@geonosis/rails 1.0.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,187 @@
+# @geonosis/rails
+
+Sandbox profiles for an unattended run, as **data rendered to text** — a macOS `sandbox-exec`
+profile or a Linux `bwrap` argv — that **fail open and loud** when they cannot be applied, plus the
+after-the-fact proof that the scored run never wrote the scoreboard.
+
+```bash
+npx geonosis-rails profile --allow-write src            # print the seatbelt profile
+npx geonosis-rails profile --format bwrap               # print the bubblewrap argv
+npx geonosis-rails contain --allow-write . 'pnpm test'  # run it inside the profile
+npx geonosis-rails shift --goal /goal --cycles 8        # the unattended shift
+```
+
+## The two halves
+
+**The profile is enforcement.** The kernel refuses the write.
+
+**The hash check is evidence.** Taken before the run and again after, so a run that went
+*uncontained* — because the binary was missing, because the profile could not be written — still
+cannot get away with having rewritten the baseline. The hashes say it did.
+
+You need both, because the first one is allowed to fail.
+
+## Fail open, and loud
+
+```
+############################################################
+#  UNSANDBOXED RUN — the profile could not be applied.     #
+############################################################
+```
+
+2ndm1nd's words for the same decision, in its own runner: *"a missing profile means unsandboxed
+instruments, not a blind cycle. Failing closed here would trade a contained risk for a certain
+outage. It logs loudly instead, because a silent fallback is how rails rot."*
+
+**Loudly** is doing the work in that sentence. The shell version this is modelled on logs to a file
+nobody reads at 3 a.m., which is silent in every way that matters. So `runContained` prints the
+banner **and** returns a `marker` — `unsandboxedRuns`, non-zero — that travels with the run into the
+gate report, where the ratchet can refuse to let it grow.
+
+Two things get the same treatment, because they are the same event: the binary is not on PATH, and
+the profile cannot be written. A rail that threw on the second would stop the run for a reason that
+has nothing to do with the work.
+
+## What is denied, always
+
+```ts
+RAILS_DENY_WRITE = ['gate-baseline.json']
+```
+
+On every profile whether it was asked for or not. Only the baseline, and that is **narrower** than
+what the Stop hook refuses at the tool layer, on purpose: the kernel cannot tell the agent from the
+hook and the `geonosis-verify` it spawned, and `.geonosis/gate-report.json` and `proofs/` are what
+those write *during* the run — the very files `@geonosis/evals` scores it from. The first version
+denied them too; every contained run then read as a red gate with zero proofs, and the rail read as
+holding. Add a path with `--deny-write` when a repo has a second scoreboard. The scored agent never writes the scoreboard — the
+rail 2ndm1nd added after probing that its sandboxed cycle could `CREATE TABLE` in the very ledger it
+was scored on.
+
+Held in three places on purpose: `plugin/hooks/lib/policy.mjs` refuses the agent's own tool call
+inside a session, this profile is the kernel outside it, and `@geonosis/evals` hashes the baseline
+before and after. A run that got past the first two must still fail the third.
+
+Stored **relative**, because a repo is at a different path on every machine and a shared list of
+absolute paths could not be shared. They become absolute in `canonicalise`, and nowhere else.
+
+## Three things measured against the real kernel
+
+All three on `/usr/bin/sandbox-exec`, 2026-08-30. `seatbelt.live.test.ts` runs them every suite and
+skips loudly where the binary is absent — a suite that quietly passed on Linux would report that the
+rail holds on a platform where nothing checked it.
+
+**1. Order is the security property.** SBPL is last-match-wins: deny the tree, allow the work back,
+**then** re-deny the rails. Falsified, not demonstrated — with the re-deny moved *before* the
+allow-back, the same write succeeded and `gate-baseline.json` really did read `tampered`. Reordering
+these lines is not a formatting change.
+
+**2. `subpath` denies a file too.** So it is used for every deny and `literal` for none. That
+removes a file-or-directory guess which had `.ssh` down as a file the first time it was written.
+
+**3. A symlinked root denies nothing.** The kernel matches the *resolved* path. On macOS
+`os.tmpdir()` is `/var/folders/…`, a symlink to `/private/var/folders/…` — a profile built from the
+symlinked spelling misses every rule, exits 0, and loads, renders and reads perfectly correct. The
+first live run of this package wrote `tampered` straight over a baseline the profile said it was
+protecting.
+
+Worse: the falsification test *also* passed, because nothing was denied either way. A symlinked root
+does not merely break the rail, it breaks the test that would have told you. Hence `canonicalise`,
+which `runContained` and the CLI both call, and which resolves children against the **canonical**
+root so a rail naming a path that does not exist yet still lands where the kernel will look.
+
+## Containment, not least-privilege
+
+`(allow default)`, then deny. Deliberately, and again in 2ndm1nd's words: *"a deny-list cannot
+silently starve a process of a path it needs"* — and a starved process fails silently, which is the
+failure class the rails exist to end. An over-tight allow-list produces a stale result that nothing
+reports.
+
+## Two renderings, one profile
+
+A profile is data. `renderSeatbelt` and `renderBubblewrap` are two functions over the same object,
+so the platforms cannot drift into meaning different things — the failure mode of a `.sb` written by
+hand on one laptop.
+
+bubblewrap has no last-match-wins deny: a path is bound or it is not. So the rails are re-bound
+read-only **after** the writable binds, because a later bind shadows an earlier one; without that the
+deny would exist only in the seatbelt rendering. A read-deny becomes `--tmpfs`, which shadows the
+path with an empty directory — the only way to make something unreadable is not to hand it over.
+
+**The bubblewrap rendering is not measured.** There is no `bwrap` on the machine this was written
+on. What is tested is the renderer.
+
+## Exit codes for `contain`
+
+The command's own exit code, except that a run which broke a rail fails even when its command
+succeeded. A run that failed on its own merits keeps **its** code, because that is the one the
+operator needs.
+
+The runner's own rendered profile lands at `.geonosis/rails.sb` and is excused by name, so a repo
+that denies `.geonosis` itself does not catch the rail-writer — the distinction is not *which* path
+was written but *who* wrote it.
+
+## The shift runner
+
+```bash
+geonosis-rails shift --goal /goal --cycles 8 [--json]
+                     [--claude <bin>] [--gh <bin>] [--ledger <bin>]
+```
+
+**One session, resumed** — the polymorph pattern 2ndm1nd's `brain-loop.sh` runs on, and not an
+optimisation. Scheduling tools die at turn-end inside `claude -p`, so an outer loop that woke
+something up gets a cold session every cycle; resuming keeps the conversation, which is the only
+reason a second cycle is worth more than a first. A cycle that comes back with **no session id**
+parks, because carrying on would silently start fresh every time and look identical in the log.
+
+**The handoff is rewritten after every cycle**, not at the end. And every park writes WHY into it
+before returning — a shift that stopped and said nothing is a shift somebody restarts from the
+beginning.
+
+### It parks rather than running blind
+
+| Condition | Why |
+|---|---|
+| `main` is red | somebody else's broken build; piling on makes the next person bisect through both |
+| `main` is **unknown** | a `gh` that is missing, logged out or answering about a run in progress. A main nobody could ask about is not a green main |
+| the gate report is red | another cycle on top of a red gate is the blind cycle this exists to refuse |
+| a ⚠AUTH class was reached | `geonosis.json → caps.auth`, D-019 |
+| the Stop hook blocked to its cap | a turn that cannot go green in five tries has a problem the sixth will not solve |
+| the CI-fix attempts are spent | two, then park rather than try the same fix again |
+
+Checked **before** the cycle where the condition is about the world (`main`, the blocks) and after
+where it is about the cycle (auth, exit code, gate). Every reason carries its count.
+
+Exit **1** on a park. Not a crash and not a pass: it says the shift stopped for a reason a human has
+to read.
+
+### The caps
+
+`geonosis.json → caps`, defaulting to Foreman's two-and-two and the Stop hook's five — the numbers
+the kit already enforces elsewhere, so a shift runner does not put a second bound on the same
+behaviour.
+
+```json
+{ "caps": { "revisions": 2, "ciFixes": 2, "stopBlocks": 5, "draftPr": true, "auth": [] } }
+```
+
+`auth` defaults to **empty**, and that is law 6 rather than an oversight: a default list of
+dangerous-sounding words would pause every repo that never read the flag, on somebody else's idea of
+dangerous. `AUTH_CLASSES` — `infra`, `deletes`, `deploys`, `money`, `third-party sends` — is the seed
+to copy in, not the default.
+
+The match is a stem and it is deliberately generous, because the asymmetry is the design: a false
+pause costs a question, a false pass costs an unattended deploy, and only one of those can be undone
+by answering.
+
+A `geonosis.json` that cannot be **parsed** is refused, never defaulted. "I could not read your
+config so I used mine" is how an unattended shift runs for eight hours under bounds nobody wrote.
+
+### Every binary is an option
+
+`--claude`, `--gh`, `--ledger`. Law 6, and the practical reason: `claude` is at `~/.local/bin/claude`
+on one machine and elsewhere on the next — and a test has to be able to point them at something that
+is not a model. Every test in this package does.
+
+A repeated single-value flag takes the **last**, so an override appended to a base argument list
+wins. First-wins read exactly like the override having no effect, which is how three of these tests
+silently ignored their stub.

package/bin/geonosis-rails.mjs

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+// Committed, so `pnpm install` can link the bin on a fresh clone — before `pnpm build` has
+// produced dist/. A bin that only exists after a build is a bin that is missing when you need it.
+import '../dist/rails-cli.js'

package/dist/chunk-SQQS5NHC.js

@@ -0,0 +1,423 @@
+// src/profile.ts
+import { realpathSync } from "fs";
+import { isAbsolute, resolve } from "path";
+var RAILS_DENY_WRITE = ["gate-baseline.json"];
+var safe = (path) => {
+  if (path.includes('"'))
+    throw new Error(`path contains a quote, which no profile can render: ${path}`);
+  if (path.includes("\n")) throw new Error(`path contains a newline: ${JSON.stringify(path)}`);
+  return path;
+};
+var sandboxProfile = ({
+  allowNet,
+  allowWrite,
+  denyRead,
+  denyWrite,
+  profilePath,
+  root
+}) => {
+  if (!isAbsolute(root)) {
+    throw new Error(
+      `sandbox root must be absolute, got "${root}" \u2014 every rule would resolve nowhere`
+    );
+  }
+  return {
+    allowNet,
+    allowWrite: allowWrite.map(safe),
+    denyRead: (denyRead ?? []).map(safe),
+    denyWrite: [.../* @__PURE__ */ new Set([...denyWrite ?? [], ...RAILS_DENY_WRITE])].map(safe),
+    profilePath: profilePath === void 0 ? void 0 : safe(profilePath),
+    root: safe(root)
+  };
+};
+var at = (profile, path) => resolve(profile.root, path);
+var renderSeatbelt = (profile) => {
+  const lines = [
+    // Measured: a `;` comment BEFORE this line is accepted too, but the version form goes first
+    // because that is the shape every reader and every other tool expects.
+    "(version 1)",
+    "; Rendered by @geonosis/rails. Last match wins: deny the tree, allow the work back, re-deny",
+    "; the rails. Reordering these lines opens a hole that the profile still reads correct with.",
+    "(allow default)",
+    `(deny file-write* (subpath "${profile.root}"))`,
+    ...profile.allowWrite.map((one) => `(allow file-write* (subpath "${at(profile, one)}"))`),
+    ...profile.denyWrite.map((one) => `(deny file-write* (subpath "${at(profile, one)}"))`),
+    ...profile.profilePath === void 0 ? [] : (
+      // The profile denies writes to ITSELF, dated in the source it is modelled on: the renderer
+      // hands back the EXISTING path when a rewrite fails, so a tampered-then-locked profile would
+      // be handed straight back and the next run would launch uncaged.
+      [`(deny file-write* (subpath "${at(profile, profile.profilePath)}"))`]
+    ),
+    // Read-denied, not merely unwritable: a run that may explore the disk must find a credential
+    // unreadable, because write containment is kernel-enforced and egress is not.
+    ...profile.denyRead.map((one) => `(deny file-read* (subpath "${at(profile, one)}"))`),
+    ...profile.allowNet ? [] : ["(deny network*)"]
+  ];
+  return `${lines.join("\n")}
+`;
+};
+var renderBubblewrap = (profile) => [
+  "--ro-bind",
+  profile.root,
+  profile.root,
+  ...profile.allowWrite.flatMap((one) => ["--bind", at(profile, one), at(profile, one)]),
+  ...profile.denyWrite.flatMap((one) => ["--ro-bind", at(profile, one), at(profile, one)]),
+  ...profile.profilePath === void 0 ? [] : ["--ro-bind", at(profile, profile.profilePath), at(profile, profile.profilePath)],
+  ...profile.denyRead.flatMap((one) => ["--tmpfs", at(profile, one)]),
+  ...profile.allowNet ? [] : ["--unshare-net"]
+];
+var realOf = (path) => {
+  try {
+    return realpathSync.native(path);
+  } catch {
+    return path;
+  }
+};
+var canonicalise = (profile, realpath = realOf) => {
+  const root = realpath(profile.root);
+  const under = (one) => realpath(resolve(root, one));
+  return {
+    allowNet: profile.allowNet,
+    allowWrite: profile.allowWrite.map(under),
+    denyRead: profile.denyRead.map(under),
+    denyWrite: profile.denyWrite.map(under),
+    profilePath: profile.profilePath === void 0 ? void 0 : under(profile.profilePath),
+    root
+  };
+};
+
+// src/contain.ts
+import { createHash } from "crypto";
+import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from "fs";
+import { dirname, join, relative, resolve as resolve2 } from "path";
+var UNSANDBOXED = "unsandboxedRuns";
+var PROFILE_PATH = ".geonosis/rails.sb";
+var banner = (why) => [
+  "",
+  "  ############################################################",
+  "  #  UNSANDBOXED RUN \u2014 the profile could not be applied.     #",
+  "  ############################################################",
+  `  reason: ${why}`,
+  "  The command RAN, uncontained. This is deliberate: failing closed here would trade a",
+  "  contained risk for a certain outage, and a blind cycle is worse than a loud one.",
+  `  The run carries a non-zero "${UNSANDBOXED}" marker so the gate report says so too.`,
+  ""
+].join("\n");
+var runContained = ({
+  command,
+  has = () => false,
+  platform = process.platform,
+  profile,
+  root,
+  spawn
+}) => {
+  const open = (why) => {
+    const said = banner(why);
+    process.stderr.write(`${said}
+`);
+    const done2 = spawn(command, [], root);
+    return {
+      banner: said,
+      exitCode: done2.exitCode,
+      marker: { count: 1, id: UNSANDBOXED },
+      sandboxed: false,
+      stderr: done2.stderr,
+      stdout: done2.stdout
+    };
+  };
+  const binary = platform === "darwin" ? "sandbox-exec" : "bwrap";
+  if (!has(binary)) return open(`${binary} is not on PATH`);
+  const at2 = resolve2(root, PROFILE_PATH);
+  let real;
+  try {
+    mkdirSync(dirname(at2), { recursive: true });
+    real = canonicalise({ ...profile, profilePath: at2 });
+    writeFileSync(at2, renderSeatbelt(real));
+  } catch (error) {
+    return open(`the profile could not be written to ${at2}: ${error.message}`);
+  }
+  const argv = platform === "darwin" ? ["-f", at2, "sh", "-c", command] : [...renderBubblewrap(real), "sh", "-c", command];
+  const done = spawn(binary, argv, root);
+  return {
+    exitCode: done.exitCode,
+    profilePath: at2,
+    sandboxed: true,
+    stderr: done.stderr,
+    stdout: done.stdout
+  };
+};
+var hashOf = (body) => createHash("sha256").update(body).digest("hex");
+var filesAt = (root, path) => {
+  const at2 = resolve2(root, path);
+  if (!existsSync(at2)) return [];
+  if (statSync(at2).isFile()) return [relative(root, at2)];
+  return readdirSync(at2, { withFileTypes: true }).flatMap((entry) => {
+    const full = join(at2, entry.name);
+    if (entry.isDirectory()) return filesAt(root, relative(root, full));
+    return entry.isFile() ? [relative(root, full)] : [];
+  });
+};
+var snapshotDenied = (root, denied) => Object.fromEntries(
+  denied.flatMap(
+    (path) => filesAt(root, path).map((file) => [file, hashOf(readFileSync(resolve2(root, file)))])
+  )
+);
+var deniedWrites = (root, denied, before, except = []) => {
+  const after = snapshotDenied(root, denied);
+  const found = [];
+  const ours = new Set(except.map((one) => relative(root, resolve2(root, one))));
+  for (const [file, hash] of Object.entries(after)) {
+    if (ours.has(file)) continue;
+    const was = before[file];
+    if (was === void 0) found.push(`${file} was created under a path the run may not write`);
+    else if (was !== hash) found.push(`${file} was changed under a path the run may not write`);
+  }
+  for (const file of Object.keys(before)) {
+    if (ours.has(file)) continue;
+    if (after[file] === void 0)
+      found.push(`${file} was deleted from a path the run may not write`);
+  }
+  return found;
+};
+
+// src/caps.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { resolve as resolve3 } from "path";
+var CAP_DEFAULTS = {
+  auth: [],
+  ciFixes: 2,
+  draftPr: true,
+  revisions: 2,
+  stopBlocks: 5
+};
+var AUTH_CLASSES = ["infra", "deletes", "deploys", "money", "third-party sends"];
+var CONFIG = "geonosis.json";
+var numberAt = (source, key, fallback) => {
+  const found = source[key];
+  if (found === void 0) return fallback;
+  if (typeof found !== "number" || !Number.isFinite(found) || found < 0) {
+    throw new Error(
+      `${CONFIG}: caps.${key} must be a number of zero or more, got ${JSON.stringify(found)}`
+    );
+  }
+  return found;
+};
+var loadCaps = (root) => {
+  const at2 = resolve3(root, CONFIG);
+  if (!existsSync2(at2)) return { ...CAP_DEFAULTS };
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync2(at2, "utf8"));
+  } catch (error) {
+    throw new Error(`${CONFIG} is not readable as JSON: ${error.message}`, {
+      cause: error
+    });
+  }
+  const caps = parsed?.caps;
+  if (caps === void 0) return { ...CAP_DEFAULTS };
+  if (typeof caps !== "object" || caps === null || Array.isArray(caps)) {
+    throw new Error(`${CONFIG}: "caps" must be an object`);
+  }
+  const source = caps;
+  const auth = source["auth"];
+  if (auth !== void 0 && (!Array.isArray(auth) || auth.some((one) => typeof one !== "string"))) {
+    throw new Error(`${CONFIG}: caps.auth must be a list of strings`);
+  }
+  return {
+    auth: auth ?? CAP_DEFAULTS.auth,
+    ciFixes: numberAt(source, "ciFixes", CAP_DEFAULTS.ciFixes),
+    draftPr: source["draftPr"] === void 0 ? CAP_DEFAULTS.draftPr : source["draftPr"] === true,
+    revisions: numberAt(source, "revisions", CAP_DEFAULTS.revisions),
+    stopBlocks: numberAt(source, "stopBlocks", CAP_DEFAULTS.stopBlocks)
+  };
+};
+var stem = (pattern) => pattern.toLowerCase().replace(/(?:es|s)$/, "");
+var needsAuth = (text, patterns) => {
+  const lower = text.toLowerCase();
+  return patterns.find((pattern) => lower.includes(stem(pattern)));
+};
+
+// src/shift.ts
+var runShift = ({ caps, cycles, goal, root, seams }) => {
+  if (!(cycles > 0))
+    throw new Error(`a shift of ${cycles} cycles would report a clean run over nothing`);
+  if (goal.trim() === "") throw new Error("a shift needs a goal command to run");
+  const ran = [];
+  let session;
+  let ciFixes = 0;
+  const park = (at2, reason) => {
+    seams.handoff(reason);
+    return { cycles: ran, parked: true, parkedAt: at2, reason };
+  };
+  for (let number = 1; number <= cycles; number += 1) {
+    const main = seams.mainStatus();
+    if (main !== "green") {
+      return park(number, `main is ${main} \u2014 parking rather than building on a red or unknown main`);
+    }
+    const blocks = seams.stopBlocks(root);
+    if (blocks >= caps.stopBlocks) {
+      return park(
+        number,
+        `the stop hook blocked ${blocks} times, at the cap of ${caps.stopBlocks} \u2014 a turn that cannot go green in ${caps.stopBlocks} tries has a problem the next one will not solve`
+      );
+    }
+    const outcome = seams.runCycle({
+      goal,
+      number,
+      ...session === void 0 ? {} : { resume: session }
+    });
+    ran.push({
+      exitCode: outcome.exitCode,
+      number,
+      ...outcome.sessionId === void 0 ? {} : { sessionId: outcome.sessionId }
+    });
+    if (outcome.sessionId === void 0) {
+      return park(
+        number,
+        "the cycle reported no session id \u2014 the next cycle could not resume it, only start over"
+      );
+    }
+    session = outcome.sessionId;
+    const auth = needsAuth(outcome.stdout, caps.auth);
+    if (auth !== void 0) {
+      return park(
+        number,
+        `the cycle reached "${auth}", which this repo reserves for a human \u2014 parking for authorisation`
+      );
+    }
+    if (outcome.exitCode === 0) {
+      ciFixes = 0;
+    } else {
+      ciFixes += 1;
+      if (ciFixes >= caps.ciFixes) {
+        return park(
+          number,
+          `${ciFixes} CI-fix attempts, at the cap of ${caps.ciFixes} \u2014 parking rather than trying the same fix again`
+        );
+      }
+    }
+    const gate = seams.gate(root);
+    if (gate !== void 0 && !gate.ok) {
+      return park(
+        number,
+        `the ${gate.tier} gate is red \u2014 parking rather than running another cycle on top of it`
+      );
+    }
+    seams.handoff(`cycle ${number} of ${cycles} complete`);
+  }
+  return { cycles: ran, parked: false, reason: `${cycles} cycles complete` };
+};
+
+// src/shift-seams.ts
+import { spawnSync } from "child_process";
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { resolve as resolve4 } from "path";
+var sessionOf = (output) => {
+  for (const line of output.split("\n").toReversed()) {
+    const trimmed = line.trim();
+    if (trimmed === "") continue;
+    let parsed;
+    try {
+      parsed = JSON.parse(trimmed);
+    } catch {
+      continue;
+    }
+    const found = parsed;
+    if (found?.type !== "result") continue;
+    return typeof found.session_id === "string" ? found.session_id : void 0;
+  }
+  return void 0;
+};
+var readJson = (root, path) => {
+  const at2 = resolve4(root, path);
+  if (!existsSync3(at2)) return void 0;
+  try {
+    return JSON.parse(readFileSync3(at2, "utf8"));
+  } catch {
+    return void 0;
+  }
+};
+var realSeams = ({ claude, gh, ledger, root }) => ({
+  gate: () => {
+    const report = readJson(root, ".geonosis/gate-report.json");
+    if (report === void 0) return void 0;
+    return { ok: report.ok === true, tier: typeof report.tier === "string" ? report.tier : "\u2014" };
+  },
+  handoff: (why) => {
+    const done = spawnSync(ledger, ["handoff", "--write", "--note", why], {
+      cwd: root,
+      encoding: "utf8"
+    });
+    return done.status ?? -1;
+  },
+  /**
+   * `gh run list --branch main --limit 1 --json conclusion`. Anything other than a clear success is
+   * NOT green: a `gh` that is not installed, not logged in, or answering about a run still in
+   * progress all come back as `unknown`, and the shift parks. A main nobody could ask about is
+   * exactly the blind cycle this is here to refuse.
+   */
+  mainStatus: () => {
+    const done = spawnSync(
+      gh,
+      ["run", "list", "--branch", "main", "--limit", "1", "--json", "conclusion"],
+      { cwd: root, encoding: "utf8" }
+    );
+    if (done.status !== 0) return "unknown";
+    try {
+      const runs = JSON.parse(done.stdout);
+      const latest = runs[0];
+      if (latest === void 0) return "unknown";
+      return latest.conclusion === "success" ? "green" : "red";
+    } catch {
+      return "unknown";
+    }
+  },
+  runCycle: ({ goal, resume }) => {
+    const done = spawnSync(
+      claude,
+      [
+        "-p",
+        goal,
+        "--output-format",
+        "stream-json",
+        ...resume === void 0 ? [] : ["--resume", resume]
+      ],
+      { cwd: root, encoding: "utf8", maxBuffer: 64 * 1024 * 1024 }
+    );
+    const stdout = done.stdout ?? "";
+    const sessionId = sessionOf(stdout);
+    return {
+      exitCode: done.status ?? -1,
+      ...sessionId === void 0 ? {} : { sessionId },
+      stdout
+    };
+  },
+  stopBlocks: () => {
+    const counts = readJson(root, ".geonosis/stop-blocks.json");
+    if (typeof counts !== "object" || counts === null) return 0;
+    return Object.values(counts).reduce(
+      (most, value) => typeof value === "number" && value > most ? value : most,
+      0
+    );
+  }
+});
+
+export {
+  RAILS_DENY_WRITE,
+  sandboxProfile,
+  renderSeatbelt,
+  renderBubblewrap,
+  canonicalise,
+  UNSANDBOXED,
+  PROFILE_PATH,
+  runContained,
+  snapshotDenied,
+  deniedWrites,
+  CAP_DEFAULTS,
+  AUTH_CLASSES,
+  loadCaps,
+  needsAuth,
+  runShift,
+  sessionOf,
+  realSeams
+};

package/dist/index.d.ts

@@ -0,0 +1,285 @@
+/**
+ * The paths a scored run may never write, on every profile whether it was asked for or not.
+ *
+ * Relative to a repo root, because the rails are a property of a repo and a repo is at a different
+ * path on every machine — a list of absolute paths could not be shared, which is law 6.
+ *
+ * 2ndm1nd's rail: the scored agent never writes the scoreboard. The commit that introduced it there
+ * followed a probe showing the sandboxed cycle could `CREATE TABLE` in the very ledger it was scored
+ * on — "harmless while the ledger is only evidence; disqualifying the moment outcome metrics
+ * computed FROM it gate promotion of the model's own code".
+ *
+ * ONLY the baseline, and that is narrower than the list `plugin/hooks/lib/policy.mjs` refuses at the
+ * tool layer, on purpose: the kernel cannot tell the agent from the hook and the verify it spawned,
+ * and `.geonosis/gate-report.json` and `proofs/` are what THOSE write during the run — the files
+ * `@geonosis/evals` scores it from. A profile that denied them denied the scorer its evidence, and
+ * every contained run read as a red gate with zero proofs. The hook guards the agent's own writes
+ * there; the kernel guards the number the run is scored against.
+ */
+declare const RAILS_DENY_WRITE: string[];
+type SandboxProfile = {
+    allowNet: boolean;
+    allowWrite: string[];
+    denyRead: string[];
+    denyWrite: string[];
+    profilePath: string | undefined;
+    root: string;
+};
+type SandboxProfileInput = {
+    allowNet: boolean;
+    allowWrite: string[];
+    denyRead?: string[];
+    denyWrite?: string[];
+    profilePath?: string;
+    root: string;
+};
+/**
+ * A profile is DATA, and its paths stay exactly as they were given.
+ *
+ * Resolution happens at RENDER time, against the root, so one profile object describes the same
+ * rails on two machines and the two renderers cannot drift into meaning different things — which is
+ * the failure mode of a `.sb` file written by hand on one laptop.
+ */
+declare const sandboxProfile: ({ allowNet, allowWrite, denyRead, denyWrite, profilePath, root, }: SandboxProfileInput) => SandboxProfile;
+/**
+ * A macOS `sandbox-exec` profile, in SBPL.
+ *
+ * Three properties, all three MEASURED against `/usr/bin/sandbox-exec` on 2026-08-30 rather than
+ * taken from documentation:
+ *
+ * 1. **`(allow default)` then deny** — containment, not least-privilege, in 2ndm1nd's words and for
+ *    its reason: "a deny-list cannot silently starve a process of a path it needs", and a starved
+ *    process fails silently, which is the failure class the rails exist to end.
+ * 2. **Last match wins, and the order is the security property.** Measured both ways: with the rail
+ *    re-denied AFTER the allow-back, a write to `gate-baseline.json` returned "Operation not
+ *    permitted"; with the same three rules in the other order the write SUCCEEDED and the file read
+ *    `tampered`. Reordering these lines is not a formatting change. It is a hole, and the profile
+ *    still reads correct.
+ * 3. **`subpath` is used for every deny, files included.** Measured: `(deny file-write* (subpath
+ *    "…/gate-baseline.json"))` denies that file. `literal` would be equal for a file and strictly
+ *    weaker for a directory, so one form is used for both and there is no file-or-directory guess to
+ *    get wrong — a guess that had `.ssh` down as a file the first time it was written.
+ */
+declare const renderSeatbelt: (profile: SandboxProfile) => string;
+/**
+ * A Linux `bwrap` invocation, as argv.
+ *
+ * NOT measured — no `bwrap` on the machine this was written on, and the renderer is what this
+ * package can honestly test. bubblewrap has no last-match-wins deny: a path is bound or it is not.
+ * So the rails are re-bound read-only AFTER the writable binds, because a later bind shadows an
+ * earlier one; without that the deny would exist only in the seatbelt rendering and Linux would run
+ * without it. A read-deny becomes a `--tmpfs`, which shadows the path with an empty directory — the
+ * only way to make something unreadable is not to hand it over.
+ */
+declare const renderBubblewrap: (profile: SandboxProfile) => string[];
+/**
+ * The same profile with every path canonicalised, and the reason it exists at all.
+ *
+ * MEASURED, and it is a landmine rather than a nicety. The kernel matches the RESOLVED path. On
+ * macOS `os.tmpdir()` is `/var/folders/…`, which is a symlink to `/private/var/folders/…`, so a
+ * profile built from the symlinked spelling denies `/var/…` while the write happens against
+ * `/private/var/…` — every rule misses, `sandbox-exec` exits 0, and the profile loads, renders and
+ * reads perfectly correct. The first live run of this package wrote `tampered` straight over a
+ * baseline the profile said it was protecting.
+ *
+ * Worse: the falsification test — the one that proves the WRONG rule order lets the write through —
+ * also passed, because nothing was being denied either way. A symlinked root does not merely break
+ * the rail, it breaks the test that would have told you.
+ *
+ * Kept out of `sandboxProfile` so the profile stays pure data and the renderers stay deterministic
+ * off it. `runContained` calls this; anyone rendering a profile to run for real must too.
+ */
+declare const canonicalise: (profile: SandboxProfile, realpath?: (path: string) => string) => SandboxProfile;
+
+/**
+ * The marker a run that could not be contained carries into the gate report.
+ *
+ * A banner is read by whoever is watching, and by nobody at 3 a.m. The marker travels WITH the run,
+ * so the evidence outlives the terminal — this is a counter's name, and a counter that is non-zero
+ * is debt the ratchet will not let grow.
+ */
+declare const UNSANDBOXED = "unsandboxedRuns";
+/** Where the rendered profile lands. Under the runner-owned directory, which it also denies. */
+declare const PROFILE_PATH = ".geonosis/rails.sb";
+type SpawnResult = {
+    exitCode: number;
+    stderr: string;
+    stdout: string;
+};
+type Spawn = (command: string, argv: string[], cwd: string) => SpawnResult;
+type ContainedRun = {
+    banner?: string;
+    exitCode: number;
+    marker?: {
+        count: number;
+        id: string;
+    };
+    profilePath?: string;
+    sandboxed: boolean;
+    stderr: string;
+    stdout: string;
+};
+type RunContainedInput = {
+    command: string;
+    has?: (binary: string) => boolean;
+    platform?: NodeJS.Platform;
+    profile: SandboxProfile;
+    root: string;
+    spawn: Spawn;
+};
+/**
+ * Runs a command inside the profile, and runs it ANYWAY when it cannot.
+ *
+ * Fails open, and loudly. 2ndm1nd's own words for the same decision: "a missing profile means
+ * unsandboxed instruments, not a blind cycle. Failing closed here would trade a contained risk for
+ * a certain outage. It logs loudly instead, because a silent fallback is how rails rot."
+ *
+ * Loudly is doing work in that sentence. The shell version this is modelled on logs to a file that
+ * nobody reads, which is a fallback that is silent in every way that matters — so this one prints a
+ * banner AND returns a marker that goes into the gate report, where the ratchet can refuse to let it
+ * grow.
+ */
+declare const runContained: ({ command, has, platform, profile, root, spawn, }: RunContainedInput) => ContainedRun;
+type DeniedSnapshot = Record<string, string>;
+/**
+ * The digest of everything under every denied path, taken before the run.
+ *
+ * A hash rather than an mtime, because an mtime moves when a tool merely opens a file for writing,
+ * and a write that restores the same bytes is not a write. A directory is walked rather than
+ * stat-ed, because a denied path may be a TREE: a file planted inside one is the write that
+ * matters, and the directory's own mtime would not always say so.
+ */
+declare const snapshotDenied: (root: string, denied: string[]) => DeniedSnapshot;
+/**
+ * What the run actually wrote to a path it may not, taken after.
+ *
+ * This is EVIDENCE, and it is the half that holds when the first half failed open: a run that went
+ * uncontained because the binary was missing still cannot get away with having rewritten the
+ * scoreboard, because the hashes say it did.
+ */
+declare const deniedWrites: (root: string, denied: string[], before: DeniedSnapshot, except?: string[]) => string[];
+
+type Caps = {
+    auth: string[];
+    ciFixes: number;
+    draftPr: boolean;
+    revisions: number;
+    stopBlocks: number;
+};
+/**
+ * Foreman's two-and-two, and the Stop hook's five — the numbers the kit already enforces elsewhere,
+ * so a shift runner that invented its own would put two different bounds on the same behaviour.
+ *
+ * `auth` is EMPTY, and that is law 6 rather than an oversight: a default list of dangerous-sounding
+ * words would pause every repo that never read the flag, on somebody else's idea of dangerous. A
+ * repo opts in by naming what it means, and `AUTH_CLASSES` is the seed to copy from.
+ */
+declare const CAP_DEFAULTS: Caps;
+/** D-019's five classes, offered rather than imposed. Copy into `geonosis.json → caps.auth`. */
+declare const AUTH_CLASSES: string[];
+/**
+ * The caps a repo runs under, from `geonosis.json → caps`, with the defaults for whatever it did
+ * not mention.
+ *
+ * A config that cannot be PARSED is refused rather than defaulted. "I could not read your config so
+ * I used mine" is how an unattended shift ends up running for eight hours under bounds nobody wrote
+ * — and the one thing an unattended run must not do is guess about its own limits.
+ */
+declare const loadCaps: (root: string) => Caps;
+/**
+ * The first configured ⚠AUTH pattern the text mentions, or nothing.
+ *
+ * Deliberately generous. The asymmetry is the whole design: a false pause costs a question, a false
+ * pass costs an unattended deploy — and only one of those can be undone by answering.
+ */
+declare const needsAuth: (text: string, patterns: string[]) => string | undefined;
+
+type CycleOutcome = {
+    exitCode: number;
+    sessionId?: string;
+    stdout: string;
+};
+type MainStatus = 'green' | 'red' | 'unknown';
+/**
+ * Everything the shift does to the outside world, in one object.
+ *
+ * A seam per side effect, because a shift runner that spawned processes could only be tested by
+ * spawning them — and the behaviour worth proving is WHEN it parks, which has nothing to do with
+ * how a process is started. Nothing here calls a model; the CLI supplies the real ones.
+ */
+type ShiftSeams = {
+    gate: (root: string) => {
+        ok: boolean;
+        tier: string;
+    } | undefined;
+    handoff: (why: string) => number;
+    mainStatus: () => MainStatus;
+    runCycle: (input: {
+        goal: string;
+        number: number;
+        resume?: string;
+    }) => CycleOutcome;
+    stopBlocks: (root: string) => number;
+};
+type ShiftCycle = {
+    exitCode: number;
+    number: number;
+    sessionId?: string;
+};
+type ShiftOutcome = {
+    cycles: ShiftCycle[];
+    parked: boolean;
+    parkedAt?: number;
+    reason: string;
+};
+type RunShiftInput = {
+    caps: Caps;
+    cycles: number;
+    goal: string;
+    root: string;
+    seams: ShiftSeams;
+};
+/**
+ * A shift: N cycles of one resumed session, with the handoff rewritten after each and a park
+ * instead of a blind cycle.
+ *
+ * ONE session, resumed — the polymorph pattern 2ndm1nd runs on, and it is not an optimisation.
+ * Scheduling tools die at turn-end inside `claude -p`, so an outer loop that woke something up would
+ * get a cold session every hour; resuming keeps the conversation, which is the only reason a second
+ * cycle is worth more than a first.
+ *
+ * Every park writes WHY into the handoff before it returns. A shift that stopped and said nothing is
+ * a shift nobody can resume, which in practice means a shift somebody restarts from the beginning.
+ */
+declare const runShift: ({ caps, cycles, goal, root, seams }: RunShiftInput) => ShiftOutcome;
+
+/**
+ * The session id out of a headless run's terminal event.
+ *
+ * This reads the same JSON shape `@geonosis/evals` reads, and it is deliberately NOT shared with it.
+ * The two are walled apart (`layer-walls`, planted in `dogfood.test.ts`) because a shift runner that
+ * imported the scorer would put a scorer inside the sandbox it is enforcing, and an evals package
+ * that imported the rails would make every repo scoring a run also install a sandbox renderer. They
+ * also want different fields for different reasons: the scorer needs `is_error` and
+ * `permission_denials`; a shift needs one string to resume with. Twelve lines is the honest price of
+ * two leaves, and the shape is documented once in
+ * `docs/evals-rails-inventory-2026-08-30.md` §3 where it was measured.
+ */
+declare const sessionOf: (output: string) => string | undefined;
+type SeamOptions = {
+    claude: string;
+    gh: string;
+    ledger: string;
+    root: string;
+};
+/**
+ * The real seams: a headless `claude -p`, `gh run list`, `geonosis-ledger handoff`, and two JSON
+ * files off disk.
+ *
+ * Every binary is an OPTION with a default rather than a hardcoded path — law 6, and the practical
+ * reason: `claude` is at `~/.local/bin/claude` on one machine and somewhere else on the next, and a
+ * test must be able to point them at something that is not a model.
+ */
+declare const realSeams: ({ claude, gh, ledger, root }: SeamOptions) => ShiftSeams;
+
+export { AUTH_CLASSES, CAP_DEFAULTS, type Caps, type ContainedRun, type CycleOutcome, type DeniedSnapshot, type MainStatus, PROFILE_PATH, RAILS_DENY_WRITE, type RunContainedInput, type RunShiftInput, type SandboxProfile, type SandboxProfileInput, type SeamOptions, type ShiftCycle, type ShiftOutcome, type ShiftSeams, type Spawn, type SpawnResult, UNSANDBOXED, canonicalise, deniedWrites, loadCaps, needsAuth, realSeams, renderBubblewrap, renderSeatbelt, runContained, runShift, sandboxProfile, sessionOf, snapshotDenied };

package/dist/index.js

@@ -0,0 +1,38 @@
+import {
+  AUTH_CLASSES,
+  CAP_DEFAULTS,
+  PROFILE_PATH,
+  RAILS_DENY_WRITE,
+  UNSANDBOXED,
+  canonicalise,
+  deniedWrites,
+  loadCaps,
+  needsAuth,
+  realSeams,
+  renderBubblewrap,
+  renderSeatbelt,
+  runContained,
+  runShift,
+  sandboxProfile,
+  sessionOf,
+  snapshotDenied
+} from "./chunk-SQQS5NHC.js";
+export {
+  AUTH_CLASSES,
+  CAP_DEFAULTS,
+  PROFILE_PATH,
+  RAILS_DENY_WRITE,
+  UNSANDBOXED,
+  canonicalise,
+  deniedWrites,
+  loadCaps,
+  needsAuth,
+  realSeams,
+  renderBubblewrap,
+  renderSeatbelt,
+  runContained,
+  runShift,
+  sandboxProfile,
+  sessionOf,
+  snapshotDenied
+};

package/dist/rails-cli.js

@@ -0,0 +1,158 @@
+import {
+  PROFILE_PATH,
+  canonicalise,
+  deniedWrites,
+  loadCaps,
+  realSeams,
+  renderBubblewrap,
+  renderSeatbelt,
+  runContained,
+  runShift,
+  sandboxProfile,
+  snapshotDenied
+} from "./chunk-SQQS5NHC.js";
+
+// src/rails-cli.ts
+import { spawnSync } from "child_process";
+import { mkdirSync, writeFileSync } from "fs";
+import { dirname, resolve } from "path";
+var REFUSED = 2;
+var USAGE = `usage: geonosis-rails <command>
+
+  profile [--root <dir>] [--allow-write <path> ...] [--deny-write <path> ...] [--deny-read <path> ...]
+          [--allow-net] [--format seatbelt|bwrap] [--out <file>]
+  contain [--root <dir>] [--allow-write <path> ...] [--deny-write <path> ...] [--allow-net] <command>
+  shift   --goal <command> [--cycles <n>] [--root <dir>] [--json]
+          [--claude <bin>] [--gh <bin>] [--ledger <bin>]`;
+var refuse = (message) => {
+  process.stderr.write(`geonosis-rails: ${message}
+`);
+  process.exit(REFUSED);
+};
+var args = process.argv.slice(2);
+var command = args[0];
+var valueAfter = (flag) => {
+  const at = args.lastIndexOf(flag);
+  if (at === -1) return void 0;
+  const next = args[at + 1];
+  if (next === void 0 || next.startsWith("--")) refuse(`${flag} needs a value`);
+  return next;
+};
+var valuesOf = (flag) => {
+  const found = [];
+  for (let at = 0; at < args.length; at += 1) {
+    if (args[at] !== flag) continue;
+    const next = args[at + 1];
+    if (next === void 0 || next.startsWith("--")) refuse(`${flag} needs a value`);
+    found.push(next ?? "");
+  }
+  return found;
+};
+var root = resolve(process.cwd(), valueAfter("--root") ?? ".");
+var profile = () => sandboxProfile({
+  allowNet: args.includes("--allow-net"),
+  allowWrite: valuesOf("--allow-write"),
+  denyRead: valuesOf("--deny-read"),
+  denyWrite: valuesOf("--deny-write"),
+  root
+});
+if (command === void 0 || command === "--help" || command === "-h") {
+  process.stdout.write(`${USAGE}
+`);
+  process.exit(command === void 0 ? REFUSED : 0);
+}
+if (command === "profile") {
+  const format = valueAfter("--format") ?? "seatbelt";
+  if (format !== "seatbelt" && format !== "bwrap") {
+    refuse(`no "${format}" renderer \u2014 known formats: seatbelt, bwrap`);
+  }
+  const real = canonicalise(profile());
+  const text = format === "bwrap" ? `${renderBubblewrap(real).join(" ")}
+` : renderSeatbelt(real);
+  const out = valueAfter("--out");
+  if (out !== void 0) {
+    const at = resolve(root, out);
+    mkdirSync(dirname(at), { recursive: true });
+    writeFileSync(at, text);
+  }
+  process.stdout.write(text);
+  process.exit(0);
+}
+if (command === "contain") {
+  const positional = args.slice(1).filter((one, at) => {
+    if (one.startsWith("--")) return false;
+    const before2 = args[at];
+    return before2 !== "--root" && before2 !== "--allow-write" && before2 !== "--deny-write" && before2 !== "--deny-read" && before2 !== "--format";
+  });
+  const toRun = positional.at(-1);
+  if (toRun === void 0) refuse(`contain needs a command to run \u2014 ${USAGE}`);
+  const built = profile();
+  const before = snapshotDenied(root, built.denyWrite);
+  const done = runContained({
+    command: toRun ?? "",
+    has: (binary) => spawnSync("command", ["-v", binary], { shell: true }).status === 0,
+    profile: built,
+    root,
+    spawn: (binary, argv, cwd) => {
+      const ran = spawnSync(binary, argv, {
+        cwd,
+        encoding: "utf8",
+        // No argv means the command is going through a shell as one string — the fail-open path.
+        shell: argv.length === 0,
+        stdio: "inherit"
+      });
+      return { exitCode: ran.status ?? -1, stderr: "", stdout: "" };
+    }
+  });
+  const wrote = deniedWrites(root, built.denyWrite, before, [PROFILE_PATH]);
+  for (const one of wrote) process.stderr.write(`geonosis-rails: ${one}
+`);
+  if (wrote.length > 0) {
+    process.stderr.write(
+      "geonosis-rails: the scored process wrote to a path it may not. That is the rail, and it holds whether or not the kernel was there to enforce it.\n"
+    );
+  }
+  process.exit(done.exitCode === 0 && wrote.length > 0 ? 1 : done.exitCode);
+}
+if (command === "shift") {
+  const goal = valueAfter("--goal");
+  if (goal === void 0) refuse(`shift needs --goal <command> \u2014 ${USAGE}`);
+  const raw = valueAfter("--cycles") ?? "1";
+  const cycles = Number(raw);
+  if (!Number.isInteger(cycles) || cycles < 1) {
+    refuse(`--cycles takes a whole number of one or more, got "${raw}"`);
+  }
+  let caps;
+  try {
+    caps = loadCaps(root);
+  } catch (error) {
+    refuse(error.message);
+  }
+  const outcome = runShift({
+    caps: caps ?? { auth: [], ciFixes: 2, draftPr: true, revisions: 2, stopBlocks: 5 },
+    cycles,
+    goal: goal ?? "",
+    root,
+    seams: realSeams({
+      claude: valueAfter("--claude") ?? "claude",
+      gh: valueAfter("--gh") ?? "gh",
+      ledger: valueAfter("--ledger") ?? "geonosis-ledger",
+      root
+    })
+  });
+  if (args.includes("--json")) {
+    process.stdout.write(`${JSON.stringify(outcome, null, 2)}
+`);
+  } else {
+    for (const cycle of outcome.cycles) {
+      process.stdout.write(`  cycle ${cycle.number}  exit ${cycle.exitCode}
+`);
+    }
+    process.stdout.write(
+      `${outcome.parked ? `shift PARKED at cycle ${outcome.parkedAt}` : "shift complete"} \u2014 ${outcome.reason}
+`
+    );
+  }
+  process.exit(outcome.parked ? 1 : 0);
+}
+refuse(`unknown command "${command}" \u2014 ${USAGE}`);

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@geonosis/rails",
+  "version": "1.0.0",
+  "description": "Sandbox profiles for an unattended run — data to a macOS seatbelt profile or a Linux bubblewrap argv — that fail OPEN and LOUD when they cannot be applied, plus the after-the-fact proof that the scored run never wrote the scoreboard.",
+  "keywords": [
+    "sandbox",
+    "seatbelt",
+    "bubblewrap",
+    "agent",
+    "rails",
+    "unattended",
+    "ci"
+  ],
+  "homepage": "https://github.com/microcompanies/geonosis/tree/main/packages/rails",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/microcompanies/geonosis.git",
+    "directory": "packages/rails"
+  },
+  "license": "Apache-2.0",
+  "type": "module",
+  "main": "dist/index.js",
+  "bin": {
+    "geonosis-rails": "bin/geonosis-rails.mjs"
+  },
+  "exports": {
+    ".": "./dist/index.js"
+  },
+  "files": [
+    "bin",
+    "dist"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsup",
+    "typecheck": "tsc --noEmit"
+  }
+}