', 'strategy'].some((key) => Object.prototype.hasOwnProperty.call(value, key));
 }
-async function convertLegacyLooseAsset(value) {
+async function resolveVerifiedExecution(verifier, input, expectedValidation, timeoutMs = DEFAULT_PUBLISH_EXECUTION_VERIFY_TIMEOUT_MS, parentSignals = []) {
+    if (!verifier)
+        return undefined;
+    if (parentSignals.some((signal) => signal.aborted))
+        return undefined;
+    const boundedTimeout = Number.isSafeInteger(timeoutMs) && timeoutMs > 0
+        ? timeoutMs
+        : DEFAULT_PUBLISH_EXECUTION_VERIFY_TIMEOUT_MS;
+    const controller = new AbortController();
+    let timer;
+    let resolveAborted;
+    const aborted = new Promise((resolve) => {
+        resolveAborted = () => resolve(null);
+    });
+    const onParentAbort = () => {
+        if (!controller.signal.aborted)
+            controller.abort(new Error('publish_verification_aborted'));
+        resolveAborted();
+    };
+    for (const signal of parentSignals)
+        signal.addEventListener('abort', onParentAbort, { once: true });
+    try {
+        const timeout = new Promise((resolve) => {
+            timer = setTimeout(() => {
+                if (!controller.signal.aborted)
+                    controller.abort(new Error('publish_verification_timeout'));
+                resolve(null);
+            }, boundedTimeout);
+            timer.unref?.();
+        });
+        const candidate = await Promise.race([verifier(input, controller.signal), timeout, aborted]);
+        if (!candidate || !Array.isArray(candidate.trace) || candidate.trace.length === 0)
+            return undefined;
+        if (controller.signal.aborted)
+            return undefined;
+        if (candidate.trace.some((row) => (!row
+            || typeof row.command !== 'string'
+            || row.command.trim().length === 0
+            || !Number.isInteger(row.exit)
+            || row.exit !== 0)))
+            return undefined;
+        if (candidate.trace.length !== expectedValidation.length)
+            return undefined;
+        if (candidate.trace.some((row, index) => row.command.trim() !== expectedValidation[index]))
+            return undefined;
+        // Compare the authoritative raw receipt first, then cross the common execution-evidence outlet exactly once.
+        // A command that required redaction no longer identifies the executed program and must not unlock publication.
+        const sanitized = verify.sanitizeExecutionPayload({ ...candidate, validation: expectedValidation });
+        return sanitized.blocked ? undefined : sanitized.value;
+    }
+    catch {
+        return undefined;
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+        for (const signal of parentSignals)
+            signal.removeEventListener('abort', onParentAbort);
+        if (!controller.signal.aborted)
+            controller.abort(new Error('publish_verification_complete'));
+    }
+}
+function declaredValidationCommands(input) {
+    const raw = input.validation ?? input.verification ?? (input.execution && typeof input.execution === 'object' && !Array.isArray(input.execution)
+        ? input.execution['validation']
+        : undefined);
+    if (!Array.isArray(raw) || raw.length === 0 || raw.length > 8)
+        return undefined;
+    const commands = raw.map((command) => typeof command === 'string' ? command.trim() : '');
+    if (commands.some((command) => command.length === 0
+        || command.length > 180
+        || !verify.isValidationCommandAllowed(command)
+        || verify.sanitizeExecutionCommand(command).blocked)) {
+        return undefined;
+    }
+    return commands;
+}
+async function resolveVerifiedExecutionAfterPreflight(verifier, input, timeoutMs, parentSignals = []) {
+    if (!verifier)
+        return undefined;
+    if (parentSignals.some((signal) => signal.aborted))
+        return undefined;
+    const preflight = await hubNs.distillConversation(input, { persist: false });
+    if (parentSignals.some((signal) => signal.aborted) || !preflight.ok || !preflight.quality.ok)
+        return undefined;
+    const validation = declaredValidationCommands(input);
+    if (!validation)
+        return undefined;
+    // 只把通过质量与命令策略预检的最小验证输入交给宿主，绝不转发调用方的 execution/status/trace。
+    return resolveVerifiedExecution(verifier, { validation }, validation, timeoutMs, parentSignals);
+}
+async function convertLegacyLooseAsset(value, verifyExecution, verifyExecutionTimeoutMs, ...parentSignals) {
     const normalized = legacyLooseDistillInput(value);
     if (!normalized.ok)
         return normalized;
     try {
-        const distilled = await hubNs.distillConversation(normalized.input, { persist: false });
-        if (!distilled.ok) {
+        const verifiedExecution = await resolveVerifiedExecutionAfterPreflight(verifyExecution, normalized.input, verifyExecutionTimeoutMs, parentSignals.filter((signal) => signal !== undefined));
+        const distilled = await hubNs.distillConversation(normalized.input, {
+            persist: false,
+            ...(verifiedExecution ? { verifiedExecution } : {}),
+        });
+        if (!distilled.ok)
             return { ok: false, error: `legacy_distill_${safeIdentifier(distilled.reason)}` };
+        // Mirror the /conversation/distill route: a draft that passed the quality gate but was
+        // blocked only by the missing host execution evidence must not be reported as a
+        // quality-gate failure.
+        if (distilled.publishable !== true) {
+            return {
+                ok: false,
+                error: distilled.quality.ok && verifiedExecution === undefined
+                    ? 'legacy_distill_execution_evidence'
+                    : 'legacy_distill_quality_gate',
+            };
         }
         const gene = {
             ...distilled.gene,
@@ -1826,7 +2110,7 @@ function parseLegacyCategory(value) {
     return { ok: false, error: 'legacy category is invalid' };
 }
 function deterministicDistilledAsset(asset) {
-    const draft = { ...asset, asset_id: '' };
+    const draft = wire.stripGeneHints({ ...asset, asset_id: '' });
     // `_source` is local distiller provenance and is not part of the current GEP Gene schema.
     // It also contains a wall-clock timestamp, so it must not influence compatibility asset ids.
     delete draft['_source'];