@kylecheng3146/agent-ops 0.9.0 → 0.10.2

package/dist/runtime/src/run/controls.js

@@ -1,10 +1,108 @@
 import { sha256 } from "../fs/hash.js";
 import { AgentOpsError } from "../fs/paths.js";
-import { canonicalJson } from "../config/hash.js";
+import { canonicalJson, calculateConfigHash } from "../config/hash.js";
+import { readRunPolicy } from "./policy.js";
 import { join } from "node:path";
 import { readPrivateFile, writePrivateFile } from "../security/permissions.js";
 import { redactSecrets } from "../security/redact.js";
 const MAX_REASON_LENGTH = 4_096;
+const RETRY_APPROVAL = "retry-approval:";
+const AUTH_ID = /^auth-[a-f0-9]{64}$/u;
+const DENIAL_DIAGNOSTIC = "Native authorization could not be accepted; no alternate permission path is allowed.";
+/** A manual resume covers initial recovery once, never a subsequent supervisor restart. */
+export function nativeResumeTime(state, now = Date.now()) {
+    const control = state.controls.at(-1);
+    if (control?.action !== "resume" || control.actor !== "user" || control.appliedAt !== null)
+        return undefined;
+    const time = Date.parse(control.requestedAt);
+    if (!Number.isFinite(time) || !Number.isFinite(now) || time > now ||
+        state.events.some(e => e.code === "RUN_SUPERVISOR_START" && (!Number.isFinite(Date.parse(e.at)) || Date.parse(e.at) >= time)))
+        return undefined;
+    return control.requestedAt;
+}
+/** An explicit retry acknowledges a failed reviewer, never a command permission. */
+export async function approvalRetryEvents(state, requested) {
+    const fail = () => { throw error("RUN_NOT_RESUMABLE", "Approval retry requires the original, intact Codex usage-limit review failure."); };
+    if (!Array.isArray(requested) || requested.some(id => typeof id !== "string" || !AUTH_ID.test(id)) || new Set(requested).size !== requested.length)
+        fail();
+    const prior = new Set();
+    for (const control of state.controls) {
+        if (control.action !== "resume" || control.actor !== "user" || !control.reason?.startsWith(RETRY_APPROVAL))
+            continue;
+        let ids;
+        try {
+            ids = JSON.parse(control.reason.slice(RETRY_APPROVAL.length));
+        }
+        catch {
+            return fail();
+        }
+        if (!Array.isArray(ids) || ids.some(id => typeof id !== "string" || !AUTH_ID.test(id)))
+            fail();
+        for (const id of ids)
+            prior.add(id);
+    }
+    const ignored = new Set();
+    for (const id of new Set([...prior, ...requested])) {
+        const index = state.events.findIndex(e => e.id === id);
+        const event = state.events[index];
+        if (event?.type !== "control" || event.code !== "RUN_COMMAND_DENIED")
+            fail();
+        const path = join(state.commonDir, "agent-ops/runs", state.runId, "authorizations", id + ".json");
+        let ref;
+        let authorization;
+        try {
+            ref = JSON.parse(event.detail);
+            const source = await readPrivateFile(path, state.commonDir);
+            if (ref.artifact !== path || ref.result !== "denied" || ref.source !== "codex-auto-review" || source === null ||
+                Buffer.byteLength(source) > 128 * 1024 || sha256(source) !== ref.digest)
+                fail();
+            authorization = JSON.parse(source);
+        }
+        catch {
+            return fail();
+        }
+        const a = authorization;
+        if (a === null || typeof a !== "object")
+            fail();
+        const worker = state.workers.find(w => w.workerId === event.workerId);
+        if (a.runId !== state.runId || a.workerId !== event.workerId || worker === undefined || event.taskId !== worker.taskId ||
+            !Number.isSafeInteger(a.generation) || a.generation < 1 || a.generation > worker.generation ||
+            (!prior.has(id) && (a.generation !== worker.generation || a.nativeSessionId !== worker.nativeSessionId)) ||
+            a.source !== "codex-auto-review" || a.result !== "denied" || a.operation !== "command" ||
+            typeof a.reason !== "string" || !/^Automatic approval review failed: You[’']ve hit your usage limit(?:[.!]|$)/u.test(a.reason) ||
+            typeof a.command !== "string" || typeof a.resource !== "string" ||
+            !/^[a-f0-9]{64}$/u.test(a.commandDigest) || !/^[a-f0-9]{64}$/u.test(a.resourceDigest) ||
+            typeof a.authorizationId !== "string" || a.authorizationId.length === 0 || a.authorizationId.length > 256 ||
+            !(a.nativeSessionId === null || typeof a.nativeSessionId === "string") ||
+            id !== "auth-" + sha256(canonicalJson({ runId: state.runId, workerId: a.workerId, generation: a.generation,
+                nativeSessionId: a.nativeSessionId, source: a.source, id: a.authorizationId })))
+            fail();
+        // Command/resource strings were redacted when saved; their original digests cannot be recomputed.
+        let binding = state.policyBinding;
+        let matched = false;
+        for (let depth = 0; binding !== undefined && depth < 128; depth++) {
+            const policy = await readRunPolicy({ ...state, policyBinding: binding }, binding.runtimeHash, Date.now(), true);
+            if (binding.artifactDigest === a.policyArtifactDigest) {
+                matched = binding.configHash === a.policyConfigHash && binding.runtimeHash === a.runtimeHash && binding.expiresAt === a.expiresAt;
+                break;
+            }
+            if (policy?.previousDigest == null)
+                break;
+            const source = await readPrivateFile(join(state.commonDir, "agent-ops/runs", state.runId, "policies", policy.previousDigest + ".json"), state.commonDir);
+            if (source === null || sha256(source) !== policy.previousDigest)
+                fail();
+            const previous = JSON.parse(source);
+            binding = { artifactDigest: policy.previousDigest, configHash: calculateConfigHash(previous.config), runtimeHash: previous.runtimeHash, expiresAt: previous.expiresAt };
+        }
+        if (!matched)
+            fail();
+        ignored.add(id);
+        const next = state.events.slice(index + 1).find(e => e.workerId === event.workerId && e.code === "RUN_COMMAND_DENIED");
+        if (next?.type === "diagnostic" && next.taskId === null && next.detail === DENIAL_DIAGNOSTIC)
+            ignored.add(next.id);
+    }
+    return ignored;
+}
 function error(code, message) {
     return new AgentOpsError(code, message);
 }

package/dist/runtime/src/run/hosts/codex.js

@@ -41,6 +41,7 @@ export class CodexGoalHost {
     kind = "codex";
     sessions = new WeakMap();
     turns = new WeakMap();
+    activations = new WeakMap();
     now;
     constructor(options = {}) {
         this.options = options;
@@ -67,12 +68,14 @@ export class CodexGoalHost {
             throw new AgentOpsError("NATIVE_GOAL_INVALID", "Codex goal objective must be 1–4000 characters.");
         }
         const session = this.session(handle);
+        this.activations.get(handle).started = true;
         const goal = await session.request("thread/goal/set", {
             threadId: handle.threadId,
             objective,
             status: "active",
             tokenBudget
         });
+        this.assertActive(goal);
         const turn = await session.request("turn/start", {
             threadId: handle.threadId,
             input: [{ type: "text", text: objective }],
@@ -89,12 +92,14 @@ export class CodexGoalHost {
         assertContext(handle, update);
         assertProcessRunning(handle.process);
         const session = this.session(handle);
+        this.activations.get(handle).started = true;
         const goal = await session.request("thread/goal/set", {
             threadId: handle.threadId,
             objective: update.objective,
             status: "active",
             tokenBudget: update.tokenBudget ?? null
         });
+        this.assertActive(goal);
         const turnId = this.turns.get(handle);
         let turn;
         if (turnId === undefined) {
@@ -176,7 +181,23 @@ export class CodexGoalHost {
     async open(input, resume, threadId) {
         const parts = commandParts(this.options, "codex", ["app-server", "--listen", "stdio://"]);
         const process = spawnNative(parts.command, parts.args, input.cwd, input.env, this.options);
-        const channel = new JsonRpcSession(process, input.timeoutMs ?? this.options.requestTimeoutMs ?? 30_000);
+        const activation = { started: false };
+        let ownedThreadId = threadId;
+        const resumeTime = Date.parse(input.manualResumeAt ?? "");
+        const channel = new JsonRpcSession(process, input.timeoutMs ?? this.options.requestTimeoutMs ?? 30_000, message => {
+            if (message.method !== "thread/goal/updated" && message.method !== "thread/goal/cleared")
+                return true;
+            const payload = nestedRecord(message, "params");
+            const scopedThread = stringField(payload, "threadId");
+            if (ownedThreadId !== null && scopedThread !== null && scopedThread !== ownedThreadId)
+                return false;
+            const goal = nestedRecord(payload, "goal");
+            const updatedAt = goal?.updatedAt;
+            // Classify at receipt: queued snapshots may be observed after activation starts.
+            return !(resume && !activation.started && scopedThread === ownedThreadId && scopedThread !== null &&
+                ["budgetLimited", "usageLimited"].includes(statusField(goal)) && Number.isFinite(resumeTime) && this.now().getTime() >= resumeTime &&
+                typeof updatedAt === "number" && Number.isSafeInteger(updatedAt) && updatedAt >= 0 && updatedAt < Math.floor(resumeTime / 1000));
+        });
         try {
             if (process.pid !== undefined)
                 await input.registerProcess?.(process.pid);
@@ -203,6 +224,7 @@ export class CodexGoalHost {
                 });
                 nativeThreadId = resultThreadId(result);
             }
+            ownedThreadId = nativeThreadId;
             const handle = {
                 runId: input.runId,
                 workerId: input.workerId,
@@ -219,6 +241,7 @@ export class CodexGoalHost {
                 goalStatus: "unknown"
             };
             this.sessions.set(handle, channel);
+            this.activations.set(handle, activation);
             return handle;
         }
         catch (cause) {
@@ -248,6 +271,10 @@ export class CodexGoalHost {
         }
         return session;
     }
+    assertActive(result) {
+        if (statusField(nestedRecord(result, "goal") ?? result) !== "active")
+            throw new AgentOpsError("NATIVE_GOAL_NOT_ACTIVE", "Codex did not activate the goal; no turn was started or steered.");
+    }
     mapEvent(handle, message) {
         const method = typeof message.method === "string" ? message.method : "message";
         const payload = isRecord(message.params) ? message.params : message;

package/dist/runtime/src/run/hosts/protocol.js

@@ -20,15 +20,17 @@ function parseLine(line, source) {
 export class JsonRpcSession {
     child;
     requestTimeoutMs;
+    acceptNotification;
     lines;
     pending = new Map();
     events = [];
     waiters = [];
     nextId = 1;
     closed = null;
-    constructor(child, requestTimeoutMs = 30_000) {
+    constructor(child, requestTimeoutMs = 30_000, acceptNotification = () => true) {
         this.child = child;
         this.requestTimeoutMs = requestTimeoutMs;
+        this.acceptNotification = acceptNotification;
         this.lines = createInterface({ input: child.stdout });
         this.lines.on("line", (line) => this.receive(line, "stdout"));
         child.once("error", (error) => this.close(error));
@@ -135,7 +137,8 @@ export class JsonRpcSession {
             }
             return;
         }
-        this.enqueue(message);
+        if (id !== undefined || this.acceptNotification(message))
+            this.enqueue(message);
     }
     write(message) {
         this.child.stdin.write(`${JSON.stringify(message)}\n`);

package/dist/runtime/src/run/integration.js

@@ -4,6 +4,7 @@ import { canonicalJson } from "../config/hash.js";
 import { sha256 } from "../fs/hash.js";
 import { AgentOpsError } from "../fs/paths.js";
 import { readPrivateFile, writePrivateFile } from "../security/permissions.js";
+import { parseWorktreeListPorcelain, readWorktreeRecord } from "../parallel/service.js";
 import { FileRunRepository } from "./service.js";
 function ledger(commonDir) { return new FileRunRepository(join(commonDir, "agent-ops", "runs"), commonDir); }
 function proofPath(commonDir, runId) { return join(commonDir, "agent-ops", "runs", runId, "integration-proof.json"); }
@@ -84,6 +85,11 @@ export async function readRunIntegrationProof(commonDir, record) {
         return null;
     if (state.ownerSessionId !== record.sessionId || state.coordinatorId !== record.workerId)
         throw new AgentOpsError("RUN_INTEGRATION_OWNERSHIP", "Recovery coordinator does not match the sealed transaction.");
+    const coordinator = state.workers.find(w => w.workerId === state.coordinatorId);
+    if (record.mainRoot !== state.root || record.ownerSessionId !== state.ownerSessionId ||
+        (state.workers.length > 0 && (coordinator === undefined || coordinator.worktree !== record.path ||
+            coordinator.generation !== record.workerGeneration || coordinator.ownerSessionId !== record.ownerSessionId)))
+        throw new AgentOpsError("RUN_INTEGRATION_OWNERSHIP", "Recovery requires the current coordinator worktree owner and generation.");
     return await readSealedProof(commonDir, record.runId, state.integration);
 }
 /** A failed pre-merge CAS may be retried only after archiving the unused sealed transaction. */
@@ -133,17 +139,15 @@ export async function markRunIntegration(commonDir, record, status, step, receip
     await ledger(commonDir).mutate(record.runId, current => {
         if (current.integration === null || current.ownerSessionId !== record.sessionId || current.coordinatorId !== record.workerId)
             throw new AgentOpsError("RUN_INTEGRATION_OWNERSHIP", "The integration transaction is missing or belongs to another coordinator.");
+        if (current.status !== "active" || current.disableRestart || current.awaitingResume)
+            throw new AgentOpsError("RUN_RESUME_DISABLED", "A paused, stopped or disabled run cannot advance integration steps.");
         return { ...current, integration: { ...current.integration, status, updatedAt: new Date().toISOString(),
                 completedSteps: [...new Set([...current.integration.completedSteps, step])],
                 ...(receipt === undefined ? {} : { receiptPath: receipt.path, receiptDigest: receipt.digest }) } };
     });
 }
-/**
- * Finish bookkeeping after a coordinator checkout vanished. This only verifies
- * sealed artifacts and advances the ledger; it never recreates a checkout or
- * starts a native writer.
- */
-export async function recoverRunIntegrationAfterCleanup(commonDir, runId, git) {
+/** Validate the sealed transaction before any remaining cleanup or final bookkeeping. */
+export async function validateRunIntegrationCleanup(commonDir, runId, git, allowMissingNote = false) {
     const repository = ledger(commonDir);
     const state = await repository.read(runId);
     if (state === null || state.integration === null)
@@ -154,7 +158,7 @@ export async function recoverRunIntegrationAfterCleanup(commonDir, runId, git) {
     await readSealedProof(commonDir, runId, integration);
     if (integration.status !== "cleaned" &&
         (integration.status !== "receipt-written" || !integration.completedSteps.includes("receipt") ||
-            !integration.completedSteps.includes("note"))) {
+            !integration.completedSteps.includes("target") || !integration.completedSteps.includes("tasks"))) {
         throw new AgentOpsError("RUN_INTEGRATION_RECOVERY_REQUIRED", "Recovery requires a recorded receipt and Git note before cleanup can be completed.");
     }
     if (integration.receiptPath === null || integration.receiptDigest === null)
@@ -177,9 +181,10 @@ export async function recoverRunIntegrationAfterCleanup(commonDir, runId, git) {
     validateRunIntegrationReceipt(integration, receipt);
     const note = await git(state.root, ["notes", "--ref=agent-ops", "show", integration.candidate]);
     const noteText = note.stdout;
-    if (note.exitCode !== 0 || !noteText.includes(`session: ${state.ownerSessionId}`) ||
-        !noteText.includes(`receipt: ${integration.receiptPath}`) ||
-        !noteText.includes(`receipt-sha256: ${integration.receiptDigest}`)) {
+    const noteBound = note.exitCode === 0 && noteText.split("\n").includes(`session: ${state.ownerSessionId}`) &&
+        noteText.split("\n").includes(`receipt: ${integration.receiptPath}`) &&
+        noteText.split("\n").includes(`receipt-sha256: ${integration.receiptDigest}`);
+    if (!noteBound && !(allowMissingNote && !integration.completedSteps.includes("note") && note.exitCode === 1)) {
         throw new AgentOpsError("RUN_INTEGRATION_RECOVERY_REQUIRED", "The sealed receipt is not bound by the Git note for the candidate.");
     }
     const target = await git(state.root, ["rev-parse", state.targetBranch + "^{commit}"]);
@@ -189,10 +194,27 @@ export async function recoverRunIntegrationAfterCleanup(commonDir, runId, git) {
         (await git(state.root, ["merge-base", "--is-ancestor", integration.candidate, target.stdout.trim()])).exitCode === 0;
     if (!exact && !historic)
         throw new AgentOpsError("RUN_INTEGRATION_TARGET_CHANGED", "The target is inconsistent with the sealed, receipt-bound integration history.");
-    await repository.mutate(runId, current => {
-        if (current.integration === null || current.integration.transactionId !== integration.transactionId ||
-            current.integration.candidate !== integration.candidate || current.integration.expectedTarget !== integration.expectedTarget)
+    return { state, integration, receipt: receipt, noteBound, observedTarget: target.stdout.trim() };
+}
+/** After owned checkouts vanish, advance bookkeeping without executing product proof or native writers. */
+export async function recoverRunIntegrationAfterCleanup(commonDir, runId, git) {
+    const { state, integration, observedTarget } = await validateRunIntegrationCleanup(commonDir, runId, git);
+    const listing = await git(state.root, ["worktree", "list", "--porcelain"]);
+    if (listing.exitCode !== 0)
+        throw new AgentOpsError("RUN_INTEGRATION_RECOVERY_REQUIRED", "Cannot confirm that integration checkouts were cleaned.");
+    for (const checkout of parseWorktreeListPorcelain(listing.stdout)) {
+        const record = await readWorktreeRecord(checkout.path);
+        if (record?.runId === runId || state.workers.some(worker => worker.worktree === checkout.path))
+            throw new AgentOpsError("RUN_INTEGRATION_CLEANUP_PENDING", "An owned integration checkout still exists; finish its missing cleanup steps before marking the run cleaned.");
+    }
+    const repository = ledger(commonDir);
+    await repository.mutate(runId, async (current) => {
+        const target = await git(state.root, ["rev-parse", state.targetBranch + "^{commit}"]);
+        if (current.revision !== state.revision || canonicalJson(current.integration) !== canonicalJson(integration) ||
+            target.exitCode !== 0 || target.stdout.trim() !== observedTarget)
             throw new AgentOpsError("RUN_INTEGRATION_STALE", "The integration changed during recovery.");
+        if (current.integration === null)
+            throw new AgentOpsError("RUN_INTEGRATION_REQUIRED", "The integration disappeared during recovery.");
         if (current.integration.status === "cleaned")
             return current;
         if (current.integration.status !== "receipt-written")

package/dist/runtime/src/run/policy.js

@@ -9,7 +9,9 @@ import { evaluateGuardrail } from "../guardrails/evaluate.js";
 import { validateConfig } from "../schema/validate.js";
 import { readPrivateFile, writePrivateFile } from "../security/permissions.js";
 import { redactSecrets } from "../security/redact.js";
-import { activeWallTimeMs } from "./scheduler.js";
+import { remainingRunTimeMs } from "./scheduler.js";
+import { MAX_EVENTS } from "./service.js";
+export const RUN_POLICY_TTL_MS = 60 * 60 * 1000;
 function fail(code, message) { throw new AgentOpsError(code, message); }
 const plain = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 function validApprovals(value) {
@@ -62,13 +64,14 @@ export async function runPolicyAssessment(state, policy, capabilityId) {
         const assessment = current.approvals.find(a => a.capabilityId === capabilityId);
         if (assessment !== undefined && canonicalJson(capabilities(current.config).get(capabilityId) ?? null) === canonicalJson(definition))
             return assessment;
-        if (current.previousDigest === null)
+        const digest = current.assessmentDigest ?? current.previousDigest;
+        if (digest === null)
             break;
-        const source = await readPrivateFile(join(state.commonDir, "agent-ops/runs", state.runId, "policies", current.previousDigest + ".json"), state.commonDir);
-        if (source === null || sha256(source) !== current.previousDigest)
+        const source = await readPrivateFile(join(state.commonDir, "agent-ops/runs", state.runId, "policies", digest + ".json"), state.commonDir);
+        if (source === null || sha256(source) !== digest)
             fail("RUN_POLICY_CHANGED", "Historical capability assessment is missing or changed.");
         const previous = JSON.parse(source);
-        current = (await readRunPolicy({ ...state, policyBinding: { artifactDigest: current.previousDigest, configHash: calculateConfigHash(previous.config),
+        current = (await readRunPolicy({ ...state, policyBinding: { artifactDigest: digest, configHash: calculateConfigHash(previous.config),
                 runtimeHash: previous.runtimeHash, expiresAt: previous.expiresAt } }, previous.runtimeHash, Date.now(), true));
     }
     return fail("RUN_POLICY_APPROVAL_REQUIRED", "The current capability lacks a matching historical run assessment.");
@@ -107,6 +110,8 @@ export function validateRunPolicyChange(previous, candidate, approvals) {
     return config;
 }
 export async function readRunPolicy(state, runtimeHash, now = Date.now(), allowExpired = false) {
+    if (!Number.isSafeInteger(now) || now < 0 || now > 8.64e15 - RUN_POLICY_TTL_MS)
+        fail("RUN_CLOCK_INVALID", "Policy clock must be a valid nonnegative timestamp with room for a finite grant.");
     const binding = state.policyBinding;
     if (binding === undefined)
         return null;
@@ -121,11 +126,19 @@ export async function readRunPolicy(state, runtimeHash, now = Date.now(), allowE
     catch {
         return fail("RUN_POLICY_INVALID", "Run policy JSON is invalid.");
     }
-    if (!plain(parsed) || Object.keys(parsed).some(key => !["schemaVersion", "runId", "config", "baseConfig", "baseTrustBinding", "runtimeHash", "expiresAt", "approvals", "previousDigest"].includes(key)) ||
+    if (!plain(parsed) || Object.keys(parsed).some(key => !["schemaVersion", "runId", "config", "baseConfig", "baseTrustBinding", "runtimeHash", "expiresAt", "issuedAt", "approvals", "previousDigest", "assessmentDigest"].includes(key)) ||
         !validBaseBinding(parsed.baseTrustBinding, state.root) || !validApprovals(parsed.approvals) ||
-        !(parsed.previousDigest === null || (typeof parsed.previousDigest === "string" && /^[a-f0-9]{64}$/u.test(parsed.previousDigest))))
+        !(parsed.previousDigest === null || (typeof parsed.previousDigest === "string" && /^[a-f0-9]{64}$/u.test(parsed.previousDigest))) ||
+        (parsed.assessmentDigest !== undefined && (typeof parsed.assessmentDigest !== "string" || !/^[a-f0-9]{64}$/u.test(parsed.assessmentDigest))))
         fail("RUN_POLICY_INVALID", "Run policy artifact has an invalid structure or trust origin.");
     const artifact = parsed;
+    const expires = Date.parse(artifact.expiresAt), issued = Date.parse(artifact.issuedAt ?? state.createdAt);
+    if (typeof artifact.expiresAt !== "string" || (artifact.issuedAt !== undefined && typeof artifact.issuedAt !== "string") ||
+        !Number.isFinite(expires) || !Number.isFinite(issued) || expires <= issued ||
+        (artifact.issuedAt !== undefined && expires - issued > RUN_POLICY_TTL_MS))
+        fail("RUN_POLICY_INVALID", "Policy requires a valid finite authorization window.");
+    if (now < issued)
+        fail("RUN_CLOCK_INVALID", "Policy clock moved behind its issuance; manual reconciliation is required.");
     if (artifact.schemaVersion !== 1 || artifact.runId !== state.runId || !validateConfig(artifact.config).ok ||
         !validateConfig(artifact.baseConfig).ok || calculateConfigHash(artifact.config) !== binding.configHash ||
         artifact.runtimeHash !== binding.runtimeHash || artifact.expiresAt !== binding.expiresAt ||
@@ -143,7 +156,7 @@ export async function bindRunPolicy(repository, runId, input) {
     if (state === null)
         return fail("RUN_NOT_FOUND", "Run does not exist.");
     const now = input.now ?? Date.now();
-    if (!Number.isFinite(now) || !validBaseBinding(input.baseTrustBinding, state.root))
+    if (!Number.isSafeInteger(now) || now < 0 || !validBaseBinding(input.baseTrustBinding, state.root))
         fail("RUN_POLICY_INVALID", "Policy requires the original canonical repository trust binding and a valid clock.");
     const previous = await readRunPolicy(state, input.resumeRuntime === true ? state.policyBinding?.runtimeHash ?? input.runtimeHash : input.runtimeHash, now, true);
     if ((state.policyBinding?.artifactDigest ?? undefined) !== input.expectedDigest)
@@ -159,12 +172,13 @@ export async function bindRunPolicy(repository, runId, input) {
     if (!validateConfig(config).ok || !/^[a-f0-9]{64}$/u.test(input.runtimeHash) ||
         (previous === null && input.baseTrustBinding.configHash !== calculateConfigHash(config)))
         fail("RUN_POLICY_INVALID", "Run policy or runtime identity is invalid.");
-    const remaining = state.budget.limitMs - activeWallTimeMs(state.budget.activeIntervals, now);
+    const remaining = remainingRunTimeMs(state, now);
     if (remaining <= 0)
         fail("RUN_BUDGET_EXHAUSTED", "No active execution budget remains.");
     const artifact = { schemaVersion: 1, runId, config, baseConfig: previous?.baseConfig ?? config,
         baseTrustBinding: previous?.baseTrustBinding ?? input.baseTrustBinding, runtimeHash: input.runtimeHash,
-        expiresAt: new Date(now + remaining).toISOString(), approvals: (input.approvals ?? []).map(a => ({ ...a, reason: redactSecrets(a.reason) })), previousDigest: previous === null ? null : state.policyBinding.artifactDigest };
+        issuedAt: new Date(now).toISOString(), expiresAt: new Date(now + Math.min(remaining, RUN_POLICY_TTL_MS)).toISOString(),
+        approvals: (input.approvals ?? []).map(a => ({ ...a, reason: redactSecrets(a.reason) })), previousDigest: previous === null ? null : state.policyBinding.artifactDigest };
     const content = canonicalJson(artifact), digest = sha256(content);
     await writePrivateFile(join(state.commonDir, "agent-ops", "runs", runId, "policies", digest + ".json"), content, state.commonDir);
     return await repository.mutate(runId, current => {
@@ -174,3 +188,44 @@ export async function bindRunPolicy(repository, runId, input) {
                 artifactDigest: digest, expiresAt: artifact.expiresAt } };
     });
 }
+/** Renew the same finite grant without changing native identities, scope or trust. Reads never renew. */
+export async function renewRunPolicy(repository, runId, input) {
+    const state = await repository.read(runId);
+    if (state === null)
+        return fail("RUN_NOT_FOUND", "Run does not exist.");
+    if (state.status !== "active" || state.disableRestart || state.awaitingResume || state.events.some(e => e.code === "RUN_COMMAND_DENIED"))
+        return fail("RUN_POLICY_DISABLED", "Renewal cannot awaken a stopped run or erase a denial.");
+    const now = input.now ?? Date.now();
+    if (now < Date.parse(state.budget.lastObservedAt))
+        return fail("RUN_CLOCK_INVALID", "Policy clock moved behind the last observed accounting time.");
+    const authority = await input.authority();
+    const previous = await readRunPolicy(state, authority.runtimeHash, now, true);
+    if (previous === null)
+        return fail("RUN_POLICY_INVALID", "Renewal requires an existing bound authorization.");
+    const assertAuthority = (current) => {
+        if (!current.trusted || current.runtimeHash !== previous.runtimeHash ||
+            canonicalJson(current.baseTrustBinding) !== canonicalJson(previous.baseTrustBinding) ||
+            calculateConfigHash(current.config) !== calculateConfigHash(previous.baseConfig))
+            fail("RUN_POLICY_AUTHORITY_CHANGED", "Original trust, repository configuration or executable runtime changed; obtain genuine authorization before resume.");
+    };
+    assertAuthority(authority);
+    if (Date.parse(previous.expiresAt) > now)
+        return state;
+    if (remainingRunTimeMs(state, now) <= 0)
+        return fail("RUN_BUDGET_EXHAUSTED", "Legacy finite runs require manual resume before renewal.");
+    const artifact = { ...previous, issuedAt: new Date(now).toISOString(),
+        expiresAt: new Date(now + Math.min(RUN_POLICY_TTL_MS, remainingRunTimeMs(state, now))).toISOString(),
+        assessmentDigest: previous.assessmentDigest ?? state.policyBinding.artifactDigest,
+        previousDigest: state.policyBinding.artifactDigest };
+    const content = canonicalJson(artifact), digest = sha256(content);
+    await writePrivateFile(join(state.commonDir, "agent-ops", "runs", runId, "policies", digest + ".json"), content, state.commonDir);
+    assertAuthority(await input.authority());
+    return await repository.mutate(runId, current => {
+        if (current.revision !== state.revision || current.status !== "active" || current.disableRestart || current.awaitingResume ||
+            current.policyBinding?.artifactDigest !== state.policyBinding.artifactDigest || current.events.some(e => e.code === "RUN_COMMAND_DENIED"))
+            return fail("RUN_POLICY_STALE", "Run stop, denial or scope changed during renewal.");
+        return { ...current, policyBinding: { ...state.policyBinding, artifactDigest: digest, expiresAt: artifact.expiresAt },
+            events: [...current.events, { id: `renewal-${digest.slice(0, 32)}`, at: artifact.issuedAt, type: "diagnostic",
+                    code: "RUN_POLICY_RENEWED", workerId: null, taskId: null, detail: `Same-authority finite grant renewed from ${state.policyBinding.artifactDigest}.` }].slice(-MAX_EVENTS) };
+    });
+}

package/dist/runtime/src/run/scheduler.js

@@ -63,16 +63,17 @@ export function planSchedule(state) {
     const running = state.tasks.filter((task) => task.status === "running" || task.status === "awaiting-delivery");
     const blocked = state.tasks.filter((task) => task.status === "blocked");
     const ready = state.tasks.filter((task) => ["planned", "ready"].includes(task.status) && dependencyState(state.tasks, task) === "ready");
+    const slotConsumers = state.workers.filter(worker => ["assigned", "starting", "running", "idle", "handing-off"].includes(worker.status));
     return {
-        ready,
+        ready: ready.filter(task => task.taskId !== state.rootTaskId),
         running,
         blocked,
-        availableSlots: Math.max(0, Math.min(state.jobs, MAX_ACTIVE_WORKERS) - running.length)
+        availableSlots: Math.max(0, Math.min(state.jobs, MAX_ACTIVE_WORKERS) - slotConsumers.length)
     };
 }
 /**
  * Compute whole-run active wall time as the union of intervals. This prevents
- * two parallel writers from doubling the 60-minute run budget.
+ * two parallel writers from doubling measured consumption.
  */
 export function activeWallTimeMs(intervals, nowMs) {
     if (!Number.isFinite(nowMs) || nowMs < 0)
@@ -101,7 +102,11 @@ export function activeWallTimeMs(intervals, nowMs) {
     return start === null ? 0 : total + end - start;
 }
 export function budgetExpired(state, now = Date.now()) {
-    return activeWallTimeMs(state.budget.activeIntervals, now) >= state.budget.limitMs;
+    return state.budget.limitMs !== null && activeWallTimeMs(state.budget.activeIntervals, now) >= state.budget.limitMs;
+}
+/** Infinity is internal only: callers retain their finite command/review timeouts. */
+export function remainingRunTimeMs(state, now = Date.now()) {
+    return state.budget.limitMs === null ? Infinity : state.budget.limitMs - activeWallTimeMs(state.budget.activeIntervals, now);
 }
 /** Two consecutive identical failure rounds without a useful change stop one child. */
 export function noProgressForTwoRounds(rounds) {
@@ -249,7 +254,7 @@ export class RunScheduler {
             throw error("RUN_CLOCK_INVALID", "Budget clock is invalid.");
         return await this.#repository.mutate(runId, (current) => {
             const accumulatedMs = activeWallTimeMs(current.budget.activeIntervals, nowMs);
-            const expired = accumulatedMs >= current.budget.limitMs;
+            const expired = current.budget.limitMs !== null && accumulatedMs >= current.budget.limitMs;
             return {
                 ...current,
                 status: expired && ["active", "awaiting-input"].includes(current.status) ? "budget-limited" : current.status,