@fungi.computer/shed 0.1.0 → 0.2.0

package/backend/test/runs.node.test.ts

@@ -1,5 +1,5 @@
 import { spawn } from "node:child_process";
-import { readFile, writeFile, rm, mkdtemp } from "node:fs/promises";
+import { readFile, rm, mkdtemp } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { randomUUID } from "node:crypto";
@@ -9,10 +9,11 @@ import * as z from "zod";
 import { it, type TestContext } from "node:test";
 import { DatabaseSync } from "node:sqlite";
 import {
+  maximumProcessRecords,
   mintComputerProcessId,
   type ComputerProcess,
-} from "@fungi.computer/computer/operations";
-import { appBackend } from "../methods.js";
+} from "@fungi.computer/computer-contract";
+import { appBackend, type ShedMethodContext } from "../methods.js";
 import {
   createShedRuns,
   type ShedRunInput,
@@ -26,6 +27,24 @@ import { appBackend as shedBackend } from "../methods.js";
 import shedMetadata from "../../package.json" with { type: "json" };
 const appApi = buildAppApi(shedBackend);
 const appDeclaration = buildAppDeclaration(shedBackend, shedMetadata.fungi.app);
+
+function hostComputer(
+  overrides: Partial<ShedMethodContext["env"]["COMPUTER"]>,
+) {
+  const unexpected = () =>
+    Promise.reject(new Error("Unexpected host binding call"));
+  return {
+    ports: unexpected,
+    processes: unexpected,
+    exec: unexpected,
+    processStart: unexpected,
+    processKill: unexpected,
+    read: unexpected,
+    preview: unexpected,
+    ...overrides,
+  };
+}
+
 /** A `run` App method reply that completed with a definite exit code. */
 const completedRun = z.object({ exitCode: z.number(), logPath: z.string() });
 
@@ -52,7 +71,7 @@ void it("reuses one process across repeated and restored calls, then returns its
     startedAt: 1,
     endedAt: null,
   };
-  const computer = {
+  const computer = hostComputer({
     processStart: (input: { command: string; cwd?: string }) => {
       starts++;
       assert.match(input.command, /tee/);
@@ -61,7 +80,7 @@ void it("reuses one process across repeated and restored calls, then returns its
       return Promise.resolve(process);
     },
     processes: () => Promise.resolve({ processes: [process] }),
-  };
+  });
   const caller = {
     actor: { kind: "member", memberId: "member-one" },
     computerId: "computer-one",
@@ -118,7 +137,7 @@ void it("tails only the recorded run log on its pinned Computer within the byte
   const context = {
     runs,
     env: {
-      COMPUTER: {
+      COMPUTER: hostComputer({
         processStart: () => Promise.resolve(process),
         processes: () => Promise.resolve({ processes: [process] }),
         read: (input: {
@@ -135,7 +154,7 @@ void it("tails only the recorded run log on its pinned Computer within the byte
             truncated: true,
           });
         },
-      },
+      }),
     },
   };
   const caller = {
@@ -211,7 +230,7 @@ void it("returns only an admitted preview and refuses an unexposed port", async
       },
     }),
     env: {
-      COMPUTER: {
+      COMPUTER: hostComputer({
         processStart: () =>
           Promise.reject(new Error("unexpected process start")),
         processes: () => Promise.reject(new Error("unexpected process read")),
@@ -226,7 +245,7 @@ void it("returns only an admitted preview and refuses an unexposed port", async
             });
           return Promise.resolve({ error: "not_granted" });
         },
-      },
+      }),
     },
   };
   const caller = {
@@ -265,7 +284,7 @@ void it("tees both real shell streams, returns a nonzero exit as a normal result
   const root = await mkdtemp(join(tmpdir(), "shed-shell-"));
   t.after(() => rm(root, { recursive: true, force: true }));
   let starts = 0;
-  const computer = {
+  const computer = hostComputer({
     processStart: (input: { command: string; cwd?: string }) =>
       new Promise<ComputerProcess>((resolve, reject) => {
         starts++;
@@ -295,7 +314,7 @@ void it("tees both real shell streams, returns a nonzero exit as a normal result
       }),
     processes: () =>
       Promise.reject(new Error("completed exit must be remembered")),
-  };
+  });
   const caller = {
     actor: { kind: "member", memberId: "member-one" },
     computerId: "computer-one",
@@ -333,7 +352,7 @@ void it("tees both real shell streams, returns a nonzero exit as a normal result
 
 void it("rejects a command whose quoted wrapper exceeds the native bound before claiming a run", async (t) => {
   const { processStartInputSchema } =
-    await import("@fungi.computer/computer/operations");
+    await import("@fungi.computer/computer-contract");
   const database = new DatabaseSync(":memory:");
   t.after(() => {
     database.close();
@@ -347,7 +366,7 @@ void it("rejects a command whose quoted wrapper exceeds the native bound before
       },
     }),
     env: {
-      COMPUTER: {
+      COMPUTER: hostComputer({
         processStart: (input: { command: string; cwd?: string }) => {
           starts++;
           processStartInputSchema
@@ -357,7 +376,7 @@ void it("rejects a command whose quoted wrapper exceeds the native bound before
         },
         processes: () => Promise.reject(new Error("unexpected process read")),
         read: () => Promise.reject(new Error("unexpected log read")),
-      },
+      }),
     },
   };
   const caller = {
@@ -392,14 +411,14 @@ void it("requires the host key and Computer, and refuses to restart after a lost
     },
   };
   let starts = 0;
-  const computer = {
+  const computer = hostComputer({
     processStart: () => {
       starts++;
       return Promise.reject(new Error("Start reply lost"));
     },
     processes: () =>
       Promise.reject(new Error("unidentified process must not be guessed")),
-  };
+  });
   const caller = {
     actor: { kind: "member", memberId: "member-one" },
     computerId: "computer-one",
@@ -450,7 +469,7 @@ void it("publishes run as Pending-capable with its required Computer authority",
   assert.ok(expose);
   assert.equal(run.pending, true);
   assert.equal(run.effect, "write");
-  assert.deepEqual(run.requires, ["computer.execute", "computer.writeFile"]);
+  assert.deepEqual(run.requires, ["computer.execute"]);
   assert.deepEqual(logs.requires, ["computer.readFile"]);
   assert.equal(logs.effect, "read");
   assert.equal(expose.effect, "write");
@@ -465,16 +484,14 @@ void it("publishes run as Pending-capable with its required Computer authority",
         "exec",
         "processStart",
         "processKill",
-        "write",
         "read",
         "preview",
-        "workflowGitPass",
       ],
     },
   ]);
 });
 
-void it("renews one Workflow selector while retaining the original process across polls and reopen", async (t) => {
+void it("retains the original process across polls and reopen without any credential traffic", async (t) => {
   const database = new DatabaseSync(":memory:");
   t.after(() => {
     database.close();
@@ -485,9 +502,6 @@ void it("renews one Workflow selector while retaining the original process acros
       return { toArray: () => rows };
     },
   };
-  let clock = 1000;
-  const remote =
-    "https://git.team.internal/workflow/pass_workflow/app_source.git";
   const gitAccess = {
     repository: {
       kind: "installation" as const,
@@ -498,7 +512,6 @@ void it("renews one Workflow selector while retaining the original process acros
   };
   const calls: string[] = [];
   let starts = 0;
-  let renewals = 0;
   const process: ComputerProcess = {
     id: mintComputerProcessId(),
     port: null,
@@ -510,27 +523,14 @@ void it("renews one Workflow selector while retaining the original process acros
     startedAt: 1000,
     endedAt: null,
   };
-  const computer = {
-    write: (input: { path: string; content: string }) =>
-      Promise.resolve({
-        path: input.path,
-        bytes: new TextEncoder().encode(input.content).byteLength,
-      }),
-    workflowGitPass: () => {
-      renewals++;
-      return Promise.resolve({
-        passId: "pass_workflow",
-        remote,
-        expiresAt: clock + 60000,
-      });
-    },
+  const computer = hostComputer({
     processStart: (input: { command: string; cwd?: string }) => {
       starts++;
       calls.push(input.command);
       return Promise.resolve(process);
     },
     processes: () => Promise.resolve({ processes: [process] }),
-  };
+  });
   const caller = {
     actor: { kind: "member" as const, memberId: "member_one" },
     computerId: "computer_one",
@@ -541,31 +541,18 @@ void it("renews one Workflow selector while retaining the original process acros
     cwd: "/workspace",
     gitAccess,
   };
-  await appBackend.call(
-    "run",
-    input,
-    { runs: createShedRuns(sql, () => clock), env: { COMPUTER: computer } },
-    caller,
-  );
-  clock = 6000;
-  await appBackend.call(
-    "run",
-    input,
-    { runs: createShedRuns(sql, () => clock), env: { COMPUTER: computer } },
-    caller,
-  );
+  for (let poll = 0; poll < 3; poll++)
+    await appBackend.call(
+      "run",
+      input,
+      { runs: createShedRuns(sql), env: { COMPUTER: computer } },
+      caller,
+    );
+  // Replays neither redispatch nor call any credential binding: the Computer
+  // would reject an unexpected write or workflowGitPass.
   assert.equal(starts, 1);
-  assert.equal(renewals, 2);
   assert.ok(calls[0]?.includes("FUNGI_GIT_REMOTE"));
-  clock = 61001;
-  await appBackend.call(
-    "run",
-    input,
-    { runs: createShedRuns(sql, () => clock), env: { COMPUTER: computer } },
-    caller,
-  );
-  assert.equal(starts, 1);
-  assert.equal(renewals, 3);
+  assert.equal(calls[0]?.includes("wgp."), false);
 });
 
 function workflowRunFixture(t: TestContext) {
@@ -579,16 +566,7 @@ function workflowRunFixture(t: TestContext) {
       return { toArray: () => rows };
     },
   };
-  let clock = 1000;
   let starts = 0;
-  let mints = 0;
-  const remote =
-    "https://git.team.internal/workflow/pass_workflow/app_source.git";
-  let pass: z.core.util.JSONType = {
-    passId: "pass_workflow",
-    remote,
-    expiresAt: 61000,
-  };
   const process: ComputerProcess = {
     id: mintComputerProcessId(),
     port: null,
@@ -600,29 +578,27 @@ function workflowRunFixture(t: TestContext) {
     startedAt: 1000,
     endedAt: null,
   };
-  const delivered = new Map<string, string>();
+  // Shed has no credential bindings any more. These tripwires would record a
+  // regression that mints, writes or renews one.
+  const forbidden: string[] = [];
+  const tripwire = (operation: string) => () => {
+    forbidden.push(operation);
+    return Promise.reject(new Error(`Forbidden credential call: ${operation}`));
+  };
   const computer = {
-    write: (input: { path: string; content: string }) => {
-      delivered.set(input.path, input.content);
-      return Promise.resolve({
-        path: input.path,
-        bytes: new TextEncoder().encode(input.content).byteLength,
-      });
-    },
-    processStart: (input: { command: string; cwd?: string }) => {
-      assert.equal(input.command.includes(remote), false);
-      assert.ok([...delivered.values()].includes(`${remote}\n`));
-      starts++;
-      return Promise.resolve(process);
-    },
-    processes: () => Promise.resolve({ processes: [process] }),
-    workflowGitPass: () => {
-      mints++;
-      return Promise.resolve(pass);
-    },
+    ...hostComputer({
+      processStart: (input: { command: string; cwd?: string }) => {
+        assert.equal(input.command.includes("wgp."), false);
+        starts++;
+        return Promise.resolve(process);
+      },
+      processes: () => Promise.resolve({ processes: [process] }),
+    }),
+    write: tripwire("write"),
+    workflowGitPass: tripwire("workflowGitPass"),
   };
   const context = {
-    runs: createShedRuns(sql, () => clock),
+    runs: createShedRuns(sql),
     env: { COMPUTER: computer },
   };
   const caller = {
@@ -648,42 +624,29 @@ function workflowRunFixture(t: TestContext) {
     input,
     computer,
     process,
-    remote,
     starts: () => starts,
-    written: () => [...delivered.values()],
-    mints: () => mints,
-    setClock: (value: number) => {
-      clock = value;
-    },
-    setPass: (value: z.core.util.JSONType) => {
-      pass = value;
-    },
+    forbidden: () => forbidden,
   };
 }
 
-void it("refuses expired or changed selectors without replacing the original process", async (t) => {
+void it("does not request a credential file before a refused Workflow run start", async (t) => {
   const f = workflowRunFixture(t);
-  await appBackend.call("run", f.input, f.context, f.caller);
-  f.setClock(61000);
-  await assert.rejects(
-    appBackend.call("run", f.input, f.context, f.caller),
-    /Workflow Git pass expired/,
-  );
-  assert.equal(f.mints(), 1);
-  assert.equal(f.starts(), 1);
-  f.setClock(6000);
-  f.setPass({
-    passId: "pass_other",
-    remote: "https://git.team.internal/workflow/pass_other/app_source.git",
-    expiresAt: 66000,
+  let attempts = 0;
+  f.computer.processStart = () => {
+    attempts++;
+    return Promise.resolve({ error: "not_granted" });
+  };
+
+  assert.deepEqual(await appBackend.call("run", f.input, f.context, f.caller), {
+    error: "not_granted",
   });
-  await assert.rejects(
-    appBackend.call("run", f.input, f.context, f.caller),
-    /changed or expired/,
-  );
-  f.setPass({ error: "revoked" });
-  await assert.rejects(appBackend.call("run", f.input, f.context, f.caller));
-  assert.equal(f.starts(), 1);
+  assert.equal(attempts, 1);
+  assert.deepEqual(f.forbidden(), []);
+});
+
+void it("refuses a replay whose Git scope differs from the original without replacing the process", async (t) => {
+  const f = workflowRunFixture(t);
+  await appBackend.call("run", f.input, f.context, f.caller);
   await assert.rejects(
     appBackend.call(
       "run",
@@ -703,6 +666,8 @@ void it("refuses expired or changed selectors without replacing the original pro
     ),
     /Run identity conflicts/,
   );
+  assert.equal(f.starts(), 1);
+  assert.deepEqual(f.forbidden(), []);
 });
 
 // Regression coverage for the Storyboard Save defect: a Workflow step's
@@ -759,33 +724,20 @@ void it("still throws on a real dispatch failure, distinct from a non-zero exit"
   );
 });
 
-void it("claims no process when the Workflow binding is missing or refuses", async (t) => {
+void it("dispatches a Workflow run with only the command and calls no credential binding", async (t) => {
   const f = workflowRunFixture(t);
-  const { workflowGitPass: omitted, ...withoutPass } = f.computer;
-  assert.ok(omitted);
-  await assert.rejects(
-    appBackend.call(
-      "run",
-      f.input,
-      { ...f.context, env: { COMPUTER: withoutPass } },
-      f.caller,
-    ),
-    /binding is unavailable/,
-  );
-  f.setPass({ error: "not_granted" });
-  await assert.rejects(appBackend.call("run", f.input, f.context, f.caller));
-  assert.equal(f.starts(), 0);
-  f.setPass({ passId: "pass_workflow", remote: f.remote, expiresAt: 61000 });
-  await appBackend.call(
-    "run",
-    { ...f.input, command: "printf fixed" },
-    f.context,
-    f.caller,
-  );
-  assert.equal(f.starts(), 1);
+  const inputs: object[] = [];
+  f.computer.processStart = (input: { command: string; cwd?: string }) => {
+    inputs.push(input);
+    return Promise.resolve(f.process);
+  };
+  await appBackend.call("run", f.input, f.context, f.caller);
+  assert.equal(inputs.length, 1);
+  assert.deepEqual(Object.keys(inputs[0] ?? {}), ["command"]);
+  assert.deepEqual(f.forbidden(), []);
 });
 
-void it("uses the canonical resolved scope grammar before minting", async (t) => {
+void it("uses the canonical resolved scope grammar before any dispatch", async (t) => {
   const f = workflowRunFixture(t);
   for (const gitAccess of [
     { repository: "$trigger.repository", branches: ["refs/heads/main"] },
@@ -816,30 +768,26 @@ void it("uses the canonical resolved scope grammar before minting", async (t) =>
       ),
     );
   assert.equal(f.starts(), 0);
-  assert.equal(f.mints(), 0);
+  assert.deepEqual(f.forbidden(), []);
 });
 
-void it("passes the complete Workflow URL only through the command-local shell environment", async (t) => {
+const hostRemote = "https://git.team.internal/app_source.git";
+
+void it("lets the host's command-local environment reach the shell with no Shed credential file", async (t) => {
   const root = await mkdtemp(join(tmpdir(), "shed-workflow-remote-"));
   t.after(() => rm(root, { recursive: true, force: true }));
   const f = workflowRunFixture(t);
-  let credentialPath = "";
-  f.computer.write = (input: { path: string; content: string }) => {
-    credentialPath = input.path.replaceAll("/workspace", root);
-    return writeFile(
-      input.path.replaceAll("/workspace", root),
-      input.content,
-    ).then(() => ({
-      path: input.path,
-      bytes: new TextEncoder().encode(input.content).byteLength,
-    }));
-  };
   f.computer.processStart = (input: { command: string; cwd?: string }) =>
     new Promise((resolve, reject) => {
+      // The trusted host injects the environment after native admission.
       const child = spawn(
         "bash",
         ["-c", input.command.replaceAll("/workspace", root)],
-        { cwd: root, stdio: "ignore" },
+        {
+          cwd: root,
+          stdio: "ignore",
+          env: { PATH: process.env.PATH, FUNGI_GIT_REMOTE: hostRemote },
+        },
       );
       child.once("error", reject);
       child.once("exit", (code) => {
@@ -853,8 +801,7 @@ void it("passes the complete Workflow URL only through the command-local shell e
     });
   const input = {
     ...f.input,
-    command:
-      'test "$FUNGI_GIT_REMOTE" = "https://git.team.internal/workflow/pass_workflow/app_source.git" && ! test -e .fungi-git-58fc43972eaef9e869f7a384f4da68f65c6b660f84e3d7fa4332f89ac6ceb7e3.remote && printf remote-matched',
+    command: `test "$FUNGI_GIT_REMOTE" = "${hostRemote}" && ! ls .fungi-git-* >/dev/null 2>&1 && printf remote-matched`,
   };
   const result = await appBackend.call("run", input, f.context, f.caller);
   assert.deepEqual(result, {
@@ -872,37 +819,37 @@ void it("passes the complete Workflow URL only through the command-local shell e
     ),
     "remote-matched",
   );
-  await assert.rejects(readFile(credentialPath), { code: "ENOENT" });
+  assert.deepEqual(f.forbidden(), []);
 });
 
-void it("gives a bearer pass to git only as command-local extraHeader config", async (t) => {
+void it("keeps a host-injected bearer out of the dispatched command, log, repository config and claims", async (t) => {
   const root = await mkdtemp(join(tmpdir(), "shed-workflow-bearer-"));
   t.after(() => rm(root, { recursive: true, force: true }));
   const f = workflowRunFixture(t);
   const remote = "https://oyster.test/git/bonsai/pond.git";
-  const bearer = `wgp.workflows.${"b".repeat(64)}`;
-  f.setPass({ passId: "pass_workflow", remote, bearer, expiresAt: 61000 });
-  await writeFile(
-    join(root, "expected-header"),
-    `Authorization: Bearer ${bearer}`,
-  );
-  await writeFile(join(root, "expected-secret"), "b".repeat(64));
-  let credentialPath = "";
+  // The presenter's secret lives only in host memory and the child's
+  // host-supplied environment: never in a file, argument or output.
+  const secret = "b".repeat(64);
+  const bearer = `wgp.workflows.${secret}`;
   let started = "";
-  f.computer.write = (input: { path: string; content: string }) => {
-    credentialPath = input.path.replaceAll("/workspace", root);
-    return writeFile(credentialPath, input.content).then(() => ({
-      path: input.path,
-      bytes: new TextEncoder().encode(input.content).byteLength,
-    }));
-  };
   f.computer.processStart = (input: { command: string; cwd?: string }) => {
     started = input.command;
     return new Promise((resolve, reject) => {
+      // The frozen host-supplied environment form; Shed never builds it.
       const child = spawn(
         "bash",
         ["-c", input.command.replaceAll("/workspace", root)],
-        { cwd: root, stdio: "ignore", env: { PATH: process.env.PATH } },
+        {
+          cwd: root,
+          stdio: "ignore",
+          env: {
+            PATH: process.env.PATH,
+            FUNGI_GIT_REMOTE: remote,
+            GIT_CONFIG_COUNT: "1",
+            GIT_CONFIG_KEY_0: `http.${remote}.extraHeader`,
+            GIT_CONFIG_VALUE_0: `Authorization: Bearer ${bearer}`,
+          },
+        },
       );
       child.once("error", reject);
       child.once("exit", (code) => {
@@ -920,17 +867,116 @@ void it("gives a bearer pass to git only as command-local extraHeader config", a
     command: [
       "git init -q repo",
       'test "$FUNGI_GIT_REMOTE" = "https://oyster.test/git/bonsai/pond.git"',
-      // The expected header comes from a file, so the command never names it.
-      'test "$(git -C repo config --get-urlmatch http.extraHeader "$FUNGI_GIT_REMOTE")" = "$(cat expected-header)"',
+      // Git sees the host-scoped header; the shell builtin compares it to the
+      // child's own environment, so no literal secret is in the command.
+      'test "$(git -C repo config --get-urlmatch http.extraHeader "$FUNGI_GIT_REMOTE")" = "$GIT_CONFIG_VALUE_0"',
       'test -z "$(git -C repo config --get-urlmatch http.extraHeader https://elsewhere.test/x.git)"',
-      '! grep -qF "$(cat expected-secret)" repo/.git/config',
       "printf header-scoped",
     ].join(" && "),
   };
-  const result = await appBackend.call("run", input, f.context, f.caller);
-  assert.equal(z.object({ exitCode: z.number() }).parse(result).exitCode, 0);
-  assert.equal(started.includes("b".repeat(64)), false);
-  await assert.rejects(readFile(credentialPath), { code: "ENOENT" });
+  const result = z
+    .object({ exitCode: z.number(), logPath: z.string() })
+    .parse(await appBackend.call("run", input, f.context, f.caller));
+  assert.equal(result.exitCode, 0);
+  // Host-side secrecy assertions, after the child exited.
+  assert.equal(started.includes(secret), false);
+  assert.equal(
+    (await readFile(join(root, "repo/.git/config"), "utf8")).includes(secret),
+    false,
+  );
+  const log = await readFile(
+    join(root, result.logPath.replace("/workspace/", "")),
+    "utf8",
+  );
+  assert.equal(log, "header-scoped");
+  assert.equal(log.includes(secret), false);
+  assert.equal(
+    JSON.stringify(
+      f.sql.exec("SELECT * FROM shed_native_process_claims").toArray(),
+    ).includes(secret),
+    false,
+  );
+  assert.deepEqual(f.forbidden(), []);
+});
+
+void it("drops the superseded claim table and keeps a current claim across reopening", async (t) => {
+  const database = new DatabaseSync(":memory:");
+  t.after(() => {
+    database.close();
+  });
+  database.exec(
+    "CREATE TABLE shed_process_claims (requestKey TEXT PRIMARY KEY, computerId TEXT NOT NULL, command TEXT NOT NULL, cwd TEXT, processId TEXT, phase TEXT NOT NULL, startedAt INTEGER, exitCode INTEGER, logPath TEXT NOT NULL, gitAccess TEXT, passId TEXT, remote TEXT, expiresAt INTEGER)",
+  );
+  const sql = {
+    exec(query: string, ...values: (string | number | null)[]) {
+      const rows = database.prepare(query).all(...values);
+      return { toArray: () => rows };
+    },
+  };
+  const names = () =>
+    database
+      .prepare("SELECT name FROM sqlite_master WHERE type='table'")
+      .all()
+      .map((row) => String(row.name));
+  const columns = () =>
+    database
+      .prepare("PRAGMA table_info(shed_native_process_claims)")
+      .all()
+      .map((row) => String(row.name));
+  const process: ComputerProcess = {
+    id: mintComputerProcessId(),
+    port: null,
+    command: "sleep 120",
+    cwd: null,
+    state: "running",
+    exitCode: null,
+    sync: "synced",
+    startedAt: 1,
+    endedAt: null,
+  };
+  let starts = 0;
+  const computer = hostComputer({
+    processStart: () => {
+      starts++;
+      return Promise.resolve(process);
+    },
+    processes: () => Promise.resolve({ processes: [process] }),
+  });
+  const caller = {
+    actor: { kind: "member" as const, memberId: "member_one" },
+    computerId: "computer_one",
+    idempotencyKey: "reopen_key",
+  };
+  const open = () => ({
+    runs: createShedRuns(sql),
+    env: { COMPUTER: computer },
+  });
+  assert.equal(names().includes("shed_process_claims"), true);
+  const first = await appBackend.call(
+    "start",
+    { command: "sleep 120" },
+    open(),
+    caller,
+  );
+  assert.equal(names().includes("shed_process_claims"), false);
+  assert.deepEqual(columns(), [
+    "requestKey",
+    "computerId",
+    "command",
+    "cwd",
+    "processId",
+    "phase",
+    "startedAt",
+    "exitCode",
+    "logPath",
+    "gitAccess",
+  ]);
+  // Reopening never drops the current table: the claim replays, no new start.
+  assert.deepEqual(
+    await appBackend.call("start", { command: "sleep 120" }, open(), caller),
+    first,
+  );
+  assert.equal(starts, 1);
 });
 
 void it("returns a running process at start and reuses its durable claim after reopening", async (t) => {
@@ -956,7 +1002,7 @@ void it("returns a running process at start and reuses its durable claim after r
     endedAt: null,
   };
   let starts = 0;
-  const computer = {
+  const computer = hostComputer({
     processStart: (input: { command: string; cwd?: string }) => {
       starts++;
       assert.match(input.command, /tee/);
@@ -964,7 +1010,7 @@ void it("returns a running process at start and reuses its durable claim after r
       return Promise.resolve(process);
     },
     processes: () => Promise.resolve({ processes: [process] }),
-  };
+  });
   const caller = {
     actor: { kind: "member", memberId: "member-one" },
     computerId: "computer-one",
@@ -1017,7 +1063,7 @@ void it("recovers a lost start reply with the same native input instead of start
     endedAt: null,
   };
   const requests: unknown[] = [];
-  const computer = {
+  const computer = hostComputer({
     // The native Computer owns replay identity; the binding retains the host call key.
     processStart: (input: { command: string; cwd?: string }) => {
       requests.push(input);
@@ -1026,7 +1072,7 @@ void it("recovers a lost start reply with the same native input instead of start
       return Promise.resolve(process);
     },
     processes: () => Promise.resolve({ processes: [process] }),
-  };
+  });
   const caller = {
     actor: { kind: "member", memberId: "member-one" },
     computerId: "computer-one",
@@ -1080,7 +1126,7 @@ void it("starts a declared port and binds retry identity to the native process p
     endedAt: null,
   };
   const requests: unknown[] = [];
-  const computer = {
+  const computer = hostComputer({
     processStart: (input: { command: string; cwd?: string; port?: number }) => {
       requests.push(input);
       assert.equal(input.port, 3000);
@@ -1089,7 +1135,7 @@ void it("starts a declared port and binds retry identity to the native process p
       return Promise.resolve(process);
     },
     processes: () => Promise.resolve({ processes: [process] }),
-  };
+  });
   const caller = {
     actor: { kind: "member", memberId: "member-one" },
     computerId: "computer-one",
@@ -1140,23 +1186,14 @@ void it("starts a declared port and binds retry identity to the native process p
   assert.equal(requests.length, 1);
 });
 
-void it("replays an already started process without renewing its expired Workflow Git pass", async (t) => {
+void it("replays an already started process without any credential call", async (t) => {
   const fixture = workflowRunFixture(t);
-  const expected = {
-    process: fixture.process,
-    logPath:
-      "/workspace/.fungi/runs/call-9a64fff978ad485e46f9452873bb5507312585c79c4265d164886c2e7cdc347c/out.log",
-  };
-  assert.deepEqual(
-    await appBackend.call(
-      "start",
-      fixture.input,
-      fixture.context,
-      fixture.caller,
-    ),
-    expected,
+  const expected = await appBackend.call(
+    "start",
+    fixture.input,
+    fixture.context,
+    fixture.caller,
   );
-  fixture.setClock(61000);
   assert.deepEqual(
     await appBackend.call(
       "start",
@@ -1167,10 +1204,10 @@ void it("replays an already started process without renewing its expired Workflo
     expected,
   );
   assert.equal(fixture.starts(), 1);
-  assert.equal(fixture.mints(), 1);
+  assert.deepEqual(fixture.forbidden(), []);
 });
 
-void it("starts a separate native process and Git pass for another member with the same raw key", async (t) => {
+void it("starts a separate native process for another member with the same raw key", async (t) => {
   const f = workflowRunFixture(t);
   const commands: string[] = [];
   const processes: ComputerProcess[] = [];
@@ -1182,12 +1219,6 @@ void it("starts a separate native process and Git pass for another member with t
     return Promise.resolve(process);
   };
   const first = await appBackend.call("start", f.input, f.context, f.caller);
-  const secondRemote = "https://git.fixture/member-b.git";
-  f.setPass({
-    passId: "pass_member_b",
-    remote: secondRemote,
-    expiresAt: 60000,
-  });
   const secondCaller = {
     ...f.caller,
     actor: { kind: "member", memberId: "member_b" },
@@ -1199,14 +1230,8 @@ void it("starts a separate native process and Git pass for another member with t
     secondCaller,
   );
   assert.equal(commands.length, 2, "member-b must reach its own native start");
-  assert.equal(f.mints(), 2);
-  assert.equal(f.written().length, 2);
-  assert.equal(f.written()[0], `${f.remote}\n`);
-  assert.equal(f.written()[1], `${secondRemote}\n`);
-  assert.equal(commands[0]?.includes(f.remote), false);
-  assert.equal(commands[1]?.includes(secondRemote), false);
+  assert.deepEqual(f.forbidden(), []);
   assert.notEqual(commands[0], commands[1]);
-  assert.equal(commands[1].includes(f.remote), false);
   assert.notDeepEqual(second, first);
 });
 
@@ -1465,7 +1490,7 @@ for (const actor of refusedActors)
       );
       assert.equal(starts, 0);
       assert.equal(
-        f.sql.exec("SELECT * FROM shed_process_claims").toArray().length,
+        f.sql.exec("SELECT * FROM shed_native_process_claims").toArray().length,
         0,
       );
     });
@@ -1519,22 +1544,14 @@ void it("stops only a process claimed by this actor on this Computer", async (t)
   assert.equal(kills, 1);
 });
 
-void it("keeps the bearer Git remote out of native stored command metadata", async (t) => {
+void it("keeps credentials out of native stored command metadata", async (t) => {
   const f = workflowRunFixture(t);
   let storedCommand = "";
-  let delivered = "";
   const context = {
     ...f.context,
     env: {
       COMPUTER: {
         ...f.computer,
-        write: (input: { path: string; content: string }) => {
-          delivered = input.content;
-          return Promise.resolve({
-            path: input.path,
-            bytes: new TextEncoder().encode(input.content).byteLength,
-          });
-        },
         processStart: (input: { command: string; cwd?: string }) => {
           storedCommand = input.command;
           return Promise.resolve({ ...f.process, command: storedCommand });
@@ -1543,42 +1560,37 @@ void it("keeps the bearer Git remote out of native stored command metadata", asy
     },
   };
   await appBackend.call("start", f.input, context, f.caller);
-  assert.equal(storedCommand.includes(f.remote), false);
-  assert.equal(delivered, `${f.remote}\n`);
+  assert.equal(storedCommand.includes("wgp."), false);
+  assert.equal(storedCommand.includes("https://"), false);
+  assert.deepEqual(f.forbidden(), []);
 });
 
-void it("does not reuse an expired Git remote while redispatching an uncertain start", async (t) => {
+void it("redispatches an uncertain start with the same command and no credential call", async (t) => {
   const f = workflowRunFixture(t);
-  let starts = 0;
-  let writes = 0;
-  const write = f.computer.write;
-  f.computer.write = (input) => {
-    writes++;
-    return write(input);
-  };
-  f.computer.processStart = () => {
-    starts++;
-    return Promise.reject(new Error("Reply lost"));
+  const commands: string[] = [];
+  let attempts = 0;
+  f.computer.processStart = (input: { command: string; cwd?: string }) => {
+    commands.push(input.command);
+    attempts++;
+    return attempts === 1
+      ? Promise.reject(new Error("Reply lost"))
+      : Promise.resolve(f.process);
   };
   await assert.rejects(
     appBackend.call("start", f.input, f.context, f.caller),
     /Reply lost/,
   );
-  const writesBeforeExpiry = writes;
-  f.setClock(61000);
-  await assert.rejects(
-    appBackend.call("start", f.input, f.context, f.caller),
-    /expired/,
-  );
-  assert.equal(starts, 1);
-  assert.equal(writes, writesBeforeExpiry);
+  await appBackend.call("start", f.input, f.context, f.caller);
+  assert.equal(attempts, 2);
+  assert.equal(commands[0], commands[1]);
+  assert.deepEqual(f.forbidden(), []);
 });
 
 void it("retires full claims with the native window and never starts a second process for a pruned uncertain key", async (t) => {
   const f = workflowRunFixture(t);
   const retained = new Map<string, ComputerProcess>();
   let starts = 0;
-  const computer = {
+  const computer = hostComputer({
     processStart(input: { command: string; cwd?: string }) {
       let process = retained.get(input.command);
       if (!process) {
@@ -1603,14 +1615,14 @@ void it("retires full claims with the native window and never starts a second pr
       return Promise.resolve(process);
     },
     processes: () => Promise.resolve({ processes: [...retained.values()] }),
-  };
+  });
   const context = { ...f.context, env: { COMPUTER: computer } };
   const input = { command: "printf done" };
   await assert.rejects(
     appBackend.call("start", input, context, f.caller),
     /Reply lost/,
   );
-  for (let index = 0; index < 64; index++)
+  for (let index = 0; index < maximumProcessRecords; index++)
     await appBackend.call("start", input, context, {
       ...f.caller,
       idempotencyKey: `fresh-${String(index)}`,
@@ -1620,7 +1632,7 @@ void it("retires full claims with the native window and never starts a second pr
   });
   assert.equal(starts, 65);
   assert.equal(
-    f.sql.exec("SELECT * FROM shed_process_claims").toArray().length,
+    f.sql.exec("SELECT * FROM shed_native_process_claims").toArray().length,
     64,
   );
 });
@@ -1638,7 +1650,7 @@ for (const mode of ["start", "run"] as const)
       endedAt: 2000,
     }));
     let truncated = false;
-    const computer = {
+    const computer = hostComputer({
       processStart: (input: { command: string }) => {
         const process: ComputerProcess = {
           ...f.process,
@@ -1657,7 +1669,7 @@ for (const mode of ["start", "run"] as const)
         }),
       processKill: () =>
         Promise.resolve({ process: f.process, signalled: true }),
-    };
+    });
     const context = { ...f.context, env: { COMPUTER: computer } };
     const input = { command: "sleep 120" };
     const first = await appBackend.call(mode, input, context, f.caller);
@@ -1701,7 +1713,7 @@ for (const mode of ["start", "run"] as const)
 void it("bounds retired markers per member and method to the latest 64 retired calls", async (t) => {
   const f = workflowRunFixture(t);
   let starts = 0;
-  const computer = {
+  const computer = hostComputer({
     processStart: (input: { command: string }) => {
       starts++;
       return Promise.resolve({
@@ -1715,7 +1727,7 @@ void it("bounds retired markers per member and method to the latest 64 retired c
       });
     },
     processes: () => Promise.resolve({ processes: [] }),
-  };
+  });
   const context = { ...f.context, env: { COMPUTER: computer } };
   for (let index = 0; index < 260; index++) {
     await appBackend.call("start", { command: "true" }, context, {
@@ -1737,7 +1749,7 @@ void it("bounds retired markers per member and method to the latest 64 retired c
   assert.equal(starts, 260);
 });
 
-void it("keeps the native command identity stable across a Git refusal and re-mint", async (t) => {
+void it("keeps the native command identity stable across a refusal and retry", async (t) => {
   const f = workflowRunFixture(t);
   const accepted = new Map<string, ComputerProcess>();
   let calls = 0;
@@ -1758,13 +1770,180 @@ void it("keeps the native command identity stable across a Git refusal and re-mi
   assert.deepEqual(await appBackend.call("start", f.input, context, f.caller), {
     error: "unavailable",
   });
-  f.setPass({
-    passId: "pass_reminted",
-    remote: "https://git.team.internal/workflow/pass_reminted/app_source.git",
-    expiresAt: 61000,
-  });
   await appBackend.call("start", f.input, context, f.caller);
-  assert.equal(f.mints(), 2);
+  assert.deepEqual(f.forbidden(), []);
   assert.equal(accepted.size, 1);
   assert.equal(calls, 2);
 });
+
+function bindingFailure(code = "binding_not_granted") {
+  return Object.assign(new Error("App binding refused"), {
+    name: "AppInstanceError",
+    code,
+  });
+}
+
+function otherBindingFailures() {
+  return [
+    bindingFailure("binding_unavailable"),
+    bindingFailure("invalid_invocation_facts"),
+    new Error("binding_not_granted"),
+  ];
+}
+
+for (const mode of ["start", "run"] as const) {
+  for (const binding of ["processStart"] as const) {
+    void it(`returns a typed denied ${binding} during ${mode}, clears the claim and can retry after grant`, async (t) => {
+      const f = workflowRunFixture(t);
+      const processStart = f.computer.processStart;
+      const denied = () => Promise.reject(bindingFailure());
+      f.computer.processStart = denied;
+      assert.deepEqual(
+        await appBackend.call(mode, f.input, f.context, f.caller),
+        { error: "not_granted" },
+      );
+      assert.equal(f.starts(), 0);
+      assert.deepEqual(f.forbidden(), []);
+      assert.equal(
+        f.sql.exec("SELECT * FROM shed_native_process_claims").toArray().length,
+        0,
+      );
+      f.computer.processStart = processStart;
+      await appBackend.call(mode, f.input, f.context, f.caller);
+      assert.equal(f.starts(), 1);
+    });
+
+    void it(`rethrows other ${binding} failures during ${mode} without pretending the claim is safe to restart`, async (t) => {
+      for (const failure of otherBindingFailures()) {
+        const f = workflowRunFixture(t);
+        const denied = () => Promise.reject(failure);
+        f.computer.processStart = denied;
+        await assert.rejects(
+          appBackend.call(mode, f.input, f.context, f.caller),
+          (cause: unknown) => cause === failure,
+        );
+        assert.equal(f.starts(), 0);
+        assert.equal(
+          f.sql.exec("SELECT * FROM shed_native_process_claims").toArray()
+            .length,
+          1,
+        );
+      }
+    });
+  }
+}
+
+void it("returns a typed denied inventory refresh without admitting another claim", async (t) => {
+  const f = workflowRunFixture(t);
+  let starts = 0;
+  f.computer.processStart = (input) => {
+    starts++;
+    return Promise.resolve({
+      ...f.process,
+      id: mintComputerProcessId(),
+      command: input.command,
+      cwd: input.cwd ?? null,
+    });
+  };
+  for (let index = 0; index < maximumProcessRecords; index++)
+    await appBackend.call("start", { command: "sleep 120" }, f.context, {
+      ...f.caller,
+      idempotencyKey: `retained-${String(index)}`,
+    });
+  f.computer.processes = () => Promise.reject(bindingFailure());
+  assert.deepEqual(
+    await appBackend.call("start", { command: "sleep 120" }, f.context, {
+      ...f.caller,
+      idempotencyKey: "not-admitted",
+    }),
+    { error: "not_granted" },
+  );
+  assert.equal(starts, maximumProcessRecords);
+  assert.equal(
+    f.sql.exec("SELECT * FROM shed_native_process_claims").toArray().length,
+    maximumProcessRecords,
+  );
+  for (const failure of otherBindingFailures()) {
+    f.computer.processes = () => Promise.reject(failure);
+    await assert.rejects(
+      appBackend.call("start", { command: "sleep 120" }, f.context, {
+        ...f.caller,
+        idempotencyKey: "not-admitted",
+      }),
+      (cause: unknown) => cause === failure,
+    );
+  }
+  assert.equal(starts, maximumProcessRecords);
+});
+
+void it("returns a typed denied stop only after the retained process ownership check", async (t) => {
+  const f = workflowRunFixture(t);
+  await appBackend.call("start", f.input, f.context, f.caller);
+  let kills = 0;
+  let failure: Error = bindingFailure();
+  const context = {
+    ...f.context,
+    env: {
+      COMPUTER: {
+        ...f.computer,
+        processKill: () => {
+          kills++;
+          return Promise.reject(failure);
+        },
+      },
+    },
+  };
+  assert.deepEqual(
+    await appBackend.call(
+      "stop",
+      { id: mintComputerProcessId() },
+      context,
+      f.caller,
+    ),
+    { error: "not_found" },
+  );
+  assert.equal(kills, 0);
+  assert.deepEqual(
+    await appBackend.call("stop", { id: f.process.id }, context, f.caller),
+    { error: "not_granted" },
+  );
+  assert.equal(kills, 1);
+  for (const other of otherBindingFailures()) {
+    failure = other;
+    await assert.rejects(
+      appBackend.call("stop", { id: f.process.id }, context, f.caller),
+      (cause: unknown) => cause === other,
+    );
+  }
+  assert.equal(kills, 4);
+});
+
+for (const site of ["resume", "expose", "logs"] as const) {
+  void it(`preserves every binding failure identity at strict ${site}`, async (t) => {
+    for (const failure of [bindingFailure(), ...otherBindingFailures()]) {
+      const f = workflowRunFixture(t);
+      if (site === "resume") {
+        await appBackend.call("run", f.input, f.context, f.caller);
+        f.computer.processes = () => Promise.reject(failure);
+      } else if (site === "expose") {
+        f.computer.preview = () => Promise.reject(failure);
+      } else {
+        await appBackend.call("start", f.input, f.context, f.caller);
+        f.computer.read = () => Promise.reject(failure);
+      }
+      const call =
+        site === "expose"
+          ? appBackend.call("expose", { port: 3000 }, f.context, f.caller)
+          : site === "logs"
+            ? appBackend.call(
+                "logs",
+                { run: f.caller.idempotencyKey },
+                f.context,
+                f.caller,
+              )
+            : appBackend.call("run", f.input, f.context, f.caller);
+      await assert.rejects(call, (cause: unknown) => cause === failure);
+      assert.equal(f.starts(), site === "resume" || site === "logs" ? 1 : 0);
+    }
+  });
+}