@fitlab-ai/agent-infra 0.9.13 → 0.9.15

package/lib/sandbox/control/container-identity.ts

@@ -1,5 +1,7 @@
 import type { SandboxControlManifest } from './protocol.ts';
-import { commandForEngine, runEngine, runProbe } from '../shell.ts';
+import { runProbe } from '../shell.ts';
+import { captureSandboxAuthority, isSandboxAuthorityEvidence, verifySandboxAuthority } from '../engines/authority.ts';
+import { discoverExactContainer } from '../engines/docker-exact-discovery.ts';
 
 export type ContainerObservation =
   | Readonly<{ state: 'found'; id: string; running: boolean; labels: Readonly<Record<string, string>> }>
@@ -12,20 +14,13 @@ export type ContainerInspection = Readonly<{
   labels?: unknown;
 }>;
 
-function isAuthoritativeNotFound(error: unknown): boolean {
-  const message = error instanceof Error ? error.message : String(error);
-  return /(?:no such (?:container|object)|container .* not found|cannot find container)/i.test(message);
-}
-
 export function classifySandboxContainerInspection(
   expected: SandboxControlManifest['containerIdentity'],
   inspection: ContainerInspection | { notFound: true } | { error: unknown }
 ): ContainerObservation {
   if ('notFound' in inspection) return { state: 'absent', id: expected.id };
   if ('error' in inspection) {
-    return isAuthoritativeNotFound(inspection.error)
-      ? { state: 'absent', id: expected.id }
-      : { state: 'unknown', reason: `container inspection failed: ${inspection.error instanceof Error ? inspection.error.message : String(inspection.error)}` };
+    return { state: 'unknown', reason: `container inspection failed: ${inspection.error instanceof Error ? inspection.error.message : String(inspection.error)}` };
   }
   const response = inspection as ContainerInspection;
   if (typeof response.id !== 'string' || response.id !== expected.id
@@ -49,44 +44,33 @@ export function classifySandboxContainerInspection(
 
 export async function inspectSandboxControlContainer(
   manifest: SandboxControlManifest,
-  options: { run?: typeof runEngine; probe?: typeof runProbe; timeoutMs?: number } = {}
+  options: { probe?: typeof runProbe; timeoutMs?: number } = {}
 ): Promise<ContainerObservation> {
+  if (!isSandboxAuthorityEvidence(manifest.authorityEvidence)) {
+    return { state: 'unknown', reason: 'SANDBOX_AUTHORITY_EVIDENCE_MISSING' };
+  }
   try {
-    const args = ['inspect', '--format', '{{json .}}', manifest.containerIdentity.id];
-    let raw: string;
-    if (options.run) {
-      raw = options.run(manifest.engine, 'docker', args, options.timeoutMs === undefined ? {} : { timeout: options.timeoutMs });
-    } else {
-      const command = commandForEngine(manifest.engine, 'docker', args);
-      const result = (options.probe ?? runProbe)(
-        command.cmd,
-        command.args,
-        options.timeoutMs === undefined ? {} : { timeout: options.timeoutMs }
-      );
-      if (result.status !== 0) {
-        const stderr = typeof result.stderr === 'string' ? result.stderr : result.stderr?.toString('utf8') ?? '';
-        return classifySandboxContainerInspection(manifest.containerIdentity, {
-          error: new Error(stderr || `container inspection exited with ${result.status ?? 'unknown'}`)
-        });
-      }
-      raw = typeof result.stdout === 'string' ? result.stdout : result.stdout?.toString('utf8') ?? '';
+    const authority = captureSandboxAuthority(manifest.engine, {
+      probe: options.probe,
+      timeoutMs: options.timeoutMs,
+      lockDomain: manifest.authorityEvidence.lockDomain,
+      route: manifest.authorityEvidence
+    });
+    const authorityState = verifySandboxAuthority(manifest.authorityEvidence, authority);
+    if (authorityState.state !== 'verified') {
+      return { state: 'unknown', reason: authorityState.reason ?? 'SANDBOX_AUTHORITY_UNAVAILABLE' };
     }
-    const parsed = JSON.parse(raw) as {
-      Id?: unknown;
-      State?: { Running?: unknown };
-      Config?: { Labels?: unknown };
-    } | Array<{
-      Id?: unknown;
-      State?: { Running?: unknown };
-      Config?: { Labels?: unknown };
-    }>;
-    const value = Array.isArray(parsed) && parsed.length === 1 ? parsed[0] : parsed;
-    if (!value || Array.isArray(value)) return { state: 'unknown', reason: 'container inspection response is incomplete' };
-    return classifySandboxContainerInspection(manifest.containerIdentity, {
-      id: value.Id,
-      running: value.State?.Running,
-      labels: value.Config?.Labels
+    const discovered = discoverExactContainer(manifest.engine, manifest.containerIdentity.id, {
+      probe: options.probe,
+      timeoutMs: options.timeoutMs,
+      authority: manifest.authorityEvidence
     });
+    if (discovered.state === 'absent') return { state: 'absent', id: discovered.id };
+    if (discovered.state === 'conflict') {
+      return { state: 'unknown', reason: `SANDBOX_CONTROL_CONTAINER_CONFLICT: ${discovered.reason}` };
+    }
+    if (discovered.state === 'unknown') return discovered;
+    return classifySandboxContainerInspection(manifest.containerIdentity, discovered);
   } catch (error) {
     return classifySandboxContainerInspection(manifest.containerIdentity, { error });
   }

package/lib/sandbox/control/executor.ts

@@ -3,16 +3,40 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { getProcessStartTime } from '../../server/process-state.ts';
-import { createTask } from '../../task/create-service.ts';
+import {
+  createTask,
+  projectTaskCreateResult,
+  taskCreateExitCode,
+  taskCreateFailure,
+  type TaskCreateResult
+} from '../../task/create-service.ts';
 import { applyTaskFinalization } from '../../task/finalization.ts';
-import { bindSandboxControlTask, validateSandboxControlRequest, type SandboxControlExecution, type SandboxControlManifest, type SandboxControlRequest } from './protocol.ts';
-import { atomicWriteJson, executionPath, readActiveLease, terminateSandboxControlExecution } from './state.ts';
+import {
+  bindSandboxControlTask,
+  validateSandboxControlRequest,
+  type SandboxControlExecution,
+  type SandboxControlExecutorGateV2,
+  type SandboxControlManifest,
+  type SandboxControlRequest
+} from './protocol.ts';
+import {
+  atomicWriteJson,
+  executionPath,
+  readActiveLease,
+  terminateSandboxControlExecution
+} from './state.ts';
+import { requestAuditFields, resultAuditFields, appendDiagnosticAudit, createSandboxControlAuditContext, appendCriticalAudit, writeSandboxControlTransition } from './audit.ts';
+import { validateSandboxControlIdentity } from './identity-sentinel.ts';
 import {
   createSandboxExecutorExecutionContext,
   dispatchTaskControlOperation,
   parseTaskControlOperation,
+  validateLifecycleRecoveryAttestation,
+  type LifecycleAuthorityResponseV1,
+  type LifecycleRecoveryAttestationV1,
   type TaskControlOperation
 } from '../../task/control-authority.ts';
+import { executeTaskWorkflow } from './workflow-executor.ts';
 import { assertSandboxControlBrokerOwner, readSandboxControlManifest, type BrokerOwner } from './lifecycle.ts';
 import { computeLifecycleBuildIdentity } from '../../agent-clients/adapters/codex-lifecycle/build-identity.ts';
 import {
@@ -21,6 +45,7 @@ import {
   openCodexControllerRegistration,
   resolveCodexControllerBinding
 } from './controller-registration.ts';
+import type { OrchestrationDiagnosticLogger } from '../../task/orchestration.ts';
 
 export type SandboxControlExecutionResult = {
   exitCode: number;
@@ -59,6 +84,27 @@ function safeEnv(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
   return Object.fromEntries(Object.entries(env).filter(([key]) => !key.toUpperCase().startsWith('AGENT_INFRA_CONTROL_')));
 }
 
+function safeRealpath(value: string): string | null {
+  try {
+    return fs.realpathSync.native(value);
+  } catch {
+    return null;
+  }
+}
+
+function appendExecutorAudit(
+  manifest: SandboxControlManifest,
+  event: string,
+  fields: Record<string, string | number | boolean | null> = {}
+): void {
+  try {
+    appendDiagnosticAudit(manifest, event, { source: 'executor', ...fields });
+  } catch {
+    // Diagnostics must never change the control protocol.
+  }
+}
+
+
 export function nodeEntryArgs(entry: string, args: string[]): string[] {
   return path.extname(entry) === '.ts'
     ? ['--experimental-strip-types', '--no-warnings', entry, ...args]
@@ -81,6 +127,7 @@ export async function prepareSandboxControlExecution(params: {
   request: SandboxControlRequest;
   requestPath: string;
   internalCliPath: string;
+  lifecycleAuthority?: LifecycleAuthorityResponseV1;
 }): Promise<PreparedSandboxControlExecution> {
   const nonce = randomUUID();
   const child = spawn(
@@ -134,7 +181,16 @@ export async function prepareSandboxControlExecution(params: {
       if (!canWrite()) throw new Error('SANDBOX_CONTROL_OWNER_LOST');
       atomicWriteJson(executionPath(params.manifest, params.request.id), { ...execution, phase: 'running', updatedAt: Date.now() });
       if (!canWrite()) throw new Error('SANDBOX_CONTROL_OWNER_LOST');
-      child.send({ version: 1, nonce, owner: gateOwner });
+      const authority = params.lifecycleAuthority?.attestation ?? null;
+      child.send({
+        version: 2,
+        nonce,
+        owner: gateOwner,
+        requestId: params.request.id,
+        operationId: authority?.operationId ?? params.request.id,
+        phase: authority?.phase ?? (params.request.family === 'task-workflow' ? 'artifact.finalize-local' : 'orchestration.prepare'),
+        authority
+      } satisfies SandboxControlExecutorGateV2);
     },
     completion,
     terminate(updateState = true) {
@@ -148,7 +204,7 @@ export async function prepareSandboxControlExecution(params: {
   };
 }
 
-function waitForGate(nonce: string, timeoutMs = 2_000): Promise<BrokerOwner> {
+function waitForGate(nonce: string, timeoutMs = 2_000): Promise<Readonly<{ owner: BrokerOwner; authority: LifecycleRecoveryAttestationV1 | null; requestId: string; operationId: string; phase: SandboxControlExecutorGateV2['phase'] }>> {
   return new Promise((resolve, reject) => {
     const timer = setTimeout(() => reject(new Error('SANDBOX_CONTROL_EXECUTOR_GATE_TIMEOUT')), timeoutMs);
     const onDisconnect = () => {
@@ -163,9 +219,14 @@ function waitForGate(nonce: string, timeoutMs = 2_000): Promise<BrokerOwner> {
         version?: unknown;
         nonce?: unknown;
         owner?: Partial<BrokerOwner> | null;
+        requestId?: unknown;
+        operationId?: unknown;
+        phase?: unknown;
+        authority?: unknown;
       } | null;
       const owner = value?.owner;
-      if (!value || value.version !== 1 || value.nonce !== nonce
+      if (!value || Object.keys(value).sort().join(',') !== 'authority,nonce,operationId,owner,phase,requestId,version'
+        || value.version !== 2 || value.nonce !== nonce
         || !owner || owner.version !== 3 || !Number.isSafeInteger(owner.pid) || (owner.pid ?? 0) <= 0
         || typeof owner.startTime !== 'number' || !Number.isSafeInteger(owner.startTime)
         || typeof owner.brokerId !== 'string' || owner.brokerId.length === 0
@@ -173,7 +234,21 @@ function waitForGate(nonce: string, timeoutMs = 2_000): Promise<BrokerOwner> {
         reject(new Error('SANDBOX_CONTROL_EXECUTOR_GATE_INVALID'));
         return;
       }
-      resolve(owner as BrokerOwner);
+      if (typeof value.requestId !== 'string' || typeof value.operationId !== 'string'
+        || !['orchestration.prepare', 'artifact.finalize-local', 'task-event.completed'].includes(value.phase as string)
+        || (value.authority !== null && value.authority !== undefined && (() => {
+          try { validateLifecycleRecoveryAttestation(value.authority); return false; } catch { return true; }
+        })())) {
+        reject(new Error('SANDBOX_CONTROL_EXECUTOR_GATE_INVALID'));
+        return;
+      }
+      resolve({
+        owner: owner as BrokerOwner,
+        authority: value.authority === null || value.authority === undefined ? null : value.authority as LifecycleRecoveryAttestationV1,
+        requestId: value.requestId,
+        operationId: value.operationId,
+        phase: value.phase as SandboxControlExecutorGateV2['phase']
+      });
     });
   });
 }
@@ -218,6 +293,22 @@ function lifecycleFailure(code: string, message: string): SandboxControlExecutio
   };
 }
 
+function taskCreateExecutionResult(result: TaskCreateResult): SandboxControlExecutionResult {
+  return {
+    exitCode: taskCreateExitCode(result),
+    stdout: `${JSON.stringify(result)}\n`,
+    stderr: ''
+  };
+}
+
+function taskCreateExecutionFailure(requestId: string, code: string, message: string): SandboxControlExecutionResult {
+  return taskCreateExecutionResult(taskCreateFailure({ code, message, retryable: false }, {
+    requestId,
+    accepted: true,
+    recovery: 'inspect-domain-state'
+  }));
+}
+
 function finalizationResult(result: Awaited<ReturnType<typeof applyTaskFinalization>>): SandboxControlExecutionResult {
   const payload = {
     version: 1,
@@ -237,21 +328,28 @@ function finalizationResult(result: Awaited<ReturnType<typeof applyTaskFinalizat
 type ExecuteRequestOptions = Readonly<{
   buildIdentity?: typeof computeLifecycleBuildIdentity;
   resolveControllerBinding?: typeof resolveCodexControllerBinding;
+  lifecycleRecoveryAttestation?: LifecycleRecoveryAttestationV1 | null;
 }>;
 
-export async function executeRequest(
+async function executeRequestInner(
   manifest: SandboxControlManifest,
   manifestPath: string,
   request: SandboxControlRequest,
   options: ExecuteRequestOptions = {}
 ): Promise<SandboxControlExecutionResult> {
   if (request.family === 'task-create') {
-    const result = await createTask(request.candidate, { repoRoot: manifest.repoRoot });
-    return {
-      exitCode: result.status === 'blocked' ? 2 : result.status === 'failed' ? 1 : 0,
-      stdout: `${JSON.stringify(result)}\n`,
-      stderr: ''
-    };
+    try {
+      const result = await createTask(request.candidate, { repoRoot: manifest.repoRoot });
+      return taskCreateExecutionResult(projectTaskCreateResult(result, {
+        requestId: request.id,
+        accepted: true,
+        recovery: 'none'
+      }));
+    } catch (error) {
+      const detail = error instanceof Error ? error.message : String(error);
+      const code = /^([A-Z][A-Z0-9_]+)/u.exec(detail)?.[1] ?? 'TASK_CREATE_EXECUTION_FAILED';
+      return taskCreateExecutionFailure(request.id, code, detail);
+    }
   }
   if (request.family === 'codex-controller') {
     try {
@@ -293,9 +391,20 @@ export async function executeRequest(
           });
       return { exitCode: 0, stdout: `${JSON.stringify(result)}\n`, stderr: '' };
     } catch (error) {
+      const errorCode = error instanceof CodexControllerRegistrationError
+        ? error.code
+        : /^([A-Z][A-Z0-9_]+)/u.exec(error instanceof Error ? error.message : String(error))?.[1]
+          ?? 'CODEX_SANDBOX_CONTROLLER_FAILED';
+      appendExecutorAudit(manifest, 'controller-operation-failed', {
+        ...requestAuditFields(manifest, request),
+        controllerCommand: request.command,
+        errorCode,
+        errorType: error instanceof Error ? error.name : typeof error,
+      });
       return controllerFailure(error);
     }
   }
+  if (request.family === 'task-workflow') return executeTaskWorkflow(manifest, request.workflow, options.lifecycleRecoveryAttestation ?? null);
   if (request.family === 'task-finalization') {
     const operation = parseTaskControlOperation(
       'task-finalization', [manifest.taskId!, 'complete', '--agent', request.agent]
@@ -309,7 +418,8 @@ export async function executeRequest(
         taskId: manifest.taskId!,
         generation: manifest.generation,
         manifestPath,
-        requestId: request.id
+        requestId: request.id,
+        lifecycleRecoveryAttestation: options.lifecycleRecoveryAttestation ?? null
       }),
       operation
     );
@@ -339,23 +449,31 @@ export async function executeRequest(
       && operation.input.client === 'codex';
     if (codexPrepare) {
       if (!request.controllerProof) {
-        return orchestrationFailure(
-          'CODEX_SANDBOX_CONTROLLER_PROOF_REQUIRED',
-          'Codex prepare requires a current controller lease proof'
-        );
-      }
-      try {
-        controllerBinding = (options.resolveControllerBinding ?? resolveCodexControllerBinding)({
-          manifest,
-          manifestPath,
-          proof: request.controllerProof,
-          buildIdentity: (options.buildIdentity ?? computeLifecycleBuildIdentity)(manifest.repoRoot)
-        });
-      } catch (error) {
-        const code = error instanceof CodexControllerRegistrationError
-          ? error.code
-          : 'CODEX_SANDBOX_CONTROLLER_PROOF_INVALID';
-        return orchestrationFailure(code, `${code}: Codex controller proof was rejected`);
+        const authority = options.lifecycleRecoveryAttestation;
+        if (!authority || authority.phase !== 'orchestration.prepare') {
+          return orchestrationFailure(
+            'CODEX_SANDBOX_CONTROLLER_PROOF_REQUIRED',
+            'Codex prepare requires a current controller lease proof'
+          );
+        }
+        controllerBinding = {
+          instanceDigest: authority.controllerInstanceDigest,
+          controlGeneration: authority.controlGeneration
+        };
+      } else {
+        try {
+          controllerBinding = (options.resolveControllerBinding ?? resolveCodexControllerBinding)({
+            manifest,
+            manifestPath,
+            proof: request.controllerProof,
+            buildIdentity: (options.buildIdentity ?? computeLifecycleBuildIdentity)(manifest.repoRoot)
+          });
+        } catch (error) {
+          const code = error instanceof CodexControllerRegistrationError
+            ? error.code
+            : 'CODEX_SANDBOX_CONTROLLER_PROOF_INVALID';
+          return orchestrationFailure(code, `${code}: Codex controller proof was rejected`);
+        }
       }
     } else if (request.controllerProof !== null) {
       return orchestrationFailure(
@@ -364,6 +482,14 @@ export async function executeRequest(
       );
     }
   }
+  const diagnosticLog: OrchestrationDiagnosticLogger = (event, fields): void => {
+    appendExecutorAudit(manifest, event.startsWith('orchestration-') ? event : `orchestration-${event}`, {
+      requestId: request.id,
+      requestFamily: request.family,
+      sandboxTaskId: manifest.taskId,
+      ...fields
+    });
+  };
   const context = createSandboxExecutorExecutionContext({
     repoRoot: manifest.repoRoot,
     worktreeRoot: manifest.worktreeRoot,
@@ -372,7 +498,9 @@ export async function executeRequest(
     generation: manifest.generation,
     manifestPath,
     requestId: request.id,
-    ...(controllerBinding ? { controllerBinding } : {})
+    diagnosticLog,
+    ...(controllerBinding ? { controllerBinding } : {}),
+    lifecycleRecoveryAttestation: options.lifecycleRecoveryAttestation ?? null
   });
   const format = (value: unknown): SandboxControlExecutionResult => {
     const result = value as { status?: string };
@@ -390,27 +518,116 @@ export async function executeRequest(
     return format(await dispatchTaskControlOperation(context, operation));
 }
 
+export async function executeRequest(
+  manifest: SandboxControlManifest,
+  manifestPath: string,
+  request: SandboxControlRequest,
+  options: ExecuteRequestOptions = {}
+): Promise<SandboxControlExecutionResult> {
+  const fields = requestAuditFields(manifest, request);
+  appendExecutorAudit(manifest, 'executor-request-start', fields);
+  try {
+    const result = await executeRequestInner(manifest, manifestPath, request, options);
+    appendExecutorAudit(manifest, 'executor-request-finished', {
+      requestId: request.id,
+      requestFamily: request.family,
+      sandboxTaskId: manifest.taskId,
+      ...resultAuditFields(result)
+    });
+    return result;
+  } catch (error) {
+    appendExecutorAudit(manifest, 'executor-request-failed', {
+      requestId: request.id,
+      requestFamily: request.family,
+      sandboxTaskId: manifest.taskId,
+      errorType: error instanceof Error ? error.name : typeof error,
+    });
+    throw error;
+  }
+}
+
 export async function runSandboxControlExecutor(requestPath: string, nonce: string): Promise<void> {
-  const gateOwner = await waitForGate(nonce);
+  const gate = await waitForGate(nonce);
+  const gateOwner = gate.owner;
   process.disconnect?.();
   const manifestPath = process.env.AGENT_INFRA_EXECUTOR_MANIFEST;
   if (!manifestPath) throw new Error('SANDBOX_CONTROL_EXECUTOR_MANIFEST_MISSING');
   const manifest = readSandboxControlManifest(manifestPath);
+  const identity = validateSandboxControlIdentity({
+    publicStatusDir: manifest.publicStatusDir,
+    root: path.dirname(path.resolve(manifestPath)),
+    mode: manifest.mode,
+    taskId: manifest.taskId,
+    generation: manifest.generation,
+    controlRootId: manifest.controlRootId
+  });
+  if (identity.state !== 'valid') {
+    throw new Error(`SANDBOX_CONTROL_IDENTITY_${identity.state.replaceAll('-', '_').toUpperCase()}`);
+  }
   const root = fs.realpathSync.native(process.cwd());
-  if (fs.realpathSync.native(manifest.repoRoot) !== root) throw new Error('SANDBOX_CONTROL_EXECUTOR_ROOT_INVALID');
+  const expectedRoot = safeRealpath(manifest.repoRoot);
+  if (expectedRoot !== root) {
+    appendExecutorAudit(manifest, 'executor-root-validation-failed', {
+      hostCwd: process.cwd(),
+      observedRoot: root,
+      expectedRoot
+    });
+    throw new Error('SANDBOX_CONTROL_EXECUTOR_ROOT_INVALID');
+  }
   const raw = JSON.parse(fs.readFileSync(requestPath, 'utf8')) as unknown;
   const request = validateSandboxControlRequest(raw, manifest);
+  if (gate.requestId !== request.id) throw new Error('SANDBOX_CONTROL_EXECUTOR_GATE_REQUEST_MISMATCH');
+  if (gate.authority !== null
+    && (gate.authority.requestId !== request.id
+      || gate.authority.operationId !== gate.operationId
+      || gate.authority.phase !== gate.phase)) {
+    throw new Error('SANDBOX_CONTROL_EXECUTOR_GATE_AUTHORITY_MISMATCH');
+  }
+  appendExecutorAudit(manifest, 'executor-request-validated', requestAuditFields(manifest, request));
   const requestDirectory = path.resolve(path.dirname(requestPath));
   const processingDirectory = path.resolve(path.join(manifest.processingDir, request.id));
   const channelRequestDirectory = path.resolve(path.join(manifest.channelDir, 'requests'));
   if (requestDirectory !== processingDirectory && requestDirectory !== channelRequestDirectory) {
+    appendExecutorAudit(manifest, 'executor-request-path-validation-failed', {
+      ...requestAuditFields(manifest, request),
+      requestPath,
+      requestDirectory,
+      processingDirectory,
+      channelRequestDirectory
+    });
     throw new Error('SANDBOX_CONTROL_EXECUTOR_REQUEST_INVALID');
   }
   let result: SandboxControlExecutionResult;
   try {
     assertSandboxControlExecutorAuthority(manifest, gateOwner);
-    result = await executeRequest(manifest, manifestPath, request);
+    const operation = request.family === 'task-lifecycle' || request.family === 'task-orchestration'
+      ? (() => {
+        try { return parseTaskControlOperation(request.family, request.args); } catch { return null; }
+      })()
+      : null;
+    const context = createSandboxControlAuditContext(manifest, {
+      requestId: request.id,
+      family: request.family,
+      operation: operation?.family === 'task-orchestration'
+        ? operation.intent
+        : operation?.family === 'task-lifecycle'
+          ? operation.request.intent
+          : request.family === 'task-finalization' ? request.operation : null,
+      phase: 'started-committed',
+      outcome: 'in-progress'
+    });
+    appendCriticalAudit(manifest, context, { transition: 'started-committed' });
+    writeSandboxControlTransition(manifest, { requestId: request.id, phase: 'started-committed' });
+    const execution = readJsonExecution(executionPath(manifest, request.id));
+    atomicWriteJson(executionPath(manifest, request.id), { ...execution, phase: 'running', updatedAt: Date.now() });
+    result = await executeRequest(manifest, manifestPath, request, {
+      lifecycleRecoveryAttestation: gate.authority
+    });
   } catch (error) {
+    appendExecutorAudit(manifest, 'executor-authority-or-dispatch-failed', {
+      ...requestAuditFields(manifest, request),
+      errorType: error instanceof Error ? error.name : typeof error,
+    });
     const detail = error instanceof Error ? error.message : String(error);
     const code = /^([A-Z][A-Z0-9_]+)/u.exec(detail)?.[1] ?? 'SANDBOX_CONTROL_EXECUTOR_FAILED';
     result = request.family === 'task-finalization'
@@ -422,7 +639,9 @@ export async function runSandboxControlExecutor(requestPath: string, nonce: stri
         })}\n`,
         stderr: ''
       }
-      : request.family === 'task-lifecycle'
+      : request.family === 'task-create'
+        ? taskCreateExecutionFailure(request.id, code, detail)
+        : request.family === 'task-lifecycle'
         ? lifecycleFailure(code, detail)
         : orchestrationFailure(code, detail);
   }
@@ -431,6 +650,12 @@ export async function runSandboxControlExecutor(requestPath: string, nonce: stri
   process.exitCode = result.exitCode;
 }
 
+function readJsonExecution(filePath: string): SandboxControlExecution {
+  const value = JSON.parse(fs.readFileSync(filePath, 'utf8')) as SandboxControlExecution;
+  if (!value || value.requestId.length === 0) throw new Error('SANDBOX_CONTROL_EXECUTION_INVALID');
+  return value;
+}
+
 export function disconnectExecutor(child: ChildProcess): void {
   if (child.connected) child.disconnect();
 }

package/lib/sandbox/control/finalization-response.ts

@@ -0,0 +1,29 @@
+import type { TaskFinalizationReceipt } from '../../task/finalization.ts';
+import type { SandboxControlResponse } from './protocol.ts';
+
+export function finalizationTerminalResponse(taskId: string, requestId: string, receipt: TaskFinalizationReceipt): SandboxControlResponse {
+  const pendingSteps = [
+    receipt.taskComment === 'pending' ? 'task-comment' : null,
+    receipt.verification === 'pending' ? 'verification' : null
+  ].filter((step): step is string => step !== null);
+  const completedSteps = ['lifecycle', receipt.taskComment === 'pending' ? null : 'task-comment', receipt.verification === 'pending' ? null : 'verification']
+    .filter((step): step is string => step !== null);
+  const warnings = receipt.warnings
+    .filter((warning) => warning.status === 'open')
+    .map(({ status: _status, resolvedAt: _resolvedAt, ...warning }) => warning);
+  const result = {
+    status: 'completed', changed: false, taskId,
+    lifecycle: { status: 'no-op', changed: false, error: null },
+    taskComment: receipt.taskComment === 'pending' ? null : { status: 'no-op', changed: false, error: null },
+    verification: receipt.verification === 'pending' ? null : { status: 'no-op', changed: false, error: null },
+    completedSteps, pendingSteps,
+    result: pendingSteps.length > 0 || receipt.warningProjection === 'pending' || warnings.length > 0
+      ? 'completed_with_warnings' : 'completed',
+    warnings, error: null
+  };
+  return {
+    version: 2, id: requestId, phase: 'completed', exitCode: 0,
+    stdout: `${JSON.stringify({ version: 1, status: 'completed', changed: false, accepted: true, result, error: null })}\n`,
+    stderr: '', error: null
+  };
+}