@kici-dev/agent 0.6.0 → 0.7.0

package/dist/server.js

@@ -2,7 +2,7 @@ import { fileURLToPath as __cjs_fileURLToPath } from "node:url";
 import { dirname as __cjs_dirname } from "node:path";
 const __filename = __cjs_fileURLToPath(import.meta.url);
 __cjs_dirname(__filename);
-import { createRequire, register } from "node:module";
+import "node:module";
 import crypto$1, { createCipheriv, createHash, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes, randomUUID } from "node:crypto";
 import * as os$1 from "node:os";
 import os, { hostname, tmpdir } from "node:os";
@@ -10,18 +10,18 @@ import { PassThrough, Readable, Transform, Writable } from "node:stream";
 import { serve } from "@hono/node-server";
 import { Hono } from "hono";
 import winston from "winston";
-import { AgentDeliveryMode, AgentPlatform, RingBuffer, addLogsToArchive, chunkBuffer, createHealthRoutes, createLogger, createMeter, createMetricsRoutes, deriveSharedSecret, getPrometheusExporter, getReconnectDelay, getRequestContext, guardStartup, initTelemetry, kiciTmpBase, logger, normalizeLineEndings, redactConfig, requestContext, setServiceName, setupGracefulShutdown, sha256, sha256File, toErrorMessage, validateRequiredTools } from "@kici-dev/shared";
+import { AgentDeliveryMode, AgentPlatform, RingBuffer, addLogsToArchive, chunkBuffer, createHealthRoutes, createLogger, createMeter, createMetricsRoutes, deriveSharedSecret, getPrometheusExporter, getReconnectDelay, getRequestContext, guardStartup, initTelemetry, kiciTmpBase, logger, redactConfig, requestContext, setServiceName, setupGracefulShutdown, sha256, sha256File, toErrorMessage, validateRequiredTools } from "@kici-dev/shared";
 import { z } from "zod";
 import { LOGGER_ENV_VARS, defineEnv, validateUnknownKiciVars } from "@kici-dev/shared/env";
-import { ALLOWED_SYSTEM_VARS, ArtifactCompleteAckOutcome, CacheRunEventType, CacheStepType, ExecutionJobStatus, ExecutionStepStatus, InitFailureCategory, KNOWN_ROLES, LogStream, MAX_MATRIX_MATERIALIZATION, MatrixShapeError, PROTOCOL_VERSION, RuntimeFact, SANDBOX_DEFAULT_VARS, SetupStepType, WS_CLOSE_AGENT_AUTH_FAILED, WS_MAX_PAYLOAD_BYTES, applyIncludeExclude, buildTrustedPassthroughEnv, deriveOsArchLabels, expandMatrix, hasOrchAgentCapability, heartbeatSchema, hostLabel, matrixCombinationCount, mergeAutoLabels, orchestratorToAgentMessageSchema, parseHostPropertyAssignments, resolveRoleLabels, resolveWhenToRunOn, runtimeLabel, validateNoReservedLabels } from "@kici-dev/engine";
+import { ALLOWED_SYSTEM_VARS, ArtifactCompleteAckOutcome, CacheRunEventType, CacheStepType, ExecutionJobStatus, ExecutionStepStatus, InitFailureCategory, KNOWN_ROLES, LogStream, PROTOCOL_VERSION, RuntimeFact, SANDBOX_DEFAULT_VARS, SetupStepType, WS_CLOSE_AGENT_AUTH_FAILED, WS_MAX_PAYLOAD_BYTES, buildTrustedPassthroughEnv, deriveOsArchLabels, hasOrchAgentCapability, heartbeatSchema, hostLabel, mergeAutoLabels, orchestratorToAgentMessageSchema, parseHostPropertyAssignments, resolveRoleLabels, runtimeLabel, validateNoReservedLabels } from "@kici-dev/engine";
 import { execFile, execFileSync, execSync, fork, spawn } from "node:child_process";
-import fsPromises, { access, chmod, lstat, mkdir, mkdtemp, readFile, readdir, realpath, rm, unlink, writeFile } from "node:fs/promises";
+import fsPromises, { access, chmod, lstat, mkdir, mkdtemp, readFile, readdir, realpath, rename, rm, unlink, writeFile } from "node:fs/promises";
 import * as fs$1 from "node:fs";
 import fs, { createReadStream, createWriteStream, existsSync } from "node:fs";
 import path, { delimiter, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import WebSocket from "ws";
 import { ZipArchive } from "archiver";
-import { fileURLToPath, pathToFileURL } from "node:url";
+import { fileURLToPath } from "node:url";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { format, promisify } from "node:util";
 import { OTEL_DATA_POINT_TYPE, mapDataPointTypeToWireKind } from "@kici-dev/engine/metrics/metric-kind-compat";
@@ -30,18 +30,20 @@ import { makeTempDir } from "@kici-dev/core/tmp";
 import Docker from "dockerode";
 import { GIT_CREDENTIAL_REQUEST_METHOD } from "@kici-dev/engine/protocol/messages/git-credential-relay";
 import { createServer } from "node:net";
-import { buildKiciApi, buildNeedsContext, createFilterContext, isDynamicGroupRef, isDynamicJobFn, isParallelGroup, isStaticArray, isStaticObject, setJobOutputsMap, setStepOutputsMap, setStepRefMap } from "@kici-dev/sdk";
-import { $ } from "zx";
 import { c, x } from "tar";
+import { KICI_SOURCE_EXCLUDED_PREFIX } from "@kici-dev/core/kici-source-digest";
 import https from "node:https";
 import http from "node:http";
 import { pipeline } from "node:stream/promises";
 import { createGunzip } from "node:zlib";
-import { normalizeRunsOnToMatchers } from "@kici-dev/engine/labels/compile";
+import "@kici-dev/sdk";
+import "@kici-dev/engine/labels/compile";
+import { buildNeedsContext } from "@kici-dev/sdk/internal";
 import { PNPM_IGNORE_BUILD_GATE_ARG, PackageManager, YarnFlavor, detectPackageManagerFromManifests, detectYarnFlavor } from "@kici-dev/shared/package-manager";
 import { parse, stringify } from "yaml";
 import { createInterface } from "node:readline";
 import { RuntimeSubtree, ensureRuntimeVolume } from "@kici-dev/shared/container-runtime";
+import { JOB_NETWORK_SUBNET, addHostIsolationRules, addIsolationRules, buildHostAccessRuleOps, buildIsolationRuleOps, ensureKiciTable, readForwardChain, readInputChain, removeIsolationRules, validateNftablesAvailability } from "@kici-dev/shared/net";
 var __defProp = Object.defineProperty;
 var __esmMin = (fn, res, err) => () => {
 	if (err) throw err[0];
@@ -292,6 +294,10 @@ const configSchema = z.object({
 	sandboxHardened: z.string().default("true").transform((s) => s !== "false"),
 	sandboxReadonlyRootfs: z.string().default("false").transform((s) => s === "true"),
 	sandboxUser: z.string().optional(),
+	runnerUser: z.string().optional(),
+	runnerDebugStdio: z.string().default("false").transform((s) => s === "true"),
+	sandboxNetworkIsolation: z.string().default("true").transform((s) => s !== "false"),
+	allowInstallScripts: z.string().default("false").transform((s) => s === "true"),
 	sandboxPidsLimit: z.coerce.number().int().positive().default(512),
 	sandboxMemoryBytes: z.coerce.number().int().positive().default(2147483648),
 	sandboxNanoCpus: z.coerce.number().int().positive().default(2e9),
@@ -346,6 +352,10 @@ const envDef = defineEnv({
 		sandboxHardened: "KICI_SANDBOX_HARDENED",
 		sandboxReadonlyRootfs: "KICI_SANDBOX_READONLY_ROOTFS",
 		sandboxUser: "KICI_SANDBOX_USER",
+		runnerUser: "KICI_RUNNER_USER",
+		runnerDebugStdio: "KICI_RUNNER_DEBUG_STDIO",
+		sandboxNetworkIsolation: "KICI_SANDBOX_NETWORK_ISOLATION",
+		allowInstallScripts: "KICI_ALLOW_INSTALL_SCRIPTS",
 		sandboxPidsLimit: "KICI_SANDBOX_PIDS_LIMIT",
 		sandboxMemoryBytes: "KICI_SANDBOX_MEMORY_BYTES",
 		sandboxNanoCpus: "KICI_SANDBOX_NANO_CPUS",
@@ -399,6 +409,10 @@ const envDef = defineEnv({
 * - KICI_SCALER_CLAIM_CODE (optional single-use claim code the agent exchanges for its own ephemeral credentials before registering; ignored when KICI_AGENT_TOKEN is set)
 * - KICI_SCALER_IDLE_TIMEOUT (ms, default 5000) — how long a scaler-managed agent waits before shutdown after going idle
 * - KICI_SCALER_PENDING_DISPATCH_TIMEOUT (ms, default 60000) — extended idle window when register.ack signals a queued bound job
+* - KICI_RUNNER_USER (optional, uid | uid:gid | name) — run the bare-metal runner child as a dedicated user instead of the agent's own
+* - KICI_ALLOW_INSTALL_SCRIPTS (default: false) — re-enable package lifecycle scripts during the `.kici/` dependency install
+* - KICI_SANDBOX_NETWORK_ISOLATION (default: true) — RFC1918 + cloud-metadata egress filtering for nested job containers
+* - KICI_RUNNER_DEBUG_STDIO (default: false) — echo the runner child's raw stdio onto the agent's stderr
 * - KICI_EXECUTION_MODE (optional, options: container | bare-metal | firecracker) — override the runner's mode-pick logic
 * - KICI_CONCURRENCY_WAIT_TIMEOUT_MS (default: 3_600_000) — workflow-runner timeout when long-polling for a slot-release follow-up `concurrency.ack`
 * - KICI_AGENT_BETWEEN_JOBS_RESET_COMMAND (optional) — host-reset command run between jobs on a reused agent (fail-open)
@@ -407,16 +421,85 @@ const envDef = defineEnv({
 * - KICI_AGENT_ORPHAN_CLEANUP (default: true) — reap a finished job's leaked process tree (bare-metal); false = only signal the runner child
 * - KICI_AGENT_DRAIN_ON_RESET_FAILURE (default: false) — drain the agent after repeated consecutive reset failures
 */
+/**
+* Env vars the boot-time unknown-KICI_* validator tolerates **only** under
+* `NODE_ENV=test`. `KICI_SKIP_DB_TESTS` is the vitest Postgres harness's
+* opt-out (`scripts/db-test-postgres.ts`), so a suite run with it set must not
+* fail the agent's own config tests. Mirrors the orchestrator's list, which
+* already carries it. Under any other NODE_ENV the allowance is empty, so a
+* production boot with a stray one still fails the validator.
+*/
+const TEST_ONLY_ENV_VARS = ["KICI_SKIP_DB_TESTS"];
 function loadConfig() {
 	const data = envDef.parse();
 	if (!data.scalerManaged && !data.agentToken) validateNoReservedLabels(data.labels, "KICI_LABELS");
-	validateUnknownKiciVars([...envDef.listKnownEnvVars(), ...LOGGER_ENV_VARS]);
+	validateUnknownKiciVars([
+		...envDef.listKnownEnvVars(),
+		...LOGGER_ENV_VARS,
+		...process.env.NODE_ENV === "test" ? TEST_ONLY_ENV_VARS : []
+	]);
 	return {
 		...data,
 		agentId: data.agentId ?? `${hostname()}-${randomUUID().slice(0, 8)}`
 	};
 }
 /**
+* Environment variables holding an agent credential, removed from the agent's
+* own `process.env` once `loadConfig()` has read them into the config object.
+*
+* `KICI_ORCHESTRATOR_URL` is deliberately NOT here — it is a URL, not a
+* credential, and `resolveOrchestratorUrl` reads it from the environment in both
+* the agent and the runner child.
+*/
+const CREDENTIAL_ENV_VARS = [
+	"KICI_AGENT_TOKEN",
+	"KICI_SCALER_CLAIM_CODE",
+	"KICI_GITHUB_TOKEN"
+];
+/**
+* Remove the agent's own credentials from `process.env` after boot.
+*
+* The runner child runs as the agent's user under the default bare-metal
+* backend, so `/proc/<agent-pid>/environ` is readable from inside a job: a step
+* could print the agent token, register a rogue agent with it, and receive every
+* dispatch routed to this one. Stripping the variables closes that read on every
+* platform, whatever backend is selected.
+*
+* This is defence in depth, not isolation — a same-uid `ptrace` or
+* `/proc/<pid>/mem` read still reaches the value the config object holds. The
+* boundary is `KICI_RUNNER_USER` (a dedicated uid) or the container backend.
+*
+* Safe because each variable has exactly one reader: `loadConfig()`, which has
+* one caller and runs before this. Returns the names actually removed.
+*/
+function scrubCredentialEnv() {
+	const removed = [];
+	for (const name of CREDENTIAL_ENV_VARS) if (process.env[name] !== void 0) {
+		delete process.env[name];
+		removed.push(name);
+	}
+	return removed;
+}
+/**
+* Describe the runner-isolation posture when it offers no boundary between a
+* job's step code and the agent process, or `undefined` when one is in place.
+*
+* The exposed posture is the default bare-metal one: `KICI_SANDBOX=false` (a
+* plain `fork()`, no namespaces), no `KICI_RUNNER_USER`, and no container
+* backend. The child then runs as the agent's own user, so the env allowlist
+* that keeps the agent's credentials out of the child is not a credential
+* boundary — anything running as that uid can still reach the agent process.
+*
+* Reported as one startup warning naming both remedies, rather than refused:
+* bwrap is Linux-only and the container backend imposes a container runtime, so
+* neither can be a default without breaking existing installs.
+*/
+function describeExposedPosture(config) {
+	if (config.sandbox || config.runnerUser) return void 0;
+	if (config.executionMode === "container" && !config.jobImageAgent) return void 0;
+	return "Runner isolation is OFF: job steps run as this agent's own user, so a step can read the agent process (for example /proc/<pid>/mem) despite the environment allowlist. Set KICI_RUNNER_USER=<user> to give the runner child a dedicated uid, or KICI_SANDBOX=true (Linux, bubblewrap) for namespace isolation.";
+}
+/**
 * Connection/identity options for the orchestrator WebSocket client, derived
 * purely from config.
 *
@@ -548,7 +631,7 @@ async function buildAgentMiniBundle(opts) {
 * name is '@kici-dev/agent'. This is robust to the agent's bundled dist layout
 * (build-service.mjs emits dist/index.js / dist/server.js, so a fixed relative
 * depth would be wrong). Returns null when it can't be resolved so the
-* agent.register message simply omits the field rather than failing.
+* agent.register message omits the field rather than failing.
 */
 function readAgentVersion() {
 	try {
@@ -600,7 +683,7 @@ var LogBuffer = class extends RingBuffer {
 };
 //#endregion
 //#region src/ws/orchestrator-client.ts
-const logger$14 = createLogger({ prefix: "orchestrator-client" });
+const logger$16 = createLogger({ prefix: "orchestrator-client" });
 /**
 * How long to wait for `artifacts.upload.complete.ack` before failing the step.
 *
@@ -779,7 +862,7 @@ var OrchestratorClient = class OrchestratorClient {
 	*/
 	connect() {
 		if (this._state !== "disconnected") {
-			logger$14.warn("connect() called while not disconnected", { state: this._state });
+			logger$16.warn("connect() called while not disconnected", { state: this._state });
 			return;
 		}
 		this.intentionalDisconnect = false;
@@ -1376,7 +1459,7 @@ var OrchestratorClient = class OrchestratorClient {
 				}
 			});
 		} catch (err) {
-			logger$14.error("Failed to create WebSocket", { error: toErrorMessage(err) });
+			logger$16.error("Failed to create WebSocket", { error: toErrorMessage(err) });
 			this._state = "disconnected";
 			this.scheduleReconnect();
 			return;
@@ -1388,12 +1471,12 @@ var OrchestratorClient = class OrchestratorClient {
 			this.handleMessage(data);
 		});
 		this.ws.on("close", (code, reason) => {
-			logger$14.info("Orchestrator connection closed", {
+			logger$16.info("Orchestrator connection closed", {
 				code,
 				reason: reason.toString()
 			});
 			if (code === WS_CLOSE_AGENT_AUTH_FAILED) {
-				logger$14.error("Orchestrator closed with auth-failed code -- token is invalid or revoked. NOT retrying.", {
+				logger$16.error("Orchestrator closed with auth-failed code -- token is invalid or revoked. NOT retrying.", {
 					code,
 					reason: reason.toString()
 				});
@@ -1432,7 +1515,7 @@ var OrchestratorClient = class OrchestratorClient {
 			if (!this.intentionalDisconnect) this.scheduleReconnect();
 		});
 		this.ws.on("error", (err) => {
-			logger$14.error(`Orchestrator WebSocket error: ${err.message}`);
+			logger$16.error(`Orchestrator WebSocket error: ${err.message}`);
 			if (this.ws && this.ws.readyState === WebSocket.OPEN) this.ws.close();
 		});
 	}
@@ -1456,7 +1539,7 @@ var OrchestratorClient = class OrchestratorClient {
 		}
 		if (this.token) {
 			this._state = "authenticating";
-			logger$14.info("Connected to orchestrator, sending auth.request", {
+			logger$16.info("Connected to orchestrator, sending auth.request", {
 				url: this.url,
 				agentId: this.agentId
 			});
@@ -1467,7 +1550,7 @@ var OrchestratorClient = class OrchestratorClient {
 			}));
 		} else {
 			this._state = "registering";
-			logger$14.info("Connected to orchestrator, sending agent.register (no token)", {
+			logger$16.info("Connected to orchestrator, sending agent.register (no token)", {
 				url: this.url,
 				agentId: this.agentId
 			});
@@ -1481,7 +1564,7 @@ var OrchestratorClient = class OrchestratorClient {
 	* already been torn down with no reconnect).
 	*/
 	async performClaimExchange(claimCode) {
-		logger$14.info("Self-bootstrap: exchanging claim code for ephemeral credentials", {
+		logger$16.info("Self-bootstrap: exchanging claim code for ephemeral credentials", {
 			url: this.url,
 			agentId: this.agentId
 		});
@@ -1500,7 +1583,7 @@ var OrchestratorClient = class OrchestratorClient {
 		this.token = agentToken;
 		this.agentId = agentId;
 		this.labels = this.mergeClaimedLabels(labels);
-		logger$14.info("Self-bootstrap: adopted ephemeral credentials", { agentId });
+		logger$16.info("Self-bootstrap: adopted ephemeral credentials", { agentId });
 		return true;
 	}
 	/**
@@ -1517,7 +1600,7 @@ var OrchestratorClient = class OrchestratorClient {
 	* and close the socket. A one-shot provisioning run then exits visibly.
 	*/
 	failClaimPermanently(reason) {
-		logger$14.error("Self-bootstrap claim exchange failed -- claim code is invalid or expired. NOT retrying.", { reason });
+		logger$16.error("Self-bootstrap claim exchange failed -- claim code is invalid or expired. NOT retrying.", { reason });
 		this.authFailed = true;
 		this.intentionalDisconnect = true;
 		if (this.ws) {
@@ -1631,7 +1714,7 @@ var OrchestratorClient = class OrchestratorClient {
 			this.pendingUserArtifactRequests.set(record.messageId, record.pending);
 			this.resendableCompletes.set(record.messageId, record);
 			this.sendDirect(record.frame);
-			logger$14.info("Re-sent artifact upload-complete after reconnect", {
+			logger$16.info("Re-sent artifact upload-complete after reconnect", {
 				messageId: record.messageId,
 				attempt: record.attempts
 			});
@@ -1676,7 +1759,7 @@ var OrchestratorClient = class OrchestratorClient {
 	* and hand the ack's lifetime flags to `onRegistered`.
 	*/
 	handleRegisterAck(msg) {
-		logger$14.info("Registration acknowledged by orchestrator", {
+		logger$16.info("Registration acknowledged by orchestrator", {
 			agentId: msg.agentId,
 			labels: msg.labels,
 			scalerManaged: msg.scalerManaged,
@@ -1701,7 +1784,7 @@ var OrchestratorClient = class OrchestratorClient {
 		try {
 			raw = JSON.parse(data.toString());
 		} catch {
-			logger$14.warn("Malformed JSON received from orchestrator");
+			logger$16.warn("Malformed JSON received from orchestrator");
 			return;
 		}
 		const rawMsg = raw;
@@ -1761,13 +1844,13 @@ var OrchestratorClient = class OrchestratorClient {
 			switch (msg.type) {
 				case "auth.success":
 					if (this._state === "authenticating") {
-						logger$14.info("Authentication successful, sending agent.register", { connectionId: msg.connectionId });
+						logger$16.info("Authentication successful, sending agent.register", { connectionId: msg.connectionId });
 						this._state = "registering";
 						this.sendAgentRegister();
 					}
 					break;
 				case "auth.failure":
-					logger$14.error("Authentication FAILED -- token is invalid or expired. NOT retrying.", { reason: msg.reason });
+					logger$16.error("Authentication FAILED -- token is invalid or expired. NOT retrying.", { reason: msg.reason });
 					this.authFailed = true;
 					this.intentionalDisconnect = true;
 					if (this.ws) {
@@ -1780,14 +1863,14 @@ var OrchestratorClient = class OrchestratorClient {
 					this.handleRegisterAck(msg);
 					break;
 				case "job.dispatch":
-					logger$14.info("Job dispatch received", {
+					logger$16.info("Job dispatch received", {
 						runId: msg.runId,
 						jobId: msg.jobId
 					});
 					this.onJobDispatch(msg);
 					break;
 				case "job.cancel":
-					logger$14.info("Job cancel received", {
+					logger$16.info("Job cancel received", {
 						runId: msg.runId,
 						jobId: msg.jobId,
 						reason: msg.reason
@@ -1795,7 +1878,7 @@ var OrchestratorClient = class OrchestratorClient {
 					this.onJobCancel(msg);
 					break;
 				case "job.concurrency.ack": {
-					logger$14.info("Concurrency ack received", {
+					logger$16.info("Concurrency ack received", {
 						requestId: msg.requestId,
 						action: msg.action
 					});
@@ -1810,7 +1893,7 @@ var OrchestratorClient = class OrchestratorClient {
 					break;
 				}
 				case "step.approval-resolved": {
-					logger$14.info("Step approval resolved", {
+					logger$16.info("Step approval resolved", {
 						requestId: msg.requestId,
 						runId: msg.runId,
 						jobId: msg.jobId,
@@ -1830,7 +1913,7 @@ var OrchestratorClient = class OrchestratorClient {
 					break;
 				}
 				case "fleet.logs.request":
-					logger$14.info("Fleet log collection requested", {
+					logger$16.info("Fleet log collection requested", {
 						requestId: msg.requestId,
 						logWindowHours: msg.logWindowHours
 					});
@@ -1839,7 +1922,7 @@ var OrchestratorClient = class OrchestratorClient {
 			return;
 		}
 		if (heartbeatSchema.safeParse(raw).success) return;
-		logger$14.warn("Invalid message from orchestrator", { errors: parsed.error.issues });
+		logger$16.warn("Invalid message from orchestrator", { errors: parsed.error.issues });
 	}
 	flushBuffer() {
 		const events = this.eventBuffer.flush();
@@ -1853,11 +1936,11 @@ var OrchestratorClient = class OrchestratorClient {
 		}
 		this.disconnectedAt = null;
 		if (events.length > 0) {
-			logger$14.info("Flushing event buffer", { count: events.length });
+			logger$16.info("Flushing event buffer", { count: events.length });
 			for (const msg of events) this.sendDirect(msg);
 		}
 		if (logLines.length > 0) {
-			logger$14.info("Flushing log buffer", { count: logLines.length });
+			logger$16.info("Flushing log buffer", { count: logLines.length });
 			for (let i = 0; i < logLines.length; i += OrchestratorClient.LOG_BATCH_SIZE) {
 				const batch = logLines.slice(i, i + OrchestratorClient.LOG_BATCH_SIZE);
 				this.sendAgentLogMessage(batch);
@@ -1910,14 +1993,14 @@ var OrchestratorClient = class OrchestratorClient {
 	*/
 	blockMmdsAccess() {
 		if (process.getuid?.() !== 0) {
-			logger$14.info("MMDS iptables block skipped (non-root) — network isolation handled by orchestrator");
+			logger$16.info("MMDS iptables block skipped (non-root) — network isolation handled by orchestrator");
 			return;
 		}
 		try {
 			execSync("iptables -A OUTPUT -d 169.254.169.254 -j DROP", { timeout: 5e3 });
-			logger$14.info("MMDS access blocked via iptables");
+			logger$16.info("MMDS access blocked via iptables");
 		} catch (err) {
-			logger$14.warn("Failed to block MMDS access via iptables", { error: toErrorMessage(err) });
+			logger$16.warn("Failed to block MMDS access via iptables", { error: toErrorMessage(err) });
 		}
 	}
 	/**
@@ -1931,7 +2014,7 @@ var OrchestratorClient = class OrchestratorClient {
 				messageId: `config-ack-${agentId}-${Date.now()}`,
 				agentId
 			}));
-			logger$14.info("Config ACK sent to orchestrator", { agentId });
+			logger$16.info("Config ACK sent to orchestrator", { agentId });
 		}
 	}
 	startHeartbeat() {
@@ -1998,12 +2081,12 @@ var OrchestratorClient = class OrchestratorClient {
 	scheduleReconnect() {
 		this.cancelReconnect();
 		if (this.authFailed) {
-			logger$14.error("Not reconnecting: authentication permanently failed");
+			logger$16.error("Not reconnecting: authentication permanently failed");
 			return;
 		}
 		const delay = this.getReconnectDelay();
 		this.reconnectAttempts++;
-		logger$14.info("Scheduling reconnect", {
+		logger$16.info("Scheduling reconnect", {
 			attempt: this.reconnectAttempts,
 			delayMs: Math.round(delay)
 		});
@@ -2022,6 +2105,32 @@ var OrchestratorClient = class OrchestratorClient {
 //#endregion
 //#region src/execution/console-capture.ts
 /**
+* AsyncLocalStorage holding the active CaptureSink.
+*
+* When a sink is active, the patched console.* methods route formatted lines
+* to the sink. When no sink is active, the patched methods fall through to
+* the original console methods.
+*
+* Nested runCaptured() shadows the outer sink for the duration of the inner
+* scope; ALS restores the outer sink when the inner scope exits.
+*/
+const consoleCapture = new AsyncLocalStorage();
+const METHODS = [
+	"log",
+	"error",
+	"warn",
+	"info",
+	"debug"
+];
+const originals = {
+	log: console.log.bind(console),
+	error: console.error.bind(console),
+	warn: console.warn.bind(console),
+	info: console.info.bind(console),
+	debug: console.debug.bind(console)
+};
+let installed = false;
+/**
 * Install monkey-patches on console.log / error / warn / info / debug.
 *
 * Idempotent: subsequent calls are no-ops.
@@ -2046,56 +2155,18 @@ function installConsoleCapture() {
 		for (const line of lines) if (line) sink.addLine(line);
 	};
 }
-/**
-* Run `fn` with the given sink active. console.* calls inside `fn` and any
-* async descendants route to the sink until the returned promise resolves.
-*
-* If `installConsoleCapture()` has not been called, the sink is still tracked
-* in ALS but console.* calls are not intercepted.
-*/
-function runCaptured(sink, fn) {
-	return new Promise((resolve, reject) => {
-		consoleCapture.run(sink, () => {
-			try {
-				Promise.resolve(fn()).then(resolve, reject);
-			} catch (err) {
-				reject(err);
-			}
-		});
-	});
-}
-var consoleCapture, METHODS, originals, installed;
-var init_console_capture = __esmMin((() => {
-	consoleCapture = new AsyncLocalStorage();
-	METHODS = [
-		"log",
-		"error",
-		"warn",
-		"info",
-		"debug"
-	];
-	originals = {
-		log: console.log.bind(console),
-		error: console.error.bind(console),
-		warn: console.warn.bind(console),
-		info: console.info.bind(console),
-		debug: console.debug.bind(console)
-	};
-	installed = false;
-}));
 //#endregion
 //#region src/routes/health.ts
-init_console_capture();
 function safe(name, fallback = "unknown") {
 	switch (name) {
-		case "version": return "0.6.0";
-		case "buildCommit": return "e4a936029";
-		case "sdkVersion": return "0.6.0";
-		case "sdkBundleHash": return "22faf0da45de7c243ce87f80fd33ee51b1df52809fde457b16bb821678f65eb3";
-		case "sharedVersion": return "0.6.0";
+		case "version": return "0.7.0";
+		case "buildCommit": return "31843a21c";
+		case "sdkVersion": return "0.7.0";
+		case "sdkBundleHash": return "065963c7765dc8d87e04d45f57d7e15be1613da705e4ff3ec3742fd1408b7bf5";
+		case "sharedVersion": return "0.7.0";
 		case "sharedBundleHash": return "a79be949815735b9e36eecc716f7eb07aa36c7bffba62e798e7e19f31a474eff";
-		case "engineVersion": return "0.6.0";
-		case "engineBundleHash": return "e49533b19f122155b3a78d95d105f97da259c2a45dee579578324b0702c91708";
+		case "engineVersion": return "0.7.0";
+		case "engineBundleHash": return "380f6edf7e0e5cfe988fa0f98512de6e6864f4f2a7a8d07f67e2ab84ed637d19";
 		default: return fallback;
 	}
 }
@@ -2380,7 +2451,7 @@ async function gcStaleAgentTmpDirs(base = kiciTmpBase()) {
 * spawn fails and the caller clears the orchestrator's reboot-pending flag and
 * surfaces the error — the deadline sweep is the backstop.
 */
-const logger$13 = createLogger({ prefix: "reboot" });
+const logger$15 = createLogger({ prefix: "reboot" });
 /** The OS reboot primitive for a Node platform string. */
 function rebootCommandFor(platform) {
 	switch (platform) {
@@ -2418,7 +2489,7 @@ function issueReboot(platform = process.platform) {
 				stdio: "ignore"
 			});
 			child.on("error", (err) => {
-				logger$13.error("Reboot command failed to spawn", {
+				logger$15.error("Reboot command failed to spawn", {
 					cmd,
 					args,
 					error: String(err)
@@ -2426,14 +2497,14 @@ function issueReboot(platform = process.platform) {
 				reject(err);
 			});
 			child.on("exit", (code) => {
-				if (code !== 0 && code !== null) logger$13.warn("Reboot command exited non-zero (privilege denied?)", {
+				if (code !== 0 && code !== null) logger$15.warn("Reboot command exited non-zero (privilege denied?)", {
 					cmd,
 					args,
 					code
 				});
 			});
 			child.unref();
-			logger$13.info("Issued host reboot", {
+			logger$15.info("Issued host reboot", {
 				cmd,
 				args
 			});
@@ -3139,7 +3210,8 @@ async function startJobGitCredentials(args) {
 		helperPath: host.helperPath,
 		onGitGrantRequest,
 		withRef: (params) => {
-			const { credential, ...rest } = params;
+			const { credential, ref: incoming, ...rest } = params;
+			if (incoming !== void 0) throw new Error("git credential refs are resolved from the job's lock by name; pass 'credential', not 'ref'");
 			const ref = refFor(typeof credential === "string" ? credential : void 0);
 			return ref ? {
 				...rest,
@@ -3159,573 +3231,133 @@ var init_job_git_credentials = __esmMin((() => {
 	init_credential_helper_host();
 }));
 //#endregion
-//#region src/checkout/changed-files.ts
-/** Build the auth context for the fetches, mirroring git-clone.ts's auth. */
-async function buildAuthCtx(auth) {
-	if (!auth) return { args: [] };
-	if (auth.kind === "basic") {
-		const user = auth.user ?? "x-access-token";
-		return { args: ["-c", `http.extraHeader=Authorization: Basic ${Buffer.from(`${user}:${auth.secret}`).toString("base64")}`] };
-	}
-	const sshSetup = await setupSshAuth({
-		privateKey: auth.secret,
-		hostKeyPolicy: auth.sshHostKeyPolicy,
-		knownHosts: auth.sshKnownHostsPem
+//#region src/execution/source-packer.ts
+/**
+* `.kici/` source tarball creation for build agents.
+*
+* After cloning a customer repo, packs the `.kici/` directory (excluding
+* `node_modules/` — that lives in its own cached tarball per `dep-packer.ts`)
+* into a deterministic gzip tarball. The tarball bytes are hashed for
+* integrity verification on the execution-job side.
+*
+* The returned hash is the tarball's OWN digest. The orchestrator stores the
+* object under it and the restoring agent verifies the downloaded bytes against
+* it, the same contract the dependency tarball has always had; a separate
+* pointer resolves the workflow `contentHash` to it.
+*/
+async function packKiciSource(workDir) {
+	const kiciDir = join(workDir, ".kici");
+	if (!existsSync(kiciDir)) throw new Error(`.kici/ not found at ${kiciDir}`);
+	logger$14.info("Packing .kici/ source tarball", { dir: workDir });
+	const startTime = Date.now();
+	const stream = c({
+		gzip: true,
+		cwd: workDir,
+		portable: true,
+		filter: (filePath) => !filePath.startsWith(KICI_SOURCE_EXCLUDED_PREFIX)
+	}, [".kici"]);
+	const chunks = [];
+	for await (const chunk of stream) chunks.push(Buffer.from(chunk));
+	const tarball = Buffer.concat(chunks);
+	const hash = sha256(tarball);
+	const sizeKB = (tarball.length / 1024).toFixed(2);
+	const durationMs = Date.now() - startTime;
+	logger$14.info(".kici/ source packed", {
+		sizeKB,
+		hash: hash.slice(0, 12),
+		durationMs
 	});
 	return {
-		args: [],
-		env: { GIT_SSH_COMMAND: sshSetup.gitSshCommand },
-		cleanup: () => sshSetup.cleanup()
+		tarball,
+		hash
 	};
 }
-function git(workDir, args, ctx) {
-	return execFileSync("git", [
-		...ctx.args,
-		...BASE_GIT_ARGS,
-		"-C",
-		workDir,
-		...args
-	], {
-		encoding: "utf8",
-		stdio: [
-			"ignore",
-			"pipe",
-			"pipe"
-		],
-		...ctx.env && { env: {
-			...process.env,
-			...ctx.env
-		} }
-	});
-}
-function tryGit(workDir, args, ctx) {
-	try {
-		git(workDir, args, ctx);
-		return true;
-	} catch {
-		return false;
-	}
+var logger$14;
+var init_source_packer = __esmMin((() => {
+	logger$14 = createLogger({ prefix: "source-packer" });
+}));
+//#endregion
+//#region src/execution/dep-restore.ts
+/**
+* Dependency restoration from cached tarballs.
+*
+* Downloads a pre-built dependency tarball, verifies SHA-256 integrity,
+* and extracts to .kici/node_modules/ in the work directory.
+*
+* HTTP/HTTPS downloads use a streaming pipeline (response -> hash transform ->
+* gunzip -> tar extract) to avoid buffering entire tarballs in memory.
+* file:// URLs use a buffer-based approach (local, no streaming benefit).
+*
+* Streaming downloads have a 5-minute timeout and up to 2 retries.
+*/
+/**
+* Compute SHA-256 hash of a buffer.
+*/
+function computeHash(data) {
+	return sha256(data);
 }
-function parseNameOnly(out) {
-	return out.split("\n").map((s) => s.replace(/\r$/, "")).filter((s) => s.length > 0);
+/**
+* Extract a gzip tarball from a buffer into the target directory.
+* Used for file:// URLs where streaming provides no benefit.
+*/
+async function extractTarball(data, targetDir) {
+	await mkdir(targetDir, { recursive: true });
+	const readable = Readable.from(data);
+	await new Promise((resolve, reject) => {
+		readable.pipe(x({
+			cwd: targetDir,
+			gzip: true
+		})).on("finish", resolve).on("error", reject);
+	});
 }
-/** Ensure `commitish` exists locally; fetch / deepen (bounded) if not. */
-function ensureCommit(workDir, commitish, ctx) {
-	if (tryGit(workDir, [
-		"cat-file",
-		"-e",
-		`${commitish}^{commit}`
-	], ctx)) return true;
-	if (tryGit(workDir, [
-		"fetch",
-		"--depth",
-		"1",
-		"origin",
-		commitish
-	], ctx)) {
-		if (tryGit(workDir, [
-			"cat-file",
-			"-e",
-			`${commitish}^{commit}`
-		], ctx)) return true;
-	}
-	for (let i = 0; i < MAX_DEEPEN; i++) {
-		if (!tryGit(workDir, [
-			"fetch",
-			`--deepen=${DEEPEN_STEP}`,
-			"origin"
-		], ctx)) break;
-		if (tryGit(workDir, [
-			"cat-file",
-			"-e",
-			`${commitish}^{commit}`
-		], ctx)) return true;
-	}
-	return false;
+/**
+* Stream download and extract an HTTP/HTTPS tarball.
+*
+* Computes SHA-256 hash on the fly via a Transform stream.
+* Returns the computed hash of the compressed tarball data.
+*/
+async function streamFetchAndExtract(url, targetDir) {
+	const response = await fetch(url, { signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS$1) });
+	if (!response.ok) throw new Error(`HTTP ${response.status}: ${response.statusText}`);
+	if (!response.body) throw new Error("No response body");
+	const nodeStream = Readable.fromWeb(response.body);
+	const hash = createHash("sha256");
+	const hashTransform = new Transform({ transform(chunk, _encoding, callback) {
+		hash.update(chunk);
+		callback(null, chunk);
+	} });
+	await mkdir(targetDir, { recursive: true });
+	await pipeline(nodeStream, hashTransform, createGunzip(), x({ cwd: targetDir }));
+	return hash.digest("hex");
 }
-function pushDiff(workDir, before, ctx) {
-	const isZero = !before || ZERO_SHA.test(before);
-	const baseRef = isZero ? EMPTY_TREE_SHA : before;
-	if (!isZero && !ensureCommit(workDir, before, ctx)) return {
-		files: [],
-		status: "unavailable"
-	};
+/**
+* Extract the dep tarball into a per-attempt scratch dir so retries never race
+* with still-draining I/O from a previous failed attempt.
+*
+* When `pipeline()` rejects on a network error or AbortSignal timeout, the
+* underlying `tar.x` continues flushing pending file writes for an unbounded
+* window after the promise settles — `pipeline` does not block on async
+* filesystem side effects. If the next retry then runs `rm -rf` on the same
+* `node_modules/`, the walk races with those writes and `rmdir` fails with
+* ENOTEMPTY (new files keep appearing under a directory we just emptied).
+*
+* We sidestep the race entirely by extracting each attempt into a unique
+* scratch dir under `.kici/`. Failed attempts leave orphan scratch dirs whose
+* draining writes are harmless — the next attempt does not touch them. On
+* success `moveScratchIntoRepo` renames the extracted entries into place
+* (atomic on the same filesystem), then best-effort cleans the scratch dir.
+*
+* Scratch dirs land inside the customer's cloned working tree, so the clone
+* phase registers `SCRATCH_DIR_GIT_EXCLUDE_GLOB` in `.git/info/exclude` to
+* keep them out of `git status` for any workflow step that shells out to git.
+* See `excludeScratchFromGit`.
+*/
+async function extractIntoScratch(url, kiciDir, attempt) {
+	const scratchDir = join(kiciDir, `${SCRATCH_DIR_BASENAME_PREFIX}${process.pid}-${attempt}-${Date.now()}`);
+	await mkdir(scratchDir, { recursive: true });
 	return {
-		files: parseNameOnly(git(workDir, [
-			"diff",
-			"--name-only",
-			baseRef,
-			"HEAD"
-		], ctx)),
-		status: "fetched"
-	};
-}
-function prDiff(workDir, base, ctx) {
-	const candidates = [
-		base,
-		`origin/${base}`,
-		"FETCH_HEAD"
-	];
-	const resolveBase = () => candidates.find((c) => tryGit(workDir, [
-		"rev-parse",
-		"--verify",
-		`${c}^{commit}`
-	], ctx));
-	let baseRef = resolveBase();
-	if (!baseRef) {
-		if (!ensureCommit(workDir, base, ctx)) return {
-			files: [],
-			status: "unavailable"
-		};
-		baseRef = resolveBase();
-	}
-	if (!baseRef) return {
-		files: [],
-		status: "unavailable"
-	};
-	for (let i = 0; i <= MAX_DEEPEN; i++) {
-		if (tryGit(workDir, [
-			"merge-base",
-			baseRef,
-			"HEAD"
-		], ctx)) return {
-			files: parseNameOnly(git(workDir, [
-				"diff",
-				"--name-only",
-				`${baseRef}...HEAD`
-			], ctx)),
-			status: "fetched"
-		};
-		if (!tryGit(workDir, [
-			"fetch",
-			`--deepen=${DEEPEN_STEP}`,
-			"origin"
-		], ctx)) break;
-	}
-	return {
-		files: [],
-		status: "unavailable"
-	};
-}
-/**
-* Compute the changed-files list from the agent's local clone (HEAD is the
-* checked-out head commit). Ground truth for job/step rule evaluation. `auth`
-* (the same credentials used for the clone) authenticates the deepen / fetch
-* calls so a private remote resolves. Returns `unavailable` for diff-less
-* events (schedule/tag/manual) or any git failure — never throws.
-*/
-async function computeChangedFiles(workDir, event, auth) {
-	let ctx;
-	try {
-		if (event.type !== "push" && event.type !== "pull_request") return {
-			files: [],
-			status: "unavailable"
-		};
-		ctx = await buildAuthCtx(auth);
-		if (event.type === "push") return pushDiff(workDir, event.payload?.before ?? "", ctx);
-		const base = event.baseBranch ?? event.targetBranch;
-		if (!base) return {
-			files: [],
-			status: "unavailable"
-		};
-		return prDiff(workDir, base, ctx);
-	} catch {
-		return {
-			files: [],
-			status: "unavailable"
-		};
-	} finally {
-		if (ctx?.cleanup) await ctx.cleanup().catch(() => {});
-	}
-}
-var EMPTY_TREE_SHA, ZERO_SHA, MAX_DEEPEN, DEEPEN_STEP, BASE_GIT_ARGS;
-var init_changed_files = __esmMin((() => {
-	init_ssh_auth();
-	EMPTY_TREE_SHA = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
-	ZERO_SHA = /^0+$/;
-	MAX_DEEPEN = 4;
-	DEEPEN_STEP = 50;
-	BASE_GIT_ARGS = [
-		"-c",
-		"safe.directory=*",
-		"-c",
-		"core.quotePath=false"
-	];
-}));
-//#endregion
-//#region src/execution/generator-context.ts
-/**
-* Build the context handed to a `DynamicJobFn`.
-*
-* Optional members are spread conditionally rather than assigned `undefined`,
-* so an absent `needs` / repo pair leaves no key behind — a present-but-
-* undefined key reads as "declared" to a generator and serializes differently
-* between the two evaluations.
-*/
-function buildGeneratorContext(input) {
-	const { workflowName, event, env, repos, needs, $, log, kici } = input;
-	return {
-		$,
-		ctx: {
-			workflow: { name: workflowName },
-			event,
-			...needs && { needs }
-		},
-		log,
-		env,
-		kici,
-		...repos && {
-			sourceRepo: repos.sourceRepo,
-			workflowRepo: repos.workflowRepo
-		}
-	};
-}
-var init_generator_context = __esmMin((() => {}));
-//#endregion
-//#region src/execution/workflow-loader.ts
-/**
-* Workflow module loading: transforms `.ts` workflow files on import via the
-* `@kici-dev/core/ts-loader-hook` oxc-transform ESM loader hook. Customer
-* workflow code is imported
-* directly from the cloned / extracted source tree — no intermediate bundle,
-* no Rolldown step at runtime. `@kici-dev/sdk` and host-repo deps resolve via
-* Node's normal ESM lookup against `.kici/node_modules/`.
-*/
-var workflow_loader_exports = /* @__PURE__ */ __exportAll({
-	COMPILE_SCHEMA_VERSION: () => 5,
-	ensureLoaderHookRegistered: () => ensureLoaderHookRegistered,
-	extractDynamicJobFn: () => extractDynamicJobFn,
-	extractSteps: () => extractSteps,
-	extractStepsFromDynamicJob: () => extractStepsFromDynamicJob,
-	extractWorkflow: () => extractWorkflow,
-	loadWorkflowSource: () => loadWorkflowSource,
-	resolveWorkflowSdkSetters: () => resolveWorkflowSdkSetters
-});
-/**
-* Resolve the `@kici-dev/sdk` instance the workflow module itself imports.
-*
-* The workflow's `.result` proxies read the module-global step-outputs map of
-* whichever SDK copy the workflow file resolves — which is generally a
-* different physical module than the agent's bundled SDK (the workflow is
-* imported from the cloned source tree and resolves its deps against that
-* tree's `node_modules`). Resolving via `createRequire(workflowFilePath)` walks
-* `node_modules` from the workflow file exactly the way the workflow's own
-* `import '@kici-dev/sdk'` does — including any hoisted copy — so the returned
-* setters mutate the SAME module-global map object the proxies read. Node caches
-* ESM modules by resolved URL, so importing that path yields the workflow's live
-* singleton, not a fresh copy.
-*
-* Falls back to the agent's bundled setters when resolution fails (mirrors
-* `resolveSdkSetters` in the compiler's test runner).
-*/
-async function resolveWorkflowSdkSetters(workflowFilePath) {
-	try {
-		const sdkEntry = createRequire(workflowFilePath).resolve("@kici-dev/sdk");
-		const sdk = await import(pathToFileURL(sdkEntry).href);
-		if (typeof sdk.setStepOutputsMap === "function" && typeof sdk.setStepRefMap === "function" && typeof sdk.setJobOutputsMap === "function") return {
-			setStepOutputsMap: sdk.setStepOutputsMap,
-			setStepRefMap: sdk.setStepRefMap,
-			setJobOutputsMap: sdk.setJobOutputsMap
-		};
-	} catch {}
-	return {
-		setStepOutputsMap,
-		setStepRefMap,
-		setJobOutputsMap
-	};
-}
-function ensureLoaderHookRegistered() {
-	if (hookRegistered) return;
-	const hookPath = process.env.KICI_TS_LOADER_HOOK_PATH;
-	if (hookPath) register(pathToFileURL(hookPath).href, import.meta.url);
-	else register("@kici-dev/core/ts-loader-hook", import.meta.url);
-	hookRegistered = true;
-}
-/**
-* Compute content hash for a workflow (same formula as `@kici-dev/compiler`
-* lockfile/hasher.ts). Used to verify the loaded source matches the lock
-* file's contentHash when `expectedContentHash` is provided.
-*
-* Line endings in `rawSource` (and inside `assetDigest`) are normalized to LF
-* before hashing. This matches the compiler-side normalization in
-* `@kici-dev/compiler` `lockfile/hasher.ts` so Windows agents — where Git's
-* `core.autocrlf=true` system default checks out text files with CRLF — agree
-* with lockfiles compiled on Linux (LF).
-*/
-function computeContentHash(rawSource, assetDigest) {
-	let input = `5:${normalizeLineEndings(rawSource)}`;
-	if (assetDigest !== void 0 && assetDigest.length > 0) input += `\0${normalizeLineEndings(assetDigest)}`;
-	return sha256(input);
-}
-async function buildAssetDigestFromResolvedPaths(workDir, resolvedPaths) {
-	const parts = [];
-	for (const rel of resolvedPaths) {
-		const abs = path.join(workDir, rel);
-		try {
-			const content = await fsPromises.readFile(abs, "utf-8");
-			parts.push(`${rel}\n${content}`);
-		} catch {
-			parts.push(`${rel}\n`);
-		}
-	}
-	return parts.join("");
-}
-/**
-* Load a workflow module by dynamic-importing its source file.
-*
-* Registers the oxc-transform loader hook (idempotent), then dynamic-imports
-* the `.ts` file. Transitive imports resolve against the workspace's
-* `node_modules/` the same way any `tsx`-style runner would — so host-repo
-* helpers and `@kici-dev/sdk` Just Work.
-*
-* When `expectedContentHash` is provided, verifies the raw source matches
-* the hash in the lock file. Drift between source and lock file produces a
-* descriptive error that surfaces the baked agent SDK fingerprint (useful
-* when debugging "is the agent running a stale build?").
-*/
-async function loadWorkflowSource(workDir, sourceFile, expectedContentHash, resolvedHashFiles) {
-	ensureLoaderHookRegistered();
-	const filePath = path.join(workDir, sourceFile);
-	if (expectedContentHash) {
-		const rawSource = await fsPromises.readFile(filePath, "utf-8");
-		let assetDigest;
-		if (resolvedHashFiles?.length) assetDigest = await buildAssetDigestFromResolvedPaths(workDir, resolvedHashFiles);
-		const actualHash = computeContentHash(rawSource, assetDigest);
-		if (actualHash !== expectedContentHash) throw new Error(`Lock file is out of date: workflow source changed without regenerating kici.lock.json (expected contentHash ${expectedContentHash}, got ${actualHash}, agent baked @kici-dev/sdk@${AGENT_SDK_VERSION} bundleHash=${AGENT_SDK_BUNDLE_HASH}). Run 'kici compile' and commit the updated lock file.`);
-	}
-	return {
-		module: await import(pathToFileURL(filePath).href + `?t=${Date.now()}`),
-		sdkSetters: await resolveWorkflowSdkSetters(filePath)
-	};
-}
-/**
-* Type guard for Workflow shape (discriminant: `_tag === 'Workflow'`).
-*/
-function isWorkflow(value) {
-	return typeof value === "object" && value !== null && "_tag" in value && value._tag === "Workflow";
-}
-/**
-* Extract a workflow by name from a module's exports.
-*
-* Searches:
-* 1. Default export (single Workflow or array of Workflows)
-* 2. Named exports
-*/
-function extractWorkflow(module, workflowName) {
-	if (module.default) {
-		const defaultExport = module.default;
-		if (isWorkflow(defaultExport) && defaultExport.name === workflowName) return defaultExport;
-		if (Array.isArray(defaultExport)) {
-			const found = defaultExport.find((item) => isWorkflow(item) && item.name === workflowName);
-			if (found) return found;
-		}
-	}
-	for (const [, value] of Object.entries(module)) if (isWorkflow(value) && value.name === workflowName) return value;
-	throw new Error(`Workflow '${workflowName}' not found in module exports`);
-}
-/**
-* Extract a dynamic job function from a workflow by index.
-*/
-function extractDynamicJobFn(workflow, index) {
-	if (index < 0 || index >= workflow.jobs.length) throw new Error(`Job index ${index} out of bounds (workflow '${workflow.name}' has ${workflow.jobs.length} jobs)`);
-	const item = workflow.jobs[index];
-	if (!isDynamicJobFn(item)) throw new Error(`Job at index ${index} in workflow '${workflow.name}' is not a dynamic job fn`);
-	return item;
-}
-/**
-* Extract steps from a static job within a workflow.
-*/
-function extractSteps(workflow, jobName) {
-	for (const item of workflow.jobs) if (!isDynamicJobFn(item) && item.name === jobName) return item.steps;
-	throw new Error(`Static job '${jobName}' not found in workflow '${workflow.name}'`);
-}
-/**
-* Extract steps from a job generated by a DynamicJobFn.
-*
-* Re-evaluates the DynamicJobFn to get the generated Job[] array, then finds
-* the job by name and returns its steps. This is necessary because
-* DynamicJobFn-generated jobs' step functions are closures that can only be
-* obtained by calling the DynamicJobFn again.
-*
-* The function must be deterministic: given the same event context, it should
-* return the same jobs with the same step functions. When `expectedJobNames`
-* is provided, the re-evaluated output is compared against the original eval.
-* A sibling mismatch logs a warning; a missing target job throws a clear
-* determinism error.
-*/
-async function extractStepsFromDynamicJob(workflow, dynamicIndex, jobName, event, env, apiTransport, expectedJobNames, upstreamSnapshot, declaredNeeds, repos) {
-	const dynamicFn = extractDynamicJobFn(workflow, dynamicIndex);
-	const { $ } = await import("zx");
-	const { createLogger } = await import("@kici-dev/shared");
-	const { buildKiciApi, buildNeedsContext } = await import("@kici-dev/sdk");
-	const log = createLogger({ prefix: `dynamic-job-fn:${workflow.name}` });
-	const kici = buildKiciApi(apiTransport ?? (() => Promise.reject(/* @__PURE__ */ new Error("Agent API not available during re-evaluation"))));
-	const needs = upstreamSnapshot ? buildNeedsContext(upstreamSnapshot, declaredNeeds ?? []) : void 0;
-	const generatedJobs = await dynamicFn(buildGeneratorContext({
-		workflowName: workflow.name,
-		event,
-		env,
-		...repos && { repos },
-		...needs && { needs },
-		$,
-		log,
-		kici
-	}));
-	const actualNames = generatedJobs.map((j) => j.name);
-	let droppedJobs = [];
-	if (expectedJobNames) {
-		const expectedSet = new Set(expectedJobNames);
-		const actualSet = new Set(actualNames);
-		const missing = expectedJobNames.filter((n) => !actualSet.has(n));
-		const extra = actualNames.filter((n) => !expectedSet.has(n));
-		droppedJobs = missing.filter((n) => n !== jobName);
-		if (missing.length > 0 || extra.length > 0) {
-			const detail = (missing.length > 0 ? `missing: [${missing.join(", ")}]` : "") + (missing.length > 0 && extra.length > 0 ? "; " : "") + (extra.length > 0 ? `unexpected: [${extra.join(", ")}]` : "");
-			if (missing.includes(jobName)) throw new Error(`DynamicJobFn non-deterministic re-evaluation: job '${jobName}' no longer exists (workflow '${workflow.name}', index ${dynamicIndex}). Original eval produced: [${expectedJobNames.join(", ")}], re-eval produced: [${actualNames.join(", ")}]. DynamicJobFn must return the same jobs given the same event context. See docs/architecture/dynamic-jobs.md for guidance.`);
-			log.warn(`DynamicJobFn non-deterministic re-evaluation detected (workflow '${workflow.name}', index ${dynamicIndex}): ${detail}. Target job '${jobName}' still exists — proceeding. DynamicJobFn should return the same jobs given the same event context.`);
-		}
-	}
-	for (const genJob of generatedJobs) if (genJob.name === jobName) return {
-		steps: genJob.steps,
-		droppedJobs
-	};
-	throw new Error(`Generated job '${jobName}' not found in DynamicJobFn output (workflow '${workflow.name}', index ${dynamicIndex}). Available: ${actualNames.join(", ")}`);
-}
-var AGENT_SDK_VERSION, AGENT_SDK_BUNDLE_HASH, hookRegistered;
-var init_workflow_loader = __esmMin((() => {
-	init_generator_context();
-	AGENT_SDK_VERSION = "0.6.0";
-	AGENT_SDK_BUNDLE_HASH = "22faf0da45de7c243ce87f80fd33ee51b1df52809fde457b16bb821678f65eb3";
-	hookRegistered = false;
-}));
-//#endregion
-//#region src/execution/source-packer.ts
-/**
-* `.kici/` source tarball creation for build agents.
-*
-* After cloning a customer repo, packs the `.kici/` directory (excluding
-* `node_modules/` — that lives in its own cached tarball per `dep-packer.ts`)
-* into a deterministic gzip tarball. The tarball bytes are hashed for
-* integrity verification on the execution-job side.
-*
-* The artifact is content-addressed by the compiler's `contentHash` (hash of
-* the raw workflow entry + asset digest), not by the tarball bytes — so the
-* orchestrator's cache lookup keys unchanged while the stored bytes switch
-* from a Rolldown bundle to a raw-source tarball.
-*/
-async function packKiciSource(workDir) {
-	const kiciDir = join(workDir, ".kici");
-	if (!existsSync(kiciDir)) throw new Error(`.kici/ not found at ${kiciDir}`);
-	logger$12.info("Packing .kici/ source tarball", { dir: workDir });
-	const startTime = Date.now();
-	const stream = c({
-		gzip: true,
-		cwd: workDir,
-		portable: true,
-		filter: (filePath) => !filePath.startsWith(".kici/node_modules")
-	}, [".kici"]);
-	const chunks = [];
-	for await (const chunk of stream) chunks.push(Buffer.from(chunk));
-	const tarball = Buffer.concat(chunks);
-	const hash = sha256(tarball);
-	const sizeKB = (tarball.length / 1024).toFixed(2);
-	const durationMs = Date.now() - startTime;
-	logger$12.info(".kici/ source packed", {
-		sizeKB,
-		hash: hash.slice(0, 12),
-		durationMs
-	});
-	return {
-		tarball,
-		hash
-	};
-}
-var logger$12;
-var init_source_packer = __esmMin((() => {
-	logger$12 = createLogger({ prefix: "source-packer" });
-}));
-//#endregion
-//#region src/execution/dep-restore.ts
-/**
-* Dependency restoration from cached tarballs.
-*
-* Downloads a pre-built dependency tarball, verifies SHA-256 integrity,
-* and extracts to .kici/node_modules/ in the work directory.
-*
-* HTTP/HTTPS downloads use a streaming pipeline (response -> hash transform ->
-* gunzip -> tar extract) to avoid buffering entire tarballs in memory.
-* file:// URLs use a buffer-based approach (local, no streaming benefit).
-*
-* Streaming downloads have a 5-minute timeout and up to 2 retries.
-*/
-/**
-* Compute SHA-256 hash of a buffer.
-*/
-function computeHash(data) {
-	return sha256(data);
-}
-/**
-* Extract a gzip tarball from a buffer into the target directory.
-* Used for file:// URLs where streaming provides no benefit.
-*/
-async function extractTarball(data, targetDir) {
-	await mkdir(targetDir, { recursive: true });
-	const readable = Readable.from(data);
-	await new Promise((resolve, reject) => {
-		readable.pipe(x({
-			cwd: targetDir,
-			gzip: true
-		})).on("finish", resolve).on("error", reject);
-	});
-}
-/**
-* Stream download and extract an HTTP/HTTPS tarball.
-*
-* Computes SHA-256 hash on the fly via a Transform stream.
-* Returns the computed hash of the compressed tarball data.
-*/
-async function streamFetchAndExtract(url, targetDir) {
-	const response = await fetch(url, { signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS$1) });
-	if (!response.ok) throw new Error(`HTTP ${response.status}: ${response.statusText}`);
-	if (!response.body) throw new Error("No response body");
-	const nodeStream = Readable.fromWeb(response.body);
-	const hash = createHash("sha256");
-	const hashTransform = new Transform({ transform(chunk, _encoding, callback) {
-		hash.update(chunk);
-		callback(null, chunk);
-	} });
-	await mkdir(targetDir, { recursive: true });
-	await pipeline(nodeStream, hashTransform, createGunzip(), x({ cwd: targetDir }));
-	return hash.digest("hex");
-}
-/**
-* Extract the dep tarball into a per-attempt scratch dir so retries never race
-* with still-draining I/O from a previous failed attempt.
-*
-* When `pipeline()` rejects on a network error or AbortSignal timeout, the
-* underlying `tar.x` continues flushing pending file writes for an unbounded
-* window after the promise settles — `pipeline` does not block on async
-* filesystem side effects. If the next retry then runs `rm -rf` on the same
-* `node_modules/`, the walk races with those writes and `rmdir` fails with
-* ENOTEMPTY (new files keep appearing under a directory we just emptied).
-*
-* We sidestep the race entirely by extracting each attempt into a unique
-* scratch dir under `.kici/`. Failed attempts leave orphan scratch dirs whose
-* draining writes are harmless — the next attempt does not touch them. On
-* success `moveScratchIntoRepo` renames the extracted entries into place
-* (atomic on the same filesystem), then best-effort cleans the scratch dir.
-*
-* Scratch dirs land inside the customer's cloned working tree, so the clone
-* phase registers `SCRATCH_DIR_GIT_EXCLUDE_GLOB` in `.git/info/exclude` to
-* keep them out of `git status` for any workflow step that shells out to git.
-* See `excludeScratchFromGit`.
-*/
-async function extractIntoScratch(url, kiciDir, attempt) {
-	const scratchDir = join(kiciDir, `${SCRATCH_DIR_BASENAME_PREFIX}${process.pid}-${attempt}-${Date.now()}`);
-	await mkdir(scratchDir, { recursive: true });
-	return {
-		scratchDir,
-		hash: await streamFetchAndExtract(url, scratchDir)
+		scratchDir,
+		hash: await streamFetchAndExtract(url, scratchDir)
 	};
 }
 /**
@@ -3768,7 +3400,7 @@ async function excludeScratchFromGit(repoWorkDir) {
 		const suffix = existing.length === 0 || existing.endsWith("\n") ? "" : "\n";
 		await fsPromises.appendFile(excludePath, `${suffix}# kici: hide dep-restore scratch dirs from customer git status\n${SCRATCH_DIR_GIT_EXCLUDE_GLOB}\n`);
 	} catch (err) {
-		logger$11.warn("Failed to register scratch dir glob in .git/info/exclude", {
+		logger$13.warn("Failed to register scratch dir glob in .git/info/exclude", {
 			excludePath,
 			error: err instanceof Error ? err.message : String(err)
 		});
@@ -3829,7 +3461,7 @@ async function cleanupScratch(scratchDir) {
 			force: true
 		});
 	} catch (cleanupErr) {
-		logger$11.warn("Scratch dir cleanup failed (orphan left behind)", {
+		logger$13.warn("Scratch dir cleanup failed (orphan left behind)", {
 			scratchDir,
 			error: cleanupErr instanceof Error ? cleanupErr.message : String(cleanupErr)
 		});
@@ -3854,7 +3486,7 @@ async function cleanupScratch(scratchDir) {
 */
 async function restoreDeps(workDir, depsUrl, depsHash) {
 	depsUrl = resolveOrchestratorUrl(depsUrl);
-	logger$11.info("Downloading dependency tarball", { url: depsUrl });
+	logger$13.info("Downloading dependency tarball", { url: depsUrl });
 	const kiciDir = join(workDir, ".kici");
 	if (depsUrl.startsWith("file://")) {
 		const localPath = fileURLToPath(depsUrl);
@@ -3868,7 +3500,7 @@ async function restoreDeps(workDir, depsUrl, depsHash) {
 		await moveScratchIntoRepo(scratchDir, workDir);
 		await cleanupScratch(scratchDir);
 		const sizeMB = (data.length / 1048576).toFixed(2);
-		logger$11.info("Dependencies restored from cache (file)", {
+		logger$13.info("Dependencies restored from cache (file)", {
 			sizeMB,
 			targetDir: workDir
 		});
@@ -3877,7 +3509,7 @@ async function restoreDeps(workDir, depsUrl, depsHash) {
 	if (!depsUrl.startsWith("http://") && !depsUrl.startsWith("https://")) throw new Error(`Unsupported deps URL scheme: ${depsUrl}`);
 	let lastError;
 	for (let attempt = 0; attempt <= 2; attempt++) {
-		if (attempt > 0) logger$11.warn("Retrying dep tarball download", {
+		if (attempt > 0) logger$13.warn("Retrying dep tarball download", {
 			attempt,
 			url: depsUrl
 		});
@@ -3886,11 +3518,11 @@ async function restoreDeps(workDir, depsUrl, depsHash) {
 			if (depsHash && hash !== depsHash) throw new Error(`Dep tarball hash mismatch: expected ${depsHash}, got ${hash}`);
 			await moveScratchIntoRepo(scratchDir, workDir);
 			await cleanupScratch(scratchDir);
-			logger$11.info("Dependencies restored from cache (stream)", { targetDir: workDir });
+			logger$13.info("Dependencies restored from cache (stream)", { targetDir: workDir });
 			return;
 		} catch (err) {
 			lastError = err instanceof Error ? err : new Error(String(err));
-			logger$11.warn("Dep tarball download failed", {
+			logger$13.warn("Dep tarball download failed", {
 				attempt,
 				error: lastError.message
 			});
@@ -3898,9 +3530,9 @@ async function restoreDeps(workDir, depsUrl, depsHash) {
 	}
 	throw new Error(`Dep tarball download failed after 3 attempts: ${lastError?.message}`);
 }
-var logger$11, DOWNLOAD_TIMEOUT_MS$1, SCRATCH_DIR_BASENAME_PREFIX, SCRATCH_DIR_GIT_EXCLUDE_GLOB;
+var logger$13, DOWNLOAD_TIMEOUT_MS$1, SCRATCH_DIR_BASENAME_PREFIX, SCRATCH_DIR_GIT_EXCLUDE_GLOB;
 var init_dep_restore = __esmMin((() => {
-	logger$11 = createLogger({ prefix: "dep-restore" });
+	logger$13 = createLogger({ prefix: "dep-restore" });
 	DOWNLOAD_TIMEOUT_MS$1 = 3e5;
 	SCRATCH_DIR_BASENAME_PREFIX = ".dep-restore-scratch-";
 	SCRATCH_DIR_GIT_EXCLUDE_GLOB = `.kici/${SCRATCH_DIR_BASENAME_PREFIX}*`;
@@ -4013,7 +3645,7 @@ async function uploadToPresignedUrl(url, data, opts) {
 	for (let attempt = 0; attempt <= 2; attempt++) {
 		if (attempt > 0) {
 			const delayMs = baseDelayMs * 2 ** (attempt - 1);
-			logger$10.warn("Retrying pre-signed upload", {
+			logger$12.warn("Retrying pre-signed upload", {
 				attempt,
 				delayMs,
 				error: lastError?.message
@@ -4030,10 +3662,10 @@ async function uploadToPresignedUrl(url, data, opts) {
 	}
 	throw new Error(`Pre-signed upload failed after 3 attempts: ${lastError?.message}`);
 }
-var logger$10, DOWNLOAD_TIMEOUT_MS, UPLOAD_TIMEOUT_MS, UPLOAD_RETRY_BASE_DELAY_MS, PresignedUploadHttpError;
+var logger$12, DOWNLOAD_TIMEOUT_MS, UPLOAD_TIMEOUT_MS, UPLOAD_RETRY_BASE_DELAY_MS, PresignedUploadHttpError;
 var init_download = __esmMin((() => {
 	init_dep_restore();
-	logger$10 = createLogger({ prefix: "agent:download" });
+	logger$12 = createLogger({ prefix: "agent:download" });
 	DOWNLOAD_TIMEOUT_MS = 3e5;
 	UPLOAD_TIMEOUT_MS = 3e5;
 	UPLOAD_RETRY_BASE_DELAY_MS = 500;
@@ -4052,22 +3684,30 @@ var init_download = __esmMin((() => {
 * `.kici/` source tarball restoration for execution agents.
 *
 * Downloads a pre-built `.kici/` source tarball from the orchestrator's cache
-* and extracts it into `workDir/` so the workflow entry point becomes
+* and installs it at `workDir/.kici` so the workflow entry point becomes
 * importable. Mirrors the shape of `dep-restore.ts` but without the streaming
 * optimization — source tarballs are tiny (kilobytes, not the hundreds of
 * megabytes a `node_modules/` tarball carries).
 *
-* Note on integrity: `dispatch.sourceTarHash` is the workflow `contentHash`
-* (computed over the raw source per `workflow-loader.ts::computeContentHash`),
-* not the SHA-256 of the tarball bytes. The shared S3 cache key is derived
-* from that same contentHash, so a signed GET URL from the orchestrator
-* already establishes provenance for restored tarballs. Every
-* `loadWorkflowSource` call site — build, init, and dynamic eval — passes
-* the dispatched `contentHash` (and `resolvedHashFiles` when present) so
-* the lock-vs-source drift gate fires at each author-TS load site, not
-* only the build phase. That closes the corner cases where init or eval
-* runs without a preceding build (cache infrastructure unavailable, or a
-* build job that failed but left dynamic dispatch in flight).
+* Two properties this path is responsible for, both of which it previously
+* lacked:
+*
+* **Verification.** `dispatch.sourceTarDigest` is the SHA-256 of the tarball's
+* own bytes, so the download is checked before anything is extracted — the same
+* contract `restoreDeps` has always had via `depsHash`. The older
+* `dispatch.sourceTarHash` field carries the workflow `contentHash` instead, so
+* it never could serve this purpose; it stays on the wire for older peers and
+* is deliberately not used as a verification input here. When no digest is
+* dispatched (an older orchestrator, or a source that did not come from the
+* content-addressed cache) the restore proceeds unverified rather than failing,
+* so a mixed-version rollout still runs.
+*
+* **Replacement, not overlay.** Extraction lands in a scratch directory and the
+* result REPLACES `workDir/.kici` wholesale, save for `node_modules/` — the one
+* directory the tarball deliberately omits, which the deps restore has already
+* written by the time this runs. Extracting over the existing tree left any file
+* the tarball no longer carries in place, so a helper the author deleted
+* survived every warm-cache run and kept being imported.
 */
 async function extractSourceTarball(data, targetDir) {
 	await mkdir(targetDir, { recursive: true });
@@ -4079,9 +3719,16 @@ async function extractSourceTarball(data, targetDir) {
 		})).on("finish", resolve).on("error", reject);
 	});
 }
-async function restoreSource(workDir, sourceTarUrl) {
+/**
+* Download, verify, and install the `.kici/` source tree.
+*
+* @param workDir - Root of the cloned repository; `.kici` is replaced under it
+* @param sourceTarUrl - `http://`, `https://`, or `file://` URL to the tarball
+* @param sourceTarDigest - Expected SHA-256 of the tarball bytes, when known
+*/
+async function restoreSource(workDir, sourceTarUrl, sourceTarDigest) {
 	sourceTarUrl = resolveOrchestratorUrl(sourceTarUrl);
-	logger$9.info("Restoring .kici/ source from tarball", { sourceTarUrl });
+	logger$11.info("Restoring .kici/ source from tarball", { sourceTarUrl });
 	const startTime = Date.now();
 	let data;
 	if (sourceTarUrl.startsWith("file://")) {
@@ -4089,174 +3736,41 @@ async function restoreSource(workDir, sourceTarUrl) {
 		data = await fsPromises.readFile(localPath);
 	} else if (sourceTarUrl.startsWith("http://") || sourceTarUrl.startsWith("https://")) data = await downloadUrl(sourceTarUrl);
 	else throw new Error(`Unsupported source tarball URL scheme: ${sourceTarUrl}`);
-	await extractSourceTarball(data, workDir);
-	const durationMs = Date.now() - startTime;
-	logger$9.info(".kici/ source restored", {
-		sizeKB: (data.length / 1024).toFixed(2),
-		durationMs
-	});
-}
-var logger$9;
-var init_source_restore = __esmMin((() => {
-	init_download();
-	init_dep_restore();
-	logger$9 = createLogger({ prefix: "source-restore" });
-}));
-//#endregion
-//#region src/execution/timeout-util.ts
-/**
-* Shared timeout utility for wrapping async operations with a deadline.
-*
-* Used by init-runner (dynamic field evaluation) and dynamic job function evaluation.
-*/
-/**
-* Execute a function with a timeout using Promise.race.
-* Throws if the function does not resolve within the given timeout.
-*/
-async function withTimeout(fn, timeoutMs, label) {
-	const ac = new AbortController();
-	const timer = setTimeout(() => ac.abort(), timeoutMs);
+	if (sourceTarDigest) {
+		const actual = createHash("sha256").update(data).digest("hex");
+		if (actual !== sourceTarDigest) throw new Error(`Source tarball hash mismatch: expected ${sourceTarDigest}, got ${actual}. The restored source does not match what the orchestrator dispatched.`);
+	}
+	const kiciDir = path.join(workDir, ".kici");
+	const scratch = path.join(workDir, `.kici.restore-${process.pid}-${Date.now()}`);
 	try {
-		return await Promise.race([Promise.resolve(fn()), new Promise((_, reject) => {
-			ac.signal.addEventListener("abort", () => reject(/* @__PURE__ */ new Error(`Timeout after ${timeoutMs}ms evaluating ${label}`)));
-		})]);
+		await extractSourceTarball(data, scratch);
+		const extracted = path.join(scratch, ".kici");
+		const src = (await fsPromises.stat(extracted).catch(() => null))?.isDirectory() ? extracted : scratch;
+		const installedDeps = path.join(kiciDir, "node_modules");
+		if (await fsPromises.stat(installedDeps).catch(() => null)) await rename(installedDeps, path.join(src, "node_modules"));
+		await rm(kiciDir, {
+			recursive: true,
+			force: true
+		});
+		await rename(src, kiciDir);
 	} finally {
-		clearTimeout(timer);
+		await rm(scratch, {
+			recursive: true,
+			force: true
+		}).catch(() => {});
 	}
-}
-var init_timeout_util = __esmMin((() => {}));
-//#endregion
-//#region src/execution/init-runner.ts
-/**
-* Run a workflow's `filter` and report whether the workflow applies.
-*
-* Shared by both agent-side evaluation sites for a same-repo workflow: the init
-* job that gates each static job's dispatch, and the dynamic-eval job that gates
-* whether a generator runs at all. Both must reach the same verdict from the same
-* inputs, so neither builds the context itself.
-*
-* The context is built through `createFilterContext` rather than as an object
-* literal: the factory installs `changedFiles` as a throwing getter, so a filter
-* that reads the diff on an event that has none fails loudly instead of seeing an
-* empty list. A `false` verdict dispatches none of the workflow's own jobs, so a
-* silently-empty diff would suppress it on a mistake. On this same-repo path the
-* verdict is at least recoverable — the run row exists, carrying the `__init__*`
-* jobs, and this evaluation's own step log records the verdict; it is the
-* organization-wide path, which runs elsewhere, that leaves nothing behind.
-*
-* A throwing filter propagates: the evaluating job fails, which surfaces as a
-* failed run. "Could not decide" is never treated as "do not run" — that would
-* be a false green, the same reasoning `buildJobRuleCompletion` applies to a rule
-* whose `check()` threw.
-*/
-async function evaluateWorkflowFilter(workflow, event, input, timeoutMs) {
-	if (typeof workflow.filter !== "function") throw new Error(`Workflow '${workflow.name}' is recorded as declaring a filter, but its module exports none — the lock file is out of date. Run 'kici compile' and commit the result.`);
-	if (!input) throw new Error(`Workflow '${workflow.name}' declares a filter but the evaluating job supplied no filter context (source tree / changed files) to evaluate it against.`);
-	const filterFn = workflow.filter;
-	const ctx = createFilterContext({
-		sourceRepo: input.sourceRepo,
-		workflowRepo: input.workflowRepo,
-		event,
-		changedFiles: input.changedFiles,
-		changedFilesStatus: input.changedFilesStatus,
-		...input.env && { env: input.env },
-		...input.$ && { $: input.$ }
+	const durationMs = Date.now() - startTime;
+	logger$11.info(".kici/ source restored", {
+		sizeKB: (data.length / 1024).toFixed(2),
+		durationMs,
+		verified: sourceTarDigest !== void 0
 	});
-	const verdict = await withTimeout(() => filterFn(ctx), timeoutMs, `filter for workflow '${workflow.name}'`);
-	return Boolean(verdict);
-}
-/**
-* Find a static job by name in a workflow's jobs array.
-* Skips dynamic job functions (factories).
-*/
-function findJobByName(workflow, jobName) {
-	for (const item of workflow.jobs) if (!isDynamicJobFn(item) && item.name === jobName) return item;
-	throw new Error(`Job '${jobName}' not found in workflow '${workflow.name}'`);
-}
-/**
-* Evaluate dynamic fields (context, env, concurrencyGroup) on a job.
-*
-* Only fields with their corresponding flag set to true AND whose property
-* on the job is a function will be evaluated. All evaluations happen in a
-* single call per.
-*
-* -: If a dynamic function throws, the error propagates (job fails).
-* -: If a dynamic function returns undefined/null, the field is left undefined.
-* -: Each dynamic function call is wrapped in a timeout (default 60s).
-*
-* A workflow-level `filter` is evaluated FIRST when `flags.hasFilter` is set. A
-* `false` verdict returns immediately: no job of that workflow will be
-* dispatched, so evaluating this one's dynamic fields would run customer code
-* whose result nothing can consume.
-*
-* @param workflow - The extracted Workflow object
-* @param jobName - Name of the job whose dynamic fields to evaluate
-* @param event - Normalized event envelope — same shape every dynamic-function call site receives.
-* @param flags - Which fields are dynamic and need evaluation
-* @param timeoutMs - Timeout per dynamic function call (default 60_000ms)
-* @param filterInput - Source tree + diff the workflow's `filter` reads. Required when `flags.hasFilter`.
-*/
-async function evaluateDynamicFields(workflow, jobName, event, flags, timeoutMs = 6e4, filterInput) {
-	const result = {};
-	if (flags.hasFilter) {
-		result.filterPassed = await evaluateWorkflowFilter(workflow, event, filterInput, timeoutMs);
-		if (!result.filterPassed) return result;
-	}
-	const job = findJobByName(workflow, jobName);
-	if (flags.dynamicMatrix && typeof job.matrix === "function") {
-		const matrixContext = {
-			$: (await import("zx")).$,
-			ctx: {
-				workflow: { name: workflow.name },
-				job: {
-					name: jobName,
-					runsOn: job.runsOn
-				}
-			},
-			log: {
-				info: () => {},
-				warn: () => {},
-				error: () => {},
-				debug: () => {}
-			},
-			env: { ...process.env }
-		};
-		const resolved = await withTimeout(() => job.matrix(matrixContext), timeoutMs, `dynamicMatrix for job '${jobName}'`);
-		let combos;
-		try {
-			const rawCount = matrixCombinationCount(resolved);
-			if (rawCount > MAX_MATRIX_MATERIALIZATION) throw new MatrixShapeError(`matrix is too large to expand: ${rawCount} raw combinations (max ${MAX_MATRIX_MATERIALIZATION})`);
-			combos = expandMatrix(resolved);
-		} catch (err) {
-			if (err instanceof MatrixShapeError) throw new MatrixShapeError(`dynamicMatrix for job '${jobName}': ${err.message}`);
-			throw err;
-		}
-		if (job.include || job.exclude) combos = applyIncludeExclude(combos, job.include, job.exclude);
-		result.matrixValues = combos;
-	}
-	if (flags.dynamicContext) {
-		const envRefs = job.contexts ?? (job.context !== void 0 ? [job.context] : void 0);
-		if (envRefs && envRefs.length > 0) {
-			const names = [];
-			for (const ref of envRefs) if (typeof ref === "function") {
-				const value = await withTimeout(() => ref(event), timeoutMs, `dynamicContext for job '${jobName}'`);
-				if (value !== void 0 && value !== null) names.push(value);
-			} else if (typeof ref === "string") names.push(ref);
-			if (names.length > 0) result.contextNames = names;
-		}
-	}
-	if (flags.dynamicEnv && typeof job.env === "function") {
-		const value = await withTimeout(() => job.env(event), timeoutMs, `dynamicEnv for job '${jobName}'`);
-		if (value !== void 0 && value !== null) result.env = value;
-	}
-	if (flags.dynamicConcurrencyGroup && typeof job.concurrencyGroup === "function") {
-		const value = await withTimeout(() => job.concurrencyGroup(event), timeoutMs, `dynamicConcurrencyGroup for job '${jobName}'`);
-		if (value !== void 0 && value !== null) result.concurrencyGroup = value;
-	}
-	return result;
 }
-var init_init_runner = __esmMin((() => {
-	init_timeout_util();
+var logger$11;
+var init_source_restore = __esmMin((() => {
+	init_download();
+	init_dep_restore();
+	logger$11 = createLogger({ prefix: "source-restore" });
 }));
 //#endregion
 //#region src/bootstrap/ssh-exec.ts
@@ -5029,8 +4543,396 @@ var init_s3_payload_source = __esmMin((() => {
 			};
 		}
 	};
+})), init_timeout_util = __esmMin((() => {})), MatrixExpansionError;
+var init_dynamic_job_serializer = __esmMin((() => {
+	init_timeout_util();
+	MatrixExpansionError = class MatrixExpansionError extends Error {
+		jobName;
+		name = "MatrixExpansionError";
+		constructor(jobName, message) {
+			super(message);
+			this.jobName = jobName;
+			Object.setPrototypeOf(this, MatrixExpansionError.prototype);
+		}
+	};
+}));
+//#endregion
+//#region src/execution/sandbox/env-sanitizer.ts
+/**
+* Environment sanitization for sandbox execution.
+*
+* Uses an explicit allowlist approach: only known-safe system variables are
+* copied from the host process.env. Agent-internal credentials (KICI_*,
+* DATABASE_URL, PLATFORM_TOKEN, WEBHOOK_SECRET, etc.) are NEVER included.
+*
+* 7-layer merge precedence (later overrides earlier):
+*   1. Allowed system vars from process.env
+*   2. Sandbox defaults (FORCE_COLOR=1, etc.)
+*   3. KICI_* system vars (orchestrator-generated, from userEnv)
+*   4. Org-level environment vars (from orchestrator via contextVars)
+*   5. Source-level environment overrides (merged into contextVars by orchestrator)
+*   6. Job env (from lock file env field, evaluated by orchestrator)
+*   7. setEnv() calls (runtime -- applied at step execution, not here)
+*/
+/**
+* Build a sanitized environment for sandbox execution.
+*
+* Constructs an environment from scratch using the 7-layer merge:
+* 1. Explicitly allowed system variables from process.env
+* 2. Sandbox default variables (FORCE_COLOR, etc.)
+* 3. User-defined env vars (KICI_* system vars from orchestrator)
+* 4-5. Environment vars (org-level + source overrides, pre-merged by orchestrator)
+* 6. Job env (SDK-defined, evaluated by orchestrator)
+* 7. setEnv() calls (runtime -- not handled here)
+*
+* Secrets are NOT injected into environment variables by this function.
+* They flow through IPC to ctx.secrets and are only exposed via ctx.secrets.expose().
+*
+* Agent-internal credentials (KICI_ORCHESTRATOR_URL, DATABASE_URL,
+* PLATFORM_TOKEN, WEBHOOK_SECRET, etc.) are never included because they
+* are not in the allowlist.
+*
+* The `trustedEnv` option (default false) selects the trusted fleet-agent
+* profile: Layer 1 passes the ambient host env through instead of restricting
+* to `ALLOWED_SYSTEM_VARS`, minus the agent's own KiCI identity/operational
+* secrets (the whole `KICI_*` namespace + a small non-`KICI_` infra denylist).
+* It is read ONLY from agent config (`KICI_TRUSTED_ENV`), never from a dispatch
+* payload, so a workflow cannot request it. With it OFF the output is
+* byte-identical to the allowlist-only behavior.
+*
+* @param userEnv - Environment variables from workflow config and orchestrator
+* @param options - Optional extended options for environment layers
+* @returns A new Record with only safe environment variables
+*/
+function buildSanitizedEnv(userEnv, options) {
+	const sanitized = {};
+	if (options?.trustedEnv) Object.assign(sanitized, buildTrustedPassthroughEnv(process.env));
+	else for (const key of ALLOWED_SYSTEM_VARS) {
+		const value = process.env[key];
+		if (value !== void 0) sanitized[key] = value;
+	}
+	Object.assign(sanitized, SANDBOX_DEFAULT_VARS);
+	Object.assign(sanitized, userEnv);
+	if (options?.contextVars) Object.assign(sanitized, options.contextVars);
+	if (options?.jobEnv) Object.assign(sanitized, options.jobEnv);
+	return sanitized;
+}
+var init_env_sanitizer = __esmMin((() => {}));
+//#endregion
+//#region src/execution/sandbox/eval-fork-runner.ts
+/**
+* Agent-side driver for the eval child.
+*
+* Forks `eval-runner.js` with a sanitized environment, sends one `eval`
+* request, streams the child's log lines onto the job's synthetic step-0 log,
+* and resolves with the evaluation's serialized result.
+*
+* The accepted inbound set is exactly `ready`, `log.line`, `eval.api.request`,
+* `eval.result` and `eval.error` — anything else from the child is ignored, so a
+* customer module that gains code execution in the child cannot reach the step
+* runner's privileged relays by naming one of their message types.
+*/
+/**
+* Run one evaluation in a fresh child and resolve with its result.
+*
+* Rejects with the evaluation's own error text on `eval.error`, so the calling
+* handler reports exactly the message the in-process evaluation used to throw.
+*/
+function runEvalChild(options) {
+	const env = buildSanitizedEnv({}, { trustedEnv: options.trustedEnv });
+	return new Promise((resolve, reject) => {
+		let settled = false;
+		const child = fork(options.evalRunnerPath, [], {
+			env,
+			cwd: options.request.workDir,
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe",
+				"ipc"
+			]
+		});
+		const send = (msg) => {
+			try {
+				child.send(msg);
+			} catch {}
+		};
+		const finish = (fn) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(hardTimeout);
+			options.signal?.removeEventListener("abort", onAbort);
+			try {
+				child.kill("SIGKILL");
+			} catch {}
+			fn();
+		};
+		const hardTimeout = setTimeout(() => {
+			finish(() => reject(/* @__PURE__ */ new Error(`Evaluation child exceeded its ${EVAL_CHILD_HARD_TIMEOUT_MS}ms ceiling and was killed`)));
+		}, EVAL_CHILD_HARD_TIMEOUT_MS);
+		hardTimeout.unref?.();
+		const onAbort = () => {
+			finish(() => reject(/* @__PURE__ */ new Error("Evaluation cancelled")));
+		};
+		options.signal?.addEventListener("abort", onAbort, { once: true });
+		child.stdout?.resume();
+		let stderrTail = "";
+		child.stderr?.setEncoding("utf8");
+		child.stderr?.on("data", (chunk) => {
+			stderrTail = (stderrTail + chunk).slice(-EVAL_CHILD_STDERR_TAIL_BYTES);
+		});
+		child.on("message", (msg) => {
+			switch (msg.type) {
+				case "ready":
+					send({
+						type: "eval",
+						request: options.request
+					});
+					return;
+				case "log.line":
+					options.onLogLine(msg.line, msg.stream);
+					return;
+				case "eval.api.request":
+					(options.onApiRequest ?? (() => Promise.reject(/* @__PURE__ */ new Error("Agent API not available"))))(msg.method, msg.params).then((result) => send({
+						type: "eval.api.response",
+						id: msg.id,
+						result
+					}), (err) => send({
+						type: "eval.api.response",
+						id: msg.id,
+						error: toErrorMessage(err)
+					}));
+					return;
+				case "eval.result":
+					finish(() => resolve(msg.result));
+					return;
+				case "eval.error":
+					finish(() => reject(new Error(msg.error)));
+					return;
+				default: logger$10.warn("Ignoring unexpected message from eval child", { type: msg.type });
+			}
+		});
+		child.on("error", (err) => {
+			finish(() => reject(/* @__PURE__ */ new Error(`Evaluation child failed to start: ${err.message}`)));
+		});
+		child.on("exit", (code, signalName) => {
+			const detail = stderrTail.trim();
+			finish(() => reject(/* @__PURE__ */ new Error(`Evaluation child exited without a result (code=${code}, signal=${signalName})` + (detail ? `: ${detail}` : ""))));
+		});
+	});
+}
+var logger$10, EVAL_CHILD_HARD_TIMEOUT_MS, EVAL_CHILD_STDERR_TAIL_BYTES;
+var init_eval_fork_runner = __esmMin((() => {
+	init_env_sanitizer();
+	logger$10 = createLogger({ prefix: "eval-fork-runner" });
+	EVAL_CHILD_HARD_TIMEOUT_MS = 18e5;
+	EVAL_CHILD_STDERR_TAIL_BYTES = 4096;
+}));
+//#endregion
+//#region src/checkout/changed-files.ts
+/** Build the auth context for the fetches, mirroring git-clone.ts's auth. */
+async function buildAuthCtx(auth) {
+	if (!auth) return { args: [] };
+	if (auth.kind === "basic") {
+		const user = auth.user ?? "x-access-token";
+		return { args: ["-c", `http.extraHeader=Authorization: Basic ${Buffer.from(`${user}:${auth.secret}`).toString("base64")}`] };
+	}
+	const sshSetup = await setupSshAuth({
+		privateKey: auth.secret,
+		hostKeyPolicy: auth.sshHostKeyPolicy,
+		knownHosts: auth.sshKnownHostsPem
+	});
+	return {
+		args: [],
+		env: { GIT_SSH_COMMAND: sshSetup.gitSshCommand },
+		cleanup: () => sshSetup.cleanup()
+	};
+}
+function git(workDir, args, ctx) {
+	return execFileSync("git", [
+		...ctx.args,
+		...BASE_GIT_ARGS,
+		"-C",
+		workDir,
+		...args
+	], {
+		encoding: "utf8",
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		],
+		...ctx.env && { env: {
+			...process.env,
+			...ctx.env
+		} }
+	});
+}
+function tryGit(workDir, args, ctx) {
+	try {
+		git(workDir, args, ctx);
+		return true;
+	} catch {
+		return false;
+	}
+}
+function parseNameOnly(out) {
+	return out.split("\n").map((s) => s.replace(/\r$/, "")).filter((s) => s.length > 0);
+}
+/** Ensure `commitish` exists locally; fetch / deepen (bounded) if not. */
+function ensureCommit(workDir, commitish, ctx) {
+	if (tryGit(workDir, [
+		"cat-file",
+		"-e",
+		`${commitish}^{commit}`
+	], ctx)) return true;
+	if (tryGit(workDir, [
+		"fetch",
+		"--depth",
+		"1",
+		"origin",
+		commitish
+	], ctx)) {
+		if (tryGit(workDir, [
+			"cat-file",
+			"-e",
+			`${commitish}^{commit}`
+		], ctx)) return true;
+	}
+	for (let i = 0; i < MAX_DEEPEN; i++) {
+		if (!tryGit(workDir, [
+			"fetch",
+			`--deepen=${DEEPEN_STEP}`,
+			"origin"
+		], ctx)) break;
+		if (tryGit(workDir, [
+			"cat-file",
+			"-e",
+			`${commitish}^{commit}`
+		], ctx)) return true;
+	}
+	return false;
+}
+function pushDiff(workDir, before, ctx) {
+	const isZero = !before || ZERO_SHA.test(before);
+	const baseRef = isZero ? EMPTY_TREE_SHA : before;
+	if (!isZero && !ensureCommit(workDir, before, ctx)) return {
+		files: [],
+		status: "unavailable"
+	};
+	return {
+		files: parseNameOnly(git(workDir, [
+			"diff",
+			"--name-only",
+			baseRef,
+			"HEAD"
+		], ctx)),
+		status: "fetched"
+	};
+}
+function prDiff(workDir, base, ctx) {
+	const candidates = [
+		base,
+		`origin/${base}`,
+		"FETCH_HEAD"
+	];
+	const resolveBase = () => candidates.find((c) => tryGit(workDir, [
+		"rev-parse",
+		"--verify",
+		`${c}^{commit}`
+	], ctx));
+	let baseRef = resolveBase();
+	if (!baseRef) {
+		if (!ensureCommit(workDir, base, ctx)) return {
+			files: [],
+			status: "unavailable"
+		};
+		baseRef = resolveBase();
+	}
+	if (!baseRef) return {
+		files: [],
+		status: "unavailable"
+	};
+	for (let i = 0; i <= MAX_DEEPEN; i++) {
+		if (tryGit(workDir, [
+			"merge-base",
+			baseRef,
+			"HEAD"
+		], ctx)) return {
+			files: parseNameOnly(git(workDir, [
+				"diff",
+				"--name-only",
+				`${baseRef}...HEAD`
+			], ctx)),
+			status: "fetched"
+		};
+		if (!tryGit(workDir, [
+			"fetch",
+			`--deepen=${DEEPEN_STEP}`,
+			"origin"
+		], ctx)) break;
+	}
+	return {
+		files: [],
+		status: "unavailable"
+	};
+}
+/**
+* Compute the changed-files list from the agent's local clone (HEAD is the
+* checked-out head commit). Ground truth for job/step rule evaluation. `auth`
+* (the same credentials used for the clone) authenticates the deepen / fetch
+* calls so a private remote resolves. Returns `unavailable` for diff-less
+* events (schedule/tag/manual) or any git failure — never throws.
+*/
+async function computeChangedFiles(workDir, event, auth) {
+	let ctx;
+	try {
+		if (event.type !== "push" && event.type !== "pull_request") return {
+			files: [],
+			status: "unavailable"
+		};
+		ctx = await buildAuthCtx(auth);
+		if (event.type === "push") return pushDiff(workDir, event.payload?.before ?? "", ctx);
+		const base = event.baseBranch ?? event.targetBranch;
+		if (!base) return {
+			files: [],
+			status: "unavailable"
+		};
+		return prDiff(workDir, base, ctx);
+	} catch {
+		return {
+			files: [],
+			status: "unavailable"
+		};
+	} finally {
+		if (ctx?.cleanup) await ctx.cleanup().catch(() => {});
+	}
+}
+var EMPTY_TREE_SHA, ZERO_SHA, MAX_DEEPEN, DEEPEN_STEP, BASE_GIT_ARGS;
+var init_changed_files = __esmMin((() => {
+	init_ssh_auth();
+	EMPTY_TREE_SHA = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
+	ZERO_SHA = /^0+$/;
+	MAX_DEEPEN = 4;
+	DEEPEN_STEP = 50;
+	BASE_GIT_ARGS = [
+		"-c",
+		"safe.directory=*",
+		"-c",
+		"core.quotePath=false"
+	];
 }));
 //#endregion
+//#region src/execution/global-workflow-env.ts
+/**
+* Derive an `owner/repo` identifier from a clone URL, stripping the trailing
+* `.git` and any `http(s)://host/` prefix.
+*/
+function repoIdentifierFromUrl(repoUrl) {
+	return repoUrl.replace(/\.git$/, "").replace(/^https?:\/\/[^/]+\//, "");
+}
+var init_global_workflow_env = __esmMin((() => {}));
+//#endregion
 //#region src/execution/streaming-zx-log.ts
 /**
 * Shared factory for the zx `log` callback that streams a subprocess's
@@ -5072,471 +4974,155 @@ function makeStreamingZxLog(emit) {
 		[LogStream.enum.stdout]: "",
 		[LogStream.enum.stderr]: ""
 	};
-	return (entry) => {
-		const e = entry;
-		if (e.kind !== "stdout" && e.kind !== "stderr") return;
-		if (!e.verbose) return;
-		const stream = e.kind === "stderr" ? LogStream.enum.stderr : LogStream.enum.stdout;
-		const text = typeof e.data === "string" ? e.data : String(e.data ?? "");
-		const lines = (lineBufs[stream] + text).split("\n");
-		lineBufs[stream] = lines.pop();
-		for (const line of lines) if (line) emit(line, stream);
-	};
-}
-var init_streaming_zx_log = __esmMin((() => {}));
-//#endregion
-//#region src/execution/dynamic-job-serializer.ts
-/**
-* Convert an array of SDK Job objects into LockJob format for the orchestrator.
-*
-* @param jobs - Jobs returned by a DynamicJobFn
-* @param ctx - Eval-time context used to resolve dynamic fields on generated jobs
-* @param seenNames - Optional accumulator of job names already emitted earlier
-*   in the same eval round; when supplied, a name already present throws and
-*   every generated name is added so later generators in the round see it
-* @returns Serialized LockJob array ready for orchestrator dispatch
-* @throws Error if validation fails (duplicates, limit exceeded) or if a user-supplied
-*   dynamic function throws / times out / returns an unsupported value
-*/
-async function serializeJobsToLock(jobs, ctx, staticNames, allowedGroups, seenNames) {
-	if (jobs.length > 100) throw new Error(`DynamicJobFn generated ${jobs.length} jobs, exceeding the limit of 100`);
-	const generatedNames = /* @__PURE__ */ new Set();
-	const roundNames = seenNames ?? /* @__PURE__ */ new Set();
-	for (const job of jobs) {
-		if (roundNames.has(job.name)) throw new Error(`Duplicate job name '${job.name}' in dynamic job output`);
-		generatedNames.add(job.name);
-		roundNames.add(job.name);
-	}
-	const result = [];
-	for (const job of jobs) result.push(await serializeJob(job, generatedNames, ctx, staticNames ?? /* @__PURE__ */ new Set(), allowedGroups ?? /* @__PURE__ */ new Set()));
-	return result;
-}
-async function serializeJob(job, generatedNames, ctx, staticNames, allowedGroups) {
-	const { include: runsOn, exclude: excludeLabels } = job.invoke && job.runsOn === void 0 ? {
-		include: [],
-		exclude: []
-	} : normalizeRunsOnToMatchers(job.runsOn, `generated job '${job.name}' runsOn`);
-	const envRefs = job.contexts ?? (job.context !== void 0 ? [job.context] : void 0);
-	let resolvedContexts;
-	if (envRefs !== void 0 && envRefs.length > 0) {
-		const resolved = [];
-		for (const ref of envRefs) if (typeof ref === "function") {
-			const value = await withTimeout(() => ref(ctx.event), DYNAMIC_FIELD_TIMEOUT_MS, `dynamic environment for generated job '${job.name}'`);
-			if (value !== void 0 && value !== null) resolved.push({
-				value,
-				dynamic: false
-			});
-		} else if (typeof ref === "string") resolved.push({
-			value: ref,
-			dynamic: false
-		});
-		if (resolved.length > 0) resolvedContexts = resolved;
-	}
-	let resolvedEnv;
-	if (typeof job.env === "function") {
-		const value = await withTimeout(() => job.env(ctx.event), DYNAMIC_FIELD_TIMEOUT_MS, `dynamic env for generated job '${job.name}'`);
-		if (value !== void 0 && value !== null) resolvedEnv = value;
-	} else if (job.env && typeof job.env === "object") resolvedEnv = job.env;
-	let resolvedConcurrencyGroup;
-	if (typeof job.concurrencyGroup === "function") {
-		const value = await withTimeout(() => job.concurrencyGroup(ctx.event), DYNAMIC_FIELD_TIMEOUT_MS, `dynamic concurrencyGroup for generated job '${job.name}'`);
-		if (value !== void 0 && value !== null) resolvedConcurrencyGroup = value;
-	} else if (typeof job.concurrencyGroup === "string") resolvedConcurrencyGroup = job.concurrencyGroup;
-	const resolvedMatrix = job.matrix ? await serializeMatrix(job.matrix, job.name, runsOn, ctx) : void 0;
-	const resolvedNeeds = resolveNeeds(job.needs, generatedNames, staticNames, allowedGroups);
-	const dependsOnGroups = resolvedNeeds.filter((n) => typeof n === "object" && "group" in n).map((n) => n.group);
-	return {
-		_type: "static",
-		name: job.name,
-		...job.invoke && runsOn.length === 0 ? {} : { runsOn },
-		...excludeLabels.length > 0 ? { excludeLabels } : {},
-		needs: resolvedNeeds,
-		...dependsOnGroups.length > 0 ? { dependsOnGroups } : {},
-		steps: serializeSteps(job.steps),
-		...resolvedMatrix ? { matrix: resolvedMatrix } : {},
-		...job.include ? { include: job.include } : {},
-		...job.exclude ? { exclude: job.exclude } : {},
-		...job.description ? { description: job.description } : {},
-		...resolvedContexts !== void 0 ? { contexts: resolvedContexts } : {},
-		...resolvedEnv !== void 0 ? { env: resolvedEnv } : {},
-		...resolvedConcurrencyGroup !== void 0 ? { concurrencyGroup: resolvedConcurrencyGroup } : {},
-		...job.invoke ? { invoke: {
-			event: job.invoke.event,
-			scope: job.invoke.scope,
-			...job.invoke.payload !== void 0 ? { payload: job.invoke.payload } : {},
-			...job.invoke.optional === true ? { optional: true } : {}
-		} } : {}
-	};
-}
-/**
-* Resolve needs references. Jobs can reference other jobs by name (string),
-* Job object reference, DynamicGroupRef, or NeedsEntry/NeedsGroupEntry objects.
-* Validates against generatedNames union staticNames union allowedGroups.
-*
-* Returns the lock file representation: strings for concrete refs,
-* NeedsEntry for { name, when }, NeedsGroupEntry for group refs (each `when`
-* normalized to a runOn status-set).
-*/
-function resolveNeeds(needs, generatedNames, staticNames, allowedGroups) {
-	if (!needs || needs.length === 0) return [];
-	const allNames = /* @__PURE__ */ new Set([...generatedNames, ...staticNames]);
-	return needs.map((dep) => {
-		if (typeof dep === "string") {
-			if (!allNames.has(dep)) throw new Error(`Job dependency '${dep}' not found in workflow jobs (checked: ${generatedNames.size} generated, ${staticNames.size} static)`);
-			return dep;
-		}
-		if (isDynamicGroupRef(dep)) {
-			const groupRef = dep;
-			if (!allowedGroups.has(groupRef.group)) throw new Error(`Dynamic group '${groupRef.group}' not found in workflow (available groups: ${[...allowedGroups].join(", ") || "none"})`);
-			return {
-				group: groupRef.group,
-				runOn: resolveWhenToRunOn(groupRef.when)
-			};
-		}
-		if (typeof dep === "object" && dep !== null && "group" in dep) {
-			const groupDep = dep;
-			if (!allowedGroups.has(groupDep.group)) throw new Error(`Dynamic group '${groupDep.group}' not found in workflow (available groups: ${[...allowedGroups].join(", ") || "none"})`);
-			return {
-				group: groupDep.group,
-				runOn: resolveWhenToRunOn(groupDep.when)
-			};
-		}
-		if (typeof dep === "object" && dep !== null && "name" in dep && !("steps" in dep)) {
-			const namedDep = dep;
-			if (!allNames.has(namedDep.name)) throw new Error(`Job dependency '${namedDep.name}' not found in workflow jobs (checked: ${generatedNames.size} generated, ${staticNames.size} static)`);
-			return {
-				name: namedDep.name,
-				runOn: resolveWhenToRunOn(namedDep.when)
-			};
-		}
-		if (isDynamicJobFn(dep)) throw new Error("Job dependency cannot be a DynamicJobFn");
-		const name = dep.name;
-		if (!allNames.has(name)) throw new Error(`Job dependency '${name}' not found in workflow jobs (checked: ${generatedNames.size} generated, ${staticNames.size} static)`);
-		return name;
-	});
-}
-/**
-* Serialize step definitions to lock file format.
-* Steps are minimal in the lock file — just metadata. The actual run functions
-* are loaded from the workflow bundle at execution time.
-*/
-function serializeSteps(steps) {
-	let flatIndex = 0;
-	return steps.map((entry) => {
-		if (isParallelGroup(entry)) {
-			const children = entry.steps.map((child) => serializeSequentialStep(child, flatIndex++));
-			return {
-				kind: "parallel",
-				name: entry.name ?? `parallel-${children[0]?.name ?? "group"}`,
-				failFast: entry.failFast,
-				...entry.maxParallel !== void 0 ? { maxParallel: entry.maxParallel } : {},
-				children
-			};
-		}
-		return serializeSequentialStep(entry, flatIndex++);
-	});
-}
-/** Serialize one sequential step (or bare function) to a flat `LockStep`. */
-function serializeSequentialStep(stepOrFn, index) {
-	if (typeof stepOrFn === "function") return {
-		name: `step-${index}`,
-		hasOutputs: false
-	};
-	const step = stepOrFn;
-	return {
-		name: step.name || `step-${index}`,
-		hasOutputs: !!step.outputs,
-		...step.continueOnError ? { continueOnError: true } : {},
-		...step.timeout ? { timeout: step.timeout } : {},
-		...step.retry ? { retry: {
-			maxAttempts: step.retry.maxAttempts,
-			delayMs: step.retry.delayMs,
-			backoff: step.retry.backoff,
-			maxDelayMs: step.retry.maxDelayMs
-		} } : {}
+	return (entry) => {
+		const e = entry;
+		if (e.kind !== "stdout" && e.kind !== "stderr") return;
+		if (!e.verbose) return;
+		const stream = e.kind === "stderr" ? LogStream.enum.stderr : LogStream.enum.stdout;
+		const text = typeof e.data === "string" ? e.data : String(e.data ?? "");
+		const lines = (lineBufs[stream] + text).split("\n");
+		lineBufs[stream] = lines.pop();
+		for (const line of lines) if (line) emit(line, stream);
 	};
 }
+var init_streaming_zx_log = __esmMin((() => {}));
 /**
-* Serialize matrix configuration. Static array/object matrices are embedded as-is;
-* dynamic matrix functions are invoked against the eval context (mirroring the
-* DynamicMatrixContext signature) and the resulting array/object is embedded.
+* Resolve the changed-files list a `filter` reads — for a global eval round and
+* for a filter-bearing init job alike.
+*
+* Ground truth is the agent's own source clone; an already-`fetched` list from
+* the orchestrator is a free fast-path. A diff-less event (schedule / tag /
+* manual) resolves to `unavailable`, which makes `ctx.changedFiles` throw
+* rather than read as an empty diff — a `filter` returning false produces no
+* run at all, so a silently-empty diff would suppress the workflow with no
+* artifact anywhere to inspect.
 */
-async function serializeMatrix(matrix, jobName, runsOn, ctx) {
-	if (isStaticArray(matrix)) return {
-		_type: "static",
-		values: matrix
-	};
-	if (isStaticObject(matrix)) return {
-		_type: "static",
-		values: matrix
-	};
-	const matrixCtx = {
-		$: ctx.$,
-		ctx: {
-			workflow: { name: ctx.workflowName },
-			job: {
-				name: jobName,
-				runsOn: runsOn.map((m) => m.kind === "exact" ? m.value : `/${m.source}/${m.flags}`)
-			}
-		},
-		log: ctx.log,
-		env: ctx.env
-	};
-	let values;
-	try {
-		values = await withTimeout(() => matrix(matrixCtx), DYNAMIC_FIELD_TIMEOUT_MS, `dynamic matrix for generated job '${jobName}'`);
-	} catch (err) {
-		throw new MatrixExpansionError(jobName, `Matrix expansion failed for job '${jobName}': ${err.message}`);
-	}
-	if (Array.isArray(values)) return {
-		_type: "static",
-		values
-	};
-	if (values && typeof values === "object") return {
-		_type: "static",
-		values
+async function resolveEvalChangedFiles(dispatch, event, sourceDir) {
+	const ev = event;
+	if (ev.changedFilesStatus === "fetched") return {
+		files: ev.changedFiles ?? [],
+		status: "fetched"
 	};
-	throw new MatrixExpansionError(jobName, `Job '${jobName}': dynamic matrix function returned an unsupported value (expected array or object, got ${typeof values})`);
+	return computeChangedFiles(sourceDir, event, dispatch.sourceAuth ?? dispatch.workflowAuth ?? (dispatch.token ? {
+		kind: "basic",
+		user: "x-access-token",
+		secret: dispatch.token
+	} : void 0));
 }
-var MatrixExpansionError, DYNAMIC_FIELD_TIMEOUT_MS;
-var init_dynamic_job_serializer = __esmMin((() => {
-	init_timeout_util();
-	MatrixExpansionError = class MatrixExpansionError extends Error {
-		jobName;
-		name = "MatrixExpansionError";
-		constructor(jobName, message) {
-			super(message);
-			this.jobName = jobName;
-			Object.setPrototypeOf(this, MatrixExpansionError.prototype);
-		}
-	};
-	DYNAMIC_FIELD_TIMEOUT_MS = 6e4;
-}));
-//#endregion
-//#region src/execution/global-workflow-env.ts
 /**
-* Derive an `owner/repo` identifier from a clone URL, stripping the trailing
-* `.git` and any `http(s)://host/` prefix.
+* Materialize the source tree a non-global workflow's `filter` reads through
+* `ctx.sourceRepo.path`.
+*
+* An init or dynamic-eval job normally restores only `.kici/` from the cached
+* source tarball — enough to import the workflow module, but a directory with no
+* repo in it. A filter that reads a file or shells out against that path would
+* get a confidently wrong answer, and `changedFiles` could not be computed at
+* all, so a filter-bearing job clones the source repo into a sibling directory.
+*
+* When no tarball was attached the job already cloned the whole repo into
+* `workDir`, and that clone is reused rather than duplicated — including the
+* local working-tree case, where there is no repo url and `workDir` IS the tree.
+*
+* A tarball with no repo url is the one combination that cannot be honoured:
+* `workDir` holds `.kici/` alone and there is nothing to clone from. Returning it
+* would hand the filter a directory in which every path test answers "absent" —
+* the exact silent lie this function exists to prevent — so it throws instead.
 */
-function repoIdentifierFromUrl(repoUrl) {
-	return repoUrl.replace(/\.git$/, "").replace(/^https?:\/\/[^/]+\//, "");
-}
-/**
-* Inject the seven global-workflow env keys and return a restorer that puts
-* `process.env` back exactly as it was — each key reset to its prior value, or
-* deleted if it had none.
-*
-* **The restorer is mandatory for any caller in a long-lived process.** The
-* sandbox may ignore it: it runs one job per forked child, which exits. The
-* pre-dispatch global eval round may NOT: it runs in the agent process, which
-* serves many dispatches from one `JobRunner`. Leaving the keys set there is
-* this module's own hazard running backwards — a later NON-global
-* `DynamicJobFn` evaluation builds its generator context with
-* `env: process.env` still carrying `KICI_IS_GLOBAL_WORKFLOW=true` and a
-* `KICI_SOURCE_REPO_PATH` pointing at a deleted work directory, while that
-* job's own sandbox re-evaluation sees neither (`buildSanitizedEnv` scrubs the
-* whole `KICI_*` namespace on the trusted profile, and the default profile is
-* allowlist-only). That is the same two-worlds determinism failure, injected
-* into an unrelated job.
-*
-* `RepoInfo.ref` / `.sha` are optional, so an evaluation with no checkout
-* metadata writes an empty string rather than leaving the key unset — matching
-* how `KICI_WORKFLOW_REPO` already handles a missing identifier. Assigning
-* `undefined` to a `process.env` key would stringify to `"undefined"`, which is
-* worse than either.
-*/
-function applyGlobalWorkflowEnv(repos) {
-	const prior = GLOBAL_WORKFLOW_ENV_KEYS.map((key) => [key, process.env[key]]);
-	process.env.KICI_IS_GLOBAL_WORKFLOW = "true";
-	process.env.KICI_WORKFLOW_REPO_PATH = repos.workflowRepo.path;
-	process.env.KICI_SOURCE_REPO_PATH = repos.sourceRepo.path;
-	process.env.KICI_SOURCE_REPO = repos.sourceRepo.identifier;
-	process.env.KICI_SOURCE_BRANCH = repos.sourceRepo.ref ?? "";
-	process.env.KICI_SOURCE_SHA = repos.sourceRepo.sha ?? "";
-	process.env.KICI_WORKFLOW_REPO = repos.workflowRepo.identifier;
-	return () => {
-		for (const [key, value] of prior) if (value === void 0) delete process.env[key];
-		else process.env[key] = value;
-	};
-}
-var GLOBAL_WORKFLOW_ENV_KEYS;
-var init_global_workflow_env = __esmMin((() => {
-	GLOBAL_WORKFLOW_ENV_KEYS = [
-		"KICI_IS_GLOBAL_WORKFLOW",
-		"KICI_WORKFLOW_REPO_PATH",
-		"KICI_SOURCE_REPO_PATH",
-		"KICI_SOURCE_REPO",
-		"KICI_SOURCE_BRANCH",
-		"KICI_SOURCE_SHA",
-		"KICI_WORKFLOW_REPO"
-	];
-}));
-//#endregion
-//#region src/execution/global-eval-runner.ts
-function buildRoundState(args) {
-	const loadModule = args.loadModule ?? (async (sourceFile) => (await loadWorkflowSource(args.workflowDir, sourceFile)).module);
-	return {
-		args,
-		$: args.$ ?? $,
-		log: args.log ?? NOOP_LOG,
-		kici: args.kici ?? buildKiciApi(() => Promise.reject(/* @__PURE__ */ new Error("Agent API not available"))),
-		loadModule,
-		moduleCache: /* @__PURE__ */ new Map()
-	};
-}
-/** Load a workflow, caching per source file so a shared module is imported once. */
-async function loadWorkflowCached(shared, sourceFile, workflowName) {
-	let pending = shared.moduleCache.get(sourceFile);
-	if (!pending) {
-		pending = shared.loadModule(sourceFile);
-		shared.moduleCache.set(sourceFile, pending);
-	}
-	return extractWorkflow(await pending, workflowName);
+async function ensureFilterSourceDir(dispatch, workDir) {
+	if (!dispatch.sourceTarUrl) return workDir;
+	if (!dispatch.repoUrl) throw new Error("Workflow declares a filter, but this job restored its source from the cache with no repo url to clone from — the filter would see an empty tree. Re-run with a source repository configured, or remove the filter.");
+	const sourceDir = join(workDir, FILTER_SOURCE_DIRNAME);
+	const sourceAuth = dispatch.sourceAuth;
+	await gitClone({
+		repoUrl: dispatch.repoUrl,
+		ref: dispatch.ref,
+		sha: dispatch.sha,
+		workDir: sourceDir,
+		gitAuth: sourceAuth,
+		token: sourceAuth ? void 0 : dispatch.token
+	});
+	return sourceDir;
 }
 /**
-* Run every `DynamicJobFn` the workflow declares and serialize the result.
+* Build the context a non-global workflow's `filter` is evaluated against.
+*
+* `sourceRepo` and `workflowRepo` are the same repo — that is what "non-global"
+* means — so both carry the same identifier, path, ref, and sha. The zx shell is
+* rooted at the source tree and streams into the evaluating step's log, matching
+* what the global eval round hands its own filters.
 *
-* The generator context is built through `buildGeneratorContext` with the same
-* repo pair the sandbox re-evaluation gets, so the two calls a generator
-* receives cannot drift apart. Returns `undefined` when the workflow declares
-* no generators, which keeps the `jobs` key off the wire entirely.
+* They are two distinct objects all the same. Being the same repo is a fact
+* about their VALUES, not a licence to hand the author one object under two
+* names: a filter that mutated `ctx.sourceRepo` would silently see
+* `ctx.workflowRepo` change with it, which happens on no other path.
 */
-async function generateDynamicJobs(workflow, shared) {
-	const { args } = shared;
-	const generators = workflow.jobs.filter(isDynamicJobFn);
-	if (generators.length === 0) return void 0;
-	const serializerCtx = {
-		event: args.event,
-		$: shared.$,
-		log: shared.log,
-		env: process.env,
-		workflowName: workflow.name
+async function buildInitFilterInput(dispatch, event, workDir, emit) {
+	const sourceDir = await ensureFilterSourceDir(dispatch, workDir);
+	const diff = await resolveEvalChangedFiles(dispatch, event, sourceDir);
+	const repo = {
+		identifier: repoIdentifierFromUrl(dispatch.repoUrl),
+		path: sourceDir,
+		ref: dispatch.ref,
+		sha: dispatch.sha
 	};
-	const jobs = [];
-	const seenNames = /* @__PURE__ */ new Set();
-	for (const generator of generators) {
-		const generated = await generator(buildGeneratorContext({
-			workflowName: workflow.name,
-			event: args.event,
-			env: process.env,
-			repos: args.repos,
-			$: shared.$,
-			log: shared.log,
-			kici: shared.kici
-		}));
-		jobs.push(...await serializeJobsToLock(generated, serializerCtx, void 0, void 0, seenNames));
-	}
-	return jobs;
-}
-/**
-* Evaluate one candidate to a verdict: run its `filter` if it declares one,
-* then its generators if it survives.
-*/
-async function evaluateCandidateInner(candidate, shared) {
-	const { args } = shared;
-	const workflow = await loadWorkflowCached(shared, candidate.sourceFile, candidate.workflowName);
-	if (candidate.hasFilter) {
-		if (typeof workflow.filter !== "function") throw new Error(`Workflow '${candidate.workflowName}' is recorded as declaring a filter, but its module exports none — the lock file is out of date. Run 'kici compile' and commit the result.`);
-		const filterCtx = createFilterContext({
-			sourceRepo: args.repos.sourceRepo,
-			workflowRepo: args.repos.workflowRepo,
-			event: args.event,
-			changedFiles: args.changedFiles,
-			changedFilesStatus: args.changedFilesStatus,
-			env: process.env,
-			$: shared.$
-		});
-		if (!await workflow.filter(filterCtx)) return {
-			workflowName: candidate.workflowName,
-			run: false
-		};
-	}
-	const jobs = await generateDynamicJobs(workflow, shared);
 	return {
-		workflowName: candidate.workflowName,
-		run: true,
-		...jobs && { jobs }
+		sourceRepo: repo,
+		workflowRepo: { ...repo },
+		changedFiles: diff.files,
+		changedFilesStatus: diff.status,
+		env: process.env,
+		$: await buildEvalShell(sourceDir, emit)
 	};
 }
 /**
-* Evaluate one candidate, never throwing. A failure — a throwing filter, a
-* broken generator, a blown per-candidate budget — becomes an indeterminate
-* verdict so the round's other candidates still get real answers.
-*/
-async function evaluateCandidate(candidate, shared) {
-	try {
-		return await withTimeout(() => evaluateCandidateInner(candidate, shared), shared.args.candidateTimeoutMs, `global workflow '${candidate.workflowName}'`);
-	} catch (error) {
-		return {
-			workflowName: candidate.workflowName,
-			run: false,
-			indeterminate: true,
-			reason: error instanceof Error ? error.message : String(error)
-		};
-	}
-}
-/**
-* Evaluate candidates one at a time — they share one checkout and one working
-* directory, so a parallel `$` would race on cwd.
+* Build the per-invocation zx `$` a global eval round hands to filters and
+* generators, so a `await $\`…\`` inside one is visible in the eval step's log.
+*
+* **`env` is the LIVE `process.env` reference, never a spread.** A spread is a
+* snapshot taken when the shell is built, which is before the round applies the
+* seven `KICI_*` keys — so a filter that shells out (`$\`printenv
+* KICI_SOURCE_REPO_PATH\``, or any subprocess inheriting env) would see nothing
+* here while the sandbox re-evaluation's ambient `$` resolves `process.env`
+* after `setupGlobalWorkflowEnv` has run and does see them. That is the same
+* two-worlds determinism failure the cwd choice below exists to prevent, one
+* layer down. Passing the live reference reproduces the ambient `$`'s own
+* behaviour, which is what the sandbox uses.
 *
-* Stops before starting a candidate once the round deadline has passed or the
-* caller aborted. That check is what keeps the sequential guarantee meaningful
-* past a timeout: `withTimeout` races rather than cancels, so without it the
-* loop would keep launching every remaining candidate — each up to
-* `candidateTimeoutMs` — into a work directory the job has already reported on
-* and whose cleanup has already deleted. With it, at most one candidate is ever
-* in flight past the deadline.
+* `verbose: true` + `makeStreamingZxLog` honors a per-call `quiet: true`, so a
+* decrypted secret never leaks into the log.
 *
-* Results are appended to the caller's array as they land, so a round that
-* blows its own budget can still report the verdicts it did establish rather
-* than discarding the work.
+* `emit` is a callback rather than the `LogStreamer` itself so the caller can
+* route it through its own closed-guard: `LogStreamer.destroy()` sets no closed
+* flag and `addLine` buffers unconditionally, so a subprocess line arriving
+* after the step was reported would otherwise emit a `log.chunk` for a terminal
+* step. That is the likeliest path for it — an orphaned candidate is usually
+* orphaned *because* it is waiting on a subprocess.
 */
-async function evaluateAllCandidates(shared, into, deadline) {
-	for (const candidate of shared.args.candidates) {
-		if (shared.args.signal?.aborted || Date.now() >= deadline) return;
-		into.push(await evaluateCandidate(candidate, shared));
-	}
+async function buildEvalShell(cwd, emit) {
+	const { $: zx$ } = await import("zx");
+	return zx$({
+		cwd,
+		env: process.env,
+		verbose: true,
+		quiet: false,
+		log: makeStreamingZxLog(emit)
+	});
 }
 /**
-* Run one global eval round and return every candidate's verdict, in candidate
-* order. Never throws: a round that exceeds `roundTimeoutMs` reports whatever
-* it established and marks the rest indeterminate.
+* Build the result-aware `ctx.needs` for a dynamic eval from its frozen upstream
+* snapshot. Returns undefined for an event-only generator (no snapshot).
 */
-async function runGlobalEvalRound(args) {
-	const restoreEnv = applyGlobalWorkflowEnv(args.repos);
-	const settled = [];
-	let stopReason;
-	try {
-		const shared = buildRoundState(args);
-		await withTimeout(() => evaluateAllCandidates(shared, settled, Date.now() + args.roundTimeoutMs), args.roundTimeoutMs, `global eval round (${args.candidates.length} candidate(s))`);
-	} catch (error) {
-		stopReason = error instanceof Error ? error.message : String(error);
-	} finally {
-		restoreEnv();
-	}
-	const candidates = [...settled];
-	const reason = stopReason ?? (args.signal?.aborted ? "global eval round was cancelled before this candidate was evaluated" : "global eval round deadline reached before this candidate was evaluated");
-	for (const candidate of args.candidates.slice(candidates.length)) candidates.push({
-		workflowName: candidate.workflowName,
-		run: false,
-		indeterminate: true,
-		reason
-	});
-	return { candidates };
+function buildEvalNeedsContext(config) {
+	if (!config.resultAware || !config.upstreamSnapshot) return void 0;
+	return buildNeedsContext(config.upstreamSnapshot, config.declaredNeeds ?? []);
 }
-var NOOP_LOG;
-var init_global_eval_runner = __esmMin((() => {
-	init_timeout_util();
-	init_generator_context();
+var FILTER_SOURCE_DIRNAME;
+var init_eval_context = __esmMin((() => {
+	init_git_clone();
+	init_changed_files();
 	init_global_workflow_env();
-	init_workflow_loader();
-	init_dynamic_job_serializer();
-	NOOP_LOG = {
-		info: () => {},
-		warn: () => {},
-		error: () => {},
-		debug: () => {}
-	};
+	init_streaming_zx_log();
+	FILTER_SOURCE_DIRNAME = "__kici_filter_source__";
 })), DEFAULT_MAX_LOG_SIZE_BYTES, DEFAULT_FLUSH_INTERVAL_MS, DEFAULT_FLUSH_LINE_THRESHOLD, PAUSE_SAFETY_TIMEOUT_MS, LogStreamer;
 var init_log_streamer = __esmMin((() => {
 	init_prometheus();
@@ -5953,7 +5539,7 @@ async function applyOverlay(config) {
 	const { tarballUrl, cliPublicKey, orchestratorPrivateKey, repoDir } = config;
 	const { path: tmpDir, cleanup } = await makeTempDir("overlay");
 	try {
-		logger$8.info("Downloading overlay tarball", { url: tarballUrl.replace(/\?.*$/, "?[redacted]") });
+		logger$9.info("Downloading overlay tarball", { url: tarballUrl.replace(/\?.*$/, "?[redacted]") });
 		let encryptedData;
 		try {
 			encryptedData = await downloadUrl(tarballUrl);
@@ -5964,7 +5550,7 @@ async function applyOverlay(config) {
 		const orchPrivKeyBuf = Buffer.from(orchestratorPrivateKey, "base64");
 		const aesKey = deriveSharedSecret(orchPrivKeyBuf, cliPubKeyBuf);
 		const decryptedData = decryptBuffer(encryptedData, aesKey);
-		logger$8.info("Extracting overlay tarball", { size: decryptedData.length });
+		logger$9.info("Extracting overlay tarball", { size: decryptedData.length });
 		const extractDir = path.join(tmpDir, "extracted");
 		await fsPromises.mkdir(extractDir, { recursive: true });
 		try {
@@ -6013,10 +5599,10 @@ async function applyOverlay(config) {
 				await fsPromises.unlink(targetPath);
 				filesDeleted++;
 			} catch {
-				logger$8.debug("Deletion target not found, skipping", { file });
+				logger$9.debug("Deletion target not found, skipping", { file });
 			}
 		}
-		logger$8.info("Overlay applied successfully", {
+		logger$9.info("Overlay applied successfully", {
 			filesApplied,
 			filesDeleted
 		});
@@ -6029,10 +5615,10 @@ async function applyOverlay(config) {
 		await cleanup().catch(() => {});
 	}
 }
-var logger$8, IV_LENGTH$1, AUTH_TAG_LENGTH;
+var logger$9, IV_LENGTH$1, AUTH_TAG_LENGTH;
 var init_overlay_applier = __esmMin((() => {
 	init_download();
-	logger$8 = createLogger({ prefix: "overlay-applier" });
+	logger$9 = createLogger({ prefix: "overlay-applier" });
 	IV_LENGTH$1 = 12;
 	AUTH_TAG_LENGTH = 16;
 }));
@@ -6168,10 +5754,12 @@ var init_npm_registry_config = __esmMin((() => {}));
 *
 * `nodeLinker: node-modules` makes berry lay down a real `node_modules` tree
 * (no PnP `.pnp.cjs`), so the agent's packer / restore / sibling-walk /
-* workflow-loader work unchanged. `enableScripts: false` (when a private
-* registry is configured) keeps dependency lifecycle scripts from seeing the
-* synthesized token env vars — the same security model as npm/pnpm/classic
-* `--ignore-scripts`.
+* workflow-loader work unchanged. `enableScripts: false` keeps dependency
+* lifecycle scripts from running at all — for every install, not only one
+* against a private registry — the same security model as npm/pnpm/classic
+* `--ignore-scripts`. An operator opts back in with
+* `KICI_ALLOW_INSTALL_SCRIPTS=true`, which arrives here as
+* `ignoreScripts: false`.
 *
 * Reuses the same `ApplyNpmRegistryConfigArgs` / `ApplyNpmRegistryConfigResult`
 * shapes as the npm overlay so `dep-installer` can pick either by flavor.
@@ -6218,8 +5806,8 @@ async function applyYarnrcBerryConfig(args) {
 	};
 	const tokenEnv = {};
 	const tokensForRedaction = [];
+	if (args.ignoreScripts !== false) merged.enableScripts = false;
 	if (hasPrivateRegistry) {
-		merged.enableScripts = false;
 		const npmScopes = { ...doc.npmScopes ?? {} };
 		for (let i = 0; i < registries.length; i++) {
 			const reg = registries[i];
@@ -6561,9 +6149,11 @@ var init_workspace_siblings = __esmMin((() => {}));
 * Security: the install runs with an isolated per-invocation cache/store
 * directory to prevent cache poisoning across build jobs — a malicious
 * package.json in one repo cannot taint the cache used by subsequent builds.
-* The same pressure rules out letting lifecycle scripts see synthesized auth
-* env vars — the install runs with `--ignore-scripts` whenever a private
-* registry is configured.
+* The install runs with `--ignore-scripts` for every package manager. A
+* lifecycle script in a committed `package.json` is customer code the agent
+* never agreed to execute: it would run wherever the install runs, which for a
+* step-child install is the process holding the job's secrets. Operators who
+* genuinely need it set `KICI_ALLOW_INSTALL_SCRIPTS=true` on the agent.
 */
 /**
 * Detect the package manager for the cloned repo from its committed manifests.
@@ -6594,9 +6184,11 @@ async function detectKiciYarnFlavor(repoRoot, kiciDir) {
 * between build jobs; the directory is removed after installation.
 *
 * If `opts.npmRegistries` / `opts.installEnvSecrets` is provided, a job-scoped
-* `.kici/.npmrc` overlay is synthesized for the install, restored in `finally`,
-* and the install runs with `--ignore-scripts` so lifecycle scripts in a
-* committed `package.json` cannot exfiltrate the synthesized token env vars.
+* `.kici/.npmrc` overlay is synthesized for the install and restored in
+* `finally`.
+*
+* Lifecycle scripts are disabled for every package manager unless the operator
+* set `opts.allowInstallScripts`.
 *
 * @param kiciDir - Path to the `.kici/` directory containing package.json.
 * @param opts    - Optional registry / installEnv / repoRoot configuration.
@@ -6605,7 +6197,7 @@ async function installDeps(kiciDir, opts = {}) {
 	const repoRoot = opts.repoRoot ?? dirname(kiciDir);
 	const packageManager = await detectKiciPackageManager(repoRoot, kiciDir);
 	const yarnFlavor = packageManager === PackageManager.Yarn ? await detectKiciYarnFlavor(repoRoot, kiciDir) : YarnFlavor.Classic;
-	logger$7.info("Installing deps inline", {
+	logger$8.info("Installing deps inline", {
 		packageManager,
 		yarnFlavor,
 		dir: kiciDir
@@ -6618,13 +6210,15 @@ async function installDeps(kiciDir, opts = {}) {
 		yarnFlavor
 	});
 	const startTime = Date.now();
-	const hasPrivateRegistry = (opts.npmRegistries?.length ?? 0) > 0 || (opts.installEnvSecrets ? Object.keys(opts.installEnvSecrets).length > 0 : false);
+	const ignoreScripts = opts.allowInstallScripts !== true;
+	const baseEnv = opts.baseEnv ?? process.env;
 	const isBerry = packageManager === PackageManager.Yarn && yarnFlavor === YarnFlavor.Berry;
 	const registryConfig = isBerry ? await applyYarnrcBerryConfig({
 		kiciDir,
 		npmRegistries: opts.npmRegistries,
 		installEnvSecrets: opts.installEnvSecrets,
-		jobIdShort: opts.jobIdShort ?? "00000000"
+		jobIdShort: opts.jobIdShort ?? "00000000",
+		ignoreScripts
 	}) : await applyNpmRegistryConfig({
 		kiciDir,
 		npmRegistries: opts.npmRegistries,
@@ -6634,22 +6228,26 @@ async function installDeps(kiciDir, opts = {}) {
 	try {
 		if (packageManager === PackageManager.Pnpm) await runPnpmInstall({
 			kiciDir,
-			hasPrivateRegistry,
-			registryConfig
+			ignoreScripts,
+			registryConfig,
+			baseEnv
 		});
 		else if (isBerry) await runYarnBerryInstall({
 			kiciDir,
-			registryConfig
+			registryConfig,
+			baseEnv
 		});
 		else if (packageManager === PackageManager.Yarn) await runYarnInstall({
 			kiciDir,
-			hasPrivateRegistry,
-			registryConfig
+			ignoreScripts,
+			registryConfig,
+			baseEnv
 		});
 		else await runNpmInstall({
 			kiciDir,
-			hasPrivateRegistry,
-			registryConfig
+			ignoreScripts,
+			registryConfig,
+			baseEnv
 		});
 	} catch (e) {
 		const tokens = registryConfig.tokensForRedaction;
@@ -6659,29 +6257,35 @@ async function installDeps(kiciDir, opts = {}) {
 	} finally {
 		await registryConfig.cleanup();
 	}
-	if (packageManager === PackageManager.Pnpm && await kiciHasLocalProtocolDeps(kiciDir)) await buildWorkspaceClosure(repoRoot);
-	if (packageManager === PackageManager.Yarn) await buildYarnWorkspaceClosure(repoRoot, kiciDir, yarnFlavor);
+	if (packageManager === PackageManager.Pnpm && await kiciHasLocalProtocolDeps(kiciDir)) await buildWorkspaceClosure(repoRoot, baseEnv);
+	if (packageManager === PackageManager.Yarn) await buildYarnWorkspaceClosure(repoRoot, kiciDir, yarnFlavor, baseEnv);
 	const durationMs = Date.now() - startTime;
 	process.stderr.write(`[dep-installer:trace] install complete: ${durationMs}ms\n`);
-	logger$7.info("Deps installed inline", {
+	logger$8.info("Deps installed inline", {
 		packageManager,
 		durationMs
 	});
 }
-/** Build the Node binary directory onto PATH so spawned tools find `node`. */
-function envWithNodeOnPath(extraEnv, nodeDir) {
-	const { NODE_ENV: _NODE_ENV, ...restEnv } = process.env;
+/**
+* Build the Node binary directory onto PATH so spawned tools find `node`.
+*
+* `baseEnv` is the caller's declared environment for the subprocess. It
+* defaults to `process.env` because inside the runner child that IS the
+* sanitized job environment; an agent-process caller passes a sanitized base.
+*/
+function envWithNodeOnPath(extraEnv, nodeDir, baseEnv = process.env) {
+	const { NODE_ENV: _NODE_ENV, ...restEnv } = baseEnv;
 	return {
 		...restEnv,
 		...extraEnv,
-		PATH: `${nodeDir}${process.platform === "win32" ? ";" : ":"}${process.env.PATH ?? ""}`
+		PATH: `${nodeDir}${process.platform === "win32" ? ";" : ":"}${restEnv.PATH ?? ""}`
 	};
 }
 /** Run `npm install` in `.kici/` with an isolated cache directory. */
 async function runNpmInstall(args) {
 	const { npmCliPath, nodeExe, nodeDir } = resolveNpm();
 	const { path: cacheDir, cleanup } = await makeTempDir("npm-cache");
-	const env = envWithNodeOnPath(args.registryConfig.extraEnv, nodeDir);
+	const env = envWithNodeOnPath(args.registryConfig.extraEnv, nodeDir, args.baseEnv);
 	const buildArgs = (...prefix) => {
 		const a = [
 			...prefix,
@@ -6691,7 +6295,7 @@ async function runNpmInstall(args) {
 			"--no-audit",
 			"--no-fund"
 		];
-		if (args.hasPrivateRegistry) a.push("--ignore-scripts");
+		if (args.ignoreScripts) a.push("--ignore-scripts");
 		return a;
 	};
 	try {
@@ -6720,7 +6324,7 @@ async function runPnpmInstall(args) {
 	await assertPnpmAvailable();
 	const { nodeDir } = resolveNpm();
 	const { path: storeDir, cleanup } = await makeTempDir("pnpm-store");
-	const env = envWithNodeOnPath(args.registryConfig.extraEnv, nodeDir);
+	const env = envWithNodeOnPath(args.registryConfig.extraEnv, nodeDir, args.baseEnv);
 	const argv = [
 		"install",
 		`--config.store-dir=${storeDir}`,
@@ -6729,7 +6333,7 @@ async function runPnpmInstall(args) {
 		"--config.side-effects-cache=false",
 		PNPM_IGNORE_BUILD_GATE_ARG
 	];
-	if (args.hasPrivateRegistry) argv.push("--ignore-scripts");
+	if (args.ignoreScripts) argv.push("--ignore-scripts");
 	try {
 		process.stderr.write(`[dep-installer:trace] running: pnpm ${argv.join(" ")}\n`);
 		await execFileAsync("pnpm", argv, {
@@ -6743,7 +6347,7 @@ async function runPnpmInstall(args) {
 	}
 }
 /** Pure: argv for `yarn install` with an isolated cache folder. */
-function buildYarnInstallArgs(cacheDir, hasPrivateRegistry) {
+function buildYarnInstallArgs(cacheDir, ignoreScripts) {
 	const a = [
 		"install",
 		"--cache-folder",
@@ -6751,7 +6355,7 @@ function buildYarnInstallArgs(cacheDir, hasPrivateRegistry) {
 		"--non-interactive",
 		"--no-progress"
 	];
-	if (hasPrivateRegistry) a.push("--ignore-scripts");
+	if (ignoreScripts) a.push("--ignore-scripts");
 	return a;
 }
 /**
@@ -6766,8 +6370,8 @@ async function runYarnInstall(args) {
 	await assertYarnAvailable();
 	const { nodeDir } = resolveNpm();
 	const { path: cacheDir, cleanup } = await makeTempDir("yarn-cache");
-	const env = envWithNodeOnPath(args.registryConfig.extraEnv, nodeDir);
-	const argv = buildYarnInstallArgs(cacheDir, args.hasPrivateRegistry);
+	const env = envWithNodeOnPath(args.registryConfig.extraEnv, nodeDir, args.baseEnv);
+	const argv = buildYarnInstallArgs(cacheDir, args.ignoreScripts);
 	try {
 		process.stderr.write(`[dep-installer:trace] running: yarn ${argv.join(" ")}\n`);
 		await execFileAsync("yarn", argv, {
@@ -6797,7 +6401,7 @@ async function runYarnBerryInstall(args) {
 	await assertYarnAvailable();
 	const { nodeDir } = resolveNpm();
 	const env = {
-		...envWithNodeOnPath(args.registryConfig.extraEnv, nodeDir),
+		...envWithNodeOnPath(args.registryConfig.extraEnv, nodeDir, args.baseEnv),
 		COREPACK_ENABLE_DOWNLOAD_PROMPT: "0"
 	};
 	const argv = buildYarnBerryInstallArgs();
@@ -6828,11 +6432,11 @@ async function assertYarnAvailable() {
 * Deep cross-sibling build chains may build out of strict topological order —
 * real `.kici` closures are shallow.
 */
-async function buildYarnWorkspaceClosure(repoRoot, kiciDir, yarnFlavor) {
+async function buildYarnWorkspaceClosure(repoRoot, kiciDir, yarnFlavor, baseEnv) {
 	const siblings = await collectInRepoSiblings(repoRoot, kiciDir, resolveYarnNodeModulesRoot(repoRoot, kiciDir));
 	if (siblings.length === 0) return;
 	const { nodeDir } = resolveNpm();
-	const env = envWithNodeOnPath({}, nodeDir);
+	const env = envWithNodeOnPath({}, nodeDir, baseEnv);
 	for (const rel of [...siblings].reverse()) {
 		const sibDir = join(repoRoot, rel);
 		if (!await siblingHasBuildScript(sibDir)) continue;
@@ -6876,9 +6480,9 @@ async function siblingHasBuildScript(sibDir) {
 * the subprocess stderr/stdout is folded into the thrown error so the job's
 * failure message names the real cause instead of a bare "Command failed".
 */
-async function buildWorkspaceClosure(repoRoot) {
+async function buildWorkspaceClosure(repoRoot, baseEnv) {
 	const { nodeDir } = resolveNpm();
-	const env = envWithNodeOnPath({}, nodeDir);
+	const env = envWithNodeOnPath({}, nodeDir, baseEnv);
 	const argv = [
 		"--filter",
 		"{.kici}^...",
@@ -6920,13 +6524,13 @@ function logSubprocessStreams(e, tokens) {
 	if (e && typeof e === "object" && "stdout" in e) process.stderr.write(`[dep-installer:trace] stdout: ${redactNpmOutput(String(e.stdout), tokens).slice(0, 500)}\n`);
 	if (e && typeof e === "object" && "stderr" in e) process.stderr.write(`[dep-installer:trace] stderr: ${redactNpmOutput(String(e.stderr), tokens).slice(0, 500)}\n`);
 }
-var logger$7, execFileAsync, INSTALL_TIMEOUT_MS, INSTALL_MAX_BUFFER;
+var logger$8, execFileAsync, INSTALL_TIMEOUT_MS, INSTALL_MAX_BUFFER;
 var init_dep_installer = __esmMin((() => {
 	init_npm_registry_config();
 	init_yarnrc_berry_config();
 	init_validate_kici_deps();
 	init_workspace_siblings();
-	logger$7 = createLogger({ prefix: "dep-installer" });
+	logger$8 = createLogger({ prefix: "dep-installer" });
 	execFileAsync = promisify(execFile);
 	INSTALL_TIMEOUT_MS = 6e5;
 	INSTALL_MAX_BUFFER = 134217728;
@@ -6974,7 +6578,7 @@ async function packNodeModules(kiciDir) {
 	const nmRoot = packageManager === PackageManager.Yarn ? resolveYarnNodeModulesRoot(workDir, kiciDir) : join(kiciDir, "node_modules");
 	if (!existsSync(nmRoot)) throw new Error(`node_modules not found at ${nmRoot}`);
 	const entries = await closureEntries(workDir, kiciDir, packageManager);
-	logger$6.info("Packing dependency closure into tarball", {
+	logger$7.info("Packing dependency closure into tarball", {
 		dir: workDir,
 		packageManager,
 		entries
@@ -6990,7 +6594,7 @@ async function packNodeModules(kiciDir) {
 	const tarball = Buffer.concat(chunks);
 	const hash = sha256(tarball);
 	const sizeMB = (tarball.length / 1048576).toFixed(2);
-	logger$6.info("Dependency closure packed", {
+	logger$7.info("Dependency closure packed", {
 		sizeMB,
 		hash: hash.slice(0, 12),
 		durationMs: Date.now() - startTime
@@ -7024,73 +6628,109 @@ async function closureEntries(workDir, kiciDir, packageManager) {
 	}
 	return [relative(workDir, join(kiciDir, "node_modules"))];
 }
-var logger$6;
+var logger$7;
 var init_dep_packer = __esmMin((() => {
 	init_workspace_siblings();
-	logger$6 = createLogger({ prefix: "dep-packer" });
+	logger$7 = createLogger({ prefix: "dep-packer" });
 }));
 //#endregion
-//#region src/execution/sandbox/env-sanitizer.ts
+//#region src/execution/sandbox/log-masker.ts
 /**
-* Environment sanitization for sandbox execution.
-*
-* Uses an explicit allowlist approach: only known-safe system variables are
-* copied from the host process.env. Agent-internal credentials (KICI_*,
-* DATABASE_URL, PLATFORM_TOKEN, WEBHOOK_SECRET, etc.) are NEVER included.
-*
-* 7-layer merge precedence (later overrides earlier):
-*   1. Allowed system vars from process.env
-*   2. Sandbox defaults (FORCE_COLOR=1, etc.)
-*   3. KICI_* system vars (orchestrator-generated, from userEnv)
-*   4. Org-level environment vars (from orchestrator via contextVars)
-*   5. Source-level environment overrides (merged into contextVars by orchestrator)
-*   6. Job env (from lock file env field, evaluated by orchestrator)
-*   7. setEnv() calls (runtime -- applied at step execution, not here)
+* Escape regex special characters in a string.
 */
+function escapeRegExp(s) {
+	return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
 /**
-* Build a sanitized environment for sandbox execution.
-*
-* Constructs an environment from scratch using the 7-layer merge:
-* 1. Explicitly allowed system variables from process.env
-* 2. Sandbox default variables (FORCE_COLOR, etc.)
-* 3. User-defined env vars (KICI_* system vars from orchestrator)
-* 4-5. Environment vars (org-level + source overrides, pre-merged by orchestrator)
-* 6. Job env (SDK-defined, evaluated by orchestrator)
-* 7. setEnv() calls (runtime -- not handled here)
-*
-* Secrets are NOT injected into environment variables by this function.
-* They flow through IPC to ctx.secrets and are only exposed via ctx.secrets.expose().
-*
-* Agent-internal credentials (KICI_ORCHESTRATOR_URL, DATABASE_URL,
-* PLATFORM_TOKEN, WEBHOOK_SECRET, etc.) are never included because they
-* are not in the allowlist.
+* Create a LogMasker initialized with all secret values from the request.
 *
-* The `trustedEnv` option (default false) selects the trusted fleet-agent
-* profile: Layer 1 passes the ambient host env through instead of restricting
-* to `ALLOWED_SYSTEM_VARS`, minus the agent's own KiCI identity/operational
-* secrets (the whole `KICI_*` namespace + a small non-`KICI_` infra denylist).
-* It is read ONLY from agent config (`KICI_TRUSTED_ENV`), never from a dispatch
-* payload, so a workflow cannot request it. With it OFF the output is
-* byte-identical to the allowlist-only behavior.
+* Collects values from both flat secrets and all namespaced context secrets,
+* deduplicating before registration.
 *
-* @param userEnv - Environment variables from workflow config and orchestrator
-* @param options - Optional extended options for environment layers
-* @returns A new Record with only safe environment variables
+* Both the runner child and the agent-side fork runner build a masker from the
+* same request, so the crash tail the agent assembles from the child's stderr is
+* masked with the same value set the child used for its own log lines.
 */
-function buildSanitizedEnv(userEnv, options) {
-	const sanitized = {};
-	if (options?.trustedEnv) Object.assign(sanitized, buildTrustedPassthroughEnv(process.env));
-	else for (const key of ALLOWED_SYSTEM_VARS) {
-		const value = process.env[key];
-		if (value !== void 0) sanitized[key] = value;
-	}
-	Object.assign(sanitized, SANDBOX_DEFAULT_VARS);
-	Object.assign(sanitized, userEnv);
-	if (options?.contextVars) Object.assign(sanitized, options.contextVars);
-	if (options?.jobEnv) Object.assign(sanitized, options.jobEnv);
-	return sanitized;
+function createSecretMasker(request) {
+	const masker = new LogMasker();
+	const allSecrets = {};
+	if (request.secrets) Object.assign(allSecrets, request.secrets);
+	if (request.namespacedSecrets) for (const contextSecrets of Object.values(request.namespacedSecrets)) Object.assign(allSecrets, contextSecrets);
+	masker.registerSecrets(allSecrets);
+	return masker;
 }
-var init_env_sanitizer = __esmMin((() => {}));
+var MIN_MASK_LENGTH, LogMasker;
+var init_log_masker = __esmMin((() => {
+	MIN_MASK_LENGTH = 3;
+	LogMasker = class {
+		pattern = null;
+		/**
+		* Register secret values to be masked in log output.
+		*
+		* Values shorter than 3 characters are skipped to avoid false positives.
+		* Base64-encoded variants of each qualifying secret are also registered,
+		* preventing leaks when secrets appear base64-encoded in logs (e.g.,
+		* Authorization: Basic headers, base64-encoded config values).
+		* Values are sorted by length descending so longer values are matched first
+		* (prevents partial masking when one secret is a substring of another).
+		*
+		* Multi-line values additionally register each of their individual lines.
+		* Log output is split into lines before it reaches the masker, so a value
+		* containing a newline can never match as a whole — a PEM private key or a
+		* kubeconfig would otherwise stream in clear text. Two consequences of the
+		* per-line registration are deliberate:
+		*
+		* - `MIN_MASK_LENGTH` is 3, so short structural lines of a structured secret
+		*   are registered too. A `---` YAML separator or a bare `{` from a
+		*   service-account JSON is masked wherever it appears in that job's logs.
+		* - PEM header and footer lines (`-----BEGIN OPENSSH PRIVATE KEY-----`) are
+		*   not secret on their own and are masked as a side effect.
+		*
+		* Both are strictly safer than leaking the body, and no heuristic separates a
+		* structural line from a body line without risking the reverse mistake.
+		*/
+		registerSecrets(secrets) {
+			const seen = /* @__PURE__ */ new Set();
+			const values = [];
+			const add = (candidate) => {
+				if (candidate.length < MIN_MASK_LENGTH || seen.has(candidate)) return;
+				seen.add(candidate);
+				values.push(candidate);
+				const b64 = Buffer.from(candidate).toString("base64");
+				if (b64.length >= MIN_MASK_LENGTH && !seen.has(b64)) {
+					seen.add(b64);
+					values.push(b64);
+				}
+			};
+			for (const value of Object.values(secrets)) {
+				add(value);
+				if (value.includes("\n")) for (const rawLine of value.split("\n")) add(rawLine.endsWith("\r") ? rawLine.slice(0, -1) : rawLine);
+			}
+			if (values.length === 0) {
+				this.pattern = null;
+				return;
+			}
+			values.sort((a, b) => b.length - a.length);
+			this.pattern = new RegExp(values.map((v) => escapeRegExp(v)).join("|"), "g");
+		}
+		/**
+		* Mask all registered secret values in a log line.
+		*
+		* Returns the line unchanged if no secrets are registered.
+		*/
+		mask(line) {
+			if (!this.pattern) return line;
+			this.pattern.lastIndex = 0;
+			return line.replace(this.pattern, "***");
+		}
+		/**
+		* Returns true if any maskable secrets are registered.
+		*/
+		hasSecrets() {
+			return this.pattern !== null;
+		}
+	};
+}));
 //#endregion
 //#region src/execution/sandbox/secret-encryption.ts
 /**
@@ -7221,8 +6861,10 @@ function buildRequest(dispatch, workDir, extra) {
 		sourceAuth: dispatch.sourceAuth,
 		workflowAuth: dispatch.workflowAuth,
 		...extra?.credentialHelperPath ? { credentialHelperPath: extra.credentialHelperPath } : {},
+		...extra?.allowInstallScripts ? { allowInstallScripts: true } : {},
 		sourceTarUrl: dispatch.sourceTarUrl,
 		sourceTarHash: dispatch.sourceTarHash,
+		sourceTarDigest: dispatch.sourceTarDigest,
 		depsUrl: dispatch.depsUrl,
 		depsHash: dispatch.depsHash,
 		workflowName: jobConfig.workflowName ?? "",
@@ -7252,6 +6894,7 @@ function buildRequest(dispatch, workDir, extra) {
 		cliPublicKey: jobConfig.cliPublicKey,
 		orchestratorPrivateKey: jobConfig.orchestratorPrivateKey,
 		runPublicKey: dispatch.runPublicKey,
+		provenanceContext: dispatch.provenanceContext,
 		context: jobConfig.context,
 		contextVars: jobConfig.contextVars,
 		jobEnv: jobConfig.jobEnv,
@@ -7398,6 +7041,56 @@ function fileCloneSourceBinds(repoUrl) {
 	}
 }
 /**
+* Resolve a `KICI_RUNNER_USER` spec to numeric ids.
+*
+* Accepts `uid`, `uid:gid`, or a user name. A name is resolved through `id`,
+* which is present on every POSIX host the bare-metal backend supports; a uid
+* with no gid takes that user's primary group.
+*
+* Throws on an unresolvable spec rather than silently falling back to the
+* agent's own uid — the operator set this to get a boundary, so quietly not
+* having one is the worst outcome.
+*/
+function resolveRunnerUser(spec) {
+	if (!spec) return void 0;
+	const [userPart, groupPart] = spec.split(":");
+	const runId = (args) => {
+		const out = execFileSync("id", args, { encoding: "utf8" }).trim();
+		if (!out) throw new Error(`empty output from \`id ${args.join(" ")}\``);
+		return out;
+	};
+	try {
+		const uid = /^\d+$/.test(userPart ?? "") ? Number(userPart) : Number(runId(["-u", userPart]));
+		const gid = groupPart === void 0 ? Number(runId(["-g", userPart])) : /^\d+$/.test(groupPart) ? Number(groupPart) : Number(runId(["-g", groupPart]));
+		if (!Number.isInteger(uid) || !Number.isInteger(gid)) throw new Error("non-numeric id");
+		return {
+			uid,
+			gid
+		};
+	} catch (err) {
+		throw new Error(`KICI_RUNNER_USER='${spec}' could not be resolved to a uid/gid: ${toErrorMessage(err)}`);
+	}
+}
+/**
+* Hand the job workdir to the runner user before the child starts.
+*
+* Without this the child cannot write its own workspace. A failure is fatal:
+* the operator asked for a dedicated uid, and running one that cannot write is
+* a broken job wearing the clothes of a boundary.
+*/
+function chownWorkDirToRunner(workDir, identity) {
+	if (!workDir) return;
+	try {
+		execFileSync("chown", [
+			"-R",
+			`${identity.uid}:${identity.gid}`,
+			workDir
+		], { stdio: "pipe" });
+	} catch (err) {
+		throw new Error(`failed to chown job workdir ${workDir} to ${identity.uid}:${identity.gid} for KICI_RUNNER_USER: ${toErrorMessage(err)}`);
+	}
+}
+/**
 * Spawn the workflow-runner child process. Returns the child handle and a
 * boolean indicating whether the spawn produced a usable PID. On Windows
 * services (shawl) fork() can fail silently when IPC pipes cannot be set up;
@@ -7405,6 +7098,12 @@ function fileCloneSourceBinds(repoUrl) {
 */
 function spawnRunnerChild(options, sanitizedEnv, effectiveWorkDir) {
 	const { runnerPath, useBwrap = false, networkIsolation = false, extraReadOnlyBinds = [] } = options;
+	const identity = resolveRunnerUser(options.runnerUser);
+	if (identity) chownWorkDirToRunner(effectiveWorkDir, identity);
+	const identityOpts = identity ? {
+		uid: identity.uid,
+		gid: identity.gid
+	} : {};
 	let child;
 	if (useBwrap) {
 		const bwrapArgs = buildBwrapArgs(effectiveWorkDir, process.execPath, networkIsolation, runnerPath, extraReadOnlyBinds);
@@ -7419,7 +7118,8 @@ function spawnRunnerChild(options, sanitizedEnv, effectiveWorkDir) {
 				"pipe",
 				"pipe",
 				"ipc"
-			]
+			],
+			...identityOpts
 		});
 	} else child = fork(runnerPath, [], {
 		env: sanitizedEnv,
@@ -7430,13 +7130,29 @@ function spawnRunnerChild(options, sanitizedEnv, effectiveWorkDir) {
 			"ipc"
 		],
 		cwd: effectiveWorkDir || void 0,
-		detached: options.detachProcessGroup === true
+		detached: options.detachProcessGroup === true,
+		...identityOpts
 	});
 	return {
 		child,
 		pidAssigned: Boolean(child.pid)
 	};
 }
+/**
+* True when the operator asked for the child's raw stdio on the agent's own
+* stderr (`KICI_RUNNER_DEBUG_STDIO=true`).
+*
+* Off by default. The agent's stderr is not a run log: for a scaler-spawned
+* agent the orchestrator's LogForwarder copies it into journald and Loki, where
+* it is readable without the `runs:read` check that guards the run log and with
+* no per-org scoping. The child's masked `log.line` stream is the log; echoing
+* the same bytes to stderr would publish the unmasked copy beside it.
+*
+* Read per call rather than cached so a test can flip it between cases.
+*/
+function debugStdioEnabled() {
+	return process.env.KICI_RUNNER_DEBUG_STDIO === "true";
+}
 /** Drain the child's stdout (preventing pipe-buffer deadlock) and capture
 *  the last N stderr lines for crash diagnostics. The returned array is
 *  mutated in place by the stderr listener. */
@@ -7444,7 +7160,7 @@ function setupChildStdioCapture(child) {
 	const stderrLines = [];
 	const MAX_STDERR_LINES = 20;
 	if (child.stdout) child.stdout.on("data", (chunk) => {
-		process.stderr.write(`[workflow-runner:stdout] ${chunk.toString().trimEnd()}\n`);
+		if (debugStdioEnabled()) process.stderr.write(`[workflow-runner:stdout] ${chunk.toString().trimEnd()}\n`);
 	});
 	if (child.stderr) {
 		let stderrBuffer = "";
@@ -7456,7 +7172,7 @@ function setupChildStdioCapture(child) {
 				if (!line.trim()) continue;
 				stderrLines.push(line);
 				if (stderrLines.length > MAX_STDERR_LINES) stderrLines.shift();
-				process.stderr.write(`[workflow-runner:stderr] ${line}\n`);
+				if (debugStdioEnabled()) process.stderr.write(`[workflow-runner:stderr] ${line}\n`);
 			}
 		});
 	}
@@ -7629,7 +7345,7 @@ function handleJobComplete(msg, dispatch, ctx) {
 /** Dispatch one IPC message from the runner. Centralises the message switch
 *  so the createForkRunner body stays small. */
 function relayChildIpcMessage(msg, dispatch, ctx) {
-	const logDetail = msg.type === "log.line" ? ` content="${msg.line}"` : msg.type === "job.complete" ? ` status=${msg.status}` : "";
+	const logDetail = msg.type === "log.line" ? debugStdioEnabled() ? ` content="${msg.line}"` : "" : msg.type === "job.complete" ? ` status=${msg.status}` : "";
 	process.stderr.write(`[fork-runner] IPC message received: type=${msg.type}${logDetail}\n`);
 	switch (msg.type) {
 		case "ready":
@@ -7637,7 +7353,8 @@ function relayChildIpcMessage(msg, dispatch, ctx) {
 				type: "execute",
 				request: buildRequest(dispatch, ctx.effectiveWorkDir, {
 					cleanupOnly: ctx.cleanupOnly,
-					credentialHelperPath: ctx.execOptions.credentialHelperPath
+					credentialHelperPath: ctx.execOptions.credentialHelperPath,
+					allowInstallScripts: ctx.execOptions.allowInstallScripts
 				})
 			});
 			return;
@@ -7719,9 +7436,10 @@ function handleChildExitWithoutCompletion(code, signal, ctx) {
 	process.stderr.write(`[fork-runner] Child exited: code=${code}, signal=${signal}, jobCompleted=${ctx.state.jobCompleted}\n`);
 	if (ctx.state.jobCompleted) return;
 	const isCancelled = ctx.state.forkState === "cancelling" || ctx.state.forkState === "force_killing";
-	const crashMsg = isCancelled ? "Job cancelled" : ctx.stderrLines.length > 0 ? `Workflow runner crashed:\n${ctx.stderrLines.join("\n")}` : `Workflow runner exited unexpectedly (code=${code}, signal=${signal})`;
+	const stderrLines = ctx.stderrLines.map((line) => ctx.masker.mask(line));
+	const crashMsg = isCancelled ? "Job cancelled" : stderrLines.length > 0 ? `Workflow runner crashed:\n${stderrLines.join("\n")}` : `Workflow runner exited unexpectedly (code=${code}, signal=${signal})`;
 	if (!isCancelled) {
-		ctx.execOptions.onLogLine(-1, `[sandbox] Child exited: code=${code}, signal=${signal}, stderr=${ctx.stderrLines.slice(-5).join(" | ")}`);
+		ctx.execOptions.onLogLine(-1, `[sandbox] Child exited: code=${code}, signal=${signal}, stderr=${stderrLines.slice(-5).join(" | ")}`);
 		ctx.execOptions.onLogLine(-1, `[sandbox] ${crashMsg}`);
 	}
 	ctx.resolve({
@@ -7781,6 +7499,7 @@ function buildCancelFn(child, ctx, defaultGracePeriodMs, agentMaxGracePeriodMs,
 function createForkRunner(options, execOptions) {
 	const sanitizedEnv = buildSanitizedEnv(options.env);
 	if (options.useBwrap) sanitizedEnv.TMPDIR = "/tmp";
+	if (debugStdioEnabled()) sanitizedEnv.KICI_RUNNER_DEBUG_STDIO = "true";
 	const effectiveWorkDir = options.workDir ?? "/workspace";
 	const dispatch = execOptions.dispatch;
 	const { child, pidAssigned } = spawnRunnerChild(options, sanitizedEnv, effectiveWorkDir);
@@ -7828,6 +7547,10 @@ function createForkRunner(options, execOptions) {
 			cancelTimers,
 			state: sharedState,
 			stderrLines,
+			masker: createSecretMasker(buildRequest(dispatch, effectiveWorkDir, {
+				cleanupOnly: options.cleanupOnly === true,
+				credentialHelperPath: execOptions.credentialHelperPath
+			})),
 			cleanupOnly: options.cleanupOnly === true
 		};
 		process.stderr.write(`[fork-runner] Child process spawned: pid=${child.pid}, runner=${options.runnerPath}, cwd=${effectiveWorkDir}\n`);
@@ -7874,6 +7597,7 @@ function createForkRunner(options, execOptions) {
 	};
 }
 var init_fork_runner = __esmMin((() => {
+	init_log_masker();
 	init_env_sanitizer();
 	init_secret_encryption();
 }));
@@ -7895,16 +7619,17 @@ var init_fork_runner = __esmMin((() => {
 * network access. This mode provides credential isolation only and should
 * be used in trusted environments.
 */
-var logger$5, BareMetalSandbox;
+var logger$6, BareMetalSandbox;
 var init_bare_metal_sandbox = __esmMin((() => {
 	init_fork_runner();
-	logger$5 = createLogger({ prefix: "bare-metal-sandbox" });
+	logger$6 = createLogger({ prefix: "bare-metal-sandbox" });
 	BareMetalSandbox = class {
 		runnerPath;
 		useBwrap;
 		sandboxNetwork;
 		env;
 		orphanCleanup;
+		runnerUser;
 		runner = null;
 		workDir;
 		lastOptions = null;
@@ -7914,6 +7639,7 @@ var init_bare_metal_sandbox = __esmMin((() => {
 			this.sandboxNetwork = options.sandboxNetwork ?? "isolated";
 			this.env = options.env;
 			this.orphanCleanup = options.orphanCleanup ?? true;
+			this.runnerUser = options.runnerUser;
 		}
 		/**
 		* Validate that the runner path exists and bwrap is available (if needed).
@@ -7928,12 +7654,12 @@ var init_bare_metal_sandbox = __esmMin((() => {
 			if (this.useBwrap) try {
 				const { execSync } = await import("node:child_process");
 				execSync("which bwrap", { stdio: "ignore" });
-				if (this.sandboxNetwork === "isolated") logger$5.info("Bubblewrap (bwrap) sandbox enabled with network isolation (--unshare-net)");
-				else logger$5.info("Bubblewrap (bwrap) sandbox enabled with host network (KICI_SANDBOX_NETWORK=host)");
+				if (this.sandboxNetwork === "isolated") logger$6.info("Bubblewrap (bwrap) sandbox enabled with network isolation (--unshare-net)");
+				else logger$6.info("Bubblewrap (bwrap) sandbox enabled with host network (KICI_SANDBOX_NETWORK=host)");
 			} catch {
 				throw new Error("Bubblewrap (bwrap) not found. Install bubblewrap or set sandbox=false. On Debian/Ubuntu: apt install bubblewrap");
 			}
-			else logger$5.warn("Bare-metal without sandbox provides limited isolation. Only environment sanitization is active. Enable sandbox=true with bubblewrap for PID/IPC/filesystem namespace isolation.");
+			else logger$6.warn("Bare-metal without sandbox provides limited isolation. Only environment sanitization is active. Enable sandbox=true with bubblewrap for PID/IPC/filesystem namespace isolation.");
 		}
 		/**
 		* Execute a job by forking the workflow runner with sanitized environment.
@@ -7948,7 +7674,8 @@ var init_bare_metal_sandbox = __esmMin((() => {
 				workDir: this.workDir,
 				networkIsolation: this.useBwrap && this.sandboxNetwork === "isolated",
 				extraReadOnlyBinds,
-				detachProcessGroup: this.orphanCleanup && !this.useBwrap
+				detachProcessGroup: this.orphanCleanup && !this.useBwrap,
+				...this.runnerUser ? { runnerUser: this.runnerUser } : {}
 			}, options);
 			return this.runner.result;
 		}
@@ -7998,7 +7725,8 @@ var init_bare_metal_sandbox = __esmMin((() => {
 				workDir,
 				networkIsolation: this.useBwrap && this.sandboxNetwork === "isolated",
 				cleanupOnly: true,
-				maxGracePeriodMs: 5e3
+				maxGracePeriodMs: 5e3,
+				...this.runnerUser ? { runnerUser: this.runnerUser } : {}
 			}, {
 				...opts,
 				signal,
@@ -8164,6 +7892,7 @@ function buildContainerHardening(opts) {
 	const network = grant?.network ?? opts.networkMode;
 	if (network === "none") hostConfig.NetworkMode = "none";
 	else if (network === "host") hostConfig.NetworkMode = "host";
+	else if (opts.jobNetworkName) hostConfig.NetworkMode = opts.jobNetworkName;
 	const user = grant?.user ?? opts.user;
 	return user ? {
 		hostConfig,
@@ -8176,6 +7905,233 @@ var init_container_hardening = __esmMin((() => {
 	NO_NEW_PRIVILEGES = ["no-new-privileges"];
 }));
 //#endregion
+//#region src/execution/sandbox/job-network.ts
+/**
+* Resolve what a job container may reach on the host.
+*
+* The default is DNS on the bridge gateway and nothing else. A job container
+* talks to the agent through `docker exec` rather than over the network, and it
+* holds none of the agent's credentials, so name resolution is the one host
+* service it genuinely needs. That carve-out is not cosmetic: rootful podman
+* runs its resolver on the gateway, a host address, so a container with no such
+* rule cannot resolve any name at all. Docker answers inside the container's
+* own netns and is unaffected either way.
+*
+* The set is derived HERE, from the agent's own configuration, and takes no
+* argument that could widen it. A `NetworkPolicy` reaching
+* {@link applyJobEgressRules} governs the FORWARD hook only — what the job
+* reaches through the host — so its `hostAccess` is deliberately not consulted:
+* a job that could name its own host reachability is the escape hatch this
+* boundary exists to close, and a signature that cannot carry one is what makes
+* that structural rather than a convention.
+*/
+function resolveJobHostAccess(gateway = JOB_NETWORK_GATEWAY) {
+	return [`${gateway}:${DNS_PORT}`];
+}
+/**
+* Ensure the `kici-jobs` network exists, the nftables table is ready, and the
+* subnet's default egress drops are installed.
+*
+* The drops land here — before any job container is created — and are keyed on
+* the subnet rather than on a container address, so a customer image's own
+* `ENTRYPOINT` never runs unfiltered.
+*
+* Returns whether egress filtering is actually in force. A host without `nft`
+* or without `NET_ADMIN` — a rootless agent, most commonly — warns loudly and
+* degrades to the network with no rules rather than refusing to run any job:
+* `kici-admin agent install` is a compat-protected surface, and hard-requiring
+* NET_ADMIN would break every existing rootless install with no additive path.
+* The same trade-off the scaler already made for agent containers.
+*/
+async function ensureJobNetwork(docker) {
+	try {
+		await validateNftablesAvailability();
+		await ensureKiciTable();
+		await ensureJobSubnetEgressRules(JOB_NETWORK_SUBNET, JOB_NETWORK_GATEWAY);
+		const actual = await ensureJobNetworkExists(docker);
+		if (actual.subnet !== JOB_NETWORK_SUBNET || actual.gateway !== "172.31.0.1") {
+			logger$5.warn(`Job network ${JOB_NETWORK_NAME} carries ${actual.subnet} (gateway ${actual.gateway}), not the expected ${JOB_NETWORK_SUBNET} (gateway ${JOB_NETWORK_GATEWAY}). Installing the egress drops for the range it actually uses. Remove the network to have the agent recreate it with the expected addressing.`);
+			await ensureJobSubnetEgressRules(actual.subnet, actual.gateway);
+		}
+		return true;
+	} catch (err) {
+		logger$5.warn(`Job-container egress filtering DISABLED: ${toErrorMessage(err)} Job containers reach the host private network and the cloud metadata endpoint. Grant the agent --cap-add=NET_ADMIN (and install nftables), or set KICI_SANDBOX_NETWORK_ISOLATION=false to silence this.`);
+		return false;
+	}
+}
+/**
+* Install the default RFC1918 + cloud-metadata drops for the whole job subnet.
+*
+* Keyed on `ip saddr 172.31.0.0/16`, so one rule set covers every container
+* that will ever join the bridge — including one that does not exist yet. A
+* customer image's own `ENTRYPOINT` therefore starts behind the drops: there is
+* no window between the container running and its rules landing, because the
+* rules do not depend on the container.
+*
+* The per-container rules {@link applyJobEgressRules} adds stay the layer above
+* these, and stay effective: `addIsolationRules` inserts at the chain head, so
+* a rule keyed on one container's address is evaluated before the subnet set
+* and a per-job `accept` still wins over the subnet `drop`. The exception is a
+* repair (below), which puts a fresh subnet set at the head — above the
+* per-container rules of jobs that were already running. That reordering has no
+* effect while `applyJobEgressRules` is called with no policy, since the two
+* sets then hold identical verdicts; a per-job policy would have to reinstall
+* its own rules after a repair to keep winning.
+*
+* Idempotent, because `ensureJobNetwork` runs once per job and an unconditional
+* install would leak a rule set per job: the chain is read first and the install
+* is skipped when it already carries the set.
+*
+* The skip requires EVERY expected rule, never merely one of them. The install
+* is one `nft insert` per rule, so a failure or a kill part-way through
+* leaves some of the set in the chain; a check that skipped on the first match
+* would then read a chain missing the `10.0.0.0/8` drop as covered, and every
+* later job on that host would join the bridge behind permanently partial
+* filtering with nothing to heal it. Comparing against the rule text
+* {@link buildIsolationRuleOps} emits is also what rejects the two near-misses
+* the scaler writes into this same chain — a per-container rule at
+* `172.31.0.10`, and an operator allowlist naming this subnet as a DESTINATION.
+*
+* A partial set is repaired by installing the whole set again rather than by
+* deleting first: the fresh block lands at the chain head, complete and in
+* order, so a job container already running behind the surviving rules is never
+* left unfiltered even briefly. The superseded rules below it are inert
+* duplicates.
+*/
+async function ensureJobSubnetEgressRules(subnet, gateway) {
+	await ensureJobSubnetHostRules(subnet, gateway);
+	const expected = buildIsolationRuleOps([
+		"ip",
+		"saddr",
+		subnet
+	], gateway).map((tokens) => tokens.join(" "));
+	const chain = await readForwardChain();
+	const present = new Set((chain ?? "").split("\n").map((line) => line.trim().replace(/\s*# handle \d+$/, "")));
+	if (chain !== null && expected.every((rule) => present.has(rule))) return;
+	await addIsolationRules(subnet, gateway, void 0, "saddr");
+	logger$5.info(`Installed default egress drops for ${subnet}`);
+}
+/**
+* Install the subnet-wide host-access rules — what a job container may reach ON
+* the host, as opposed to through it.
+*
+* Keyed on the subnet for the same reason the forward set is: it covers a
+* container that does not exist yet, so a customer image's `ENTRYPOINT` never
+* runs in the window before the per-container rules land.
+*
+* Idempotent against the chain's own text rather than by remove-then-insert.
+* Removing first would take the drop away from every running job container for
+* as long as the re-insert takes, which is the one direction that must not
+* fail open.
+*/
+async function ensureJobSubnetHostRules(subnet, gateway) {
+	const hostAccess = resolveJobHostAccess(gateway);
+	const expected = buildHostAccessRuleOps([
+		"ip",
+		"saddr",
+		subnet
+	], hostAccess).map((tokens) => tokens.join(" "));
+	const chain = await readInputChain();
+	const present = new Set((chain ?? "").split("\n").map((line) => line.trim().replace(/\s*# handle \d+$/, "")));
+	if (chain !== null && expected.every((rule) => present.has(rule))) return;
+	await addHostIsolationRules(subnet, hostAccess, "saddr");
+	logger$5.info(`Installed default host-access rules for ${subnet}`);
+}
+/**
+* Create the `kici-jobs` bridge network, tolerating a concurrent creator.
+*
+* Returns the addressing job containers will actually get. That is the
+* canonical pair whenever this call created the network, and whatever an
+* already-present network carries otherwise — which is the only thing the drop
+* set can honestly be keyed on. A network someone else made under this name
+* with a different subnet would leave every job container outside a set keyed
+* on the constant, and the pre-start window this whole module exists to close
+* would reopen for it.
+*/
+async function ensureJobNetworkExists(docker) {
+	const canonical = {
+		subnet: JOB_NETWORK_SUBNET,
+		gateway: JOB_NETWORK_GATEWAY
+	};
+	const existing = await findJobNetwork(docker);
+	if (existing) return existing;
+	try {
+		await docker.createNetwork({
+			Name: JOB_NETWORK_NAME,
+			Driver: "bridge",
+			IPAM: { Config: [{
+				Subnet: JOB_NETWORK_SUBNET,
+				Gateway: JOB_NETWORK_GATEWAY
+			}] },
+			Labels: { "kici-managed": "true" }
+		});
+		logger$5.info(`Created job network ${JOB_NETWORK_NAME}`);
+		return canonical;
+	} catch (err) {
+		if (err.statusCode === 409) return await findJobNetwork(docker) ?? canonical;
+		throw err;
+	}
+}
+/** The present `kici-jobs` network's addressing, or `undefined` when absent. */
+async function findJobNetwork(docker) {
+	const found = (await docker.listNetworks({ filters: { name: [JOB_NETWORK_NAME] } })).find((n) => n.Name === JOB_NETWORK_NAME);
+	if (!found) return void 0;
+	const config = (found.IPAM?.Config ?? [])[0];
+	return {
+		subnet: config?.Subnet ?? JOB_NETWORK_SUBNET,
+		gateway: config?.Gateway ?? "172.31.0.1"
+	};
+}
+/**
+* Apply the per-container egress rules once the container has an IP.
+*
+* This is the per-job layer, not the control: the subnet drop set
+* {@link ensureJobNetwork} installs is already in the chain and already covers
+* this container. What a per-container rule set adds is a place to key a future
+* per-job policy — an allowlist or `denyAll` — on one address rather than on
+* the whole bridge.
+*
+* Returns the container IP the rules are keyed on, so teardown can remove
+* exactly those rules; `undefined` when no IP could be read, which is logged
+* rather than thrown — a job whose rules could not be keyed still runs behind
+* the subnet drops, and the operator sees why.
+*/
+async function applyJobEgressRules(docker, containerId, policy) {
+	const containerIp = (await docker.getContainer(containerId).inspect()).NetworkSettings?.Networks?.[JOB_NETWORK_NAME]?.IPAddress;
+	if (!containerIp) {
+		logger$5.warn("Could not determine job container IP — no per-container egress rules applied. A container on the kici-jobs bridge stays behind the subnet drops; one that is not on that bridge has unfiltered egress.", { containerId });
+		return;
+	}
+	await addIsolationRules(containerIp, JOB_NETWORK_GATEWAY, policy, "saddr");
+	await addHostIsolationRules(containerIp, resolveJobHostAccess(), "saddr");
+	return containerIp;
+}
+/**
+* Remove the per-container rules at teardown.
+*
+* Never throws: a failed cleanup must not turn a finished job into a failed
+* one. A leaked rule set is keyed on an IP the network will reuse, so it is
+* reported at `warn` for the operator rather than swallowed.
+*/
+async function removeJobEgressRules(containerIp) {
+	if (!containerIp) return;
+	try {
+		await removeIsolationRules(containerIp);
+	} catch (err) {
+		logger$5.warn("Failed to remove job-container egress rules", {
+			containerIp,
+			error: toErrorMessage(err)
+		});
+	}
+}
+var logger$5, JOB_NETWORK_NAME, JOB_NETWORK_GATEWAY, DNS_PORT;
+var init_job_network = __esmMin((() => {
+	logger$5 = createLogger({ prefix: "job-network" });
+	JOB_NETWORK_NAME = "kici-jobs";
+	JOB_NETWORK_GATEWAY = "172.31.0.1";
+	DNS_PORT = 53;
+}));
+//#endregion
 //#region src/execution/sandbox/container-sandbox.ts
 /**
 * Container execution sandbox implementation.
@@ -8421,6 +8377,7 @@ var init_container_sandbox = __esmMin((() => {
 	init_image_preflight();
 	init_secret_encryption();
 	init_container_hardening();
+	init_job_network();
 	logger$4 = createLogger({ prefix: "container-sandbox" });
 	MAX_STDERR_LINES = 20;
 	ABORT_GRACE_MS = 1e4;
@@ -8449,6 +8406,9 @@ var init_container_sandbox = __esmMin((() => {
 		keepFailed;
 		jobId;
 		hardening;
+		networkIsolation;
+		/** Container IP the applied egress rules are keyed on; unset when none were applied. */
+		egressRuleIp;
 		/** Resolved container user (image-user override / grant), applied to createContainer + each exec. */
 		resolvedUser;
 		/** The running container instance (set during setup). */
@@ -8473,6 +8433,7 @@ var init_container_sandbox = __esmMin((() => {
 			this.keepFailed = options.keepFailed ?? false;
 			this.jobId = options.jobId ?? `unknown-${Date.now()}`;
 			this.hardening = options.hardening;
+			this.networkIsolation = options.networkIsolation ?? true;
 		}
 		/**
 		* Ensure the job's container image is present locally, pulling it on demand
@@ -8532,7 +8493,12 @@ var init_container_sandbox = __esmMin((() => {
 				image: this.image,
 				workDir: options.workDir
 			});
-			const hardened = this.hardening ? buildContainerHardening(this.hardening) : {
+			const effectiveNetwork = this.hardening?.grant?.network ?? this.hardening?.networkMode;
+			const egressRulesActive = this.networkIsolation && effectiveNetwork !== "host" && effectiveNetwork !== "none" ? await ensureJobNetwork(this.docker) : false;
+			const hardened = this.hardening ? buildContainerHardening({
+				...this.hardening,
+				...egressRulesActive ? { jobNetworkName: JOB_NETWORK_NAME } : {}
+			}) : {
 				hostConfig: {},
 				user: void 0
 			};
@@ -8559,6 +8525,7 @@ var init_container_sandbox = __esmMin((() => {
 				}
 			});
 			await this.container.start();
+			if (egressRulesActive) this.egressRuleIp = await applyJobEgressRules(this.docker, this.container.id, void 0);
 			logger$4.info("Sandbox container started", {
 				name: this.containerName,
 				containerId: this.container.id.slice(0, 12)
@@ -8876,6 +8843,8 @@ var init_container_sandbox = __esmMin((() => {
 			} catch {}
 		}
 		async teardown() {
+			await removeJobEgressRules(this.egressRuleIp);
+			this.egressRuleIp = void 0;
 			if (!this.container) {
 				await this.reclaimBuiltImage();
 				return;
@@ -8965,85 +8934,7 @@ async function fileExists(p) {
 		return false;
 	}
 }
-/**
-* Build the source / workflow repo pair the round hands to every filter and
-* generator. Mirrors the sandbox's own `setupGlobalWorkflowEnv` construction so
-* a generator's two evaluations see the same identifiers, refs, and shas — only
-* the absolute paths differ, and those are never compared.
-*/
-function buildRoundRepos(dispatch, config, workflowDir, sourceDir) {
-	return {
-		workflowRepo: {
-			identifier: config.workflowRepoIdentifier ?? repoIdentifierFromUrl(config.workflowRepoUrl),
-			path: workflowDir,
-			ref: config.workflowRef,
-			sha: config.workflowSha
-		},
-		sourceRepo: {
-			identifier: repoIdentifierFromUrl(dispatch.repoUrl),
-			path: sourceDir,
-			ref: dispatch.ref,
-			sha: dispatch.sha
-		}
-	};
-}
-/**
-* Resolve the changed-files list a `filter` reads — for a global eval round and
-* for a filter-bearing init job alike.
-*
-* Ground truth is the agent's own source clone; an already-`fetched` list from
-* the orchestrator is a free fast-path. A diff-less event (schedule / tag /
-* manual) resolves to `unavailable`, which makes `ctx.changedFiles` throw
-* rather than read as an empty diff — a `filter` returning false produces no
-* run at all, so a silently-empty diff would suppress the workflow with no
-* artifact anywhere to inspect.
-*/
-async function resolveEvalChangedFiles(dispatch, event, sourceDir) {
-	const ev = event;
-	if (ev.changedFilesStatus === "fetched") return {
-		files: ev.changedFiles ?? [],
-		status: "fetched"
-	};
-	return computeChangedFiles(sourceDir, event, dispatch.sourceAuth ?? dispatch.workflowAuth ?? (dispatch.token ? {
-		kind: "basic",
-		user: "x-access-token",
-		secret: dispatch.token
-	} : void 0));
-}
-/**
-* Materialize the source tree a non-global workflow's `filter` reads through
-* `ctx.sourceRepo.path`.
-*
-* An init or dynamic-eval job normally restores only `.kici/` from the cached
-* source tarball — enough to import the workflow module, but a directory with no
-* repo in it. A filter that reads a file or shells out against that path would
-* get a confidently wrong answer, and `changedFiles` could not be computed at
-* all, so a filter-bearing job clones the source repo into a sibling directory.
-*
-* When no tarball was attached the job already cloned the whole repo into
-* `workDir`, and that clone is reused rather than duplicated — including the
-* local working-tree case, where there is no repo url and `workDir` IS the tree.
-*
-* A tarball with no repo url is the one combination that cannot be honoured:
-* `workDir` holds `.kici/` alone and there is nothing to clone from. Returning it
-* would hand the filter a directory in which every path test answers "absent" —
-* the exact silent lie this function exists to prevent — so it throws instead.
-*/
-async function ensureFilterSourceDir(dispatch, workDir) {
-	if (!dispatch.sourceTarUrl) return workDir;
-	if (!dispatch.repoUrl) throw new Error("Workflow declares a filter, but this job restored its source from the cache with no repo url to clone from — the filter would see an empty tree. Re-run with a source repository configured, or remove the filter.");
-	const sourceDir = join(workDir, FILTER_SOURCE_DIRNAME);
-	const sourceAuth = dispatch.sourceAuth;
-	await gitClone({
-		repoUrl: dispatch.repoUrl,
-		ref: dispatch.ref,
-		sha: dispatch.sha,
-		workDir: sourceDir,
-		gitAuth: sourceAuth,
-		token: sourceAuth ? void 0 : dispatch.token
-	});
-	return sourceDir;
-}
+/** Agent-side fallbacks when the orchestrator sends no round budgets. */
 /**
 * Restore deps, materialize the workflow source, and install `.kici/`
 * dependencies for a dynamic-eval job — everything that has to exist before its
@@ -9054,7 +8945,24 @@ async function ensureFilterSourceDir(dispatch, workDir) {
 * handler's `logger.info` call site (which Loki keys off) or parameterize it,
 * and neither is worth it for twenty lines.
 */
-async function materializeEvalWorkspace(dispatch, workDir, log) {
+/**
+* Sanitized base environment for a dependency install that runs in the AGENT
+* process rather than in a child.
+*
+* `installDeps` defaults `baseEnv` to `process.env`, which is correct inside the
+* runner child (already the sanitized job environment) and wrong here: the agent
+* process holds the orchestrator connection and, before boot scrubs them, the
+* agent's own credentials. `buildSanitizedEnv` merges its first argument
+* wholesale at its user-env layer, so it must be `{}` and never `process.env` —
+* passing `process.env` re-adds every variable the sanitizer just excluded.
+*
+* `trustedEnv` is threaded because it is an operator-set agent-launch property a
+* trusted fleet agent legitimately relies on.
+*/
+function agentInstallBaseEnv(trustedEnv) {
+	return buildSanitizedEnv({}, { trustedEnv });
+}
+async function materializeEvalWorkspace(dispatch, workDir, log, installOpts) {
 	if (dispatch.depsUrl) {
 		log("Restoring dependencies from cache");
 		await restoreDeps(workDir, dispatch.depsUrl, dispatch.depsHash);
@@ -9062,7 +8970,7 @@ async function materializeEvalWorkspace(dispatch, workDir, log) {
 	}
 	if (dispatch.sourceTarUrl) {
 		log("Restoring workflow source from cached tarball");
-		await restoreSource(workDir, dispatch.sourceTarUrl);
+		await restoreSource(workDir, dispatch.sourceTarUrl, dispatch.sourceTarDigest);
 	} else {
 		log(`Cloning ${dispatch.repoUrl} ref=${dispatch.ref}`);
 		const cloneStart = Date.now();
@@ -9082,76 +8990,13 @@ async function materializeEvalWorkspace(dispatch, workDir, log) {
 		await installDeps(kiciDir, {
 			npmRegistries: dispatch.npmRegistries,
 			installEnvSecrets: dispatch.installEnvSecrets,
-			jobIdShort: dispatch.jobId.slice(0, 8)
+			jobIdShort: dispatch.jobId.slice(0, 8),
+			baseEnv: installOpts.baseEnv,
+			allowInstallScripts: installOpts.allowInstallScripts
 		});
 	}
 }
 /**
-* Build the context a non-global workflow's `filter` is evaluated against.
-*
-* `sourceRepo` and `workflowRepo` are the same repo — that is what "non-global"
-* means — so both carry the same identifier, path, ref, and sha. The zx shell is
-* rooted at the source tree and streams into the evaluating step's log, matching
-* what the global eval round hands its own filters.
-*
-* They are two distinct objects all the same. Being the same repo is a fact
-* about their VALUES, not a licence to hand the author one object under two
-* names: a filter that mutated `ctx.sourceRepo` would silently see
-* `ctx.workflowRepo` change with it, which happens on no other path.
-*/
-async function buildInitFilterInput(dispatch, event, workDir, emit) {
-	const sourceDir = await ensureFilterSourceDir(dispatch, workDir);
-	const diff = await resolveEvalChangedFiles(dispatch, event, sourceDir);
-	const repo = {
-		identifier: repoIdentifierFromUrl(dispatch.repoUrl),
-		path: sourceDir,
-		ref: dispatch.ref,
-		sha: dispatch.sha
-	};
-	return {
-		sourceRepo: repo,
-		workflowRepo: { ...repo },
-		changedFiles: diff.files,
-		changedFilesStatus: diff.status,
-		env: process.env,
-		$: await buildEvalShell(sourceDir, emit)
-	};
-}
-/**
-* Build the per-invocation zx `$` a global eval round hands to filters and
-* generators, so a `await $\`…\`` inside one is visible in the eval step's log.
-*
-* **`env` is the LIVE `process.env` reference, never a spread.** A spread is a
-* snapshot taken when the shell is built, which is before the round applies the
-* seven `KICI_*` keys — so a filter that shells out (`$\`printenv
-* KICI_SOURCE_REPO_PATH\``, or any subprocess inheriting env) would see nothing
-* here while the sandbox re-evaluation's ambient `$` resolves `process.env`
-* after `setupGlobalWorkflowEnv` has run and does see them. That is the same
-* two-worlds determinism failure the cwd choice below exists to prevent, one
-* layer down. Passing the live reference reproduces the ambient `$`'s own
-* behaviour, which is what the sandbox uses.
-*
-* `verbose: true` + `makeStreamingZxLog` honors a per-call `quiet: true`, so a
-* decrypted secret never leaks into the log.
-*
-* `emit` is a callback rather than the `LogStreamer` itself so the caller can
-* route it through its own closed-guard: `LogStreamer.destroy()` sets no closed
-* flag and `addLine` buffers unconditionally, so a subprocess line arriving
-* after the step was reported would otherwise emit a `log.chunk` for a terminal
-* step. That is the likeliest path for it — an orphaned candidate is usually
-* orphaned *because* it is waiting on a subprocess.
-*/
-async function buildEvalShell(cwd, emit) {
-	const { $: zx$ } = await import("zx");
-	return zx$({
-		cwd,
-		env: process.env,
-		verbose: true,
-		quiet: false,
-		log: makeStreamingZxLog(emit)
-	});
-}
-/**
 * Resolve the absolute path to the compiled workflow-runner.js entry point.
 *
 * The runner is a separate rolldown entry point. Its location depends on the
@@ -9173,6 +9018,25 @@ function resolveRunnerPath() {
 	return bundlePath;
 }
 /**
+* Resolve the compiled eval-runner path, using the same three-location probe as
+* {@link resolveRunnerPath}.
+*
+* The eval child is always forked on the agent's own host from the agent's own
+* build — an evaluation job never goes through a sandbox backend — so unlike the
+* step runner it needs no self-contained bundle sibling to mount into a customer
+* job container.
+*/
+function resolveEvalRunnerPath() {
+	const __dirname = dirname(fileURLToPath(import.meta.url));
+	const bundlePath = join(__dirname, "eval-runner.js");
+	if (existsSync(bundlePath)) return bundlePath;
+	const originalPath = join(__dirname, "sandbox", "eval-runner.js");
+	if (existsSync(originalPath)) return originalPath;
+	const chunkedPath = join(__dirname, "execution", "sandbox", "eval-runner.js");
+	if (existsSync(chunkedPath)) return chunkedPath;
+	return bundlePath;
+}
+/**
 * Derive the self-contained runner bundle path from the resolved runner path.
 *
 * The container backend mounts the runner as a single file into the customer
@@ -9202,14 +9066,6 @@ function determineExecutionMode(jobConfig, agentConfig) {
 	return "bare-metal";
 }
 /**
-* Build the result-aware `ctx.needs` for a dynamic eval from its frozen upstream
-* snapshot. Returns undefined for an event-only generator (no snapshot).
-*/
-function buildEvalNeedsContext(config) {
-	if (!config.resultAware || !config.upstreamSnapshot) return void 0;
-	return buildNeedsContext(config.upstreamSnapshot, config.declaredNeeds ?? []);
-}
-/**
 * Resolve a job's workDir and its cleanup.
 *
 * - Default: a fresh `mkdtemp` the agent clones into and removes after the job.
@@ -9236,26 +9092,20 @@ async function resolveJobWorkDir(inPlace, repoUrl) {
 		inPlace: false
 	};
 }
-var logger$3, DEFAULT_GLOBAL_EVAL_ROUND_TIMEOUT_MS, DEFAULT_GLOBAL_EVAL_CANDIDATE_TIMEOUT_MS, FILTER_SOURCE_DIRNAME, JobRunner$1;
+var logger$3, JobRunner$1;
 var init_job_runner = __esmMin((() => {
 	init_git_clone();
 	init_clone_job_repos();
 	init_job_git_credentials();
-	init_changed_files();
-	init_workflow_loader();
 	init_source_packer();
 	init_source_restore();
-	init_init_runner();
 	init_api_intercept();
 	init_ensure_init_runner();
 	init_payload_source();
 	init_s3_payload_source();
-	init_timeout_util();
-	init_streaming_zx_log();
 	init_dynamic_job_serializer();
-	init_generator_context();
-	init_global_workflow_env();
-	init_global_eval_runner();
+	init_eval_fork_runner();
+	init_eval_context();
 	init_log_streamer();
 	init_build_step();
 	init_build_engine();
@@ -9267,9 +9117,6 @@ var init_job_runner = __esmMin((() => {
 	init_sandbox();
 	init_prometheus();
 	logger$3 = createLogger({ prefix: "job-runner" });
-	DEFAULT_GLOBAL_EVAL_ROUND_TIMEOUT_MS = 12e4;
-	DEFAULT_GLOBAL_EVAL_CANDIDATE_TIMEOUT_MS = 2e4;
-	FILTER_SOURCE_DIRNAME = "__kici_filter_source__";
 	JobRunner$1 = class {
 		send;
 		config;
@@ -9353,8 +9200,8 @@ var init_job_runner = __esmMin((() => {
 		* orchestrator relay (unit harnesses, offline local runs).
 		*
 		* A failure here must not fail the job: without a helper, git falls back to
-		* its own mechanisms exactly as it did before this existed. The job simply
-		* cannot push.
+		* its own mechanisms exactly as it did before this existed. The job cannot
+		* push.
 		*/
 		async startGitCredentials(jobId, jobConfig) {
 			if (!this._sendApiRequest) return void 0;
@@ -9667,6 +9514,7 @@ var init_job_runner = __esmMin((() => {
 				}) : void 0,
 				onGitGrantRequest: this.jobGitCredentials.get(jobId)?.onGitGrantRequest,
 				credentialHelperPath: this.jobGitCredentials.get(jobId)?.helperPath,
+				allowInstallScripts: this.config.allowInstallScripts,
 				onCacheRequest: this._requestUserCache ? async (request) => this._requestUserCache(jobId, request) : void 0,
 				onProvenanceRequest: this._relayProvenance ? async (request) => this._relayProvenance(jobId, request) : void 0,
 				onArtifactRequest: this._requestUserArtifact ? async (request) => this._requestUserArtifact(jobId, request) : void 0,
@@ -9831,7 +9679,7 @@ var init_job_runner = __esmMin((() => {
 					this.sendJobStatus(dispatch, ExecutionJobStatus.enum.cancelled);
 					return;
 				}
-				await this.packAndUploadSource(dispatch, workDir, buildConfig, buildStreamer, buildLog);
+				await this.packAndUploadSource(dispatch, workDir, buildConfig, buildStreamer, buildLog, abortController.signal);
 				buildLog("Build completed successfully");
 				buildStreamer.flush();
 				buildStreamer.destroy();
@@ -9914,7 +9762,7 @@ var init_job_runner = __esmMin((() => {
 				await fsPromises.mkdir(workDir, { recursive: true });
 			} else if (dispatch.sourceTarUrl) {
 				initLog("Restoring workflow source from cached tarball");
-				await restoreSource(workDir, dispatch.sourceTarUrl);
+				await restoreSource(workDir, dispatch.sourceTarUrl, dispatch.sourceTarDigest);
 			} else {
 				initLog(`Cloning ${dispatch.repoUrl} (ref: ${dispatch.ref})`);
 				const cloneStart = Date.now();
@@ -9955,13 +9803,16 @@ var init_job_runner = __esmMin((() => {
 			await installDeps(kiciDir, {
 				npmRegistries: dispatch.npmRegistries,
 				installEnvSecrets: dispatch.installEnvSecrets,
-				jobIdShort: dispatch.jobId.slice(0, 8)
+				jobIdShort: dispatch.jobId.slice(0, 8),
+				baseEnv: agentInstallBaseEnv(this.config.trustedEnv),
+				allowInstallScripts: this.config.allowInstallScripts
 			});
 			buildLog("Dependencies installed");
 			if (!buildConfig.buildDepsNeeded) return;
 			const { tarball, hash } = await packNodeModules(kiciDir);
 			const depKey = {
 				lockfileHash: buildConfig.lockfileHash,
+				...buildConfig.siblingsDigest && { siblingsDigest: buildConfig.siblingsDigest },
 				platform: os.platform(),
 				arch: os.arch()
 			};
@@ -9992,16 +9843,28 @@ var init_job_runner = __esmMin((() => {
 		* file's expected `contentHash`, pack `.kici/` into a tarball, and upload
 		* it to the source cache.
 		*/
-		async packAndUploadSource(dispatch, workDir, buildConfig, buildStreamer, buildLog) {
+		async packAndUploadSource(dispatch, workDir, buildConfig, buildStreamer, buildLog, signal) {
 			if (!buildConfig.buildSourceNeeded || !buildConfig.contentHash) return;
 			const sourceFile = dispatch.jobConfig.source?.file;
 			if (!sourceFile) return;
 			buildLog(`Verifying workflow source (${sourceFile})...`);
-			await runCaptured({ addLine: (line) => buildStreamer.addLine(line) }, () => loadWorkflowSource(workDir, sourceFile, buildConfig.contentHash, buildConfig.resolvedHashFiles));
+			await this.runEvaluation({
+				kind: "build-verify",
+				dispatch,
+				workDir,
+				config: {
+					sourceFile,
+					contentHash: buildConfig.contentHash,
+					resolvedHashFiles: buildConfig.resolvedHashFiles
+				},
+				emit: (line) => buildStreamer.addLine(line),
+				signal
+			});
 			buildLog("Packing .kici/ source tarball...");
 			const { tarball, hash: sourceTarHash } = await packKiciSource(workDir);
 			const sourceKey = {
 				contentHash: buildConfig.contentHash,
+				sourceTarDigest: sourceTarHash,
 				platform: os.platform(),
 				arch: os.arch()
 			};
@@ -10061,7 +9924,7 @@ var init_job_runner = __esmMin((() => {
 			}
 			if (dispatch.sourceTarUrl) {
 				log("Restoring workflow source from cached tarball");
-				await restoreSource(workflowDir, dispatch.sourceTarUrl);
+				await restoreSource(workflowDir, dispatch.sourceTarUrl, dispatch.sourceTarDigest);
 			}
 			const kiciDir = join(workflowDir, ".kici");
 			if (!dispatch.depsUrl && await fileExists(join(kiciDir, "package.json"))) {
@@ -10069,7 +9932,9 @@ var init_job_runner = __esmMin((() => {
 				await installDeps(kiciDir, {
 					npmRegistries: dispatch.npmRegistries,
 					installEnvSecrets: dispatch.installEnvSecrets,
-					jobIdShort: dispatch.jobId.slice(0, 8)
+					jobIdShort: dispatch.jobId.slice(0, 8),
+					baseEnv: agentInstallBaseEnv(this.config.trustedEnv),
+					allowInstallScripts: this.config.allowInstallScripts
 				});
 			}
 		}
@@ -10111,7 +9976,6 @@ var init_job_runner = __esmMin((() => {
 				evalStreamer.destroy();
 				streamerClosed = true;
 			};
-			const evalSink = { addLine: (line) => evalLog(line) };
 			this.sendStepStatus(dispatch, 0, "global-eval", ExecutionStepStatus.enum.running);
 			const heartbeatTimer = setInterval(() => {
 				this.send({
@@ -10130,28 +9994,14 @@ var init_job_runner = __esmMin((() => {
 					return;
 				}
 				await this.checkoutForGlobalEvalRound(dispatch, config, workflowDir, sourceDir, evalLog);
-				const diff = await resolveEvalChangedFiles(dispatch, config.event, sourceDir);
-				const evalShell = await buildEvalShell(workDir, evalStreamLine);
-				const roundResult = await runCaptured(evalSink, () => runGlobalEvalRound({
-					workflowDir,
-					sourceDir,
-					repos: buildRoundRepos(dispatch, config, workflowDir, sourceDir),
-					candidates: config.candidates,
-					event: config.event,
-					changedFiles: diff.files,
-					changedFilesStatus: diff.status,
-					roundTimeoutMs: config.roundTimeoutMs ?? DEFAULT_GLOBAL_EVAL_ROUND_TIMEOUT_MS,
-					candidateTimeoutMs: config.candidateTimeoutMs ?? DEFAULT_GLOBAL_EVAL_CANDIDATE_TIMEOUT_MS,
-					signal: abortController.signal,
-					$: evalShell,
-					log: {
-						info: (msg) => evalLog(msg),
-						warn: (msg) => evalLog(`WARN: ${msg}`),
-						error: (msg) => evalLog(`ERROR: ${msg}`),
-						debug: (msg) => evalLog(`DEBUG: ${msg}`)
-					},
-					kici: buildKiciApi(this._sendApiRequest ? withBootstrapInterception((method, params) => this._sendApiRequest(method, params ?? {})) : () => Promise.reject(/* @__PURE__ */ new Error("Agent API not available")))
-				}));
+				const roundResult = await this.runEvaluation({
+					kind: "global-eval",
+					dispatch,
+					workDir,
+					config,
+					emit: (line, stream) => stream ? evalStreamLine(line, stream) : evalLog(line),
+					signal: abortController.signal
+				});
 				const running = roundResult.candidates.filter((c) => c.run).length;
 				const indeterminate = roundResult.candidates.filter((c) => c.indeterminate).length;
 				logger$3.info("Global eval round completed", {
@@ -10186,6 +10036,48 @@ var init_job_runner = __esmMin((() => {
 			}
 		}
 		/**
+		* Run one evaluation in the eval child and stream its log onto the job's
+		* synthetic step-0 log.
+		*
+		* Every customer-module load and evaluation goes through here. The calling
+		* handler keeps what is the agent's own work — materializing the workspace,
+		* installing dependencies, packing and uploading a tarball, reporting status —
+		* and hands the child only the evaluation itself, in a process whose
+		* environment carries no agent credential.
+		*/
+		runEvaluation(args) {
+			const { jobId } = args.dispatch;
+			return runEvalChild({
+				evalRunnerPath: resolveEvalRunnerPath(),
+				request: {
+					kind: args.kind,
+					workDir: args.workDir,
+					config: args.config,
+					dispatch: {
+						runId: args.dispatch.runId,
+						jobId: args.dispatch.jobId,
+						repoUrl: args.dispatch.repoUrl,
+						ref: args.dispatch.ref,
+						sha: args.dispatch.sha,
+						token: args.dispatch.token,
+						sourceAuth: args.dispatch.sourceAuth,
+						workflowAuth: args.dispatch.workflowAuth,
+						sourceTarUrl: args.dispatch.sourceTarUrl
+					}
+				},
+				onLogLine: args.emit,
+				...this._sendApiRequest ? { onApiRequest: withBootstrapInterception((method, params) => this._sendApiRequest(method, params ?? {})) } : {},
+				trustedEnv: this.config.trustedEnv,
+				signal: args.signal
+			}).catch((err) => {
+				logger$3.debug("Evaluation child reported a failure", {
+					jobId,
+					error: toErrorMessage(err)
+				});
+				throw err;
+			});
+		}
+		/**
 		* Handle an init-only job.
 		*
 		* Init jobs evaluate dynamic functions (environment, env, concurrencyGroup)
@@ -10220,7 +10112,6 @@ var init_job_runner = __esmMin((() => {
 				await initStreamer.flush();
 				initStreamer.destroy();
 			};
-			const initSink = { addLine: (line) => initLog(line) };
 			this.sendStepStatus(dispatch, 0, "init", ExecutionStepStatus.enum.running);
 			const heartbeatTimer = setInterval(() => {
 				this.send({
@@ -10254,21 +10145,18 @@ var init_job_runner = __esmMin((() => {
 					await installDeps(kiciDir, {
 						npmRegistries: dispatch.npmRegistries,
 						installEnvSecrets: dispatch.installEnvSecrets,
-						jobIdShort: dispatch.jobId.slice(0, 8)
+						jobIdShort: dispatch.jobId.slice(0, 8),
+						baseEnv: agentInstallBaseEnv(this.config.trustedEnv),
+						allowInstallScripts: this.config.allowInstallScripts
 					});
 				}
-				const filterInput = config.hasFilter ? await buildInitFilterInput(dispatch, config.event, workDir, initStreamLine) : void 0;
-				const initResult = await runCaptured(initSink, async () => {
-					const { module } = await loadWorkflowSource(workDir, config.source, config.contentHash, config.resolvedHashFiles);
-					const workflow = extractWorkflow(module, config.workflowName);
-					initLog(`Evaluating dynamic fields for job '${config.targetJobName}' (env=${config.dynamicEnv} context=${config.dynamicContext} concurrencyGroup=${config.dynamicConcurrencyGroup} matrix=${config.dynamicMatrix ?? false} filter=${config.hasFilter ?? false})`);
-					return evaluateDynamicFields(workflow, config.targetJobName, config.event, {
-						dynamicContext: config.dynamicContext,
-						dynamicEnv: config.dynamicEnv,
-						dynamicConcurrencyGroup: config.dynamicConcurrencyGroup,
-						dynamicMatrix: config.dynamicMatrix ?? false,
-						hasFilter: config.hasFilter ?? false
-					}, config.timeoutMs, filterInput);
+				const initResult = await this.runEvaluation({
+					kind: "init",
+					dispatch,
+					workDir,
+					config,
+					emit: (line, stream) => stream ? initStreamLine(line, stream) : initLog(line),
+					signal: abortController.signal
 				});
 				logger$3.info("Init job completed successfully", {
 					jobId,
@@ -10312,7 +10200,6 @@ var init_job_runner = __esmMin((() => {
 		async handleDynamicJobFn(dispatch, workDir, abortController) {
 			const { runId, jobId, jobConfig } = dispatch;
 			const config = jobConfig;
-			const timeoutMs = config.timeoutMs ?? 12e4;
 			logger$3.info("Starting DynamicJobFn evaluation", {
 				jobId,
 				workflowName: config.workflowName,
@@ -10336,47 +10223,17 @@ var init_job_runner = __esmMin((() => {
 					this.sendJobStatus(dispatch, ExecutionJobStatus.enum.cancelled);
 					return;
 				}
-				await materializeEvalWorkspace(dispatch, workDir, evalLog);
-				const scopedDollar = await buildEvalShell(workDir, (line, stream) => evalStreamer.addLine(line, stream));
-				const evalSink = { addLine: (line) => evalStreamer.addLine(line) };
-				const filterInput = config.hasFilter ? await buildInitFilterInput(dispatch, config.event, workDir, (line, stream) => evalStreamer.addLine(line, stream)) : void 0;
-				const dynamicJobLogger = {
-					info: (msg, ..._args) => evalLog(msg),
-					warn: (msg, ..._args) => evalLog(`WARN: ${msg}`),
-					error: (msg, ..._args) => evalLog(`ERROR: ${msg}`),
-					debug: (msg, ..._args) => evalLog(`DEBUG: ${msg}`)
-				};
-				const kici = buildKiciApi(this._sendApiRequest ? withBootstrapInterception((method, params) => this._sendApiRequest(method, params ?? {})) : () => Promise.reject(/* @__PURE__ */ new Error("Agent API not available")));
-				const lockJobs = await runCaptured(evalSink, async () => {
-					const { module } = await loadWorkflowSource(workDir, config.source.file, config.contentHash, config.resolvedHashFiles);
-					evalLog("Workflow loaded");
-					const { extractDynamicJobFn } = await Promise.resolve().then(() => (init_workflow_loader(), workflow_loader_exports));
-					const workflow = extractWorkflow(module, config.workflowName);
-					if (config.hasFilter) {
-						if (!await evaluateWorkflowFilter(workflow, config.event, filterInput, timeoutMs)) {
-							evalLog(`Workflow filter returned false — '${config.workflowName}' does not apply to this event, so its generator is not run and no jobs are generated`);
-							return [];
-						}
-					}
-					const dynamicFn = extractDynamicJobFn(workflow, config.source.index);
-					evalLog(`Evaluating DynamicJobFn (index ${config.source.index}, timeout ${timeoutMs}ms)`);
-					const needs = buildEvalNeedsContext(config);
-					const context = buildGeneratorContext({
-						workflowName: config.workflowName,
-						event: config.event,
-						env: process.env,
-						...needs && { needs },
-						$: scopedDollar,
-						log: dynamicJobLogger,
-						kici
-					});
-					return serializeJobsToLock(await withTimeout(() => dynamicFn(context), timeoutMs, `DynamicJobFn index ${config.source.index} in workflow '${config.workflowName}'`), {
-						event: config.event,
-						$: scopedDollar,
-						log: dynamicJobLogger,
-						env: process.env,
-						workflowName: config.workflowName
-					});
+				await materializeEvalWorkspace(dispatch, workDir, evalLog, {
+					baseEnv: agentInstallBaseEnv(this.config.trustedEnv),
+					allowInstallScripts: this.config.allowInstallScripts
+				});
+				const lockJobs = await this.runEvaluation({
+					kind: "dynamic-job",
+					dispatch,
+					workDir,
+					config,
+					emit: (line, stream) => evalStreamer.addLine(line, stream),
+					signal: abortController.signal
 				});
 				logger$3.info("DynamicJobFn evaluation completed", {
 					jobId,
@@ -10478,6 +10335,7 @@ var init_job_runner = __esmMin((() => {
 							networkMode: this.config.sandboxNetwork === "host" ? "host" : "default",
 							grant: opts.jobConfig.sandboxGrant
 						},
+						networkIsolation: this.config.sandboxNetworkIsolation,
 						...opts.registryAuth ? { registryAuth: opts.registryAuth } : {},
 						...opts.builtImage ? { buildTag: opts.builtImage } : {},
 						...this.config.runtimeNodeSource ? { runtimeNodePath: this.config.runtimeNodeSource } : {},
@@ -10493,7 +10351,8 @@ var init_job_runner = __esmMin((() => {
 					env: opts.env,
 					sandbox: this.config.sandbox,
 					sandboxNetwork: this.config.sandboxNetwork,
-					orphanCleanup: this.config.orphanCleanup
+					orphanCleanup: this.config.orphanCleanup,
+					...this.config.runnerUser ? { runnerUser: this.config.runnerUser } : {}
 				});
 			}
 		}
@@ -10797,16 +10656,15 @@ var init_between_jobs_controller = __esmMin((() => {
 * - SIGTERM/SIGINT: 10s grace for running jobs, then force-kill
 * - SIGUSR1: Drain mode (stop accepting, finish current, exit)
 */
-init_console_capture();
 init_npm_resolver();
-const AGENT_VERSION = "0.6.0";
-const BUILD_COMMIT = "e4a936029";
-const SDK_VERSION = "0.6.0";
-const SDK_BUNDLE_HASH = "22faf0da45de7c243ce87f80fd33ee51b1df52809fde457b16bb821678f65eb3";
-const SHARED_VERSION = "0.6.0";
+const AGENT_VERSION = "0.7.0";
+const BUILD_COMMIT = "31843a21c";
+const SDK_VERSION = "0.7.0";
+const SDK_BUNDLE_HASH = "065963c7765dc8d87e04d45f57d7e15be1613da705e4ff3ec3742fd1408b7bf5";
+const SHARED_VERSION = "0.7.0";
 const SHARED_BUNDLE_HASH = "a79be949815735b9e36eecc716f7eb07aa36c7bffba62e798e7e19f31a474eff";
-const ENGINE_VERSION = "0.6.0";
-const ENGINE_BUNDLE_HASH = "e49533b19f122155b3a78d95d105f97da259c2a45dee579578324b0702c91708";
+const ENGINE_VERSION = "0.7.0";
+const ENGINE_BUNDLE_HASH = "380f6edf7e0e5cfe988fa0f98512de6e6864f4f2a7a8d07f67e2ab84ed637d19";
 initTelemetry({
 	serviceName: "kici-agent",
 	otlpEndpoint: process.env.OTEL_EXPORTER_OTLP_ENDPOINT
@@ -10845,7 +10703,11 @@ async function serializeAgentMetrics() {
 installConsoleCapture();
 await guardStartup(logger$1, async () => {
 	const config = loadConfig();
+	const scrubbedEnvVars = scrubCredentialEnv();
+	const exposedPosture = describeExposedPosture(config);
+	if (exposedPosture) logger$1.warn(exposedPosture);
 	logger$1.info("Agent starting", {
+		scrubbedEnvVars,
 		agentId: config.agentId,
 		orchestratorUrl: config.orchestratorUrl,
 		labels: config.labels,