@kitman-sh/cli 0.6.0 → 0.7.1

package/dist/{chunk-3j7sewn0.js → chunk-f1f60hgt.js}

@@ -14,7 +14,7 @@ import {
   isNone,
   isSome,
   getOrUndefined,
-  Service2,
+  Service,
   get,
   merge,
   succeed,
@@ -24,6 +24,7 @@ import {
   isSuccess,
   ensure,
   map2,
+  infinity,
   millis,
   seconds,
   TaggedError,
@@ -34,12 +35,12 @@ import {
   void_,
   isSuccess2,
   isFailure2,
-  makeUnsafe2,
+  makeUnsafe,
   _await,
   isDoneUnsafe,
   doneUnsafe,
   Scope,
-  make9,
+  make6,
   provide,
   addFinalizer,
   close,
@@ -104,9 +105,9 @@ import {
   logWarning,
   logError,
   interrupt3,
+  makeUnsafe3,
   makeUnsafe4,
-  makeUnsafe5,
-  make13,
+  make10,
   map4,
   filter,
   decodeText,
@@ -115,7 +116,7 @@ import {
   FileSystem,
   Path,
   ChildProcessSpawner,
-  make15,
+  make12,
   Crypto,
   value,
   is,
@@ -146,19 +147,21 @@ import {
   encodePrettyJsonString,
   decodeJsonStringSync,
   encodeUnknownJsonStringSync,
-  option2,
-  String3,
   digestSha256,
+  RunSettled,
   CommandFailed2,
   runCommand2,
   shellOutputTailChars2,
+  runProcess2,
   runShell2,
+  optionalEnv,
+  detectHarnesses2,
   herdrExecutionExtension2,
   herdrNativeExtensionIds2,
-  herdrPiRunnerCapabilitiesForRepoBinding2,
-  herdrPiRunnerCapabilities2,
+  herdrRunnerCapabilitiesForRepoBinding2,
+  herdrRunnerCapabilities2,
   assertHerdrRunnerCapability2
-} from "./chunk-txyq8r41.js";
+} from "./chunk-5rp5hvc0.js";
 import {
   make4,
   readerString,
@@ -169,18 +172,17 @@ import {
   SocketUpgradeError,
   SocketCloseError,
   SocketError
-} from "./chunk-hw7qkap1.js";
-import"./chunk-hrvcz0m4.js";
+} from "./chunk-9bje6bm0.js";
+import"./chunk-tkk2synn.js";
 import {
-  RunSettled
-} from "./chunk-xdk488qp.js";
-import"./chunk-n32jhswz.js";
-import {
-  programLease
-} from "./chunk-fc0v325q.js";
+  programLease,
+  programHostsEnv,
+  undeclaredHostsEnv
+} from "./chunk-2vcae278.js";
+import"./chunk-23ch5vdv.js";
 import {
   nextInt
-} from "./chunk-brp7cekg.js";
+} from "./chunk-1d2e4je3.js";
 
 // packages/core/src/runner-trust.ts
 import { createHash } from "crypto";
@@ -468,14 +470,6 @@ function sortValue(value) {
   }
   return result;
 }
-// packages/agent-runtime/src/env.ts
-var optionalEnv = (name) => gen(function* () {
-  const value = getOrUndefined(yield* option2(String3(name)))?.trim();
-  return value === undefined || value.length === 0 ? undefined : value;
-}).pipe(orElseSucceed(() => {
-  return;
-}));
-
 // packages/agent-runtime/src/config.ts
 class AgentRuntimeConfigError extends TaggedError("AgentRuntimeConfigError") {
 }
@@ -1826,7 +1820,7 @@ var makeNet = (options) => fromDuplex(contextWith((context) => {
 }), options);
 var fromDuplex = (open, options) => withFiber((fiber) => {
   let currentSocket;
-  const latch = makeUnsafe4(false);
+  const latch = makeUnsafe3(false);
   const openServices = fiber.context;
   const isServer = options?.tlsServer === true;
   const secureEvent = isServer ? "secure" : "secureConnect";
@@ -2354,12 +2348,10 @@ class HerdrServerSupervisor {
   start = fnUntraced(function* () {
     if (this.started && this.client !== undefined)
       return yield* this.client.sessionSnapshot().pipe(mapError((error) => fail3(error.message)));
-    if ((this.options.platform ?? process.platform) !== "linux")
-      return yield* fail3("herdr_linux_required");
+    if (!["linux", "darwin"].includes(this.options.platform ?? process.platform))
+      return yield* fail3("herdr_platform_unsupported");
     const defaultSession = this.options.session === "default";
     const runtime = defaultSession ? undefined : yield* this.prepareRuntime();
-    if (!(yield* (this.options.executableAvailable ?? executableAvailable)(this.options.piCommand ?? "pi")))
-      return yield* fail3("herdr_pi_unavailable");
     const socketClientOptions = this.options.socketClientOptions ?? {};
     const socketPath = runtime?.socketPath ?? (yield* defaultSessionSocketPath);
     const clientOptions = {
@@ -2499,15 +2491,10 @@ var defaultSessionSocketPath = gen(function* () {
 });
 var homeDirectory = map3(optionalEnv("HOME"), (home) => home ?? "/");
 var temporaryDirectory = map3(optionalEnv("TMPDIR"), (tmp) => tmp ?? "/tmp");
-var executableAvailable = (command) => gen(function* () {
-  const spawner = yield* ChildProcessSpawner;
-  const exitCode = yield* spawner.exitCode(make15("which", [command], { stdin: "ignore", stdout: "ignore", stderr: "ignore" }));
-  return exitCode === 0;
-}).pipe(orElseSucceed(() => false));
 var spawnServer = (input) => gen(function* () {
   const spawner = yield* ChildProcessSpawner;
-  const scope = yield* make9();
-  const handle = yield* spawner.spawn(make15(input.command, [...input.args], {
+  const scope = yield* make6();
+  const handle = yield* spawner.spawn(make12(input.command, [...input.args], {
     env: { HERDR_SOCKET_PATH: input.socketPath },
     extendEnv: true,
     detached: true,
@@ -2562,7 +2549,7 @@ function digest(value) {
 class HarnessError extends TaggedError("HarnessError") {
 }
 
-class Harness extends Service2()("Harness") {
+class Harness extends Service()("Harness") {
 }
 // packages/agent-runtime/src/herdr-execution-primitives.ts
 class HerdrHarnessError extends TaggedError("HerdrHarnessError") {
@@ -2998,6 +2985,7 @@ var srtSettings = (policy) => policy.network === "open" ? undefined : {
   network: { allowedDomains: [...policy.network.hosts], deniedDomains: [], strictAllowlist: true },
   filesystem: {
     denyRead: [...policy.readDeniedPaths],
+    allowRead: policy.readAllowedPaths.map((path) => ({ path, literal: true })),
     allowWrite: [...policy.writablePaths],
     denyWrite: []
   }
@@ -3008,8 +2996,8 @@ var srtCacheEnvironment = (dir) => ({
   BUN_INSTALL_CACHE_DIR: `${dir}/bun`
 });
 var quote = (value) => `'${value.replaceAll("'", `'\\''`)}'`;
-var prepareSrtPane = (input) => gen(function* () {
-  const settings = srtSettings(input.policy);
+var writeSrtSettings = (policy) => gen(function* () {
+  const settings = srtSettings(policy);
   if (settings === undefined)
     return yield* die3(new Error("srt cannot run a Step with an open network"));
   const fs = yield* FileSystem;
@@ -3017,11 +3005,24 @@ var prepareSrtPane = (input) => gen(function* () {
   const dir = yield* fs.makeTempDirectoryScoped({ prefix: "kitman-srt-" });
   const settingsFile = path.join(dir, "srt-settings.json");
   yield* fs.writeFileString(settingsFile, encodeUnknownJsonStringSync(settings));
+  return { dir, settingsFile };
+});
+var srtArgv = (srtCommand, settingsFile, argv) => [
+  ...srtCommand,
+  "--settings",
+  settingsFile,
+  "--",
+  ...argv
+];
+var prepareSrtPane = (input) => gen(function* () {
+  const fs = yield* FileSystem;
+  const path = yield* Path;
+  const { dir, settingsFile } = yield* writeSrtSettings(input.policy);
   yield* fs.writeFileString(path.join(dir, input.binary), [
     "#!/bin/sh",
     `PATH=$(printf %s "$PATH" | tr ':' '\\n' | grep -vxF ${quote(dir)} | paste -sd: -)`,
     "export PATH",
-    `exec ${[...input.srtCommand, "--settings", settingsFile, "--", input.binary].map(quote).join(" ")} "$@"`,
+    `exec ${srtArgv(input.srtCommand, settingsFile, [input.binary]).map(quote).join(" ")} "$@"`,
     ""
   ].join(`
 `), { mode: 493 });
@@ -3062,6 +3063,16 @@ var dockerContainerRunner = map3(ChildProcessSpawner, (spawner) => {
       input.image,
       ...input.command
     ], imagePull)),
+    exec: (input) => runProcess2([
+      "docker",
+      "exec",
+      ...input.stdin === undefined ? [] : ["--interactive"],
+      "--workdir",
+      input.workdir,
+      ...Object.keys(input.env).flatMap((name) => ["--env", name]),
+      input.container,
+      ...input.command
+    ], { env: input.env, timeout: input.timeout, ...input.stdin === undefined ? undefined : { stdin: input.stdin } }).pipe(mapError((error) => new ContainerError({ message: error.message })), provideService(ChildProcessSpawner, spawner)),
     connect: (input) => asVoid(docker(["network", "connect", "--alias", input.alias, input.network, input.container])),
     removeLabelled: ([key, value]) => gen(function* () {
       const filter = ["--filter", `label=${key}=${value}`];
@@ -3076,7 +3087,7 @@ var dockerContainerRunner = map3(ChildProcessSpawner, (spawner) => {
 });
 var quote2 = (value) => `'${value.replaceAll("'", `'\\''`)}'`;
 var dockerName = (id) => id.replaceAll(/[^a-zA-Z0-9_.-]/g, "-");
-var prepareDockerPane = (input) => gen(function* () {
+var startDockerSandbox = (input) => gen(function* () {
   const { containers } = input.docker;
   const fs = yield* FileSystem;
   const path = yield* Path;
@@ -3113,7 +3124,10 @@ var prepareDockerPane = (input) => gen(function* () {
     labels,
     ...network === undefined ? undefined : { network },
     ...input.docker.user === undefined ? undefined : { user: input.docker.user },
-    mounts: input.policy.writablePaths.map((writable) => ({ source: writable, target: writable })),
+    mounts: [
+      ...input.policy.writablePaths.map((writable) => ({ source: writable, target: writable })),
+      ...(input.readOnlyPaths ?? []).map((readable) => ({ source: readable, target: readable, readOnly: true }))
+    ],
     workdir: input.workspace,
     env: {
       HOME: path.join(input.configDir, "home"),
@@ -3130,6 +3144,12 @@ var prepareDockerPane = (input) => gen(function* () {
     command: ["sleep", "infinity"]
   });
   yield* fs.makeDirectory(path.join(input.configDir, "home"), { recursive: true });
+  return { container: agent };
+});
+var prepareDockerPane = (input) => gen(function* () {
+  const fs = yield* FileSystem;
+  const path = yield* Path;
+  const { container: agent } = yield* startDockerSandbox(input);
   const dir = yield* fs.makeTempDirectoryScoped({ prefix: "kitman-docker-" });
   const shell = path.join(dir, "shell");
   const forwarded = ["TERM", ...Object.keys(input.policy.environment)].flatMap((name) => ["-e", name]);
@@ -3161,6 +3181,7 @@ var stepSandboxPolicy = (input) => ({
     ...input.policy.readDeniedPaths,
     ...HarnessAdapters.filter((other) => other.id !== input.adapter.id).flatMap((other) => other.auth)
   ],
+  readAllowedPaths: [...input.policy.readAllowedPaths, input.workspace, input.configDir],
   environment: { ...input.policy.environment, ...input.environment }
 });
 var executeHerdrStepAttempt = (input) => gen(function* () {
@@ -3322,7 +3343,7 @@ var classifyFailure = (error) => {
 class AgentBackendRefusal extends TaggedError("AgentBackendRefusal") {
 }
 
-class AgentBackend extends Service2()("AgentBackend") {
+class AgentBackend extends Service()("AgentBackend") {
 }
 var herdrSandboxBackends = ["host"];
 var refuseAgentRequest = (request, enforceable) => {
@@ -3444,185 +3465,342 @@ var probeSandboxHost = (probe, platform = process.platform, options = {}) => gen
   };
 });
 var commandHostProbe = map3(ChildProcessSpawner, (spawner) => (command, args) => runCommand2(command, args, { timeout: "10 seconds" }).pipe(as(true), orElseSucceed(() => false), provideService(ChildProcessSpawner, spawner)));
-// packages/agent-runtime/src/herdr-executor.ts
-var agentStepSandboxPolicy = (work, apiUrl, authStore) => ({
-  ...runnerAgentSandboxPolicy(),
-  readDeniedPaths: [...new Set([...runnerAgentSandboxPolicy().readDeniedPaths, authStore])],
-  network: agentNetworkAllowlist({
-    apiUrl,
-    providerHosts: harnessAdapter(work.brief.harness)?.providerHosts ?? [],
-    ...work.repoBinding === undefined ? undefined : { repoBindingHost: work.repoBinding.host },
-    ...work.network === undefined ? undefined : { agent: work.network }
-  })
-});
-function runnerStepAttemptFromAgentStep(work) {
-  return {
-    kind: "step_attempt",
-    attempt: {
-      id: work.id,
-      workspaceId: "",
-      ...work.projectId === undefined ? undefined : { projectId: work.projectId },
-      runId: work.runId,
-      taskId: work.runId,
-      stepKey: work.stepKey,
-      sequence: 0,
-      required: true,
-      attempt: work.attempt,
-      status: "running",
-      inputManifest: { manifestVersion: 1, assembledAt: work.lease.lastHeartbeatAt, entries: [] },
-      execution: { metadata: {} },
-      reviewEvidence: [],
-      lease: {
-        ownerId: work.lease.leaseOwnerId,
-        runnerReplicaId: work.lease.runnerReplicaId,
-        leaseId: work.lease.leaseId,
-        fencingToken: work.lease.fencingToken,
-        capacitySlot: work.lease.capacitySlot,
-        expiresAt: work.lease.leaseExpiresAt,
-        lastHeartbeatAt: work.lease.lastHeartbeatAt
-      },
-      createdAt: work.lease.lastHeartbeatAt,
-      updatedAt: work.lease.lastHeartbeatAt
-    },
-    step: {
-      title: work.stepKey,
-      implementation: { kind: "agent", taskIdRef: work.runId, agentId: work.id, runtimeKind: "herdr" },
-      inputSchemaRef: { kind: "typebox_ref", name: "WorkUnitInput" },
-      outputSchemaRef: { kind: "typebox_ref", name: "WorkUnitOutput" },
-      allowedCapabilities: [],
-      retryPolicy: { maxAttempts: 1, backoff: "none" },
-      timeoutPolicy: { timeoutSeconds: 1800 },
-      metadata: {}
-    }
-  };
-}
-// packages/agent-runtime/src/materialization-plan.ts
-class AgentEnvironmentPlanApplyError extends TaggedError("AgentEnvironmentPlanApplyError") {
-  get message() {
-    return `AgentEnvironment plan apply failed during ${this.phase}: ${this.cause.message}`;
+// packages/agent-runtime/src/sandbox-command.ts
+var runSandboxCommand = (input) => scoped(gen(function* () {
+  const { command } = input;
+  const env = { ...input.policy.environment, ...command.env };
+  if (input.backend === "srt") {
+    const { settingsFile } = yield* writeSrtSettings(input.policy);
+    return yield* runProcess2(srtArgv(input.srtCommand ?? pinnedSrtCommand(), settingsFile, command.argv), {
+      cwd: command.cwd,
+      env,
+      timeout: command.timeout,
+      ...command.extendEnv === undefined ? undefined : { extendEnv: command.extendEnv },
+      ...command.stdin === undefined ? undefined : { stdin: command.stdin }
+    });
   }
-}
-var previewAgentEnvironmentPlan = fnUntraced(function* (input) {
-  const skills = yield* previewAgentEnvironmentMaterialization({
-    environment: input.environment,
-    ...input.rootDir === undefined ? undefined : { rootDir: input.rootDir },
-    ...input.scope === undefined ? undefined : { scope: input.scope },
-    ...input.cacheRoot === undefined ? undefined : { cacheRoot: input.cacheRoot },
-    ...input.noInstall === undefined ? undefined : { noInstall: input.noInstall }
+  const configDir = yield* (yield* FileSystem).makeTempDirectoryScoped({ prefix: "kitman-sandbox-" });
+  const { container } = yield* startDockerSandbox({
+    docker: input.docker,
+    runnerId: input.runnerId,
+    attemptId: input.id,
+    policy: { ...input.policy, writablePaths: [...input.policy.writablePaths, configDir] },
+    workspace: command.cwd,
+    configDir,
+    ...input.readOnlyPaths === undefined ? undefined : { readOnlyPaths: input.readOnlyPaths }
   });
-  const harnessConfig = yield* previewAgentEnvironmentConfigSync({
-    environment: input.environment,
-    materializedSkills: skills.materializedSkills,
-    ...input.syncKit === undefined ? undefined : { syncKit: input.syncKit },
-    ...input.rootDir === undefined ? undefined : { rootDir: input.rootDir },
-    ...input.scope === undefined ? undefined : { scope: input.scope },
-    ...input.mcpCredentialName === undefined ? undefined : { mcpCredentialName: input.mcpCredentialName }
+  return yield* input.docker.containers.exec({
+    container,
+    workdir: command.cwd,
+    env,
+    command: command.argv,
+    timeout: command.timeout,
+    ...command.stdin === undefined ? undefined : { stdin: command.stdin }
   });
-  return {
-    harness: input.environment.harness,
-    ...input.syncKit === undefined ? undefined : { syncKitHash: input.syncKit.syncKitHash },
-    skills,
-    harnessConfig,
-    operationCount: skills.operations.length + harnessConfig.operations.length,
-    warnings: [...skills.warnings, ...harnessConfig.warnings].map((item) => item.message)
-  };
+}));
+// packages/oversight/src/domain/intent.ts
+var ConstraintKind = Literals(["rule", "semantic"]);
+var ConstraintSeverity = Literals(["block", "warn"]);
+var ConstraintSource = Literals(["launch", "repository", "plan", "parent", "human"]);
+var ProtectedPathsRule = Struct({
+  kind: Literal("protected_paths"),
+  globs: ArraySchema(String2)
 });
-function composeAgentEnvironmentSyncPlan(targets) {
-  return { version: 1, planId: canonicalSha256(targets), targets };
-}
-var applyAgentEnvironmentPlans = fnUntraced(function* (plan) {
-  for (const target of plan.targets)
-    yield* applyAgentEnvironmentMaterialization(target.skills).pipe(mapError((cause) => new AgentEnvironmentPlanApplyError({ phase: "skills", cause })));
-  for (const target of plan.targets)
-    yield* applyAgentEnvironmentConfigSync(target.harnessConfig).pipe(mapError((cause) => new AgentEnvironmentPlanApplyError({ phase: "harness_config", cause })));
-  return plan;
+var Constraint = Struct({
+  id: String2,
+  text: String2,
+  kind: ConstraintKind,
+  severity: ConstraintSeverity,
+  source: ConstraintSource,
+  rule: optionalKey(ProtectedPathsRule)
 });
-// node_modules/.bun/effect@4.0.4/node_modules/effect/dist/internal/matcher.js
-var TypeId = "~effect/Match/Matcher";
-var TypeMatcherProto = {
-  [TypeId]: {
-    _input: identity,
-    _filters: identity,
-    _remaining: identity,
-    _result: identity,
-    _return: identity,
-    _args: identity
-  },
-  _tag: "TypeMatcher",
-  add(_case) {
-    return makeTypeMatcher(this.select, [...this.cases, _case]);
-  },
-  pipe() {
-    return pipeArguments(this, arguments);
-  }
-};
-function makeTypeMatcher(select, cases) {
-  const matcher = Object.create(TypeMatcherProto);
-  matcher.select = select;
-  matcher.cases = cases;
-  return matcher;
+var Intent = Struct({
+  version: Int,
+  goal: String2,
+  doneWhen: ArraySchema(String2),
+  constraints: ArraySchema(Constraint),
+  corrections: Boolean2,
+  removedConstraintIds: ArraySchema(String2)
+});
+
+class ConstraintSpellingInvalid extends TaggedError2()("ConstraintSpellingInvalid", { message: String2 }) {
 }
-var ValueMatcherProto = {
-  [TypeId]: {
-    _input: identity,
-    _filters: identity,
-    _result: identity,
-    _return: identity,
-    _flavor: identity
-  },
-  _tag: "ValueMatcher",
-  add(_case) {
-    if (isSuccess(this.value)) {
-      return this;
-    }
-    if (_case._tag === "When" && _case.guard(this.provided) === true) {
-      return makeValueMatcher(this.provided, succeed(_case.evaluate(this.provided)));
-    } else if (_case._tag === "Not" && _case.guard(this.provided) === false) {
-      return makeValueMatcher(this.provided, succeed(_case.evaluate(this.provided)));
-    }
-    return this;
-  },
-  pipe() {
-    return pipeArguments(this, arguments);
-  }
-};
-function makeValueMatcher(provided, value) {
-  const matcher = Object.create(ValueMatcherProto);
-  matcher.provided = provided;
-  matcher.value = value;
-  return matcher;
+
+class ConstraintNotFound extends TaggedError2()("ConstraintNotFound", {
+  message: String2
+}) {
 }
-var makeWhen = (guard, evaluate) => ({
-  _tag: "When",
-  guard,
-  evaluate
+// packages/oversight/src/domain/drift.ts
+var EvidenceLimits = { files: 20, linesPerFile: 200, changedPaths: 1000, lineLength: 1000 };
+var outputLines = EvidenceLimits.files * EvidenceLimits.linesPerFile;
+var EvidenceFile = Struct({
+  path: String2,
+  excerpt: String2,
+  redacted: Boolean2,
+  truncated: Boolean2
 });
-var valueTags = /* @__PURE__ */ dual(2, (input, fields) => {
-  const match = tagsExhaustive(fields)(makeTypeMatcher(identity, []));
-  return match(input);
+var ChangeEvidence = Struct({
+  kind: Literal("change"),
+  changedPaths: ArraySchema(String2),
+  omittedPaths: Int,
+  files: ArraySchema(EvidenceFile),
+  truncated: Boolean2
 });
-var discriminators = (field) => (fields) => {
-  const predicate = makeWhen((arg) => arg != null && Object.hasOwn(fields, arg[field]), (data) => fields[data[field]](data));
-  return (self) => self.add(predicate);
-};
-var discriminatorsExhaustive = (field) => (fields) => {
-  const addCases = discriminators(field)(fields);
-  return (matcher) => exhaustive(addCases(matcher));
+var OutputEvidence = Struct({
+  kind: Literal("output"),
+  text: String2,
+  truncated: Boolean2
+});
+var Evidence = Union([ChangeEvidence, OutputEvidence]);
+var globParts = new Map([
+  ["**/", "(?:.*/)?"],
+  ["**", ".*"],
+  ["*", "[^/]*"],
+  ["?", "[^/]"]
+]);
+var secretName = /^\.env(\..*)?$|^\.?credentials(\..*)?$|^\.(netrc|npmrc|pgpass)$|\.(pem|key|p12|pfx|jks|keystore)$|^id_(rsa|dsa|ecdsa|ed25519)|secret/i;
+var looksSecret = (path) => secretName.test(path.split("/").at(-1) ?? path);
+var capLines = (text, limit) => {
+  const lines = text.split(`
+`);
+  const capped = lines.slice(0, limit).map((line) => line.length > EvidenceLimits.lineLength ? line.slice(0, EvidenceLimits.lineLength) : line);
+  return {
+    text: capped.join(`
+`),
+    truncated: lines.length > limit || lines.some((line) => line.length > EvidenceLimits.lineLength)
+  };
 };
-var tagsExhaustive = /* @__PURE__ */ discriminatorsExhaustive("_tag");
-var result2 = (self) => {
-  if (self._tag === "ValueMatcher") {
-    return self.value;
-  }
-  const len = self.cases.length;
-  if (len === 1) {
-    const _case = self.cases[0];
-    return (...args) => {
-      const input = self.select(...args);
-      if (_case._tag === "When" && _case.guard(input) === true) {
-        return succeed(_case.evaluate(input, ...args));
-      } else if (_case._tag === "Not" && _case.guard(input) === false) {
-        return succeed(_case.evaluate(input, ...args));
+var boundChange = (change) => {
+  const changedPaths = change.changedPaths.slice(0, EvidenceLimits.changedPaths);
+  const omittedPaths = (change.omittedPaths ?? 0) + change.changedPaths.length - changedPaths.length;
+  const files = changedPaths.slice(0, EvidenceLimits.files).map((path) => {
+    if (looksSecret(path))
+      return { path, excerpt: "", redacted: true, truncated: false };
+    const given = change.files.find((file) => file.path === path);
+    const capped = capLines(given?.diff ?? "", EvidenceLimits.linesPerFile);
+    return { path, excerpt: capped.text, redacted: false, truncated: capped.truncated || given?.truncated === true };
+  });
+  return {
+    kind: "change",
+    changedPaths,
+    omittedPaths,
+    files,
+    truncated: omittedPaths > 0 || changedPaths.length > files.length || files.some((file) => file.truncated)
+  };
+};
+var DriftStatus = Literals(["open", "correction_sent", "escalated", "verified", "dismissed"]);
+var DriftActor = Struct({ actorType: String2, actorId: String2 });
+var DriftResolution = Struct({
+  status: DriftStatus,
+  intentVersion: Int,
+  at: Date2,
+  reason: optionalKey(String2),
+  actor: optionalKey(DriftActor)
+});
+var DriftReport = Struct({
+  constraintId: String2,
+  constraintText: String2,
+  kind: ConstraintKind,
+  severity: ConstraintSeverity,
+  intentVersion: Int,
+  citedPaths: ArraySchema(String2),
+  truncated: Boolean2,
+  status: DriftStatus,
+  history: ArraySchema(DriftResolution)
+});
+
+class DriftReportNotOpen extends TaggedError2()("DriftReportNotOpen", {
+  message: String2
+}) {
+}
+// packages/oversight/src/domain/judgement.ts
+var ConstraintVerdict = Literals(["holds", "breached", "unverified"]);
+var OutcomeVerdict = Literals(["met", "not_met", "unverified"]);
+var Citation = Struct({ path: String2, line: optionalKey(Int) });
+var JudgeOutput = Struct({
+  constraints: ArraySchema(Struct({ id: String2, verdict: ConstraintVerdict, citations: ArraySchema(Citation) })),
+  goal: optionalKey(OutcomeVerdict),
+  doneWhen: optionalKey(ArraySchema(Struct({ item: Int, verdict: OutcomeVerdict })))
+});
+var JudgementReading = Struct({
+  constraints: ArraySchema(Struct({ constraintId: String2, verdict: ConstraintVerdict, citations: ArraySchema(Citation) })),
+  goal: optionalKey(OutcomeVerdict),
+  doneWhen: optionalKey(ArraySchema(OutcomeVerdict))
+});
+var verdictEnum = (values) => ({ type: "string", enum: values });
+var closedObject = (properties, required) => ({
+  type: "object",
+  additionalProperties: false,
+  required,
+  properties
+});
+var constraintsSchema = {
+  type: "array",
+  items: closedObject({
+    id: { type: "string" },
+    verdict: verdictEnum(ConstraintVerdict.literals),
+    citations: {
+      type: "array",
+      items: closedObject({ path: { type: "string" }, line: { type: "integer", minimum: 1 } }, ["path"])
+    }
+  }, ["id", "verdict", "citations"])
+};
+// packages/oversight/src/domain/alignment.ts
+var AlignmentVerdict = Literals(["aligned", "not_aligned", "unverified"]);
+var Alignment = Struct({
+  verdict: AlignmentVerdict,
+  reasons: ArraySchema(String2),
+  intentVersion: Int,
+  judgedAt: Date2
+});
+// packages/agent-runtime/src/agent-step-executor.ts
+import { homedir } from "os";
+
+// packages/agent-runtime/src/harness-sessions.ts
+import { gunzipSync, gzipSync } from "zlib";
+var projectDirectory = (worktree) => worktree.replace(/[^a-zA-Z0-9]/g, "-");
+var rolloutId = /([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\.jsonl$/;
+var filesUnder = (directory) => gen(function* () {
+  const fs = yield* FileSystem;
+  if (!(yield* fs.exists(directory)))
+    return [];
+  return (yield* fs.readDirectory(directory, { recursive: true })).map((file) => `${directory}/${file}`);
+});
+var rolloutDirectory = (path) => gen(function* () {
+  const fs = yield* FileSystem;
+  const firstLine = (yield* fs.readFileString(path)).split(`
+`, 1)[0] ?? "";
+  const line = getOrUndefined(decodeJsonStringOption(firstLine));
+  const payload = isJsonObject(line) ? line.payload : undefined;
+  return isJsonObject(payload) && isString2(payload.cwd) ? payload.cwd : undefined;
+});
+var findSession = (adapter, place) => gen(function* () {
+  const location = adapter.session?.location;
+  if (location === undefined)
+    return;
+  const root = `${place.home}/${location.root}`;
+  if (location.layout === "per_directory") {
+    if (place.id === undefined)
+      return;
+    const name = `${place.id}.jsonl`;
+    const own = `${root}/${projectDirectory(place.worktree)}/${name}`;
+    const fs = yield* FileSystem;
+    const path = (yield* fs.exists(own)) ? own : (yield* filesUnder(root)).find((file) => file.endsWith(`/${name}`));
+    return path === undefined ? undefined : { id: place.id, name, path };
+  }
+  for (const path of (yield* filesUnder(root)).filter((file) => rolloutId.test(file)).sort().reverse()) {
+    const name = path.slice(path.lastIndexOf("/") + 1);
+    const id = rolloutId.exec(name)?.[1];
+    if (id === undefined)
+      continue;
+    if (place.id === undefined ? (yield* rolloutDirectory(path)) === place.worktree : id === place.id)
+      return { id, name, path };
+  }
+  return;
+}).pipe(orElseSucceed(() => {
+  return;
+}));
+var packSession = (path) => map3(flatMap(FileSystem, (fs) => fs.readFile(path)), (content) => new Uint8Array(gzipSync(content)));
+var restoreSession = (adapter, place) => gen(function* () {
+  const fs = yield* FileSystem;
+  const location = adapter.session?.location;
+  if (location === undefined)
+    return yield* die3(`${adapter.id} keeps no session to restore`);
+  const root = `${place.home}/${location.root}`;
+  const today = toDate(wallClockMillis()).toISOString().slice(0, 10).replaceAll("-", "/");
+  const directory = location.layout === "per_directory" ? `${root}/${projectDirectory(place.worktree)}` : `${root}/${today}`;
+  const path = `${directory}/${place.session.name}`;
+  yield* fs.makeDirectory(directory, { recursive: true });
+  yield* fs.writeFile(path, new Uint8Array(gunzipSync(place.session.content)));
+  return { id: place.session.id, name: place.session.name, path };
+});
+
+// node_modules/.bun/effect@4.0.4/node_modules/effect/dist/internal/matcher.js
+var TypeId = "~effect/Match/Matcher";
+var TypeMatcherProto = {
+  [TypeId]: {
+    _input: identity,
+    _filters: identity,
+    _remaining: identity,
+    _result: identity,
+    _return: identity,
+    _args: identity
+  },
+  _tag: "TypeMatcher",
+  add(_case) {
+    return makeTypeMatcher(this.select, [...this.cases, _case]);
+  },
+  pipe() {
+    return pipeArguments(this, arguments);
+  }
+};
+function makeTypeMatcher(select, cases) {
+  const matcher = Object.create(TypeMatcherProto);
+  matcher.select = select;
+  matcher.cases = cases;
+  return matcher;
+}
+var ValueMatcherProto = {
+  [TypeId]: {
+    _input: identity,
+    _filters: identity,
+    _result: identity,
+    _return: identity,
+    _flavor: identity
+  },
+  _tag: "ValueMatcher",
+  add(_case) {
+    if (isSuccess(this.value)) {
+      return this;
+    }
+    if (_case._tag === "When" && _case.guard(this.provided) === true) {
+      return makeValueMatcher(this.provided, succeed(_case.evaluate(this.provided)));
+    } else if (_case._tag === "Not" && _case.guard(this.provided) === false) {
+      return makeValueMatcher(this.provided, succeed(_case.evaluate(this.provided)));
+    }
+    return this;
+  },
+  pipe() {
+    return pipeArguments(this, arguments);
+  }
+};
+function makeValueMatcher(provided, value) {
+  const matcher = Object.create(ValueMatcherProto);
+  matcher.provided = provided;
+  matcher.value = value;
+  return matcher;
+}
+var makeWhen = (guard, evaluate) => ({
+  _tag: "When",
+  guard,
+  evaluate
+});
+var valueTags = /* @__PURE__ */ dual(2, (input, fields) => {
+  const match = tagsExhaustive(fields)(makeTypeMatcher(identity, []));
+  return match(input);
+});
+var discriminators = (field) => (fields) => {
+  const predicate = makeWhen((arg) => arg != null && Object.hasOwn(fields, arg[field]), (data) => fields[data[field]](data));
+  return (self) => self.add(predicate);
+};
+var discriminatorsExhaustive = (field) => (fields) => {
+  const addCases = discriminators(field)(fields);
+  return (matcher) => exhaustive(addCases(matcher));
+};
+var tagsExhaustive = /* @__PURE__ */ discriminatorsExhaustive("_tag");
+var result2 = (self) => {
+  if (self._tag === "ValueMatcher") {
+    return self.value;
+  }
+  const len = self.cases.length;
+  if (len === 1) {
+    const _case = self.cases[0];
+    return (...args) => {
+      const input = self.select(...args);
+      if (_case._tag === "When" && _case.guard(input) === true) {
+        return succeed(_case.evaluate(input, ...args));
+      } else if (_case._tag === "Not" && _case.guard(input) === false) {
+        return succeed(_case.evaluate(input, ...args));
       }
       return fail(input);
     };
@@ -3687,7 +3865,7 @@ class RunnerReplicaCancellation extends TaggedError("RunnerReplicaCancellation")
 }
 var makeReplicaSignals = sync(() => {
   let generation = 0;
-  let nextWork = makeUnsafe2();
+  let nextWork = makeUnsafe();
   const stops = new Map;
   const mailboxes = new Map;
   const mailboxFor = (workUnitId) => {
@@ -3697,8 +3875,8 @@ var makeReplicaSignals = sync(() => {
     const created = {
       notes: [],
       seen: new Set,
-      arrived: makeUnsafe2(),
-      updated: makeUnsafe2()
+      arrived: makeUnsafe(),
+      updated: makeUnsafe()
     };
     mailboxes.set(workUnitId, created);
     return created;
@@ -3709,14 +3887,14 @@ var makeReplicaSignals = sync(() => {
     if (note !== undefined)
       return succeed5(note);
     if (isDoneUnsafe(mailbox.arrived))
-      mailbox.arrived = makeUnsafe2();
+      mailbox.arrived = makeUnsafe();
     return andThen(_await(mailbox.arrived), nextSteer(workUnitId));
   });
   const stopFor = (workUnitId) => {
     const existing = stops.get(workUnitId);
     if (existing !== undefined)
       return existing;
-    const created = makeUnsafe2();
+    const created = makeUnsafe();
     stops.set(workUnitId, created);
     return created;
   };
@@ -3728,7 +3906,7 @@ var makeReplicaSignals = sync(() => {
         WorkAvailable: () => {
           generation += 1;
           const signalled = nextWork;
-          nextWork = makeUnsafe2();
+          nextWork = makeUnsafe();
           doneUnsafe(signalled, void_);
         },
         LeaseRevoked: ({ workUnitId }) => stop(workUnitId, "lost"),
@@ -3758,7 +3936,7 @@ var makeReplicaSignals = sync(() => {
     sessionUpdated: (workUnitId) => suspend(() => {
       const mailbox = mailboxFor(workUnitId);
       return andThen(_await(mailbox.updated), sync(() => {
-        mailbox.updated = makeUnsafe2();
+        mailbox.updated = makeUnsafe();
       }));
     }),
     forget: (workUnitId) => sync(() => {
@@ -3822,7 +4000,7 @@ function runReplica(control, executor, signals) {
 var idleBackoff = (idleIterations) => millis(Math.min(1000 * 2 ** idleIterations, 30000));
 function superviseReplica(input) {
   const { signals } = input;
-  const claimTurn = makeUnsafe5(1);
+  const claimTurn = makeUnsafe4(1);
   let emptyAt = -1;
   const wokenControl = (control, signals) => ({
     ...control,
@@ -3854,382 +4032,35 @@ function superviseReplica(input) {
         continue;
       }
       if (isFailure2(exit2)) {
-        const error = findErrorOption(exit2.cause);
-        if (isSome(error) && error.value instanceof RunnerReplicaError && error.value.kind === "unauthorized")
-          return yield* error.value;
-        yield* logError("runner_slot_recoverable_error", capacitySlot, pretty(exit2.cause));
-      }
-      yield* sleep(idleBackoff(idleIterations++));
-    }
-  });
-  const heartbeat = input.control(input.slots[0] ?? "slot-1").heartbeatReplica;
-  const replicaHeartbeat = gen(function* () {
-    while (true) {
-      const exit2 = yield* exit(retryTransient(heartbeatCall(heartbeat)));
-      if (isFailure2(exit2)) {
-        const error = findErrorOption(exit2.cause);
-        if (isSome(error) && error.value.kind === "unauthorized")
-          return yield* error.value;
-        yield* logError("runner_replica_heartbeat_failed", pretty(exit2.cause));
-      }
-      yield* sleep(ReplicaHeartbeatInterval);
-    }
-  });
-  return all([replicaHeartbeat, forEach(input.slots, runSlot, { concurrency: "unbounded", discard: true })], {
-    concurrency: "unbounded",
-    discard: true
-  }).pipe(andThen(never));
-}
-var ReplicaHeartbeatInterval = seconds(10);
-var ReplicaHeartbeatTimeout = seconds(15);
-var heartbeatCall = (heartbeat) => suspend(heartbeat).pipe(timeout(ReplicaHeartbeatTimeout), mapError((cause) => new RunnerReplicaError({ operation: "heartbeatReplica", kind: controlFailureKind(cause), cause })));
-// packages/agent-runtime/src/herdr-executor-surface.ts
-class HerdrExecutorSurfaceError extends TaggedError("HerdrExecutorSurfaceError") {
-}
-function herdrExecutorSurface(input) {
-  const supervisor = input.supervisor ?? new HerdrServerSupervisor({
-    runnerId: input.runnerId,
-    ...input.session === undefined ? undefined : { session: input.session }
-  });
-  const createdWorkspaces = new Set;
-  const createdTabs = new Map;
-  const record = (method, response) => sync(() => {
-    const workspaceId = nestedString(response, ["workspace", "workspace_id"]);
-    const tabId = nestedString(response, ["tab", "tab_id"]);
-    const tabWorkspaceId = nestedString(response, ["tab", "workspace_id"]);
-    if (method === "workspace.create" && workspaceId !== undefined)
-      createdWorkspaces.add(workspaceId);
-    if (method === "tab.create" && tabId !== undefined && tabWorkspaceId !== undefined)
-      createdTabs.set(tabId, tabWorkspaceId);
-  });
-  const prune = suspend(() => {
-    const client = supervisor.executionClient;
-    const workspaces = [...createdWorkspaces];
-    const tabs = [...createdTabs].flatMap(([tabId, workspaceId]) => createdWorkspaces.has(workspaceId) ? [] : [tabId]);
-    createdWorkspaces.clear();
-    createdTabs.clear();
-    return all([
-      ...workspaces.map((workspaceId) => ignore(client.request("workspace.close", { workspace_id: workspaceId }))),
-      ...tabs.map((tabId) => ignore(client.request("tab.close", { tab_id: tabId })))
-    ], { discard: true });
-  });
-  return {
-    executionClient: {
-      request: (method, params) => supervisor.executionClient.request(method, params).pipe(tap((response) => record(method, response)))
-    },
-    start: () => supervisor.start().pipe(mapError((error) => new HerdrExecutorSurfaceError({ reason: "start_failed", message: error.message })), flatMap((readiness) => readiness.protocol === HERDR_SOCKET_PROTOCOL ? void_2 : fail4(new HerdrExecutorSurfaceError({ reason: "start_failed", message: "herdr_protocol_mismatch" })))),
-    stop: () => andThen(prune, supervisor.stop())
-  };
-}
-// packages/agent-runtime/src/kitman-mcp-preflight.ts
-class KitmanMcpUnreachable extends TaggedError("KitmanMcpUnreachable") {
-}
-var handshake = [
-  {
-    jsonrpc: "2.0",
-    id: 1,
-    method: "initialize",
-    params: { protocolVersion: "2025-06-18", capabilities: {}, clientInfo: { name: "kitman-runner", version: "1" } }
-  },
-  { jsonrpc: "2.0", method: "notifications/initialized" },
-  { jsonrpc: "2.0", id: 2, method: "tools/call", params: { name: "step_brief", arguments: {} } }
-].map((message) => `${JSON.stringify(message)}
-`).join("");
-var kitmanMcpPreflight = (mcp) => gen(function* () {
-  const spawner = yield* ChildProcessSpawner;
-  const server = yield* spawner.spawn(make15(mcp.command, [...mcp.args], {
-    extendEnv: true,
-    env: mcp.env,
-    stdin: { stream: make13(new TextEncoder().encode(handshake)), endOnDone: false },
-    stderr: "ignore"
-  }));
-  const reply = yield* server.stdout.pipe(decodeText, splitLines, map4((line) => recordValue(getOrUndefined(decodeJsonStringOption(line)))), filter((message) => message?.id === 2), runHead);
-  const result = isSome(reply) ? recordValue(reply.value?.result) : undefined;
-  if (result === undefined || result.isError === true)
-    return yield* new KitmanMcpUnreachable({ message: "Kitman MCP did not return the StepAttempt brief" });
-}).pipe(scoped, timeoutOrElse({
-  duration: "20 seconds",
-  orElse: () => fail4(new KitmanMcpUnreachable({ message: "Kitman MCP did not answer in time" }))
-}), mapError((error) => error instanceof KitmanMcpUnreachable ? error : new KitmanMcpUnreachable({ message: error.message })));
-// packages/agent-runtime/src/loop-bundles.ts
-import { fileURLToPath as fileURLToPath3 } from "url";
-
-class BundleRefused extends TaggedError("BundleRefused") {
-  get message() {
-    return `Loop bundle ${this.digest} refused: ${this.reason}`;
-  }
-}
-var sha2562 = (bytes) => digestSha256(bytes, "hex");
-var bundleCacheDir = fileURLToPath3(new URL("../.bundles/", import.meta.url));
-var kitmanBundles = (input) => gen(function* () {
-  const fs = yield* FileSystem;
-  const path = yield* Path;
-  const cacheDir = input.cacheDir ?? bundleCacheDir;
-  const fileOf = (digest) => path.join(cacheDir, `${digest}.js`);
-  const refused = (digest, reason) => new BundleRefused({ digest, reason });
-  const verified = (digest, bytes) => sha2562(bytes) === digest ? void_2 : fail4(refused(digest, "its content does not match its digest"));
-  const write = (digest, bytes) => gen(function* () {
-    const written = `${fileOf(digest)}.${yield* nextInt}.partial`;
-    yield* fs.makeDirectory(cacheDir, { recursive: true });
-    yield* fs.writeFile(written, bytes);
-    yield* fs.rename(written, fileOf(digest));
-  }).pipe(mapError((error) => refused(digest, `not cached: ${error.message}`)));
-  const file = (digest) => gen(function* () {
-    const cached = yield* fs.readFile(fileOf(digest)).pipe(option);
-    if (isSome(cached) && sha2562(cached.value) === digest)
-      return fileOf(digest);
-    const fetched = yield* input.fetch(digest).pipe(mapError((error) => refused(digest, `not fetched: ${error.message}`)));
-    const bytes = new TextEncoder().encode(fetched);
-    yield* verified(digest, bytes);
-    yield* write(digest, bytes);
-    return fileOf(digest);
-  });
-  return {
-    file
-  };
-});
-// packages/agent-runtime/src/program-process.ts
-var inheritedEnv = ["PATH", "HOME", "TMPDIR", "LANG", "LC_ALL", "TZ"];
-var programProcessExecutor = (input) => (work) => gen(function* () {
-  const file = yield* input.bundles.file(work.loopDigest);
-  const spawner = yield* ChildProcessSpawner;
-  const { program, ...unit } = work;
-  const inherited = yield* forEach(inheritedEnv, (name) => map3(optionalEnv(name), (value) => value === undefined ? [] : [[name, value]]));
-  const handle = yield* spawner.spawn(make15(input.bun ?? process.execPath, [file], {
-    stdin: make13(new TextEncoder().encode(encodeUnknownJsonStringSync(unit))),
-    stdout: "inherit",
-    stderr: "inherit",
-    extendEnv: false,
-    env: {
-      ...Object.fromEntries(inherited.flat()),
-      KITMAN_LOOP_ID: program.loopId,
-      KITMAN_API_URL: input.apiUrl,
-      KITMAN_PROGRAM_CREDENTIAL: program.credential
-    },
-    forceKillAfter: "5 seconds"
-  }));
-  const exitCode = yield* handle.exitCode;
-  if (exitCode === 0)
-    return { status: "settled" };
-  yield* logWarning("runner_program_exited_unsettled", { workUnitId: work.id, exitCode });
-  return { status: "deferred" };
-}).pipe(scoped, catch_((error) => as(logWarning("runner_program_not_started", error.message), { status: "deferred" })));
-// packages/oversight/src/domain/intent.ts
-var ConstraintKind = Literals(["rule", "semantic"]);
-var ConstraintSeverity = Literals(["block", "warn"]);
-var ConstraintSource = Literals(["launch", "repository", "plan", "parent", "human"]);
-var ProtectedPathsRule = Struct({
-  kind: Literal("protected_paths"),
-  globs: ArraySchema(String2)
-});
-var Constraint = Struct({
-  id: String2,
-  text: String2,
-  kind: ConstraintKind,
-  severity: ConstraintSeverity,
-  source: ConstraintSource,
-  rule: optionalKey(ProtectedPathsRule)
-});
-var Intent = Struct({
-  version: Int,
-  goal: String2,
-  doneWhen: ArraySchema(String2),
-  constraints: ArraySchema(Constraint),
-  corrections: Boolean2,
-  removedConstraintIds: ArraySchema(String2)
-});
-
-class ConstraintSpellingInvalid extends TaggedError2()("ConstraintSpellingInvalid", { message: String2 }) {
-}
-
-class ConstraintNotFound extends TaggedError2()("ConstraintNotFound", {
-  message: String2
-}) {
-}
-// packages/oversight/src/domain/drift.ts
-var EvidenceLimits = { files: 20, linesPerFile: 200, changedPaths: 1000, lineLength: 1000 };
-var outputLines = EvidenceLimits.files * EvidenceLimits.linesPerFile;
-var EvidenceFile = Struct({
-  path: String2,
-  excerpt: String2,
-  redacted: Boolean2,
-  truncated: Boolean2
-});
-var ChangeEvidence = Struct({
-  kind: Literal("change"),
-  changedPaths: ArraySchema(String2),
-  omittedPaths: Int,
-  files: ArraySchema(EvidenceFile),
-  truncated: Boolean2
-});
-var OutputEvidence = Struct({
-  kind: Literal("output"),
-  text: String2,
-  truncated: Boolean2
-});
-var Evidence = Union([ChangeEvidence, OutputEvidence]);
-var globParts = new Map([
-  ["**/", "(?:.*/)?"],
-  ["**", ".*"],
-  ["*", "[^/]*"],
-  ["?", "[^/]"]
-]);
-var secretName = /^\.env(\..*)?$|^\.?credentials(\..*)?$|^\.(netrc|npmrc|pgpass)$|\.(pem|key|p12|pfx|jks|keystore)$|^id_(rsa|dsa|ecdsa|ed25519)|secret/i;
-var looksSecret = (path) => secretName.test(path.split("/").at(-1) ?? path);
-var capLines = (text, limit) => {
-  const lines = text.split(`
-`);
-  const capped = lines.slice(0, limit).map((line) => line.length > EvidenceLimits.lineLength ? line.slice(0, EvidenceLimits.lineLength) : line);
-  return {
-    text: capped.join(`
-`),
-    truncated: lines.length > limit || lines.some((line) => line.length > EvidenceLimits.lineLength)
-  };
-};
-var boundChange = (change) => {
-  const changedPaths = change.changedPaths.slice(0, EvidenceLimits.changedPaths);
-  const omittedPaths = (change.omittedPaths ?? 0) + change.changedPaths.length - changedPaths.length;
-  const files = changedPaths.slice(0, EvidenceLimits.files).map((path) => {
-    if (looksSecret(path))
-      return { path, excerpt: "", redacted: true, truncated: false };
-    const given = change.files.find((file) => file.path === path);
-    const capped = capLines(given?.diff ?? "", EvidenceLimits.linesPerFile);
-    return { path, excerpt: capped.text, redacted: false, truncated: capped.truncated || given?.truncated === true };
-  });
-  return {
-    kind: "change",
-    changedPaths,
-    omittedPaths,
-    files,
-    truncated: omittedPaths > 0 || changedPaths.length > files.length || files.some((file) => file.truncated)
-  };
-};
-var DriftStatus = Literals(["open", "correction_sent", "escalated", "verified", "dismissed"]);
-var DriftActor = Struct({ actorType: String2, actorId: String2 });
-var DriftResolution = Struct({
-  status: DriftStatus,
-  intentVersion: Int,
-  at: Date2,
-  reason: optionalKey(String2),
-  actor: optionalKey(DriftActor)
-});
-var DriftReport = Struct({
-  constraintId: String2,
-  constraintText: String2,
-  kind: ConstraintKind,
-  severity: ConstraintSeverity,
-  intentVersion: Int,
-  citedPaths: ArraySchema(String2),
-  truncated: Boolean2,
-  status: DriftStatus,
-  history: ArraySchema(DriftResolution)
-});
-
-class DriftReportNotOpen extends TaggedError2()("DriftReportNotOpen", {
-  message: String2
-}) {
-}
-// packages/oversight/src/domain/judgement.ts
-var ConstraintVerdict = Literals(["holds", "breached", "unverified"]);
-var OutcomeVerdict = Literals(["met", "not_met", "unverified"]);
-var Citation = Struct({ path: String2, line: optionalKey(Int) });
-var JudgeOutput = Struct({
-  constraints: ArraySchema(Struct({ id: String2, verdict: ConstraintVerdict, citations: ArraySchema(Citation) })),
-  goal: optionalKey(OutcomeVerdict),
-  doneWhen: optionalKey(ArraySchema(Struct({ item: Int, verdict: OutcomeVerdict })))
-});
-var JudgementReading = Struct({
-  constraints: ArraySchema(Struct({ constraintId: String2, verdict: ConstraintVerdict, citations: ArraySchema(Citation) })),
-  goal: optionalKey(OutcomeVerdict),
-  doneWhen: optionalKey(ArraySchema(OutcomeVerdict))
-});
-var verdictEnum = (values) => ({ type: "string", enum: values });
-var closedObject = (properties, required) => ({
-  type: "object",
-  additionalProperties: false,
-  required,
-  properties
-});
-var constraintsSchema = {
-  type: "array",
-  items: closedObject({
-    id: { type: "string" },
-    verdict: verdictEnum(ConstraintVerdict.literals),
-    citations: {
-      type: "array",
-      items: closedObject({ path: { type: "string" }, line: { type: "integer", minimum: 1 } }, ["path"])
-    }
-  }, ["id", "verdict", "citations"])
-};
-// packages/oversight/src/domain/alignment.ts
-var AlignmentVerdict = Literals(["aligned", "not_aligned", "unverified"]);
-var Alignment = Struct({
-  verdict: AlignmentVerdict,
-  reasons: ArraySchema(String2),
-  intentVersion: Int,
-  judgedAt: Date2
-});
-// packages/agent-runtime/src/agent-step-executor.ts
-import { homedir } from "os";
-
-// packages/agent-runtime/src/harness-sessions.ts
-import { gunzipSync, gzipSync } from "zlib";
-var projectDirectory = (worktree) => worktree.replace(/[^a-zA-Z0-9]/g, "-");
-var rolloutId = /([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\.jsonl$/;
-var filesUnder = (directory) => gen(function* () {
-  const fs = yield* FileSystem;
-  if (!(yield* fs.exists(directory)))
-    return [];
-  return (yield* fs.readDirectory(directory, { recursive: true })).map((file) => `${directory}/${file}`);
-});
-var rolloutDirectory = (path) => gen(function* () {
-  const fs = yield* FileSystem;
-  const firstLine = (yield* fs.readFileString(path)).split(`
-`, 1)[0] ?? "";
-  const line = getOrUndefined(decodeJsonStringOption(firstLine));
-  const payload = isJsonObject(line) ? line.payload : undefined;
-  return isJsonObject(payload) && isString2(payload.cwd) ? payload.cwd : undefined;
-});
-var findSession = (adapter, place) => gen(function* () {
-  const location = adapter.session?.location;
-  if (location === undefined)
-    return;
-  const root = `${place.home}/${location.root}`;
-  if (location.layout === "per_directory") {
-    if (place.id === undefined)
-      return;
-    const name = `${place.id}.jsonl`;
-    const own = `${root}/${projectDirectory(place.worktree)}/${name}`;
-    const fs = yield* FileSystem;
-    const path = (yield* fs.exists(own)) ? own : (yield* filesUnder(root)).find((file) => file.endsWith(`/${name}`));
-    return path === undefined ? undefined : { id: place.id, name, path };
-  }
-  for (const path of (yield* filesUnder(root)).filter((file) => rolloutId.test(file)).sort().reverse()) {
-    const name = path.slice(path.lastIndexOf("/") + 1);
-    const id = rolloutId.exec(name)?.[1];
-    if (id === undefined)
-      continue;
-    if (place.id === undefined ? (yield* rolloutDirectory(path)) === place.worktree : id === place.id)
-      return { id, name, path };
-  }
-  return;
-}).pipe(orElseSucceed(() => {
-  return;
-}));
-var packSession = (path) => map3(flatMap(FileSystem, (fs) => fs.readFile(path)), (content) => new Uint8Array(gzipSync(content)));
-var restoreSession = (adapter, place) => gen(function* () {
-  const fs = yield* FileSystem;
-  const location = adapter.session?.location;
-  if (location === undefined)
-    return yield* die3(`${adapter.id} keeps no session to restore`);
-  const root = `${place.home}/${location.root}`;
-  const today = toDate(wallClockMillis()).toISOString().slice(0, 10).replaceAll("-", "/");
-  const directory = location.layout === "per_directory" ? `${root}/${projectDirectory(place.worktree)}` : `${root}/${today}`;
-  const path = `${directory}/${place.session.name}`;
-  yield* fs.makeDirectory(directory, { recursive: true });
-  yield* fs.writeFile(path, new Uint8Array(gunzipSync(place.session.content)));
-  return { id: place.session.id, name: place.session.name, path };
-});
+        const error = findErrorOption(exit2.cause);
+        if (isSome(error) && error.value instanceof RunnerReplicaError && error.value.kind === "unauthorized")
+          return yield* error.value;
+        yield* logError("runner_slot_recoverable_error", capacitySlot, pretty(exit2.cause));
+      }
+      yield* sleep(idleBackoff(idleIterations++));
+    }
+  });
+  const heartbeat = input.control(input.slots[0] ?? "slot-1").heartbeatReplica;
+  const replicaHeartbeat = gen(function* () {
+    while (true) {
+      const exit2 = yield* exit(retryTransient(heartbeatCall(heartbeat)));
+      if (isFailure2(exit2)) {
+        const error = findErrorOption(exit2.cause);
+        if (isSome(error) && error.value.kind === "unauthorized")
+          return yield* error.value;
+        yield* logError("runner_replica_heartbeat_failed", pretty(exit2.cause));
+      }
+      yield* sleep(ReplicaHeartbeatInterval);
+    }
+  });
+  return all([replicaHeartbeat, forEach(input.slots, runSlot, { concurrency: "unbounded", discard: true })], {
+    concurrency: "unbounded",
+    discard: true
+  }).pipe(andThen(never));
+}
+var ReplicaHeartbeatInterval = seconds(10);
+var ReplicaHeartbeatTimeout = seconds(15);
+var heartbeatCall = (heartbeat) => suspend(heartbeat).pipe(timeout(ReplicaHeartbeatTimeout), mapError((cause) => new RunnerReplicaError({ operation: "heartbeatReplica", kind: controlFailureKind(cause), cause })));
 
 // packages/agent-runtime/src/agent-step-executor.ts
 var transfer = { timeout: "30 minutes" };
@@ -4237,22 +4068,22 @@ var stallLimit = ["-c", "http.lowSpeedLimit=1000", "-c", "http.lowSpeedTime=60"]
 var checkpointTransfer = { timeout: "5 minutes" };
 var clonePermits = new Map;
 var inClone = (directory) => (effect) => {
-  const permit = clonePermits.get(directory) ?? makeUnsafe5(1);
+  const permit = clonePermits.get(directory) ?? makeUnsafe4(1);
   clonePermits.set(directory, permit);
   return permit.withPermits(1)(effect);
 };
+var repositoryClone = (rootDir, repoBindingId) => `${rootDir}/repos/${repoBindingId}`;
 var runCheckouts = (rootDir) => {
   const runsDir = `${rootDir}/runs`;
   const reposDir = `${rootDir}/repos`;
   const cloned = (repoBinding) => gen(function* () {
     const fs = yield* FileSystem;
-    const path = yield* Path;
     const forbidden = findForbiddenRepoBindingSecretPath(repoBinding);
     if (forbidden !== undefined)
       return yield* new RepoMaterializationError({
         message: `RepoBinding contains forbidden secret-like value at ${forbidden}`
       });
-    const directory = path.join(reposDir, repoBinding.id);
+    const directory = repositoryClone(rootDir, repoBinding.id);
     const url = repositoryUrl(repoBinding);
     if (yield* fs.exists(directory)) {
       const origin = yield* runCommand2("git", ["-C", directory, "remote", "get-url", "origin"]);
@@ -4265,7 +4096,7 @@ var runCheckouts = (rootDir) => {
     return directory;
   });
   const fetch = (directory) => runCommand2("git", ["-C", directory, ...stallLimit, "fetch", "--prune", "origin"], transfer);
-  const inCloneOf = (repoBinding) => inClone(`${reposDir}/${repoBinding.id}`);
+  const inCloneOf = (repoBinding) => inClone(repositoryClone(rootDir, repoBinding.id));
   const clone = (repoBinding) => inCloneOf(repoBinding)(cloned(repoBinding));
   const holds = (directory, revision) => revision === undefined || !/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/.test(revision) ? succeed5(false) : map3(exit(runCommand2("git", ["-C", directory, "cat-file", "-e", `${revision}^{commit}`])), isSuccess2);
   const checkout = (work, repoBinding, checkpoint) => gen(function* () {
@@ -4460,17 +4291,338 @@ var agentStepExecutor = (input) => (work) => gen(function* () {
   return boundary === undefined ? { status: "completed", revision } : { status: "completed", revision, boundary };
 }).pipe(scoped);
 var checkpointRef = (work) => `refs/kitman/checkpoints/${work.runId}/${work.id}`;
+
+// packages/agent-runtime/src/herdr-executor.ts
+var runnerStateSandboxPolicy = (runner, readAllowed) => ({
+  ...runnerAgentSandboxPolicy(),
+  readDeniedPaths: [
+    ...new Set([
+      ...runnerAgentSandboxPolicy().readDeniedPaths,
+      runner.workRoot,
+      runner.bundleCache,
+      runner.kitmanConfigDir,
+      runner.authStore
+    ])
+  ],
+  readAllowedPaths: [...readAllowed]
+});
+var agentStepSandboxPolicy = (work, apiUrl, runner) => ({
+  ...runnerStateSandboxPolicy(runner, work.checkout === "none" || work.repoBinding === undefined ? [] : [repositoryClone(runner.workRoot, work.repoBinding.id)]),
+  network: agentNetworkAllowlist({
+    apiUrl,
+    providerHosts: harnessAdapter(work.brief.harness)?.providerHosts ?? [],
+    ...work.repoBinding === undefined ? undefined : { repoBindingHost: work.repoBinding.host },
+    ...work.network === undefined ? undefined : { agent: work.network }
+  })
+});
+function runnerStepAttemptFromAgentStep(work) {
+  return {
+    kind: "step_attempt",
+    attempt: {
+      id: work.id,
+      workspaceId: "",
+      ...work.projectId === undefined ? undefined : { projectId: work.projectId },
+      runId: work.runId,
+      taskId: work.runId,
+      stepKey: work.stepKey,
+      sequence: 0,
+      required: true,
+      attempt: work.attempt,
+      status: "running",
+      inputManifest: { manifestVersion: 1, assembledAt: work.lease.lastHeartbeatAt, entries: [] },
+      execution: { metadata: {} },
+      reviewEvidence: [],
+      lease: {
+        ownerId: work.lease.leaseOwnerId,
+        runnerReplicaId: work.lease.runnerReplicaId,
+        leaseId: work.lease.leaseId,
+        fencingToken: work.lease.fencingToken,
+        capacitySlot: work.lease.capacitySlot,
+        expiresAt: work.lease.leaseExpiresAt,
+        lastHeartbeatAt: work.lease.lastHeartbeatAt
+      },
+      createdAt: work.lease.lastHeartbeatAt,
+      updatedAt: work.lease.lastHeartbeatAt
+    },
+    step: {
+      title: work.stepKey,
+      implementation: { kind: "agent", taskIdRef: work.runId, agentId: work.id, runtimeKind: "herdr" },
+      inputSchemaRef: { kind: "typebox_ref", name: "WorkUnitInput" },
+      outputSchemaRef: { kind: "typebox_ref", name: "WorkUnitOutput" },
+      allowedCapabilities: [],
+      retryPolicy: { maxAttempts: 1, backoff: "none" },
+      timeoutPolicy: { timeoutSeconds: 1800 },
+      metadata: {}
+    }
+  };
+}
+// packages/agent-runtime/src/materialization-plan.ts
+class AgentEnvironmentPlanApplyError extends TaggedError("AgentEnvironmentPlanApplyError") {
+  get message() {
+    return `AgentEnvironment plan apply failed during ${this.phase}: ${this.cause.message}`;
+  }
+}
+var previewAgentEnvironmentPlan = fnUntraced(function* (input) {
+  const skills = yield* previewAgentEnvironmentMaterialization({
+    environment: input.environment,
+    ...input.rootDir === undefined ? undefined : { rootDir: input.rootDir },
+    ...input.scope === undefined ? undefined : { scope: input.scope },
+    ...input.cacheRoot === undefined ? undefined : { cacheRoot: input.cacheRoot },
+    ...input.noInstall === undefined ? undefined : { noInstall: input.noInstall }
+  });
+  const harnessConfig = yield* previewAgentEnvironmentConfigSync({
+    environment: input.environment,
+    materializedSkills: skills.materializedSkills,
+    ...input.syncKit === undefined ? undefined : { syncKit: input.syncKit },
+    ...input.rootDir === undefined ? undefined : { rootDir: input.rootDir },
+    ...input.scope === undefined ? undefined : { scope: input.scope },
+    ...input.mcpCredentialName === undefined ? undefined : { mcpCredentialName: input.mcpCredentialName }
+  });
+  return {
+    harness: input.environment.harness,
+    ...input.syncKit === undefined ? undefined : { syncKitHash: input.syncKit.syncKitHash },
+    skills,
+    harnessConfig,
+    operationCount: skills.operations.length + harnessConfig.operations.length,
+    warnings: [...skills.warnings, ...harnessConfig.warnings].map((item) => item.message)
+  };
+});
+function composeAgentEnvironmentSyncPlan(targets) {
+  return { version: 1, planId: canonicalSha256(targets), targets };
+}
+var applyAgentEnvironmentPlans = fnUntraced(function* (plan) {
+  for (const target of plan.targets)
+    yield* applyAgentEnvironmentMaterialization(target.skills).pipe(mapError((cause) => new AgentEnvironmentPlanApplyError({ phase: "skills", cause })));
+  for (const target of plan.targets)
+    yield* applyAgentEnvironmentConfigSync(target.harnessConfig).pipe(mapError((cause) => new AgentEnvironmentPlanApplyError({ phase: "harness_config", cause })));
+  return plan;
+});
+// packages/agent-runtime/src/herdr-executor-surface.ts
+class HerdrExecutorSurfaceError extends TaggedError("HerdrExecutorSurfaceError") {
+}
+function herdrExecutorSurface(input) {
+  const supervisor = input.supervisor ?? new HerdrServerSupervisor({
+    runnerId: input.runnerId,
+    ...input.session === undefined ? undefined : { session: input.session }
+  });
+  const createdWorkspaces = new Set;
+  const createdTabs = new Map;
+  const record = (method, response) => sync(() => {
+    const workspaceId = nestedString(response, ["workspace", "workspace_id"]);
+    const tabId = nestedString(response, ["tab", "tab_id"]);
+    const tabWorkspaceId = nestedString(response, ["tab", "workspace_id"]);
+    if (method === "workspace.create" && workspaceId !== undefined)
+      createdWorkspaces.add(workspaceId);
+    if (method === "tab.create" && tabId !== undefined && tabWorkspaceId !== undefined)
+      createdTabs.set(tabId, tabWorkspaceId);
+  });
+  const prune = suspend(() => {
+    const client = supervisor.executionClient;
+    const workspaces = [...createdWorkspaces];
+    const tabs = [...createdTabs].flatMap(([tabId, workspaceId]) => createdWorkspaces.has(workspaceId) ? [] : [tabId]);
+    createdWorkspaces.clear();
+    createdTabs.clear();
+    return all([
+      ...workspaces.map((workspaceId) => ignore(client.request("workspace.close", { workspace_id: workspaceId }))),
+      ...tabs.map((tabId) => ignore(client.request("tab.close", { tab_id: tabId })))
+    ], { discard: true });
+  });
+  return {
+    executionClient: {
+      request: (method, params) => supervisor.executionClient.request(method, params).pipe(tap((response) => record(method, response)))
+    },
+    start: () => supervisor.start().pipe(mapError((error) => new HerdrExecutorSurfaceError({ reason: "start_failed", message: error.message })), flatMap((readiness) => readiness.protocol === HERDR_SOCKET_PROTOCOL ? void_2 : fail4(new HerdrExecutorSurfaceError({ reason: "start_failed", message: "herdr_protocol_mismatch" })))),
+    stop: () => andThen(prune, supervisor.stop())
+  };
+}
+// packages/agent-runtime/src/kitman-mcp-preflight.ts
+class KitmanMcpUnreachable extends TaggedError("KitmanMcpUnreachable") {
+}
+var handshake = [
+  {
+    jsonrpc: "2.0",
+    id: 1,
+    method: "initialize",
+    params: { protocolVersion: "2025-06-18", capabilities: {}, clientInfo: { name: "kitman-runner", version: "1" } }
+  },
+  { jsonrpc: "2.0", method: "notifications/initialized" },
+  { jsonrpc: "2.0", id: 2, method: "tools/call", params: { name: "step_brief", arguments: {} } }
+].map((message) => `${JSON.stringify(message)}
+`).join("");
+var kitmanMcpPreflight = (mcp) => gen(function* () {
+  const spawner = yield* ChildProcessSpawner;
+  const server = yield* spawner.spawn(make12(mcp.command, [...mcp.args], {
+    extendEnv: true,
+    env: mcp.env,
+    stdin: { stream: make10(new TextEncoder().encode(handshake)), endOnDone: false },
+    stderr: "ignore"
+  }));
+  const reply = yield* server.stdout.pipe(decodeText, splitLines, map4((line) => recordValue(getOrUndefined(decodeJsonStringOption(line)))), filter((message) => message?.id === 2), runHead);
+  const result = isSome(reply) ? recordValue(reply.value?.result) : undefined;
+  if (result === undefined || result.isError === true)
+    return yield* new KitmanMcpUnreachable({ message: "Kitman MCP did not return the StepAttempt brief" });
+}).pipe(scoped, timeoutOrElse({
+  duration: "20 seconds",
+  orElse: () => fail4(new KitmanMcpUnreachable({ message: "Kitman MCP did not answer in time" }))
+}), mapError((error) => error instanceof KitmanMcpUnreachable ? error : new KitmanMcpUnreachable({ message: error.message })));
+// packages/agent-runtime/src/loop-bundles.ts
+import { fileURLToPath as fileURLToPath3 } from "url";
+
+class BundleRefused extends TaggedError("BundleRefused") {
+  get message() {
+    return `Loop bundle ${this.digest} refused: ${this.reason}`;
+  }
+}
+var sha2562 = (bytes) => digestSha256(bytes, "hex");
+var bundleCacheDir = fileURLToPath3(new URL("../.bundles/", import.meta.url));
+var kitmanBundles = (input) => gen(function* () {
+  const fs = yield* FileSystem;
+  const path = yield* Path;
+  const cacheDir = input.cacheDir ?? bundleCacheDir;
+  const fileOf = (digest) => path.join(cacheDir, `${digest}.js`);
+  const refused = (digest, reason) => new BundleRefused({ digest, reason });
+  const verified = (digest, bytes) => sha2562(bytes) === digest ? void_2 : fail4(refused(digest, "its content does not match its digest"));
+  const write = (digest, bytes) => gen(function* () {
+    const written = `${fileOf(digest)}.${yield* nextInt}.partial`;
+    yield* fs.makeDirectory(cacheDir, { recursive: true });
+    yield* fs.writeFile(written, bytes);
+    yield* fs.rename(written, fileOf(digest));
+  }).pipe(mapError((error) => refused(digest, `not cached: ${error.message}`)));
+  const file = (digest) => gen(function* () {
+    const cached = yield* fs.readFile(fileOf(digest)).pipe(option);
+    if (isSome(cached) && sha2562(cached.value) === digest)
+      return fileOf(digest);
+    const fetched = yield* input.fetch(digest).pipe(mapError((error) => refused(digest, `not fetched: ${error.message}`)));
+    const bytes = new TextEncoder().encode(fetched);
+    yield* verified(digest, bytes);
+    yield* write(digest, bytes);
+    return fileOf(digest);
+  });
+  return {
+    file
+  };
+});
+// packages/agent-runtime/src/program-process.ts
+var inheritedEnv = ["PATH", "HOME", "TMPDIR", "LANG", "LC_ALL", "TZ"];
+var containerEnv = new Set(["LANG", "LC_ALL", "TZ"]);
+var failed2 = (failureSummary) => ({ status: "failed", failureSummary });
+var programProcessExecutor = (input) => (work) => gen(function* () {
+  const { sandbox } = input;
+  if (sandbox !== undefined && sandbox.backend === undefined)
+    return failed2("A shared Runner runs programs only in `srt` or `docker`.");
+  if (sandbox?.backend === "srt" && work.network === "open")
+    return failed2("The Loop opens the network, which `srt` cannot do; it needs `docker`.");
+  const file = yield* input.bundles.file(work.loopDigest);
+  const { program, ...unit } = work;
+  const stdin = encodeUnknownJsonStringSync(unit);
+  const hosts = work.network === "open" ? undefined : [...new Set([new URL(input.apiUrl).hostname, ...work.network?.hosts ?? []])];
+  const inherited = (yield* forEach(inheritedEnv, (name) => map3(optionalEnv(name), (value) => value === undefined ? [] : [[name, value]]))).flat();
+  const programEnv = {
+    KITMAN_LOOP_ID: program.loopId,
+    KITMAN_API_URL: input.apiUrl,
+    KITMAN_PROGRAM_CREDENTIAL: program.credential,
+    ...hosts === undefined ? undefined : { [programHostsEnv]: hosts.join(",") },
+    [undeclaredHostsEnv]: sandbox === undefined ? "warn" : "fail"
+  };
+  const exitCode = sandbox === undefined ? yield* gen(function* () {
+    const spawner = yield* ChildProcessSpawner;
+    const handle = yield* spawner.spawn(make12(input.bun ?? process.execPath, [file], {
+      stdin: make10(new TextEncoder().encode(stdin)),
+      stdout: "inherit",
+      stderr: "inherit",
+      extendEnv: false,
+      env: { ...Object.fromEntries(inherited), ...programEnv },
+      forceKillAfter: "5 seconds"
+    }));
+    return yield* handle.exitCode;
+  }) : yield* gen(function* () {
+    const tmp = yield* (yield* FileSystem).makeTempDirectoryScoped({ prefix: "kitman-program-" });
+    const policy = {
+      ...runnerStateSandboxPolicy(sandbox.runner, [file]),
+      writablePaths: [tmp],
+      network: hosts === undefined ? "open" : { hosts },
+      environment: {}
+    };
+    const command = (argv, env) => ({
+      argv,
+      cwd: tmp,
+      env: { ...env, ...programEnv },
+      extendEnv: false,
+      stdin,
+      timeout: infinity
+    });
+    const ran = sandbox.backend === "srt" ? yield* runSandboxCommand({
+      backend: "srt",
+      policy,
+      command: command([
+        "env",
+        "-u",
+        "NO_PROXY",
+        "-u",
+        "no_proxy",
+        `TMPDIR=${tmp}`,
+        input.bun ?? process.execPath,
+        file
+      ], Object.fromEntries(inherited)),
+      ...sandbox.srtCommand === undefined ? undefined : { srtCommand: sandbox.srtCommand }
+    }) : yield* runSandboxCommand({
+      backend: "docker",
+      docker: { ...sandbox.docker, image: sandbox.docker.proxyImage ?? EgressProxyImage },
+      runnerId: sandbox.runnerId,
+      id: work.id,
+      readOnlyPaths: [file],
+      policy,
+      command: command(["bun", file], {
+        ...Object.fromEntries(inherited.filter(([name]) => containerEnv.has(name))),
+        TMPDIR: tmp
+      })
+    });
+    if (ran.exitCode !== 0)
+      yield* logWarning("runner_program_output", ran.output);
+    return ran.exitCode;
+  });
+  if (exitCode === 0)
+    return { status: "settled" };
+  yield* logWarning("runner_program_exited_unsettled", { workUnitId: work.id, exitCode });
+  return { status: "deferred" };
+}).pipe(scoped, catch_((error) => as(logWarning("runner_program_not_started", error.message), { status: "deferred" })));
 // packages/agent-runtime/src/verification-executor.ts
 var checkTimeout = "30 minutes";
-var runChecks = (worktree, checks, tree, known) => gen(function* () {
+var checkSandboxPolicy = (work, sandbox, checkout, cache) => ({
+  ...runnerStateSandboxPolicy(sandbox.runner, [
+    repositoryClone(sandbox.runner.workRoot, work.repoBinding.id),
+    checkout
+  ]),
+  writablePaths: [checkout, cache],
+  network: agentNetworkAllowlist({ apiUrl: sandbox.apiUrl, providerHosts: [], repoBindingHost: work.repoBinding.host }),
+  environment: srtCacheEnvironment(cache)
+});
+var checkRunner = (work, sandbox, cache) => (checkout) => (command, cwd) => {
+  if (sandbox === undefined || sandbox.backend === undefined)
+    return runShell2(command, { cwd, timeout: checkTimeout });
+  const policy = checkSandboxPolicy(work, sandbox, checkout, cache);
+  const sandboxCommand = { argv: ["sh", "-c", command], cwd, env: {}, timeout: checkTimeout };
+  return sandbox.backend === "srt" ? runSandboxCommand({
+    backend: "srt",
+    policy,
+    command: sandboxCommand,
+    ...sandbox.srtCommand === undefined ? undefined : { srtCommand: sandbox.srtCommand }
+  }) : runSandboxCommand({
+    backend: "docker",
+    docker: sandbox.docker,
+    runnerId: sandbox.runnerId,
+    id: work.id,
+    readOnlyPaths: [repositoryClone(sandbox.runner.workRoot, work.repoBinding.id)],
+    policy,
+    command: sandboxCommand
+  });
+};
+var runChecks = (worktree, checks, tree, known, run) => gen(function* () {
   const path = yield* Path;
   const due = checks.filter((check) => !known.some((entry) => entry.tree === tree && entry.name === check.name && entry.command === check.command));
   return yield* forEach(due, (check) => gen(function* () {
     const startedAt = yield* currentTimeMillis;
-    const ran = yield* runShell2(check.command, {
-      cwd: path.join(worktree, check.workingDirectory ?? "."),
-      timeout: checkTimeout
-    });
+    const ran = yield* run(check.command, path.join(worktree, check.workingDirectory ?? "."));
     return {
       name: check.name,
       command: check.command,
@@ -4483,6 +4635,13 @@ var runChecks = (worktree, checks, tree, known) => gen(function* () {
 });
 var treeOf = (worktree) => map3(runCommand2("git", ["-C", worktree, "rev-parse", "HEAD^{tree}"]), (tree) => tree.trim());
 var verificationExecutor = (input) => (work) => gen(function* () {
+  if (input.sandbox !== undefined && input.sandbox.backend === undefined)
+    return {
+      status: "failed",
+      failureSummary: "A shared Runner runs verifications only in `srt` or `docker`."
+    };
+  const cache = yield* (yield* FileSystem).makeTempDirectoryScoped({ prefix: "kitman-verify-cache-" });
+  const runIn = checkRunner(work, input.sandbox, cache);
   const checkouts = runCheckouts(input.rootDir);
   const head = yield* checkouts.checkout({ runId: work.runId, id: work.id, baseRevision: work.revision }, work.repoBinding);
   const baseline = yield* checkouts.checkout({ runId: work.runId, id: `${work.id}-baseline` }, work.repoBinding);
@@ -4490,7 +4649,7 @@ var verificationExecutor = (input) => (work) => gen(function* () {
   const baselineTree = yield* treeOf(baseline);
   const trees = headTree === baselineTree ? [headTree] : [headTree, baselineTree];
   const known = yield* input.known(work, trees);
-  const headChecks = yield* runChecks(head, work.checks, headTree, known);
+  const headChecks = yield* runChecks(head, work.checks, headTree, known, runIn(head));
   return {
     status: "completed",
     evidence: {
@@ -4499,12 +4658,12 @@ var verificationExecutor = (input) => (work) => gen(function* () {
         baseline: {
           revision: (yield* runCommand2("git", ["-C", baseline, "rev-parse", "HEAD"])).trim(),
           tree: baselineTree,
-          checks: yield* runChecks(baseline, work.checks, baselineTree, known)
+          checks: yield* runChecks(baseline, work.checks, baselineTree, known, runIn(baseline))
         }
       }
     }
   };
-});
+}).pipe(scoped);
 var rpcKnownEvidence = (rpc) => (work, trees) => rpc.knownEvidence({ lease: programLease(work), trees: [...trees] });
 
 // packages/agent-runtime/src/index.ts
@@ -4552,6 +4711,7 @@ export {
   composeAgentEnvironmentSyncPlan,
   controlFailureKind,
   defaultAgentRuntimeUserConfigPath,
+  detectHarnesses2 as detectHarnesses,
   dockerContainerRunner,
   dockerMissing,
   executeHerdrStepAttempt,
@@ -4561,8 +4721,8 @@ export {
   herdrExecutorSurface,
   herdrHarnessLayer,
   herdrNativeExtensionIds2 as herdrNativeExtensionIds,
-  herdrPiRunnerCapabilities2 as herdrPiRunnerCapabilities,
-  herdrPiRunnerCapabilitiesForRepoBinding2 as herdrPiRunnerCapabilitiesForRepoBinding,
+  herdrRunnerCapabilities2 as herdrRunnerCapabilities,
+  herdrRunnerCapabilitiesForRepoBinding2 as herdrRunnerCapabilitiesForRepoBinding,
   herdrSandboxBackends,
   isPathWithin,
   isRecord2 as isRecord,
@@ -4589,6 +4749,7 @@ export {
   recordValue,
   refuseAgentRequest,
   removeRunnerContainers,
+  repositoryClone,
   repositoryUrl,
   requestRecord,
   resolveAgentEnvironment,
@@ -4598,21 +4759,27 @@ export {
   rpcStepCheckpoints,
   runCheckouts,
   runCommand2 as runCommand,
+  runProcess2 as runProcess,
   runReplica,
+  runSandboxCommand,
   runShell2 as runShell,
+  runnerStateSandboxPolicy,
   runnerStepAttemptFromAgentStep,
   setDefaultAgentRuntimeProfile,
   sha2562 as sha256,
   shellOutputTailChars2 as shellOutputTailChars,
   shortId,
   skillIdentity,
+  srtArgv,
   srtCacheEnvironment,
   srtMissing,
   srtSettings,
+  startDockerSandbox,
   stepSandboxPolicy,
   stopOwnedHarness,
   stringValue,
   superviseReplica,
   verificationExecutor,
-  writeAgentEnvironmentConfigFile
+  writeAgentEnvironmentConfigFile,
+  writeSrtSettings
 };