@fitlab-ai/agent-infra 0.9.13 → 0.9.14

package/lib/sandbox/control/server.ts

@@ -1,3 +1,4 @@
+import { completedReentryView } from './completed-reentry.ts';
 import fs from 'node:fs';
 import path from 'node:path';
 import { createHash, randomUUID } from 'node:crypto';
@@ -34,7 +35,8 @@ import {
   writeSandboxControlReservation,
   writeSandboxControlResultEvidence,
   terminateSandboxControlExecution,
-  writeSandboxControlStatus
+  writeSandboxControlStatus,
+  readSandboxControlStatus
 } from './state.ts';
 import { validateSandboxControlRequest } from './protocol.ts';
 import { inspectSandboxControlContainer, type ContainerObservation } from './container-identity.ts';
@@ -48,6 +50,13 @@ import type { BrokerOwner } from './lifecycle.ts';
 import { nextSandboxControlBackoff } from './timing.ts';
 import { readTaskFinalizationReceipt } from '../../task/finalization.ts';
 import { resolveTaskRef } from '../../task/resolve-ref.ts';
+import {
+  mergeSandboxTaskView,
+  taskViewAfterFinalization,
+  taskViewForManifest,
+  type SandboxTaskView
+} from './task-view.ts';
+import { taskCreateOutputUnavailableResult } from '../../task/create-service.ts';
 
 type ActiveExecution = {
   request: SandboxControlRequest;
@@ -58,6 +67,67 @@ type ActiveExecution = {
   settled: boolean;
 };
 
+function safeRealpath(value: string): string | null {
+  try {
+    return fs.realpathSync.native(value);
+  } catch {
+    return null;
+  }
+}
+
+function appendBrokerAudit(
+  manifest: SandboxControlManifest,
+  event: string,
+  fields: Record<string, string | number | boolean | null> = {}
+): void {
+  try {
+    appendSandboxControlAudit(manifest, event, { source: 'broker', ...fields });
+  } catch {
+    // Diagnostics must never change the control protocol.
+  }
+}
+
+function requestAuditFields(
+  manifest: SandboxControlManifest,
+  manifestPath: string,
+  request: SandboxControlRequest
+): Record<string, string | number | boolean | null> {
+  const args = 'args' in request ? request.args : [];
+  const encodedArgs = JSON.stringify(args);
+  return {
+    requestId: request.id,
+    requestFamily: request.family,
+    sandboxTaskId: manifest.taskId,
+    requestGeneration: request.generation,
+    requestIssuedAt: request.issuedAt,
+    requestExpiresAt: request.expiresAt,
+    requestArgCount: args.length,
+    requestArgsSha256: createHash('sha256').update(encodedArgs, 'utf8').digest('hex'),
+    requestTaskRef: args[0] ?? null,
+    requestCommand: args[1] ?? null,
+    controllerProofPresent: request.controllerProof !== null,
+    hostCwd: process.cwd(),
+    manifestPath,
+    manifestPathRealpath: safeRealpath(manifestPath),
+    repoRoot: manifest.repoRoot,
+    repoRootRealpath: safeRealpath(manifest.repoRoot),
+    worktreeRoot: manifest.worktreeRoot,
+    worktreeRootRealpath: safeRealpath(manifest.worktreeRoot),
+    runtimeDir: manifest.runtimeDir,
+    runtimeDirRealpath: safeRealpath(manifest.runtimeDir)
+  };
+}
+
+function resultAuditFields(result: SandboxControlExecutionResult): Record<string, string | number | boolean | null> {
+  return {
+    exitCode: result.exitCode,
+    stdoutBytes: Buffer.byteLength(result.stdout, 'utf8'),
+    stderrBytes: Buffer.byteLength(result.stderr, 'utf8'),
+    stdoutSha256: createHash('sha256').update(result.stdout, 'utf8').digest('hex'),
+    stderrSha256: createHash('sha256').update(result.stderr, 'utf8').digest('hex')
+  };
+}
+
 function assertRealDirectory(directory: string, parent?: string): void {
   const stat = fs.lstatSync(directory);
   if (!stat.isDirectory() || stat.isSymbolicLink()) throw new Error('SANDBOX_CONTROL_CHANNEL_INVALID');
@@ -171,6 +241,36 @@ function finalizationRecoveryResponse(
   };
 }
 
+function publishFinalizationTaskView(
+  manifest: SandboxControlManifest,
+  broker: BrokerOwner,
+  requestId: string,
+  state: 'starting' | 'healthy' | 'busy' | 'parked',
+  reasonCode: string | null,
+  activeRequestId: string | null
+): SandboxTaskView {
+  let view: SandboxTaskView;
+  try {
+    const resolved = resolveTaskRef(manifest.taskId ?? '', { repoRoot: manifest.repoRoot });
+    const receipt = readTaskFinalizationReceipt(manifest.repoRoot, manifest.taskId ?? '');
+    view = resolved.ok && resolved.state === 'completed'
+      ? taskViewAfterFinalization({
+          taskId: manifest.taskId ?? '', generation: manifest.generation, requestId, receipt
+        })
+      : {
+          state: 'unknown', taskId: manifest.taskId, observedSource: 'unknown', receipt: null,
+          reasonCode: 'SANDBOX_TASK_VIEW_SOURCE_UNCONFIRMED'
+        };
+  } catch {
+    view = {
+      state: 'unknown', taskId: manifest.taskId, observedSource: 'unknown', receipt: null,
+      reasonCode: 'SANDBOX_TASK_VIEW_RECEIPT_INVALID'
+    };
+  }
+  writeSandboxControlStatus(manifest, broker, state, reasonCode, activeRequestId, Date.now(), view);
+  return view;
+}
+
 function payloadReference(payload: ReturnType<typeof createSandboxControlPayload>) {
   return {
     version: payload.version,
@@ -201,17 +301,21 @@ function outputMatchesEvidence(output: string, bytes: number, sha256: string): b
 }
 
 function genericRecoveryResponse(
-  requestId: string,
-  evidence: ReturnType<typeof readSandboxControlResultEvidence>,
-  payload: ReturnType<typeof readSandboxControlPayload> | null
+  request: SandboxControlRequest,
+  exitCode: number,
+  payload: ReturnType<typeof readSandboxControlPayload> | null,
+  cause: 'publish' | 'recovery' = 'recovery'
 ): SandboxControlResponse {
+  const outputUnavailable = request.family === 'task-create' && !payload;
   return {
     version: 2,
-    id: requestId,
+    id: request.id,
     phase: 'completed',
-    exitCode: evidence.exitCode,
-    stdout: '',
-    stderr: payload ? '' : 'SANDBOX_CONTROL_OUTPUT_UNAVAILABLE: broker restarted after executor completion\n',
+    exitCode,
+    stdout: outputUnavailable ? `${JSON.stringify(taskCreateOutputUnavailableResult(request.id))}\n` : '',
+    stderr: payload ? '' : cause === 'publish'
+      ? 'SANDBOX_CONTROL_OUTPUT_UNAVAILABLE: output payload was not retained\n'
+      : 'SANDBOX_CONTROL_OUTPUT_UNAVAILABLE: broker restarted after executor completion\n',
     error: null,
     outputState: payload ? 'available' : 'unavailable',
     payload: payload ? payloadReference(payload) : null
@@ -228,7 +332,7 @@ function recoveryResponse(
     const finalization = finalizationRecoveryResponse(manifest, request.id, evidence.exitCode);
     return finalization.status === 'matched' ? finalization.response ?? null : null;
   }
-  return genericRecoveryResponse(request.id, evidence, payload);
+  return genericRecoveryResponse(request, evidence.exitCode, payload);
 }
 
 function terminalMatchesEvidence(
@@ -267,8 +371,10 @@ function terminalMatchesEvidence(
     };
   }
   if (response.outputState === 'unavailable') {
-    const expected = genericRecoveryResponse(request.id, evidence, null);
-    return { valid: JSON.stringify(response) === JSON.stringify(expected), payloadReferenced: false };
+    const causes = ['recovery', 'publish'] as const;
+    const valid = causes.some((cause) => JSON.stringify(response)
+      === JSON.stringify(genericRecoveryResponse(request, evidence.exitCode, null, cause)));
+    return { valid, payloadReferenced: false };
   }
   return {
     valid: response.payload === undefined
@@ -282,6 +388,7 @@ function publishExecutionResult(
   manifest: SandboxControlManifest,
   request: SandboxControlRequest,
   result: SandboxControlExecutionResult,
+  broker: BrokerOwner,
   brokerOwns: () => boolean
 ): boolean {
   const normalized = sanitizeSandboxControlResult(manifest, result);
@@ -299,7 +406,7 @@ function publishExecutionResult(
     if (sandboxControlEncodedJsonBytes(inline) <= SANDBOX_CONTROL_MAX_TERMINAL_RECORD_BYTES) {
       terminal = inline;
     }
-    let payload = null;
+    let payload: ReturnType<typeof createSandboxControlPayload> | null = null;
     if (!terminal) {
       try {
         payload = createSandboxControlPayload(manifest, request.id, normalized);
@@ -312,20 +419,14 @@ function publishExecutionResult(
       } catch {
         payload = null;
       }
-      terminal = {
-        version: 2,
-        id: request.id,
-        phase: 'completed',
-        exitCode: normalized.exitCode,
-        stdout: '',
-        stderr: payload ? '' : 'SANDBOX_CONTROL_OUTPUT_UNAVAILABLE: output payload was not retained\n',
-        error: null,
-        outputState: payload ? 'available' : 'unavailable',
-        payload: payload ? payloadReference(payload) : null
-      };
+      terminal = genericRecoveryResponse(request, normalized.exitCode, payload, 'publish');
     }
   }
   if (!brokerOwns()) return false;
+  if (request.family === 'task-finalization' && normalized.exitCode === 0) {
+    const view = publishFinalizationTaskView(manifest, broker, request.id, 'healthy', null, null);
+    if (view.state === 'unknown') return false;
+  }
   return writeSandboxControlResponse(manifest, terminal);
 }
 
@@ -391,7 +492,7 @@ function bindingReason(manifest: SandboxControlManifest): string | null {
   }
 }
 
-function recoverProcessing(manifest: SandboxControlManifest, brokerOwns: () => boolean): boolean {
+function recoverProcessing(manifest: SandboxControlManifest, broker: BrokerOwner, brokerOwns: () => boolean): boolean {
   for (const entry of fs.readdirSync(manifest.processingDir, { withFileTypes: true })) {
     if (!entry.isDirectory() || !/^[a-f0-9-]{16,64}$/.test(entry.name)) continue;
     if (!brokerOwns()) return false;
@@ -459,7 +560,7 @@ function recoverProcessing(manifest: SandboxControlManifest, brokerOwns: () => b
               || response.payload.stdoutSha256 !== payload.stdoutSha256
               || response.payload.stderrSha256 !== payload.stderrSha256) throw new Error('payload missing or mismatched');
             payloadReferenced = true;
-          } else if (terminal && (response.outputState !== undefined
+          } else if (terminal && ((response.outputState !== undefined && response.outputState !== 'unavailable')
             || response.payload !== undefined && response.payload !== null)) {
             throw new Error('payload state invalid');
           }
@@ -473,12 +574,20 @@ function recoverProcessing(manifest: SandboxControlManifest, brokerOwns: () => b
         const reconciliation = terminalMatchesEvidence(manifest, request, existingTerminalResponse!, resultEvidence, payload, payloadInvalid);
         if (!reconciliation.valid) continue;
         payloadReferenced = reconciliation.payloadReferenced;
+        if (request.family === 'task-finalization' && resultEvidence.exitCode === 0) {
+          const view = publishFinalizationTaskView(manifest, broker, request.id, 'starting', null, null);
+          if (view.state === 'unknown') continue;
+        }
       }
       if (!terminal) {
         if (!brokerOwns()) return false;
         if (!resultEvidence || !request || payloadInvalid) continue;
         const recovered = recoveryResponse(manifest, request, resultEvidence, payload);
         if (!recovered) continue;
+        if (request.family === 'task-finalization' && resultEvidence.exitCode === 0) {
+          const view = publishFinalizationTaskView(manifest, broker, request.id, 'starting', null, null);
+          if (view.state === 'unknown') continue;
+        }
         writeSandboxControlResponse(manifest, recovered);
         payloadReferenced = Boolean(payload) && request.family !== 'task-finalization';
       }
@@ -499,7 +608,13 @@ function delay(ms: number): Promise<void> {
 }
 
 export function sandboxControlSafeEnv(env: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv {
-  return Object.fromEntries(Object.entries(env).filter(([key]) => !key.toUpperCase().startsWith('AGENT_INFRA_CONTROL_')));
+  return Object.fromEntries(Object.entries(env).filter(([key]) => {
+    const normalized = key.toUpperCase();
+    return !normalized.startsWith('AGENT_INFRA_CONTROL_')
+      && normalized !== 'AGENT_INFRA_TASK_ID'
+      && normalized !== 'AGENT_INFRA_RUNTIME_DIR'
+      && normalized !== 'AGENT_INFRA_EXECUTOR_MANIFEST';
+  }));
 }
 
 export async function serveSandboxControl(
@@ -562,6 +677,25 @@ export async function serveSandboxControl(
     releaseStartup();
   }
   let active: ActiveExecution | null = null;
+  let startupReceipt: unknown = null;
+  if (manifest.taskId) {
+    try {
+      startupReceipt = readTaskFinalizationReceipt(manifest.repoRoot, manifest.taskId);
+    } catch {
+      // Preserve malformed receipt evidence as unknown rather than treating it as no receipt.
+      startupReceipt = {};
+    }
+  }
+  let taskView = taskViewForManifest({
+    ...manifest,
+    receipt: startupReceipt
+  });
+  try {
+    const previous = readSandboxControlStatus(manifest.publicStatusDir);
+    if (previous.generation === manifest.generation) taskView = mergeSandboxTaskView(taskView, previous.taskView);
+  } catch {
+    // A fresh control root has no previous task-view projection.
+  }
   let lastState = '';
   let lastStatusAt = 0;
   let nextBindingCheckAt = 0;
@@ -572,10 +706,43 @@ export async function serveSandboxControl(
   let bindingBackoffMs: number = timing.parkedBindingInitialMs;
   try {
     if (!brokerOwns()) return;
-    writeSandboxControlStatus(manifest, broker, 'starting', null, null);
+    if (taskView.state === 'current' && taskView.observedSource === 'completed') {
+      // Recheck durable re-entry evidence before publishing a trusted startup view.
+      const unverified = { ...taskView, state: 'unknown' as const,
+        reasonCode: 'SANDBOX_COMPLETED_REENTRY_EVIDENCE_INVALID' };
+      try {
+        taskView = await completedReentryView(manifest, inspectContainer) ?? unverified;
+      } catch {
+        taskView = unverified;
+      }
+      if (!brokerOwns()) return;
+    }
+    writeSandboxControlStatus(manifest, broker, 'starting', null, null, Date.now(), taskView);
     if (!brokerOwns()) return;
-    appendSandboxControlAudit(manifest, 'broker-start', { pid: broker.pid });
-    if (!recoverProcessing(manifest, brokerOwns)) return;
+    appendBrokerAudit(manifest, 'broker-start', {
+      pid: broker.pid,
+      brokerId: broker.brokerId,
+      hostCwd: process.cwd(),
+      manifestPath,
+      manifestPathRealpath: safeRealpath(manifestPath),
+      repoRoot: manifest.repoRoot,
+      repoRootRealpath: safeRealpath(manifest.repoRoot),
+      worktreeRoot: manifest.worktreeRoot,
+      worktreeRootRealpath: safeRealpath(manifest.worktreeRoot),
+      runtimeDir: manifest.runtimeDir,
+      runtimeDirRealpath: safeRealpath(manifest.runtimeDir),
+      channelDir: manifest.channelDir,
+      publicStatusDir: manifest.publicStatusDir,
+      processingDir: manifest.processingDir,
+      internalCliPath: options.internalCliPath ?? process.argv[1] ?? null
+    });
+    if (!recoverProcessing(manifest, broker, brokerOwns)) return;
+    try {
+      const published = readSandboxControlStatus(manifest.publicStatusDir);
+      if (published.generation === manifest.generation) taskView = published.taskView;
+    } catch {
+      // The regular heartbeat will publish an invalid or missing projection as unknown.
+    }
     while (!signal.aborted) {
       let settledExecution: ActiveExecution | null = null;
       if (!brokerOwns()) break;
@@ -647,7 +814,7 @@ export async function serveSandboxControl(
         if (!brokerOwns()) break;
         if (cleanupStaleSandboxControlLease(manifest)) {
           if (!brokerOwns()) break;
-          appendSandboxControlAudit(manifest, 'lease-stale-cleanup');
+          appendBrokerAudit(manifest, 'lease-stale-cleanup');
         }
         if (readActiveLease(manifest)) reasonCode = 'SANDBOX_CONTROL_HANDOFF_ACTIVE';
       } catch {
@@ -667,25 +834,49 @@ export async function serveSandboxControl(
       }
       reasonCode ??= containerReasonCode;
       reasonCode ??= bindingReasonCode;
+      if (!reasonCode && !active && taskView.state !== 'current') {
+        try {
+          const reentered = await completedReentryView(manifest, inspectContainer);
+          if (reentered && brokerOwns() && !readActiveLease(manifest) && !bindingCheck(manifest)) {
+            taskView = reentered;
+          }
+        } catch {
+          // Invalid or changed re-entry evidence never clears the existing task view.
+        }
+      }
       const state = reasonCode ? 'parked' : active ? 'busy' : 'healthy';
       const stateKey = `${state}:${reasonCode ?? ''}:${active?.request.id ?? ''}`;
       if (brokerOwns() && (stateKey !== lastState || now - lastStatusAt >= timing.controlTickMs)) {
-        writeSandboxControlStatus(manifest, broker, state, reasonCode, active?.request.id ?? null, now);
+        writeSandboxControlStatus(manifest, broker, state, reasonCode, active?.request.id ?? null, now, taskView);
         lastStatusAt = now;
       }
       if (brokerOwns() && stateKey !== lastState) {
-        appendSandboxControlAudit(manifest, 'broker-state', { state, reasonCode, requestId: active?.request.id ?? null });
+        appendBrokerAudit(manifest, 'broker-state', { state, reasonCode, requestId: active?.request.id ?? null });
         lastState = stateKey;
       }
       if (settledExecution) {
         if (!brokerOwns()) break;
         let terminalCommitted = false;
         if (settledExecution.result && settledExecution.resultEvidenceWritten) {
-          terminalCommitted = publishExecutionResult(manifest, settledExecution.request, settledExecution.result, brokerOwns);
+          terminalCommitted = publishExecutionResult(manifest, settledExecution.request, settledExecution.result, broker, brokerOwns);
+          if (terminalCommitted && settledExecution.request.family === 'task-finalization') {
+            try {
+              const published = readSandboxControlStatus(manifest.publicStatusDir);
+              if (published.generation === manifest.generation) taskView = published.taskView;
+            } catch {
+              taskView = { state: 'unknown', taskId: manifest.taskId, observedSource: 'unknown', receipt: null, reasonCode: 'SANDBOX_TASK_VIEW_STATUS_INVALID' };
+            }
+          }
         } else {
           terminalCommitted = writeSandboxControlResponse(manifest, unknown(settledExecution.request.id));
         }
         if (!terminalCommitted) return;
+        appendBrokerAudit(manifest, 'executor-result-published', {
+          ...requestAuditFields(manifest, manifestPath, settledExecution.request),
+          resultAvailable: settledExecution.result !== null,
+          resultEvidenceWritten: settledExecution.resultEvidenceWritten,
+          ...(settledExecution.result ? resultAuditFields(settledExecution.result) : {})
+        });
         if (!brokerOwns()) break;
         removeAcceptedResponse(manifest, settledExecution.request.id);
         fs.rmSync(path.join(manifest.processingDir, settledExecution.request.id), { recursive: true, force: true });
@@ -697,12 +888,19 @@ export async function serveSandboxControl(
         const id = name.slice(0, -5);
         const source = path.join(requestsDir, name);
         let claimed: string | null = null;
+        let validatedRequest: SandboxControlRequest | null = null;
         try {
           if (!brokerOwns()) {
             retiring = true;
             break;
           }
           claimed = claimRequest(manifest, source, id);
+          appendBrokerAudit(manifest, 'request-claimed', {
+            requestId: id,
+            requestSourcePath: source,
+            requestClaimedPath: claimed,
+            requestProcessingDir: path.dirname(claimed)
+          });
           if (!brokerOwns()) {
             retiring = true;
             break;
@@ -715,13 +913,44 @@ export async function serveSandboxControl(
           if (reasonCode) throw new Error(reasonCode);
           if (active) throw new Error('SANDBOX_CONTROL_BUSY');
           const request = validateSandboxControlRequest(JSON.parse(fs.readFileSync(claimed, 'utf8')), manifest);
+          validatedRequest = request;
+          appendBrokerAudit(manifest, 'request-validated', {
+            ...requestAuditFields(manifest, manifestPath, request),
+            requestPath: claimed
+          });
           if (bindingCheck(manifest)) throw new Error('SANDBOX_WORKTREE_BINDING_LOST');
           if (readActiveLease(manifest)) throw new Error('SANDBOX_CONTROL_HANDOFF_ACTIVE');
+          appendBrokerAudit(manifest, 'request-gates-passed', {
+            ...requestAuditFields(manifest, manifestPath, request),
+            requestPath: claimed,
+            bindingChecked: true,
+            handoffLeaseChecked: true
+          });
           writeSandboxControlReservation(manifest, request.id, sandboxControlGenerationUsage(manifest));
+          appendBrokerAudit(manifest, 'executor-reservation-written', {
+            ...requestAuditFields(manifest, manifestPath, request),
+            requestPath: claimed,
+            executionPath: executionPath(manifest, request.id)
+          });
+          appendBrokerAudit(manifest, 'executor-prepare-start', {
+            ...requestAuditFields(manifest, manifestPath, request),
+            requestPath: claimed,
+            executorCwd: manifest.repoRoot,
+            executorEntry: options.internalCliPath ?? process.argv[1] ?? null
+          });
           const prepared = await prepareExecution({
             manifest, manifestPath, request, requestPath: claimed,
             internalCliPath: options.internalCliPath ?? process.argv[1]!
           });
+          appendBrokerAudit(manifest, 'executor-prepared', {
+            ...requestAuditFields(manifest, manifestPath, request),
+            requestPath: claimed,
+            executorCwd: manifest.repoRoot,
+            childPid: prepared.execution.child.pid,
+            childStartTime: prepared.execution.child.startTime,
+            childProcessGroupId: prepared.execution.child.processGroupId,
+            executionPath: executionPath(manifest, request.id)
+          });
           const execution: ActiveExecution = {
             request, prepared, result: null, resultEvidenceWritten: false, failure: null, settled: false
           };
@@ -729,15 +958,39 @@ export async function serveSandboxControl(
           prepared.completion.then(
             (result) => {
               execution.result = sanitizeSandboxControlResult(manifest, result);
+              appendBrokerAudit(manifest, 'executor-completed', {
+                ...requestAuditFields(manifest, manifestPath, request),
+                ...resultAuditFields(execution.result),
+                childPid: prepared.execution.child.pid,
+                childStartTime: prepared.execution.child.startTime
+              });
               try {
                 writeSandboxControlResultEvidence(manifest, request.id, execution.result);
                 execution.resultEvidenceWritten = true;
                 execution.settled = true;
+                appendBrokerAudit(manifest, 'executor-result-evidence-written', {
+                  ...requestAuditFields(manifest, manifestPath, request),
+                  resultPath: path.join(manifest.processingDir, request.id, 'result.json'),
+                  ...resultAuditFields(execution.result)
+                });
               } catch (error) {
                 execution.failure = error;
+                appendBrokerAudit(manifest, 'executor-result-evidence-failed', {
+                  ...requestAuditFields(manifest, manifestPath, request),
+                  errorType: error instanceof Error ? error.name : typeof error,
+                });
               }
             },
-            (error) => { execution.failure = error; execution.settled = true; }
+            (error) => {
+              execution.failure = error;
+              execution.settled = true;
+              appendBrokerAudit(manifest, 'executor-failed', {
+                ...requestAuditFields(manifest, manifestPath, request),
+                childPid: prepared.execution.child.pid,
+                childStartTime: prepared.execution.child.startTime,
+                errorType: error instanceof Error ? error.name : typeof error,
+              });
+            }
           );
           if (!brokerOwns()) {
             prepared.terminate(false);
@@ -754,6 +1007,11 @@ export async function serveSandboxControl(
           writeAcceptedResponse(manifest, {
             version: 2, id, phase: 'accepted', exitCode: null, stdout: '', stderr: '', error: null
           });
+          appendBrokerAudit(manifest, 'request-accepted', {
+            ...requestAuditFields(manifest, manifestPath, request),
+            acceptedPath: acceptedResponsePath(manifest, id),
+            executionPhase: 'prepared'
+          });
           if (!brokerOwns()) {
             prepared.terminate(false);
             active = null;
@@ -761,8 +1019,18 @@ export async function serveSandboxControl(
             break;
           }
           try {
+            appendBrokerAudit(manifest, 'executor-start', {
+              ...requestAuditFields(manifest, manifestPath, request),
+              childPid: prepared.execution.child.pid,
+              childStartTime: prepared.execution.child.startTime,
+              executionPath: executionPath(manifest, request.id)
+            });
             prepared.start(brokerOwns);
           } catch (error) {
+            appendBrokerAudit(manifest, 'executor-start-failed', {
+              ...requestAuditFields(manifest, manifestPath, request),
+              errorType: error instanceof Error ? error.name : typeof error,
+            });
             const owned = brokerOwns();
             prepared.terminate(owned);
             if (!owned || !brokerOwns()) {
@@ -784,7 +1052,7 @@ export async function serveSandboxControl(
               retiring = true;
               break;
             }
-            appendSandboxControlAudit(manifest, 'executor-gate-failed', { requestId: id });
+            appendBrokerAudit(manifest, 'executor-gate-failed', { requestId: id });
             continue;
           }
         } catch (error) {
@@ -792,6 +1060,16 @@ export async function serveSandboxControl(
             retiring = true;
             break;
           }
+          const detail = controlError(error);
+          appendBrokerAudit(manifest, 'request-rejected', {
+            requestId: id,
+            requestFamily: validatedRequest?.family ?? null,
+            sandboxTaskId: manifest.taskId,
+            requestPath: claimed,
+            errorCode: detail.code,
+            errorRetryable: detail.retryable,
+            errorType: error instanceof Error ? error.name : typeof error,
+          });
           writeSandboxControlResponse(manifest, rejected(id, error));
           if (!brokerOwns()) {
             retiring = true;
@@ -818,7 +1096,7 @@ export async function serveSandboxControl(
         }
       }
       if (owned && active.result && active.resultEvidenceWritten) {
-        if (publishExecutionResult(manifest, active.request, active.result, brokerOwns)) {
+        if (publishExecutionResult(manifest, active.request, active.result, broker, brokerOwns)) {
           if (brokerOwns()) {
             removeAcceptedResponse(manifest, active.request.id);
             fs.rmSync(path.join(manifest.processingDir, active.request.id), { recursive: true, force: true });
@@ -830,7 +1108,11 @@ export async function serveSandboxControl(
         const terminationConfirmed = active.prepared.terminate(owned);
         if (owned && brokerOwns() && active.request.family === 'task-finalization') {
           const recovered = finalizationRecoveryResponse(manifest, active.request.id, 0);
-          if (recovered.status === 'matched' && recovered.response && writeSandboxControlResponse(manifest, recovered.response)) {
+          const view = recovered.status === 'matched'
+            ? publishFinalizationTaskView(manifest, broker, active.request.id, 'healthy', null, null)
+            : null;
+          if (view?.state !== 'unknown' && recovered.status === 'matched' && recovered.response
+            && writeSandboxControlResponse(manifest, recovered.response)) {
             if (terminationConfirmed && brokerOwns()) {
               removeAcceptedResponse(manifest, active.request.id);
               fs.rmSync(path.join(manifest.processingDir, active.request.id), { recursive: true, force: true });

package/lib/sandbox/control/state.ts

@@ -23,6 +23,7 @@ import {
   SANDBOX_CONTROL_MAX_TERMINAL_RECORD_BYTES,
   SANDBOX_CONTROL_RESERVATION_BYTES
 } from './protocol.ts';
+import { parseSandboxTaskView, taskViewForManifest, type SandboxTaskView } from './task-view.ts';
 
 export const SANDBOX_CONTROL_AUDIT_MAX_BYTES = 1024 * 1024;
 export const SANDBOX_CONTROL_EXECUTION_STOP_MS = 2_000;
@@ -296,10 +297,11 @@ export function writeSandboxControlStatus(
   state: SandboxControlStatus['state'],
   reasonCode: string | null,
   activeRequestId: string | null,
-  now = Date.now()
+  now = Date.now(),
+  taskView: SandboxTaskView = taskViewForManifest(manifest)
 ): SandboxControlStatus {
   const status: SandboxControlStatus = {
-    version: 2, generation: manifest.generation, broker, state, reasonCode, activeRequestId, updatedAt: now
+    version: 3, generation: manifest.generation, broker, state, reasonCode, activeRequestId, updatedAt: now, taskView
   };
   atomicWriteJson(statusPath(manifest), status, 0o600, false);
   return status;
@@ -307,7 +309,7 @@ export function writeSandboxControlStatus(
 
 export function parseSandboxControlStatus(value: unknown): SandboxControlStatus {
   const status = value as Partial<SandboxControlStatus> | null;
-  if (!status || status.version !== 2 || typeof status.generation !== 'string'
+  if (!status || status.version !== 3 || typeof status.generation !== 'string'
     || !status.broker || !Number.isSafeInteger(status.broker.pid) || typeof status.broker.startTime !== 'number'
     || !Number.isSafeInteger(status.broker.startTime) || typeof status.broker.brokerId !== 'string'
     || status.broker.brokerId.length === 0
@@ -315,6 +317,7 @@ export function parseSandboxControlStatus(value: unknown): SandboxControlStatus
     || (status.reasonCode !== null && typeof status.reasonCode !== 'string')
     || (status.activeRequestId !== null && typeof status.activeRequestId !== 'string')
     || !Number.isSafeInteger(status.updatedAt)) throw new Error('SANDBOX_CONTROL_STATUS_INVALID');
+  parseSandboxTaskView(status.taskView);
   return status as SandboxControlStatus;
 }