@fitlab-ai/agent-infra 0.9.14 → 0.9.15

package/dist/lib/sandbox/control/server.js

@@ -1,3 +1,5 @@
+import { finalizationTerminalResponse } from './finalization-response.js';
+import { isDeepStrictEqual } from 'node:util';
 import { completedReentryView } from './completed-reentry.js';
 import fs from 'node:fs';
 import path from 'node:path';
@@ -6,65 +8,125 @@ import { getProcessStartTime } from '../../server/process-state.js';
 import { assertGitWorktreeBinding } from '../../git/worktree-identity.js';
 import { controlError, DEFAULT_SANDBOX_CONTROL_TIMING, SANDBOX_CONTROL_MAX_RESPONSE_BYTES, SANDBOX_CONTROL_MAX_TERMINAL_RECORD_BYTES } from './protocol.js';
 import { prepareSandboxControlExecution } from './executor.js';
-import { appendSandboxControlAudit, atomicWriteJsonNoReplace, createSandboxControlPayload, cleanupStaleSandboxControlLease, executionPath, readJsonFile, readActiveLease, readExecution, readSandboxControlPayload, readSandboxControlResultEvidence, sandboxControlEncodedJsonBytes, sandboxControlGenerationUsage, sanitizeSandboxControlOutput, sanitizeSandboxControlResult, payloadPath, writeSandboxControlPayload, writeSandboxControlReservation, writeSandboxControlResultEvidence, terminateSandboxControlExecution, writeSandboxControlStatus, readSandboxControlStatus } from './state.js';
+import { atomicWriteJsonNoReplace, createSandboxControlPayload, cleanupStaleSandboxControlLease, executionPath, readJsonFile, readActiveLease, readExecution, readSandboxControlPayload, readSandboxControlResultEvidence, readSandboxControlTerminalResult, createSandboxControlTerminalResult, sandboxControlEncodedJsonBytes, sandboxControlGenerationUsage, sanitizeSandboxControlOutput, sanitizeSandboxControlResult, payloadPath, writeSandboxControlPayload, writeSandboxControlReservation, writeSandboxControlResultEvidence, writeSandboxControlTerminalResult, appendSandboxControlAudit, terminateSandboxControlExecution, writeSandboxControlStatus, readSandboxControlStatus } from './state.js';
 import { validateSandboxControlRequest } from './protocol.js';
+import { requestAuditFields, resultAuditFields, appendCriticalAudit, appendDiagnosticAudit, createSandboxControlAuditContext, writeSandboxControlTransition, readSandboxControlTransition } from './audit.js';
+import { parseTaskControlOperation } from '../../task/control-authority.js';
+import { parseControlOutput, classifySandboxControlRecovery, findSandboxControlRecoveryOperation, operationRecoveryBinding, SANDBOX_CONTROL_REQUIRED_COMPLETION_PHASES } from '../../task/control-recovery.js';
+import { readRun } from '../../task/orchestration.js';
+import { captureRepositorySnapshot } from '../../task/workspace-snapshot.js';
+import { parseTypedTaskFrontmatter } from '../../task/frontmatter.js';
+import { readLifecycleJournalEvidence } from '../../task/lifecycle.js';
+import { resolveTaskRef } from '../../task/resolve-ref.js';
+import { loadShortIdByTaskId } from '../../task/short-id.js';
 import { inspectSandboxControlContainer } from './container-identity.js';
 import { acquireSandboxControlBrokerStartup, garbageCollectSandboxControlRoot, isSandboxControlRootQuiescing, readSandboxControlManifest } from './lifecycle.js';
 import { nextSandboxControlBackoff } from './timing.js';
 import { readTaskFinalizationReceipt } from '../../task/finalization.js';
-import { resolveTaskRef } from '../../task/resolve-ref.js';
+import { readCodexControllerRegistration } from './controller-registration.js';
+import { validateSandboxControlIdentity } from './identity-sentinel.js';
 import { mergeSandboxTaskView, taskViewAfterFinalization, taskViewForManifest } from './task-view.js';
 import { taskCreateOutputUnavailableResult } from '../../task/create-service.js';
-function safeRealpath(value) {
+import { consumeLifecycleRecoveryAttestation, issueLifecycleRecoveryAttestation, recoverLifecycleRecoveryOperation } from '../../task/control-authority.js';
+import { createCodexCapabilityStore } from '../../agent-clients/adapters/codex-lifecycle/capability-store.js';
+import { computeLifecycleBuildIdentity } from '../../agent-clients/adapters/codex-lifecycle/build-identity.js';
+function consumeLifecycleAuthorityForResult(manifest, execution) {
+    const authority = execution.lifecycleAuthority?.attestation;
+    if (!authority || execution.result?.exitCode !== 0)
+        return true;
     try {
-        return fs.realpathSync.native(value);
+        consumeLifecycleRecoveryAttestation(authority);
+        return true;
+    }
+    catch (error) {
+        appendBrokerAudit(manifest, 'lifecycle-authority-consume-retry', {
+            ...requestAuditFields(manifest, execution.request),
+            errorCode: error instanceof Error ? error.name : 'LIFECYCLE_AUTHORITY_CONSUME_FAILED'
+        });
+        return false;
+    }
+}
+function lifecycleAuthorityForRequest(manifest, manifestPath, request) {
+    const selector = request.family === 'task-workflow' || request.family === 'task-orchestration'
+        ? request.authority
+        : undefined;
+    if (!selector)
+        return undefined;
+    let controllerBinding = null;
+    try {
+        const registration = readCodexControllerRegistration(manifestPath);
+        controllerBinding = {
+            instanceDigest: registration.controllerInstanceDigest,
+            controlGeneration: registration.controlGeneration
+        };
     }
     catch {
-        return null;
+        // The issuer reports the stable unavailable result; the broker never trusts
+        // a controller binding supplied by the request.
     }
+    return issueLifecycleRecoveryAttestation(selector, {
+        controllerBinding,
+        capabilityStore: createCodexCapabilityStore(),
+        buildIdentity: computeLifecycleBuildIdentity(manifest.repoRoot)
+    });
 }
 function appendBrokerAudit(manifest, event, fields = {}) {
+    appendDiagnosticAudit(manifest, event, { source: 'broker', ...fields });
+}
+function operationKey(request, output) {
+    if (request.family === 'task-finalization')
+        return request.operation;
+    if (request.family === 'task-create')
+        return 'create';
+    if (request.family === 'codex-controller')
+        return request.command;
+    if (request.family === 'task-workflow')
+        return request.workflow.operation;
+    if (request.family !== 'task-lifecycle' && request.family !== 'task-orchestration')
+        return null;
+    if (request.family === 'task-orchestration' && request.args[1] === 'route') {
+        if (!output)
+            return 'route';
+        const result = parseControlOutput(output);
+        return result?.changed === true && result.status === 'completed' ? 'route.clean-completion' : 'route.read';
+    }
     try {
-        appendSandboxControlAudit(manifest, event, { source: 'broker', ...fields });
+        const operation = parseTaskControlOperation(request.family, request.args);
+        return operation.family === 'task-orchestration' ? operation.intent : operation.request.intent;
     }
     catch {
-        // Diagnostics must never change the control protocol.
+        return null;
     }
 }
-function requestAuditFields(manifest, manifestPath, request) {
-    const args = 'args' in request ? request.args : [];
-    const encodedArgs = JSON.stringify(args);
-    return {
-        requestId: request.id,
-        requestFamily: request.family,
-        sandboxTaskId: manifest.taskId,
-        requestGeneration: request.generation,
-        requestIssuedAt: request.issuedAt,
-        requestExpiresAt: request.expiresAt,
-        requestArgCount: args.length,
-        requestArgsSha256: createHash('sha256').update(encodedArgs, 'utf8').digest('hex'),
-        requestTaskRef: args[0] ?? null,
-        requestCommand: args[1] ?? null,
-        controllerProofPresent: request.controllerProof !== null,
-        hostCwd: process.cwd(),
-        manifestPath,
-        manifestPathRealpath: safeRealpath(manifestPath),
-        repoRoot: manifest.repoRoot,
-        repoRootRealpath: safeRealpath(manifest.repoRoot),
-        worktreeRoot: manifest.worktreeRoot,
-        worktreeRootRealpath: safeRealpath(manifest.worktreeRoot),
-        runtimeDir: manifest.runtimeDir,
-        runtimeDirRealpath: safeRealpath(manifest.runtimeDir)
-    };
+function recoveryOperationKey(request, terminalResult, output) {
+    const operation = operationKey(request, output);
+    if (operation !== 'route')
+        return operation;
+    const digest = terminalResult?.intentDigest;
+    for (const candidate of ['route.read', 'route.clean-completion']) {
+        const expected = operationRecoveryBinding(request.id, request.generation, null, request.family, candidate).intentDigest;
+        if (digest === expected)
+            return candidate;
+    }
+    return null;
 }
-function resultAuditFields(result) {
-    return {
-        exitCode: result.exitCode,
-        stdoutBytes: Buffer.byteLength(result.stdout, 'utf8'),
-        stderrBytes: Buffer.byteLength(result.stderr, 'utf8'),
-        stdoutSha256: createHash('sha256').update(result.stdout, 'utf8').digest('hex'),
-        stderrSha256: createHash('sha256').update(result.stderr, 'utf8').digest('hex')
-    };
+function terminalResultMatchesRequest(request, terminalResult) {
+    const operation = operationKey(request);
+    const candidates = operation === 'route'
+        ? ['route.read', 'route.clean-completion']
+        : operation ? [operation] : [];
+    return candidates.some((candidate) => createHash('sha256').update(`${request.family}\0${candidate}`, 'utf8').digest('hex') === terminalResult.intentDigest);
+}
+function criticalRequestPhase(manifest, request, phase, outcome, reference) {
+    const context = createSandboxControlAuditContext(manifest, {
+        requestId: request.id,
+        family: request.family,
+        operation: operationKey(request),
+        phase,
+        outcome
+    });
+    appendCriticalAudit(manifest, context, { reference: reference ?? null });
+    writeSandboxControlTransition(manifest, { requestId: request.id, phase, reference });
 }
 function assertRealDirectory(directory, parent) {
     const stat = fs.lstatSync(directory);
@@ -146,33 +208,7 @@ function finalizationRecoveryResponse(manifest, requestId, exitCode) {
     catch {
         return { status: 'deferred' };
     }
-    const pendingSteps = [
-        receipt.taskComment === 'pending' ? 'task-comment' : null,
-        receipt.verification === 'pending' ? 'verification' : null
-    ].filter((step) => step !== null);
-    const completedSteps = ['lifecycle', receipt.taskComment === 'pending' ? null : 'task-comment', receipt.verification === 'pending' ? null : 'verification']
-        .filter((step) => step !== null);
-    const warnings = receipt.warnings
-        .filter((warning) => warning.status === 'open')
-        .map(({ status: _status, resolvedAt: _resolvedAt, ...warning }) => warning);
-    const result = {
-        status: 'completed', changed: false, taskId: manifest.taskId,
-        lifecycle: { status: 'no-op', changed: false, error: null },
-        taskComment: receipt.taskComment === 'pending' ? null : { status: 'no-op', changed: false, error: null },
-        verification: receipt.verification === 'pending' ? null : { status: 'no-op', changed: false, error: null },
-        completedSteps, pendingSteps,
-        result: pendingSteps.length > 0 || receipt.warningProjection === 'pending' || warnings.length > 0
-            ? 'completed_with_warnings' : 'completed',
-        warnings, error: null
-    };
-    return {
-        status: 'matched',
-        response: {
-            version: 2, id: requestId, phase: 'completed', exitCode: 0,
-            stdout: `${JSON.stringify({ version: 1, status: 'completed', changed: false, accepted: true, result, error: null })}\n`,
-            stderr: '', error: null
-        }
-    };
+    return { status: 'matched', response: finalizationTerminalResponse(manifest.taskId, requestId, receipt) };
 }
 function publishFinalizationTaskView(manifest, broker, requestId, state, reasonCode, activeRequestId) {
     let view;
@@ -236,16 +272,244 @@ function genericRecoveryResponse(request, exitCode, payload, cause = 'recovery')
         payload: payload ? payloadReference(payload) : null
     };
 }
-function recoveryResponse(manifest, request, evidence, payload) {
+function taskCreateDomainEvidence(manifest, output) {
+    if (!output || !['applied', 'no-op', 'degraded'].includes(String(output.status))) {
+        return { consistent: false };
+    }
+    const task = output.task && typeof output.task === 'object' && !Array.isArray(output.task)
+        ? output.task : null;
+    const taskId = typeof task?.id === 'string' ? task.id : null;
+    const shortId = typeof task?.shortId === 'string' ? task.shortId : null;
+    if (!taskId || !shortId)
+        return { consistent: false };
+    try {
+        const resolved = resolveTaskRef(taskId, { repoRoot: manifest.repoRoot });
+        const shortIds = loadShortIdByTaskId(manifest.repoRoot);
+        return {
+            consistent: resolved.ok && resolved.taskId === taskId && resolved.state === 'active' && shortIds.get(taskId) === shortId,
+            taskId,
+            shortId
+        };
+    }
+    catch {
+        return { consistent: false };
+    }
+}
+function controllerDomainEvidence(manifest, manifestPath, request, output) {
+    if (!output || output.error !== null || typeof output.status !== 'string')
+        return { consistent: false };
+    try {
+        const registration = readCodexControllerRegistration(manifestPath);
+        if (request.family !== 'codex-controller')
+            return { consistent: false };
+        if (request.command === 'open') {
+            const lease = output.lease && typeof output.lease === 'object' && !Array.isArray(output.lease)
+                ? output.lease : null;
+            return {
+                consistent: output.status === 'opened' && output.changed === true
+                    && lease?.taskId === registration.taskId
+                    && lease.controlGeneration === registration.controlGeneration
+                    && lease.controllerInstanceDigest === registration.controllerInstanceDigest
+                    && registration.taskId === manifest.taskId
+                    && registration.controlGeneration === manifest.generation
+            };
+        }
+        if (request.command === 'verify') {
+            const binding = output.binding && typeof output.binding === 'object' && !Array.isArray(output.binding)
+                ? output.binding : null;
+            return {
+                consistent: output.status === 'verified' && output.changed === false
+                    && binding?.taskId === registration.taskId
+                    && binding.controlGeneration === registration.controlGeneration
+                    && binding.controllerInstanceDigest === registration.controllerInstanceDigest
+            };
+        }
+        return { consistent: false };
+    }
+    catch (error) {
+        return { consistent: request.family === 'codex-controller' && request.command === 'close'
+                && error.code === 'CODEX_SANDBOX_CONTROLLER_REGISTRATION_MISSING'
+                && output?.status === 'closed' && typeof output.changed === 'boolean' };
+    }
+}
+function orchestrationDomainEvidence(operation, terminalResult, output, run) {
+    if (!operation || !output)
+        return { consistent: false };
+    const outputRun = output.run && typeof output.run === 'object' && !Array.isArray(output.run)
+        ? output.run : null;
+    const runMatches = outputRun === null ? run === null : run !== null && JSON.stringify(run) === JSON.stringify(outputRun);
+    if (operation.class === 'read-only') {
+        return {
+            consistent: output.status === terminalResult.status && output.changed === terminalResult.changed && runMatches,
+            snapshotValid: true,
+            status: run?.status ?? terminalResult.status,
+            pendingDelegation: run?.pendingDelegation ?? null
+        };
+    }
+    if (!run || !outputRun)
+        return { consistent: false };
+    return {
+        consistent: output.status === terminalResult.status && output.changed === terminalResult.changed && runMatches,
+        status: run.status,
+        pendingDelegation: run.pendingDelegation
+    };
+}
+function readRecoveryDomain(manifest, manifestPath, request, operation, terminalResult, payloadOutput) {
+    if (!operation)
+        return { domain: null };
+    const taskRef = request.family === 'task-finalization' || request.family === 'task-workflow'
+        ? manifest.taskId
+        : 'args' in request ? request.args[0] ?? null : manifest.taskId;
+    const output = parseControlOutput(payloadOutput);
+    if (!taskRef && operation.family !== 'task-create' && operation.family !== 'codex-controller') {
+        return { domain: null };
+    }
+    if (operation.family === 'task-lifecycle') {
+        if (!taskRef || !terminalResult.targetState)
+            return { domain: null };
+        const journal = readLifecycleJournalEvidence(manifest.repoRoot, taskRef);
+        try {
+            const resolved = resolveTaskRef(taskRef, { repoRoot: manifest.repoRoot });
+            const shortIds = loadShortIdByTaskId(manifest.repoRoot);
+            const shortIdMatches = terminalResult.targetState === 'active'
+                ? shortIds.has(resolved.ok ? resolved.taskId : taskRef)
+                : !shortIds.has(resolved.ok ? resolved.taskId : taskRef);
+            return {
+                domain: { consistent: resolved.ok && resolved.state === terminalResult.targetState && shortIdMatches },
+                journal
+            };
+        }
+        catch {
+            return { domain: { consistent: false }, journal };
+        }
+    }
+    if (operation.family === 'task-orchestration') {
+        if (!taskRef)
+            return { domain: null };
+        try {
+            const resolved = resolveTaskRef(taskRef, { repoRoot: manifest.repoRoot });
+            if (!resolved.ok)
+                return { domain: { consistent: false } };
+            const run = readRun(resolved.taskDir);
+            if (!run && operation.class !== 'read-only')
+                return { domain: { consistent: false } };
+            if (operation.class === 'route.clean-completion') {
+                const snapshot = captureRepositorySnapshot(manifest.repoRoot);
+                const metadata = parseTypedTaskFrontmatter(fs.readFileSync(resolved.taskMdPath, 'utf8'));
+                const completion = run?.completionEvidence ?? null;
+                const consistent = run !== null && completion !== null
+                    && terminalResult.completionEvidence !== null
+                    && isDeepStrictEqual(completion, terminalResult.completionEvidence);
+                return {
+                    domain: {
+                        consistent,
+                        status: run?.status ?? null,
+                        pendingDelegation: run?.pendingDelegation ?? null,
+                        completionEvidence: completion,
+                        snapshot,
+                        lastReviewedCommit: metadata.last_reviewed_commit
+                    }
+                };
+            }
+            return { domain: orchestrationDomainEvidence(operation, terminalResult, output, run) };
+        }
+        catch {
+            return { domain: { consistent: false } };
+        }
+    }
+    if (operation.family === 'task-create') {
+        return { domain: taskCreateDomainEvidence(manifest, output) };
+    }
+    if (operation.family === 'codex-controller') {
+        return { domain: controllerDomainEvidence(manifest, manifestPath, request, output) };
+    }
+    if (operation.family === 'task-workflow') {
+        return {
+            domain: { consistent: output?.status === terminalResult.status && output.changed === terminalResult.changed, snapshotValid: true }
+        };
+    }
+    return { domain: null };
+}
+function readCommittedCriticalPhases(manifest, requestId) {
+    return SANDBOX_CONTROL_REQUIRED_COMPLETION_PHASES.filter((phase) => {
+        try {
+            readSandboxControlTransition(manifest, requestId, phase);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    });
+}
+function recoveryResponse(manifest, manifestPath, request, evidence, payload, terminalResult) {
+    const operationName = recoveryOperationKey(request, terminalResult, payload?.stdout);
+    const operation = operationName ? findSandboxControlRecoveryOperation(request.family, operationName) : null;
+    if (!operation)
+        return null;
+    if (payload) {
+        const payloadTerminal = createSandboxControlTerminalResult(manifest, {
+            id: request.id, family: request.family, operation: operationName
+        }, payload.stdout);
+        if (JSON.stringify(payloadTerminal) !== JSON.stringify(terminalResult))
+            return unknown(request.id);
+    }
+    const finalization = request.family === 'task-finalization' ? finalizationRecoveryResponse(manifest, request.id, 0) : null;
+    if (evidence.exitCode === 0 && finalization?.status === 'deferred')
+        return null;
+    if (evidence.exitCode === 0 && request.family === 'task-workflow' && request.authority?.phase === 'task-event.completed') {
+        try {
+            const registration = readCodexControllerRegistration(manifestPath);
+            const recovered = recoverLifecycleRecoveryOperation(request.authority, {
+                repoRoot: manifest.repoRoot,
+                capabilityStore: createCodexCapabilityStore(),
+                buildIdentity: computeLifecycleBuildIdentity(manifest.repoRoot),
+                controllerBinding: {
+                    instanceDigest: registration.controllerInstanceDigest,
+                    controlGeneration: registration.controlGeneration
+                }
+            });
+            if (recovered.status !== 'committed')
+                return null;
+        }
+        catch (error) {
+            appendBrokerAudit(manifest, 'lifecycle-authority-recovery-failed', {
+                ...requestAuditFields(manifest, request),
+                errorCode: error instanceof Error ? error.name : 'LIFECYCLE_AUTHORITY_RECOVERY_FAILED'
+            });
+            return null;
+        }
+    }
+    const recovery = finalization
+        ? { domain: { consistent: finalization.status === 'matched' } }
+        : readRecoveryDomain(manifest, manifestPath, request, operation, terminalResult, payload?.stdout ?? null);
+    const binding = operationRecoveryBinding(request.id, manifest.generation, manifest.taskId, request.family, operationName);
+    const decision = classifySandboxControlRecovery({
+        operation,
+        binding,
+        startedCommitted: true,
+        terminalResult,
+        criticalPhases: readCommittedCriticalPhases(manifest, request.id),
+        domain: recovery.domain,
+        journal: recovery.journal
+    });
+    if (decision.outcome === 'unknown' || decision.outcome === 'in-progress')
+        return unknown(request.id);
+    if (decision.outcome === 'not-executed')
+        return notExecuted(request.id);
+    if (decision.outcome !== 'success' && decision.outcome !== 'failure')
+        return null;
     if (request.family === 'task-finalization' && evidence.exitCode === 0) {
-        const finalization = finalizationRecoveryResponse(manifest, request.id, evidence.exitCode);
-        return finalization.status === 'matched' ? finalization.response ?? null : null;
+        if (finalization?.status !== 'matched')
+            return null;
+        return finalization.response ?? null;
     }
     return genericRecoveryResponse(request, evidence.exitCode, payload);
 }
-function terminalMatchesEvidence(manifest, request, response, evidence, payload, payloadInvalid) {
+function terminalMatchesEvidence(manifest, manifestPath, request, response, evidence, payload, payloadInvalid, terminalResult) {
     if (request.family === 'task-finalization' && evidence.exitCode === 0) {
-        const expected = recoveryResponse(manifest, request, evidence, payload);
+        if (!terminalResult)
+            return { valid: false, payloadReferenced: false };
+        const expected = recoveryResponse(manifest, manifestPath, request, evidence, payload, terminalResult);
         return {
             valid: expected !== null && JSON.stringify(response) === JSON.stringify(expected),
             payloadReferenced: false
@@ -286,6 +550,16 @@ function terminalMatchesEvidence(manifest, request, response, evidence, payload,
 }
 function publishExecutionResult(manifest, request, result, broker, brokerOwns) {
     const normalized = sanitizeSandboxControlResult(manifest, result);
+    writeSandboxControlTerminalResult(manifest, {
+        id: request.id,
+        family: request.family,
+        operation: operationKey(request, normalized.stdout)
+    }, normalized.stdout);
+    if (fs.existsSync(path.join(manifest.processingDir, request.id, 'transitions'))) {
+        criticalRequestPhase(manifest, request, 'completed', normalized.exitCode === 0 ? 'success' : 'failure');
+        criticalRequestPhase(manifest, request, 'evidence-written', normalized.exitCode === 0 ? 'success' : 'failure');
+        criticalRequestPhase(manifest, request, 'publish-authorized', normalized.exitCode === 0 ? 'success' : 'failure');
+    }
     let terminal = null;
     if (request.family === 'task-finalization') {
         const finalization = finalizationRecoveryResponse(manifest, request.id, normalized.exitCode);
@@ -326,7 +600,11 @@ function publishExecutionResult(manifest, request, result, broker, brokerOwns) {
         if (view.state === 'unknown')
             return false;
     }
-    return writeSandboxControlResponse(manifest, terminal);
+    const committed = writeSandboxControlResponse(manifest, terminal);
+    if (committed && fs.existsSync(path.join(manifest.processingDir, request.id, 'transitions'))) {
+        criticalRequestPhase(manifest, request, 'published-committed', normalized.exitCode === 0 ? 'success' : 'failure');
+    }
+    return committed;
 }
 function writeAcceptedResponse(manifest, response) {
     atomicWriteJsonNoReplace(acceptedResponsePath(manifest, response.id), response);
@@ -386,7 +664,20 @@ function bindingReason(manifest) {
         return 'SANDBOX_WORKTREE_BINDING_LOST';
     }
 }
-function recoverProcessing(manifest, broker, brokerOwns) {
+function assertCurrentSandboxControlIdentity(manifest, manifestPath) {
+    const result = validateSandboxControlIdentity({
+        publicStatusDir: manifest.publicStatusDir,
+        root: path.dirname(path.resolve(manifestPath)),
+        mode: manifest.mode,
+        taskId: manifest.taskId,
+        generation: manifest.generation,
+        controlRootId: manifest.controlRootId
+    });
+    if (result.state !== 'valid') {
+        throw new Error(`SANDBOX_CONTROL_IDENTITY_${result.state.replaceAll('-', '_').toUpperCase()}`);
+    }
+}
+function recoverProcessing(manifest, manifestPath, broker, brokerOwns) {
     for (const entry of fs.readdirSync(manifest.processingDir, { withFileTypes: true })) {
         if (!entry.isDirectory() || !/^[a-f0-9-]{16,64}$/.test(entry.name))
             continue;
@@ -395,14 +686,19 @@ function recoverProcessing(manifest, broker, brokerOwns) {
         const descriptor = executionPath(manifest, entry.name);
         const existingResponse = responsePath(manifest, entry.name);
         const processingDirectory = path.join(manifest.processingDir, entry.name);
+        const transitionsDirectory = path.join(processingDirectory, 'transitions');
+        const transitionProtocolActive = fs.existsSync(transitionsDirectory);
+        const startedCommitted = fs.existsSync(path.join(transitionsDirectory, 'started-committed.json'));
         let payloadReferenced = false;
         if (fs.existsSync(descriptor)) {
             const execution = readExecution(descriptor);
             let resultEvidence = null;
+            let terminalResult = null;
             let payload = null;
             let payloadInvalid = false;
             let request = null;
             let existingTerminalResponse = null;
+            let terminalReconciled = false;
             try {
                 const rawRequest = JSON.parse(fs.readFileSync(path.join(processingDirectory, 'request.json'), 'utf8'));
                 request = validateSandboxControlRequest(rawRequest, manifest, {
@@ -424,6 +720,19 @@ function recoverProcessing(manifest, broker, brokerOwns) {
                     resultEvidence = null;
                 }
             }
+            const terminalResultPathValue = path.join(processingDirectory, 'terminal-result.json');
+            if (fs.existsSync(terminalResultPathValue)) {
+                try {
+                    terminalResult = readSandboxControlTerminalResult(terminalResultPathValue);
+                    if (terminalResult.requestId !== entry.name || terminalResult.generation !== manifest.generation
+                        || !request || !terminalResultMatchesRequest(request, terminalResult)) {
+                        terminalResult = null;
+                    }
+                }
+                catch {
+                    terminalResult = null;
+                }
+            }
             const publishedPayloadPath = payloadPath(manifest, entry.name);
             if (fs.existsSync(publishedPayloadPath)) {
                 try {
@@ -437,12 +746,24 @@ function recoverProcessing(manifest, broker, brokerOwns) {
                     payloadInvalid = true;
                 }
             }
+            if (transitionProtocolActive && startedCommitted && !terminalResult) {
+                if (!brokerOwns())
+                    return false;
+                if (!terminateSandboxControlExecution(execution)) {
+                    throw new Error(`SANDBOX_CONTROL_EXECUTION_STILL_RUNNING: ${entry.name}`);
+                }
+                appendDiagnosticAudit(manifest, 'orphan-tree-terminated', { requestId: entry.name });
+                writeSandboxControlResponse(manifest, unknown(entry.name));
+                continue;
+            }
+            if (transitionProtocolActive && !startedCommitted && terminalResult)
+                continue;
             if (!terminateSandboxControlExecution(execution)) {
                 throw new Error(`SANDBOX_CONTROL_EXECUTION_STILL_RUNNING: ${entry.name}`);
             }
             if (!brokerOwns())
                 return false;
-            appendSandboxControlAudit(manifest, 'orphan-tree-terminated', { requestId: entry.name });
+            appendDiagnosticAudit(manifest, 'orphan-tree-terminated', { requestId: entry.name });
             let terminal = false;
             if (fs.existsSync(existingResponse)) {
                 try {
@@ -476,9 +797,12 @@ function recoverProcessing(manifest, broker, brokerOwns) {
             if (terminal && (!request || !resultEvidence))
                 continue;
             if (terminal && request && resultEvidence) {
-                const reconciliation = terminalMatchesEvidence(manifest, request, existingTerminalResponse, resultEvidence, payload, payloadInvalid);
+                if (!terminalResult && request.family !== 'task-create')
+                    continue;
+                const reconciliation = terminalMatchesEvidence(manifest, manifestPath, request, existingTerminalResponse, resultEvidence, payload, payloadInvalid, terminalResult);
                 if (!reconciliation.valid)
                     continue;
+                terminalReconciled = true;
                 payloadReferenced = reconciliation.payloadReferenced;
                 if (request.family === 'task-finalization' && resultEvidence.exitCode === 0) {
                     const view = publishFinalizationTaskView(manifest, broker, request.id, 'starting', null, null);
@@ -486,12 +810,29 @@ function recoverProcessing(manifest, broker, brokerOwns) {
                         continue;
                 }
             }
+            if (!terminalResult && !terminalReconciled) {
+                if (terminal)
+                    continue;
+                if (!brokerOwns())
+                    return false;
+                if (!resultEvidence || !request || payloadInvalid)
+                    continue;
+                if (request.family === 'task-create' && resultEvidence.exitCode === 0 && payload === null) {
+                    writeSandboxControlResponse(manifest, genericRecoveryResponse(request, resultEvidence.exitCode, null));
+                    terminalReconciled = true;
+                    terminal = true;
+                }
+                else {
+                    writeSandboxControlResponse(manifest, unknown(entry.name));
+                    continue;
+                }
+            }
             if (!terminal) {
                 if (!brokerOwns())
                     return false;
                 if (!resultEvidence || !request || payloadInvalid)
                     continue;
-                const recovered = recoveryResponse(manifest, request, resultEvidence, payload);
+                const recovered = recoveryResponse(manifest, manifestPath, request, resultEvidence, payload, terminalResult);
                 if (!recovered)
                     continue;
                 if (request.family === 'task-finalization' && resultEvidence.exitCode === 0) {
@@ -500,12 +841,22 @@ function recoverProcessing(manifest, broker, brokerOwns) {
                         continue;
                 }
                 writeSandboxControlResponse(manifest, recovered);
+                const preserveRecoveryEvidence = recovered.error?.code === 'SANDBOX_CONTROL_RESULT_UNKNOWN';
+                if (transitionProtocolActive && !preserveRecoveryEvidence) {
+                    writeSandboxControlTransition(manifest, { requestId: entry.name, phase: 'recovered' });
+                }
+                if (preserveRecoveryEvidence)
+                    continue;
                 payloadReferenced = Boolean(payload) && request.family !== 'task-finalization';
             }
         }
         else {
             if (!brokerOwns())
                 return false;
+            if (transitionProtocolActive && startedCommitted) {
+                writeSandboxControlResponse(manifest, unknown(entry.name));
+                continue;
+            }
             writeSandboxControlResponse(manifest, notExecuted(entry.name));
         }
         if (!brokerOwns())
@@ -536,6 +887,7 @@ export async function serveSandboxControl(manifestPath, signal = new AbortContro
     const prepareExecution = options.prepareExecution ?? prepareSandboxControlExecution;
     const manifest = readSandboxControlManifest(manifestPath);
     const root = path.dirname(manifestPath);
+    assertCurrentSandboxControlIdentity(manifest, manifestPath);
     const startTime = getProcessStartTime(process.pid);
     if (!startTime)
         throw new Error('SANDBOX_CONTROL_BROKER_IDENTITY_UNAVAILABLE');
@@ -634,22 +986,9 @@ export async function serveSandboxControl(manifestPath, signal = new AbortContro
             return;
         appendBrokerAudit(manifest, 'broker-start', {
             pid: broker.pid,
-            brokerId: broker.brokerId,
-            hostCwd: process.cwd(),
-            manifestPath,
-            manifestPathRealpath: safeRealpath(manifestPath),
-            repoRoot: manifest.repoRoot,
-            repoRootRealpath: safeRealpath(manifest.repoRoot),
-            worktreeRoot: manifest.worktreeRoot,
-            worktreeRootRealpath: safeRealpath(manifest.worktreeRoot),
-            runtimeDir: manifest.runtimeDir,
-            runtimeDirRealpath: safeRealpath(manifest.runtimeDir),
-            channelDir: manifest.channelDir,
-            publicStatusDir: manifest.publicStatusDir,
-            processingDir: manifest.processingDir,
-            internalCliPath: options.internalCliPath ?? process.argv[1] ?? null
+            brokerId: broker.brokerId
         });
-        if (!recoverProcessing(manifest, broker, brokerOwns))
+        if (!recoverProcessing(manifest, manifestPath, broker, brokerOwns))
             return;
         try {
             const published = readSandboxControlStatus(manifest.publicStatusDir);
@@ -666,6 +1005,7 @@ export async function serveSandboxControl(manifestPath, signal = new AbortContro
             let current;
             try {
                 current = readSandboxControlManifest(manifestPath);
+                assertCurrentSandboxControlIdentity(current, manifestPath);
             }
             catch {
                 break;
@@ -702,7 +1042,7 @@ export async function serveSandboxControl(manifestPath, signal = new AbortContro
                 }
                 else if (observation.state === 'unknown') {
                     containerReasonCode = 'SANDBOX_CONTROL_CONTAINER_UNKNOWN';
-                    appendSandboxControlAudit(manifest, 'container-heartbeat-unknown', { reason: observation.reason });
+                    appendDiagnosticAudit(manifest, 'container-heartbeat-unknown', { reason: observation.reason });
                     const backoff = nextSandboxControlBackoff(containerBackoffMs, timing.slowCheckMs);
                     nextContainerHeartbeatAt = Date.now() + backoff.delayMs;
                     containerBackoffMs = backoff.nextDelayMs;
@@ -721,7 +1061,7 @@ export async function serveSandboxControl(manifestPath, signal = new AbortContro
                         if (!brokerOwns())
                             break;
                         containerReasonCode = 'SANDBOX_CONTROL_CONTAINER_ABSENT_GC_FAILED';
-                        appendSandboxControlAudit(manifest, 'container-gc-failed', { reason: controlError(error).code });
+                        appendDiagnosticAudit(manifest, 'container-gc-failed', { reason: controlError(error).code });
                         const backoff = nextSandboxControlBackoff(containerBackoffMs, timing.slowCheckMs);
                         nextContainerHeartbeatAt = Date.now() + backoff.delayMs;
                         containerBackoffMs = backoff.nextDelayMs;
@@ -790,6 +1130,10 @@ export async function serveSandboxControl(manifestPath, signal = new AbortContro
                     break;
                 let terminalCommitted = false;
                 if (settledExecution.result && settledExecution.resultEvidenceWritten) {
+                    if (!consumeLifecycleAuthorityForResult(manifest, settledExecution)) {
+                        active = settledExecution;
+                        continue;
+                    }
                     terminalCommitted = publishExecutionResult(manifest, settledExecution.request, settledExecution.result, broker, brokerOwns);
                     if (terminalCommitted && settledExecution.request.family === 'task-finalization') {
                         try {
@@ -808,7 +1152,7 @@ export async function serveSandboxControl(manifestPath, signal = new AbortContro
                 if (!terminalCommitted)
                     return;
                 appendBrokerAudit(manifest, 'executor-result-published', {
-                    ...requestAuditFields(manifest, manifestPath, settledExecution.request),
+                    ...requestAuditFields(manifest, settledExecution.request),
                     resultAvailable: settledExecution.result !== null,
                     resultEvidenceWritten: settledExecution.resultEvidenceWritten,
                     ...(settledExecution.result ? resultAuditFields(settledExecution.result) : {})
@@ -826,6 +1170,7 @@ export async function serveSandboxControl(manifestPath, signal = new AbortContro
                 const source = path.join(requestsDir, name);
                 let claimed = null;
                 let validatedRequest = null;
+                let prepared = null;
                 try {
                     if (!brokerOwns()) {
                         retiring = true;
@@ -853,63 +1198,76 @@ export async function serveSandboxControl(manifestPath, signal = new AbortContro
                         throw new Error('SANDBOX_CONTROL_BUSY');
                     const request = validateSandboxControlRequest(JSON.parse(fs.readFileSync(claimed, 'utf8')), manifest);
                     validatedRequest = request;
+                    criticalRequestPhase(manifest, request, 'validated', 'in-progress');
                     appendBrokerAudit(manifest, 'request-validated', {
-                        ...requestAuditFields(manifest, manifestPath, request),
+                        ...requestAuditFields(manifest, request),
                         requestPath: claimed
                     });
                     if (bindingCheck(manifest))
                         throw new Error('SANDBOX_WORKTREE_BINDING_LOST');
                     if (readActiveLease(manifest))
                         throw new Error('SANDBOX_CONTROL_HANDOFF_ACTIVE');
+                    criticalRequestPhase(manifest, request, 'gated', 'in-progress');
                     appendBrokerAudit(manifest, 'request-gates-passed', {
-                        ...requestAuditFields(manifest, manifestPath, request),
+                        ...requestAuditFields(manifest, request),
                         requestPath: claimed,
                         bindingChecked: true,
                         handoffLeaseChecked: true
                     });
+                    criticalRequestPhase(manifest, request, 'reserved', 'in-progress');
                     writeSandboxControlReservation(manifest, request.id, sandboxControlGenerationUsage(manifest));
                     appendBrokerAudit(manifest, 'executor-reservation-written', {
-                        ...requestAuditFields(manifest, manifestPath, request),
+                        ...requestAuditFields(manifest, request),
                         requestPath: claimed,
                         executionPath: executionPath(manifest, request.id)
                     });
                     appendBrokerAudit(manifest, 'executor-prepare-start', {
-                        ...requestAuditFields(manifest, manifestPath, request),
+                        ...requestAuditFields(manifest, request),
                         requestPath: claimed,
                         executorCwd: manifest.repoRoot,
                         executorEntry: options.internalCliPath ?? process.argv[1] ?? null
                     });
-                    const prepared = await prepareExecution({
+                    const lifecycleAuthority = lifecycleAuthorityForRequest(manifest, manifestPath, request);
+                    if (lifecycleAuthority?.status === 'rejected') {
+                        throw Object.assign(new Error(lifecycleAuthority.error?.message ?? 'lifecycle authority was rejected'), { code: lifecycleAuthority.error?.code ?? 'LIFECYCLE_AUTHORITY_REJECTED' });
+                    }
+                    prepared = await prepareExecution({
                         manifest, manifestPath, request, requestPath: claimed,
-                        internalCliPath: options.internalCliPath ?? process.argv[1]
+                        internalCliPath: options.internalCliPath ?? process.argv[1],
+                        ...(lifecycleAuthority ? { lifecycleAuthority } : {})
                     });
+                    const preparedExecution = prepared;
+                    if (!preparedExecution)
+                        throw new Error('SANDBOX_CONTROL_EXECUTION_PREPARE_INVALID');
+                    criticalRequestPhase(manifest, request, 'prepared', 'in-progress', `${preparedExecution.execution.child.pid}`);
                     appendBrokerAudit(manifest, 'executor-prepared', {
-                        ...requestAuditFields(manifest, manifestPath, request),
+                        ...requestAuditFields(manifest, request),
                         requestPath: claimed,
                         executorCwd: manifest.repoRoot,
-                        childPid: prepared.execution.child.pid,
-                        childStartTime: prepared.execution.child.startTime,
-                        childProcessGroupId: prepared.execution.child.processGroupId,
+                        childPid: preparedExecution.execution.child.pid,
+                        childStartTime: preparedExecution.execution.child.startTime,
+                        childProcessGroupId: preparedExecution.execution.child.processGroupId,
                         executionPath: executionPath(manifest, request.id)
                     });
                     const execution = {
-                        request, prepared, result: null, resultEvidenceWritten: false, failure: null, settled: false
+                        request, prepared: preparedExecution, lifecycleAuthority, result: null,
+                        resultEvidenceWritten: false, failure: null, settled: false
                     };
                     active = execution;
-                    prepared.completion.then((result) => {
+                    preparedExecution.completion.then((result) => {
                         execution.result = sanitizeSandboxControlResult(manifest, result);
                         appendBrokerAudit(manifest, 'executor-completed', {
-                            ...requestAuditFields(manifest, manifestPath, request),
+                            ...requestAuditFields(manifest, request),
                             ...resultAuditFields(execution.result),
-                            childPid: prepared.execution.child.pid,
-                            childStartTime: prepared.execution.child.startTime
+                            childPid: preparedExecution.execution.child.pid,
+                            childStartTime: preparedExecution.execution.child.startTime
                         });
                         try {
                             writeSandboxControlResultEvidence(manifest, request.id, execution.result);
                             execution.resultEvidenceWritten = true;
                             execution.settled = true;
                             appendBrokerAudit(manifest, 'executor-result-evidence-written', {
-                                ...requestAuditFields(manifest, manifestPath, request),
+                                ...requestAuditFields(manifest, request),
                                 resultPath: path.join(manifest.processingDir, request.id, 'result.json'),
                                 ...resultAuditFields(execution.result)
                             });
@@ -917,7 +1275,7 @@ export async function serveSandboxControl(manifestPath, signal = new AbortContro
                         catch (error) {
                             execution.failure = error;
                             appendBrokerAudit(manifest, 'executor-result-evidence-failed', {
-                                ...requestAuditFields(manifest, manifestPath, request),
+                                ...requestAuditFields(manifest, request),
                                 errorType: error instanceof Error ? error.name : typeof error,
                             });
                         }
@@ -925,9 +1283,9 @@ export async function serveSandboxControl(manifestPath, signal = new AbortContro
                         execution.failure = error;
                         execution.settled = true;
                         appendBrokerAudit(manifest, 'executor-failed', {
-                            ...requestAuditFields(manifest, manifestPath, request),
-                            childPid: prepared.execution.child.pid,
-                            childStartTime: prepared.execution.child.startTime,
+                            ...requestAuditFields(manifest, request),
+                            childPid: preparedExecution.execution.child.pid,
+                            childStartTime: preparedExecution.execution.child.startTime,
                             errorType: error instanceof Error ? error.name : typeof error,
                         });
                     });
@@ -943,11 +1301,13 @@ export async function serveSandboxControl(manifestPath, signal = new AbortContro
                         retiring = true;
                         continue;
                     }
+                    criticalRequestPhase(manifest, request, 'accepted-authorized', 'in-progress');
                     writeAcceptedResponse(manifest, {
                         version: 2, id, phase: 'accepted', exitCode: null, stdout: '', stderr: '', error: null
                     });
+                    writeSandboxControlTransition(manifest, { requestId: request.id, phase: 'accepted-committed' });
                     appendBrokerAudit(manifest, 'request-accepted', {
-                        ...requestAuditFields(manifest, manifestPath, request),
+                        ...requestAuditFields(manifest, request),
                         acceptedPath: acceptedResponsePath(manifest, id),
                         executionPhase: 'prepared'
                     });
@@ -958,8 +1318,9 @@ export async function serveSandboxControl(manifestPath, signal = new AbortContro
                         break;
                     }
                     try {
+                        criticalRequestPhase(manifest, request, 'start-authorized', 'in-progress', `${prepared.execution.child.pid}`);
                         appendBrokerAudit(manifest, 'executor-start', {
-                            ...requestAuditFields(manifest, manifestPath, request),
+                            ...requestAuditFields(manifest, request),
                             childPid: prepared.execution.child.pid,
                             childStartTime: prepared.execution.child.startTime,
                             executionPath: executionPath(manifest, request.id)
@@ -968,7 +1329,7 @@ export async function serveSandboxControl(manifestPath, signal = new AbortContro
                     }
                     catch (error) {
                         appendBrokerAudit(manifest, 'executor-start-failed', {
-                            ...requestAuditFields(manifest, manifestPath, request),
+                            ...requestAuditFields(manifest, request),
                             errorType: error instanceof Error ? error.name : typeof error,
                         });
                         const owned = brokerOwns();
@@ -997,6 +1358,14 @@ export async function serveSandboxControl(manifestPath, signal = new AbortContro
                     }
                 }
                 catch (error) {
+                    if (prepared) {
+                        try {
+                            prepared.terminate(brokerOwns());
+                        }
+                        catch { /* cleanup is best effort after a failed admission */ }
+                        prepared = null;
+                        active = null;
+                    }
                     if (!brokerOwns()) {
                         retiring = true;
                         break;
@@ -1016,6 +1385,7 @@ export async function serveSandboxControl(manifestPath, signal = new AbortContro
                         retiring = true;
                         break;
                     }
+                    removeAcceptedResponse(manifest, id);
                     if (claimed)
                         fs.rmSync(path.dirname(claimed), { recursive: true, force: true });
                 }
@@ -1041,7 +1411,8 @@ export async function serveSandboxControl(manifestPath, signal = new AbortContro
                 }
             }
             if (owned && active.result && active.resultEvidenceWritten) {
-                if (publishExecutionResult(manifest, active.request, active.result, broker, brokerOwns)) {
+                if (consumeLifecycleAuthorityForResult(manifest, active)
+                    && publishExecutionResult(manifest, active.request, active.result, broker, brokerOwns)) {
                     if (brokerOwns()) {
                         removeAcceptedResponse(manifest, active.request.id);
                         fs.rmSync(path.join(manifest.processingDir, active.request.id), { recursive: true, force: true });
@@ -1071,7 +1442,7 @@ export async function serveSandboxControl(manifestPath, signal = new AbortContro
             }
         }
         if (brokerOwns()) {
-            appendSandboxControlAudit(manifest, 'broker-stop', { pid: broker.pid, brokerId: broker.brokerId });
+            appendDiagnosticAudit(manifest, 'broker-stop', { pid: broker.pid, brokerId: broker.brokerId });
             try {
                 if (fs.readFileSync(brokerPath, 'utf8') === brokerRecord)
                     fs.unlinkSync(brokerPath);