@mettlelabs/mettle 0.0.0-beta.1-linux-arm64 → 0.0.0-beta.2-darwin-arm64

package/harness/chunk-4vx34w5h.mjs

@@ -0,0 +1,2357 @@
+import {
+  CONTRACT_VERSION,
+  SEAM_VERSION,
+  IdSchema,
+  ChangeContextSchema,
+  RunConfigSchema,
+  ArtifactRefSchema,
+  WebIdentitySchema,
+  EndpointInputSchema,
+  EndpointLeadSchema,
+  ApiDescriptionSchema,
+  WebSurfaceSchema,
+  ApiDescriptionReferenceSchema,
+  InvestigationDepthSchema,
+  InvestigationPlanBindingSchema,
+  packageIdentity,
+  SourceReadPolicySchema,
+  SOURCE_ANALYSIS_VERSION,
+  SOURCE_PARSER_ID,
+  EventSchema,
+  TargetIdentitySchema,
+  VerifyRequestSchema,
+  WebsiteFamilySchema,
+  caseSteps,
+  InvestigationModelSchema,
+  SourceDeploymentBindingSchema,
+  PROVIDER_KEYS,
+  isLoopback,
+  providerFixture,
+  providerKey,
+  catalogIdentities,
+  offeredIdentities,
+  HarnessError,
+  canonicalJson,
+  sha256,
+  digest,
+  endpointInput,
+  requestInputs,
+  endpointShape,
+  endpointIdentity,
+  matchesEndpointTemplate,
+  apiDescription,
+  captureResponseText,
+  captureEvidence,
+  candidateRevision,
+  admitIndependentVerification,
+  packageSourceMatches,
+  sourceRoute,
+  routeTarget,
+  validateOracleVerdict
+} from "./chunk-rd80vvc5.mjs";
+import {
+  CommitSchema,
+  RepositoryConfigSchema,
+  hasRepositorySource,
+  RepositoryTestProfileSchema,
+  BashProfilesSchema,
+  ExperimentPolicySchema,
+  SemgrepProfileSchema,
+  WebCaptureSchema,
+  PermissionPolicySchema,
+  GVISOR_RUNTIME,
+  SandboxConfigSchema,
+  sandboxRuntime,
+  sandboxAllowsExecution,
+  TaskNameSchema,
+  SCANNER_CAPABILITIES,
+  privateFile,
+  SOURCE_TOTAL_BYTES,
+  SOURCE_FILES_MAX,
+  executionPlan,
+  workStrategy,
+  sourceManifest,
+  withinHttpScope,
+  PublicAddressSchema,
+  RegisteredAddressSchema,
+  LiveWebSchema,
+  validateLiveWeb,
+  OwnershipProofSchema,
+  ownsHost,
+  ownershipToken,
+  WEBSITE_PASSIVE_METHODS,
+  WebScopeSchema,
+  validateRegisteredWebTarget,
+  validateWebTarget,
+  webRequestAllowed,
+  webExplicitAddress,
+  WorkJournal,
+  ownsVerificationJob,
+  WEBSITE_DISCOVERY_TOOLS,
+  isWebsiteCoverageTool,
+  counterModelProfile,
+  liveWebScope,
+  authorizationIdentities,
+  authorizationObservations,
+  authorizationAssessment,
+  WebsiteWorkPolicySchema,
+  WebsiteWorklist,
+  PostgresJournal
+} from "./chunk-c7dx5mdd.mjs";
+import {
+  RunAuthoritySchema
+} from "./chunk-zvkxtj82.mjs";
+import {
+  FoundryClient,
+  openAIPricing,
+  OpenAIClient,
+  byteInputBound,
+  imageInputBound
+} from "./chunk-3wt8a8fq.mjs";
+import {
+  JoernProfileSchema,
+  joernCandidate,
+  SecretScanProfileSchema,
+  DependencyScanProfileSchema,
+  ActiveScannersSchema,
+  validateActiveScanners,
+  sqlmapCandidate,
+  PortScanProfileSchema,
+  packageJavaScript
+} from "./chunk-9dg1btk1.mjs";
+import {
+  exports_iso
+} from "./chunk-b71gpkxg.mjs";
+import {
+  NEVER,
+  string,
+  uuid,
+  url,
+  number,
+  boolean,
+  array,
+  object,
+  strictObject,
+  discriminatedUnion,
+  record,
+  _enum,
+  literal
+} from "./chunk-1sygmp11.mjs";
+
+// apps/harness/src/runtime/models.ts
+var INPUT_BOUND_REVISION = "development-byte-bound-v1";
+var FIRST_TOKEN_MS = 30000;
+var MS_PER_OUTPUT_TOKEN = 25;
+function deadline(maxOutputTokens) {
+  return FIRST_TOKEN_MS + maxOutputTokens * MS_PER_OUTPUT_TOKEN;
+}
+var OPENAI = Object.freeze({
+  "gpt-5.5": {
+    snapshot: "gpt-5.5-2026-04-23",
+    effort: "medium",
+    rates: {
+      revision: "openai-gpt-5.5-standard-2026-09-29",
+      longInputTokens: 272000,
+      standard: {
+        inputNanousdPerToken: 5000,
+        cachedInputNanousdPerToken: 500,
+        outputNanousdPerToken: 30000
+      },
+      long: {
+        inputNanousdPerToken: 1e4,
+        cachedInputNanousdPerToken: 1000,
+        outputNanousdPerToken: 45000
+      }
+    }
+  }
+});
+function openAIModel(identity) {
+  const model = { ...identity, ...OPENAI[identity.model] };
+  const pricing = openAIPricing(model.rates);
+  return Object.freeze({
+    model: model.model,
+    provider: "openai",
+    id: `openai:responses:${model.model}:${model.effort}:${pricing.revision}`,
+    responseModels: Object.freeze([model.model, model.snapshot]),
+    contextTokens: model.contextTokens,
+    maxOutputTokens: model.maxOutputTokens,
+    timeoutMs: deadline(model.maxOutputTokens),
+    imageTokens: model.imageTokens,
+    inputBoundRevision: `${INPUT_BOUND_REVISION}-image-${model.imageTokens}`,
+    pricing,
+    client: (apiKey, options) => new OpenAIClient({
+      apiKey,
+      model: model.model,
+      snapshot: model.snapshot,
+      effort: model.effort,
+      rates: model.rates,
+      ...options.fetch ? { fetch: options.fetch } : {}
+    })
+  });
+}
+function foundryModel(identity) {
+  const { endpoint, deployment } = identity;
+  return Object.freeze({
+    maxOutputTokens: identity.maxOutputTokens,
+    timeoutMs: deadline(identity.maxOutputTokens),
+    inputBoundRevision: INPUT_BOUND_REVISION,
+    model: identity.model,
+    provider: "foundry",
+    id: `foundry:${new URL(endpoint).hostname}:${deployment.name}:${deployment.model}`,
+    responseModels: Object.freeze([
+      ...new Set([deployment.model, deployment.name])
+    ]),
+    contextTokens: identity.contextTokens,
+    client: (apiKey, options) => new FoundryClient({
+      apiKey,
+      model: identity.model,
+      deployment: deployment.name,
+      endpoint,
+      ...options.fetch ? { fetch: options.fetch } : {}
+    })
+  });
+}
+function catalogModels(environment) {
+  return catalogIdentities(environment).map((identity) => identity.provider === "foundry" ? foundryModel(identity) : openAIModel(identity));
+}
+
+// apps/harness/src/runtime/live-profile.ts
+function defaultModel(environment) {
+  return offeredIdentities(environment)[0]?.model ?? catalogModels(environment)[0].model;
+}
+function liveRoute(environment = process.env, model = defaultModel(environment)) {
+  const route = catalogModels(environment).find((entry) => entry.model === model);
+  if (!route)
+    throw new HarnessError("unsupported_profile", "The requested live model is not supported.");
+  return route;
+}
+function liveClient(environment = process.env, options = {}) {
+  const route = liveRoute(environment, options.model);
+  const key = providerKey(environment, route.provider);
+  if (!key)
+    throw new HarnessError("model_credential_missing", `${PROVIDER_KEYS[route.provider]} is required for ${route.model}.`);
+  const fixture = options.fetch ?? providerFixture(environment);
+  return route.client(key, {
+    ...options,
+    ...fixture ? { fetch: fixture } : {}
+  });
+}
+function refuseDispatch() {
+  throw new HarnessError("model_dispatch_refused", "This command makes no model calls.");
+}
+var NO_DISPATCH = Object.freeze({
+  seamVersion: SEAM_VERSION.model,
+  complete: async () => refuseDispatch(),
+  stream: () => refuseDispatch()
+});
+function liveCounterProfile(environment = process.env, client, model = liveRoute(environment).model) {
+  const route = liveRoute(environment, model);
+  return counterModelProfile({
+    route: {
+      id: route.id,
+      provider: route.provider,
+      model: route.model,
+      responseModels: route.responseModels,
+      sampling: [],
+      vision: route.imageTokens !== undefined,
+      client: client ?? liveClient(environment, { model: route.model })
+    },
+    inputBound: route.imageTokens === undefined ? byteInputBound : imageInputBound(route.imageTokens),
+    inputBoundRevision: route.inputBoundRevision,
+    maxOutputTokens: route.maxOutputTokens,
+    contextTokens: route.contextTokens,
+    timeoutMs: route.timeoutMs,
+    pricing: route.pricing
+  });
+}
+function liveProfiles(environment = process.env, model = defaultModel(environment)) {
+  const primary = liveCounterProfile(environment, undefined, model);
+  return [
+    primary,
+    ...offeredIdentities(environment).filter((identity) => identity.model !== primary.route.model).map((identity) => liveCounterProfile(environment, undefined, identity.model))
+  ];
+}
+
+// apps/harness/src/storage/investigation-journal.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+
+// apps/harness/src/storage/adapters.ts
+import { randomUUID } from "node:crypto";
+import { setTimeout as sleep } from "node:timers/promises";
+var endpoint = strictObject({
+  url: url().max(2048).refine((value) => {
+    const url2 = new URL(value);
+    return ["http:", "https:"].includes(url2.protocol) && withinHttpScope(url2, url2);
+  }),
+  address: RegisteredAddressSchema
+});
+var credential = strictObject({
+  file: string().startsWith("/"),
+  sha256: string().regex(/^[a-f0-9]{64}$/)
+});
+var bytes = string().min(1).max(10924).refine((value) => Buffer.from(value, "base64").toString("base64") === value && Buffer.from(value, "base64").length <= 8192);
+var ProtocolProfileSchema = discriminatedUnion("transport", [
+  strictObject({
+    id: IdSchema,
+    transport: literal("raw-http"),
+    endpoint,
+    control: bytes,
+    probe: bytes
+  }),
+  strictObject({
+    id: IdSchema,
+    transport: literal("websocket"),
+    endpoint,
+    control: array(bytes).min(1).max(8),
+    probe: array(bytes).min(1).max(8),
+    receiveMessages: number().int().min(1).max(8),
+    binary: boolean()
+  })
+]).refine((value) => {
+  if (value.transport !== "websocket" || value.binary)
+    return true;
+  try {
+    for (const encoded of [...value.control, ...value.probe])
+      new TextDecoder("utf8", { fatal: true }).decode(Buffer.from(encoded, "base64"));
+    return true;
+  } catch {
+    return false;
+  }
+}, "WebSocket text recipes must contain valid UTF-8.");
+var AgentTargetProfileSchema = strictObject({
+  id: IdSchema,
+  transport: _enum(["http-json", "mcp"]),
+  endpoint,
+  credential: credential.optional(),
+  inputField: string().regex(/^[a-zA-Z][a-zA-Z0-9_]{0,63}$/).refine((name) => !["constructor", "prototype", "__proto__", "trialId"].includes(name)),
+  toolName: string().regex(/^[a-zA-Z0-9_.-]{1,128}$/).optional(),
+  observer: strictObject({
+    endpoint,
+    credential,
+    resetUrl: url(),
+    observeUrl: url(),
+    independent: literal(true)
+  })
+}).superRefine((value, context) => {
+  const origin = new URL(value.observer.endpoint.url);
+  if (origin.origin === new URL(value.endpoint.url).origin || value.transport === "mcp" !== Boolean(value.toolName) || ![value.observer.resetUrl, value.observer.observeUrl].every((url2) => withinHttpScope(origin, new URL(url2))))
+    context.addIssue({
+      code: "custom",
+      message: "The observer must have its own origin and bounded reset/observe paths; MCP requires an approved tool name."
+    });
+});
+var AdapterPolicySchema = strictObject({
+  approvedBy: string().min(1).max(256),
+  expiresAt: exports_iso.datetime(),
+  buildIdentityRef: string().min(1).max(2048),
+  timeoutMs: number().int().min(100).max(15000),
+  internalScope: boolean().default(false),
+  requestsPerSecond: number().int().min(1).max(5).default(1),
+  maxRequests: number().int().min(1).max(1000),
+  maxTotalBytes: number().int().min(65536).max(134217728),
+  concurrency: number().int().min(1).max(8),
+  protocols: array(ProtocolProfileSchema).max(16),
+  agents: array(AgentTargetProfileSchema).max(16)
+}).refine((value) => {
+  const ids = [...value.protocols, ...value.agents].map((profile) => profile.id);
+  return ids.length > 0 && new Set(ids).size === ids.length;
+}).superRefine((value, context) => {
+  if (value.internalScope)
+    return;
+  const endpoints = [
+    ...value.protocols.map((profile) => profile.endpoint),
+    ...value.agents.flatMap((profile) => [
+      profile.endpoint,
+      profile.observer.endpoint
+    ])
+  ];
+  if (endpoints.some((entry) => !PublicAddressSchema.safeParse(entry.address).success))
+    context.addIssue({
+      code: "custom",
+      message: "Private adapter or observer addresses require explicit internalScope approval."
+    });
+});
+
+class AdapterJournal {
+  journal;
+  lease;
+  callId;
+  policy;
+  constructor(journal, lease, callId, policy) {
+    this.journal = journal;
+    this.lease = lease;
+    this.callId = callId;
+    this.policy = policy;
+  }
+  async reserve(descriptor, signal) {
+    for (;; ) {
+      signal.throwIfAborted();
+      const reservation = await this.journal.fenced(this.lease, async ({ client }) => {
+        signal.throwIfAborted();
+        const action = await client.query("SELECT 1 FROM harness_mastra.actions WHERE run_id=$1 AND call_id=$2 AND tool IN ('protocol_run','agent_target') AND state='dispatched' AND child_id IS NOT DISTINCT FROM $3", [this.lease.runId, this.callId, this.lease.child?.id ?? null]);
+        const usage = await client.query("SELECT count(*)::int AS requests,count(*) FILTER(WHERE w.state='dispatched')::int AS active,COALESCE(sum(w.bytes),0)::float8 AS bytes,clock_timestamp()>=$2::timestamptz AS expired,GREATEST(0,EXTRACT(EPOCH FROM (max(w.dispatched_at)+($3::double precision * interval '1 millisecond')-clock_timestamp()))*1000)::double precision AS wait_ms FROM harness_mastra.web_requests w JOIN harness_mastra.actions a ON a.run_id=w.run_id AND a.call_id=w.call_id WHERE w.run_id=$1 AND a.tool IN ('protocol_run','agent_target')", [
+          this.lease.runId,
+          this.policy.expiresAt,
+          1000 / this.policy.requestsPerSecond
+        ]);
+        const used = usage.rows[0];
+        if (!action.rowCount || used.expired || used.requests >= this.policy.maxRequests || used.bytes + 65536 > this.policy.maxTotalBytes)
+          throw new HarnessError("adapter_denied", "Adapter dispatch requires its owning action, active grant and remaining request, concurrency and byte budgets.");
+        if (used.active >= this.policy.concurrency || used.wait_ms > 0)
+          return {
+            waitMs: Math.max(50, Math.ceil(used.wait_ms)),
+            id: undefined
+          };
+        signal.throwIfAborted();
+        const id = randomUUID();
+        await client.query("INSERT INTO harness_mastra.web_requests(id,run_id,call_id,request_digest,policy_digest,bytes,state) VALUES($1,$2,$3,$4,$5,65536,'dispatched')", [
+          id,
+          this.lease.runId,
+          this.callId,
+          digest(descriptor),
+          digest(this.policy)
+        ]);
+        return { id, waitMs: 0 };
+      });
+      if (reservation.id)
+        return reservation.id;
+      await sleep(reservation.waitMs, undefined, { signal });
+    }
+  }
+  async complete(id, bytes, observation) {
+    if (!Number.isInteger(bytes) || bytes < 0 || bytes > 65536)
+      throw new HarnessError("adapter_uncertain", "Adapter response exceeded its reserved bound.");
+    const ref = await this.journal.captureActionEvidence(this.lease, this.callId, {
+      kind: "adapter-observation",
+      requestId: id,
+      policyDigest: digest(this.policy),
+      observation
+    });
+    await this.journal.fenced(this.lease, async ({ client }) => {
+      const result = await client.query("UPDATE harness_mastra.web_requests SET state='completed',bytes=$4,response_digest=$5,response_ref=$6 WHERE id=$1 AND run_id=$2 AND call_id=$3 AND state='dispatched' AND policy_digest=$7", [
+        id,
+        this.lease.runId,
+        this.callId,
+        bytes,
+        digest(observation),
+        ref,
+        digest(this.policy)
+      ]);
+      if (result.rowCount !== 1)
+        throw new HarnessError("adapter_uncertain", "Adapter evidence cannot settle a different or completed reservation.");
+      await this.journal.writeWebProgress(client, this.lease.runId);
+    }, "settlement");
+    return ref;
+  }
+}
+
+// apps/harness/src/storage/assessment-operations.ts
+var VerificationPolicySchema = strictObject({
+  authority: strictObject({
+    kind: literal("gyms_oracle"),
+    id: string().min(1).max(128)
+  }),
+  policy: strictObject({
+    id: string().min(1).max(128),
+    revision: string().min(1).max(128),
+    claims: array(_enum(["vulnerability", "dependency_exploitability"])).min(1).max(2),
+    requiresExpiry: boolean()
+  })
+});
+var VerificationIntentSchema = strictObject({
+  request: VerifyRequestSchema,
+  context: VerificationPolicySchema,
+  approvalDigest: string().regex(/^[a-f0-9]{64}$/)
+});
+
+// apps/harness/src/storage/callbacks.ts
+import { randomBytes } from "node:crypto";
+var CallbackPolicySchema = strictObject({
+  publicOrigin: url().max(2048).refine((value) => {
+    const url2 = new URL(value);
+    return ["http:", "https:"].includes(url2.protocol) && url2.origin === value && !url2.username && !url2.password;
+  }),
+  ttlMs: number().int().min(1000).max(600000),
+  maxRegistrations: number().int().min(1).max(32)
+});
+var CallbackOpenSchema = strictObject({
+  hypothesis: string().min(1).max(512)
+});
+var CallbackReadSchema = strictObject({
+  registrationId: string().min(1).max(256)
+});
+var CallbackEventSchema = strictObject({
+  transport: literal("http"),
+  method: string().min(1).max(16),
+  requestDigest: string().regex(/^[a-f0-9]{64}$/),
+  peerDigest: string().regex(/^[a-f0-9]{64}$/),
+  bytes: number().int().min(0).max(4096)
+});
+var CallbackReadResultSchema = strictObject({
+  registrationId: string(),
+  closed: boolean(),
+  expiresAt: exports_iso.datetime(),
+  controlCount: number().int().nonnegative(),
+  probeCount: number().int().nonnegative(),
+  omitted: number().int().nonnegative(),
+  events: array(CallbackEventSchema.extend({
+    arm: _enum(["control", "probe"]),
+    receivedAt: exports_iso.datetime()
+  })).max(32),
+  assertion: _enum(["pending", "observed", "not_observed", "inconclusive"]),
+  verification: literal("not-independent")
+});
+
+class CallbackJournal {
+  journal;
+  lease;
+  policy;
+  constructor(journal, lease, policy) {
+    this.journal = journal;
+    this.lease = lease;
+    this.policy = policy;
+  }
+  async open(input, callId) {
+    const args = CallbackOpenSchema.parse(input);
+    const control = randomBytes(32).toString("hex"), probe = randomBytes(32).toString("hex");
+    return this.journal.fenced(this.lease, async ({ client }) => {
+      const action = await client.query("SELECT 1 FROM harness_mastra.actions WHERE run_id=$1 AND call_id=$2 AND tool='callback_open' AND args_digest=$3 AND state='dispatched' AND child_id IS NOT DISTINCT FROM $4", [this.lease.runId, callId, digest(args), this.lease.child?.id ?? null]);
+      const count = await client.query("SELECT count(*)::integer AS count FROM harness_mastra.callback_registrations WHERE run_id=$1", [this.lease.runId]);
+      if (!action.rowCount || count.rows[0].count >= this.policy.maxRegistrations)
+        throw new HarnessError("callback_denied", "Callback registration requires a dispatched action and remaining registration budget.");
+      const result = await client.query("INSERT INTO harness_mastra.callback_registrations(run_id,call_id,policy_digest,control_hash,probe_hash,expires_at) VALUES($1,$2,$3,$4,$5,clock_timestamp()+$6*interval '1 millisecond') RETURNING expires_at", [
+        this.lease.runId,
+        callId,
+        digest(this.policy),
+        sha256(control),
+        sha256(probe),
+        this.policy.ttlMs
+      ]);
+      return {
+        registrationId: callId,
+        controlUrl: `${this.policy.publicOrigin}/callbacks/${control}`,
+        probeUrl: `${this.policy.publicOrigin}/callbacks/${probe}`,
+        expiresAt: result.rows[0].expires_at.toISOString(),
+        verification: "not-independent"
+      };
+    });
+  }
+  async read(input) {
+    const { registrationId } = CallbackReadSchema.parse(input);
+    return this.journal.fenced(this.lease, async ({ client }) => {
+      const result = await client.query("SELECT *,clock_timestamp()>=expires_at AS closed FROM harness_mastra.callback_registrations WHERE run_id=$1 AND call_id=$2 AND policy_digest=$3", [this.lease.runId, registrationId, digest(this.policy)]);
+      const row = result.rows[0];
+      if (!row)
+        throw new HarnessError("callback_denied", "Callback evidence belongs to a different run or policy.");
+      return CallbackReadResultSchema.parse({
+        registrationId,
+        closed: row.closed,
+        expiresAt: row.expires_at.toISOString(),
+        controlCount: Number(row.control_count),
+        probeCount: Number(row.probe_count),
+        omitted: Number(row.omitted),
+        events: row.events,
+        assertion: callbackAssertion(row.closed, Number(row.control_count), Number(row.probe_count), Number(row.omitted)),
+        verification: "not-independent"
+      });
+    });
+  }
+}
+function callbackAssertion(closed, control, probe, omitted) {
+  return !closed ? "pending" : omitted || control > 0 ? "inconclusive" : probe > 0 ? "observed" : "not_observed";
+}
+
+// apps/harness/src/storage/stage-analysis.ts
+var StageAnalysisSchema = strictObject({
+  kind: literal("stage-analysis"),
+  role: string().min(1).max(128),
+  text: string().max(8192),
+  truncated: boolean(),
+  completedActions: number().int().nonnegative(),
+  failedActions: number().int().nonnegative()
+});
+function stagedWebsite(grant) {
+  return grant.mode === "pentest" && Boolean(grant.config.website && grant.stages);
+}
+async function stageAnalyses(journal, lease) {
+  return journal.fenced(lease, async ({ client }) => {
+    const rows = await client.query("SELECT job_key,CASE WHEN result->>'kind'='stage-analysis' THEN result ELSE result->'analysis' END AS result FROM harness_mastra.child_jobs WHERE run_id=$1 AND state='completed' AND (result->>'kind'='stage-analysis' OR result->'analysis'->>'kind'='stage-analysis') ORDER BY job_key", [lease.runId]);
+    return rows.rows.map((row) => ({
+      jobKey: row.job_key,
+      analysis: StageAnalysisSchema.parse(row.result)
+    }));
+  });
+}
+
+// apps/harness/src/storage/capability-plan.ts
+var SOURCE = [
+  "repo_inventory",
+  "repo_context",
+  "repo_read",
+  "repo_search",
+  "change_inspect",
+  "change_impact",
+  "semgrep_scan",
+  "secret_scan",
+  "dependency_scan",
+  "joern_confirm",
+  "patch_propose",
+  "test_run",
+  "package_import_probe"
+];
+var WEB = [
+  "protocol_run",
+  "agent_target",
+  "callback_open",
+  "callback_read",
+  "execution_assert",
+  "environment_check",
+  "web_inventory",
+  "site_recon_save",
+  "investigation_read",
+  "web_discover",
+  "web_request",
+  "web_browse",
+  "web_case",
+  "http_request",
+  "session_health",
+  "browser_workflow",
+  "identity_catalog",
+  "policy_read",
+  "nuclei_scan",
+  "port_scan",
+  "zap_scan",
+  "sqli_confirm",
+  "web_capture_read",
+  "web_capture_compare"
+];
+var SHARED = [
+  "coverage_record",
+  "evidence_catalog",
+  "evidence_inspect",
+  "engagement_describe",
+  "finding_propose",
+  "bash_run",
+  "experiment_run"
+];
+function environmentRequirements(grant) {
+  if (grant.mode !== "pentest" || !grant.sandbox)
+    return;
+  const browserVersion = grant.config.website?.browserVersion ?? grant.config.live?.browser?.playwrightVersion;
+  const scanners = [
+    ...grant.config.portScan ? [{ tool: "port_scan", version: grant.config.portScan.version }] : [],
+    ...new Map((grant.config.scanners?.profiles ?? []).map((entry) => [
+      entry.tool,
+      { tool: entry.tool, version: entry.version }
+    ])).values()
+  ];
+  return browserVersion || scanners.length ? { ...browserVersion ? { browserVersion } : {}, scanners } : undefined;
+}
+function capabilityPlan(grant) {
+  const bindings = new Map;
+  const bind = (names, id, value, version = null, rules) => {
+    if (value === undefined || value === false)
+      return;
+    for (const name of names)
+      bindings.set(name, [
+        ...bindings.get(name) ?? [],
+        {
+          id,
+          digest: digest(value),
+          version,
+          ruleDigest: rules === undefined ? null : digest(rules)
+        }
+      ]);
+  };
+  const source = grant.mode === "codereview" ? grant.config : grant.config.sourceAssistance;
+  if (source) {
+    const review = grant.mode === "codereview" ? grant.config : undefined;
+    if (review?.repository.package?.ecosystem === "npm" && grant.sandbox && sandboxAllowsExecution(grant.sandbox, "package_import_probe"))
+      bind(["package_import_probe"], "npm-import-descriptors-v1", review.repository, "node24");
+    if (grant.mode === "codereview")
+      bind(["coverage_record"], "source-work", grant.stages);
+    bind(["repo_inventory", "repo_context", "repo_read", "repo_search"], "repository", source.repository);
+    const change = review?.change;
+    bind(["change_inspect", "change_impact"], "change", change);
+    bind(["repo_context", ...change ? ["change_impact"] : []], "source-analysis", { parser: SOURCE_PARSER_ID, strategy: SOURCE_ANALYSIS_VERSION }, SOURCE_ANALYSIS_VERSION);
+    bind(["patch_propose"], "patch-authority", source.allowPatchProposals);
+    bind(["semgrep_scan"], "semgrep", review?.semgrep, review?.semgrep?.version, review?.semgrep?.rules);
+    bind(["secret_scan"], "gitleaks", review?.secretScan, review?.secretScan?.version);
+    bind(["joern_confirm"], "joern", review?.joern, review?.joern?.version);
+    bind(["dependency_scan"], "osv", review?.dependencyScan, review?.dependencyScan?.version, review?.dependencyScan?.database);
+    for (const profile of source.testProfiles ?? [])
+      bind(["test_run"], profile.id, profile, "node24");
+  }
+  if (grant.mode === "pentest") {
+    const config = grant.config;
+    bind(["port_scan"], "naabu", config.portScan, config.portScan?.version);
+    bind(["callback_open", "callback_read"], "callback-collector", config.callbacks, "http-v1");
+    for (const profile of config.adapters?.protocols ?? [])
+      bind(["protocol_run"], profile.id, profile, "wire-v1");
+    for (const profile of config.adapters?.agents ?? [])
+      bind(["agent_target"], profile.id, profile, profile.transport === "mcp" ? "2025-11-25" : "http-json-v1");
+    bind(["environment_check"], "execution-prerequisites", environmentRequirements(grant));
+    bind(["web_discover", "web_request"], "website", config.website);
+    if (stagedWebsite(grant)) {
+      bind(["site_recon_save"], "site-recon-v2", config.website, "1.0.0");
+      bind(["investigation_read"], "stage-agents-v1", grant.stages, "1.0.0");
+    }
+    bind(["web_inventory"], "surface-discovery", config.website || config.live || config.apiDescriptions ? {
+      strategy: "web-surface-v1",
+      website: config.website ?? null,
+      live: config.live ?? null,
+      descriptions: config.apiDescriptions ?? []
+    } : undefined, "1.0.0");
+    if (config.website && config.live?.sessions.some((session) => session.capabilities?.includes("website")))
+      bind([
+        "web_discover",
+        "web_request",
+        ...config.website?.browserVersion ? ["web_browse"] : []
+      ], "website-sessions", config.live);
+    if (config.website?.browserVersion)
+      bind(["web_browse", "execution_assert"], "browser", config.website, config.website.browserVersion);
+    if (config.captures.length)
+      bind(["web_capture_read", "web_capture_compare"], "saved-captures", config.captures);
+    bind(["http_request", "session_health"], "live-sessions", config.live);
+    bind(["web_case"], "executable-cases", config.live?.testCases);
+    bind(["browser_workflow"], "live-browser", config.live?.browser, config.live?.browser?.playwrightVersion);
+    bind(["identity_catalog", "policy_read"], "identity-policy", config.permissionPolicy);
+    for (const profile of config.scanners?.profiles ?? [])
+      bind([profile.tool], profile.id, profile, profile.version, profile.tool === "nuclei_scan" ? profile.template : profile.tool === "zap_scan" ? profile.rules : { parameter: profile.parameter, technique: profile.technique });
+    if (config.website)
+      bind(["coverage_record"], "website-work", grant.stages?.websiteWork);
+  }
+  for (const profile of grant.config.bashProfiles ?? [])
+    bind(["bash_run"], profile.id, profile, "bash-offline-v1", profile.script);
+  bind(["experiment_run"], "custom-experiments", grant.config.experiments, "offline-v1");
+  for (const name of SHARED.filter((name) => !["bash_run", "experiment_run"].includes(name)))
+    bindings.set(name, []);
+  const names = [
+    ...SOURCE,
+    ...WEB.filter((name) => name !== "investigation_read" || stagedWebsite(grant)),
+    ...SHARED
+  ];
+  return names.sort().map((name) => {
+    const applicable = grant.mode === "codereview" ? !WEB.includes(name) : !SOURCE.includes(name) || Boolean(source);
+    const configured = bindings.has(name);
+    const isolated = TaskNameSchema.options.some((task) => task === name) && Boolean(grant.sandbox);
+    return {
+      name,
+      applicable,
+      configured,
+      reason: !applicable ? `The ${grant.mode} subject does not support this capability.` : !configured ? "No admitted profile or required input is configured for this capability." : "The admitted configuration permits this capability; preflight and actual execution are recorded separately.",
+      execution: isolated ? {
+        location: grant.sandbox.location ?? "local",
+        runtime: sandboxRuntime(grant.sandbox),
+        image: grant.sandbox.image,
+        engineId: grant.sandbox.engineId ?? null
+      } : {
+        location: "backend-host",
+        runtime: ["web_case", "protocol_run", "agent_target"].includes(name) ? "host-broker" : "host-read",
+        image: null,
+        engineId: null
+      },
+      profiles: bindings.get(name) ?? [],
+      requiredChecks: [
+        "registry",
+        ...isolated ? ["sandbox"] : [],
+        ...[
+          "http_request",
+          "session_health",
+          "browser_workflow",
+          "web_case"
+        ].includes(name) ? ["sessions"] : []
+      ]
+    };
+  });
+}
+
+// apps/harness/src/storage/pentest-config.ts
+function pentestConfig(environment = process.env, bundled = true) {
+  return Object.freeze({
+    ownershipTestMode: !bundled && (environment.HARNESS_API_AUTH ?? "file") === "file" && isLoopback(environment.HARNESS_API_HOST ?? "127.0.0.1")
+  });
+}
+var PENTEST_CONFIG = pentestConfig();
+
+// apps/harness/src/storage/site-recon.ts
+var SITE_RECON_JOB = "recon:site-discovery:v1";
+var SITE_RECON_SCAN = Object.freeze({
+  callId: "recon:site-context:v1",
+  tool: "site_recon_save",
+  args: {}
+});
+var SiteReconNarrativeSchema = strictObject({
+  text: string().max(32768),
+  truncated: boolean(),
+  specialists: array(StageAnalysisSchema).length(3)
+});
+var SectionNameSchema = _enum([
+  "notes",
+  "surface",
+  "endpoints",
+  "omissions",
+  "observations"
+]);
+var SiteReconFileSchema = strictObject({
+  kind: literal("site-recon"),
+  version: literal("1.0.0"),
+  filename: literal("site-recon.json"),
+  runId: uuid(),
+  target: url().max(2048),
+  targetRevision: string().min(1).max(2048),
+  scope: WebScopeSchema,
+  summary: string().max(1024),
+  narrativeTruncated: boolean(),
+  endpoints: number().int().nonnegative(),
+  observedEndpoints: number().int().nonnegative(),
+  omitted: number().int().nonnegative(),
+  sections: array(strictObject({
+    name: SectionNameSchema,
+    artifactRef: ArtifactRefSchema,
+    parts: number().int().positive(),
+    records: number().int().nonnegative()
+  })).length(5),
+  coverage: literal("discovery-only"),
+  interpretation: literal("Discovery snapshot before Hunt. Agent notes are unverified analysis, not findings or authorization. Follow section artifact references and nextArtifactRef links for the full retained data; cite original observations for security claims. Later observations remain in web_inventory.")
+});
+async function captureSiteRecon(journal, lease, callId, signal) {
+  const grant = journal.grant;
+  if (lease.child || grant.mode !== "pentest" || !grant.config.website || !grant.stages || callId !== SITE_RECON_SCAN.callId)
+    throw new HarnessError("tool_denied", "Only the website Recon coordinator can save the shared site reference.");
+  const narrative = await journal.fenced(lease, async ({ client }) => {
+    const result = await client.query("SELECT result FROM harness_mastra.child_jobs WHERE run_id=$1 AND job_key=$2 AND state='completed'", [lease.runId, SITE_RECON_JOB]);
+    if (!result.rows.length)
+      throw new HarnessError("tool_denied", "Detailed site discovery has no committed result.");
+    return SiteReconNarrativeSchema.parse(result.rows[0].result);
+  });
+  const surface = await journal.reportWeb(lease.runId);
+  const { endpoints, omissions, ...metadata } = surface;
+  const observations = (await journal.actions(lease.runId)).filter((action) => action.state === "completed" && action.artifactRef && [
+    ...WEBSITE_DISCOVERY_TOOLS,
+    "http_request",
+    "session_health",
+    "browser_workflow"
+  ].includes(action.tool)).map(({ callId, tool, artifactRef }) => ({ callId, tool, artifactRef }));
+  const sections = [];
+  const content = [
+    ["notes", [narrative]],
+    ["surface", [metadata]],
+    ["endpoints", endpoints],
+    ["omissions", omissions],
+    ["observations", observations]
+  ];
+  for (const [name, records] of content) {
+    const text = `[${records.map((record) => captureResponseText(canonicalJson(record))).join(",")}]`;
+    const characters = Array.from(text);
+    const parts = Math.ceil(characters.length / 8192);
+    let nextArtifactRef = null;
+    for (let index = parts - 1;index >= 0; index--) {
+      if (signal.aborted)
+        throw new HarnessError("stop_requested", "Site reference capture was cancelled.");
+      nextArtifactRef = await journal.captureActionEvidence(lease, callId, {
+        kind: "site-recon-part",
+        filename: `site-recon-${name}-${index + 1}.json`,
+        section: name,
+        index,
+        format: "json-fragment",
+        text: characters.slice(index * 8192, (index + 1) * 8192).join(""),
+        nextArtifactRef
+      });
+    }
+    sections.push({
+      name,
+      artifactRef: nextArtifactRef,
+      parts,
+      records: records.length
+    });
+  }
+  return SiteReconFileSchema.parse({
+    kind: "site-recon",
+    version: "1.0.0",
+    filename: "site-recon.json",
+    runId: lease.runId,
+    target: grant.target,
+    targetRevision: surface.targetRevision,
+    scope: grant.config.website,
+    summary: captureResponseText(narrative.text).slice(0, 1024),
+    narrativeTruncated: narrative.truncated,
+    endpoints: endpoints.length,
+    observedEndpoints: endpoints.filter((endpoint) => endpoint.state === "observed").length,
+    omitted: surface.omitted,
+    sections,
+    coverage: "discovery-only",
+    interpretation: "Discovery snapshot before Hunt. Agent notes are unverified analysis, not findings or authorization. Follow section artifact references and nextArtifactRef links for the full retained data; cite original observations for security claims. Later observations remain in web_inventory."
+  });
+}
+
+// apps/harness/src/storage/tool-calls.ts
+function completedToolCalls(runId, actions, excludedTools = []) {
+  const byCall = new Map(actions.map((action) => [action.callId, action]));
+  return async (requestedRun, callId) => {
+    const action = byCall.get(callId);
+    return requestedRun === runId && action?.state === "completed" && action.artifactRef && !excludedTools.includes(action.tool) ? { callId, tool: action.tool, artifactRef: action.artifactRef } : null;
+  };
+}
+
+// apps/harness/src/storage/web-scanner-plan.ts
+var WEB_SCANNER_STRATEGY = "surface-scanners-v1";
+function webScannerCall(targetRevision, profile) {
+  return {
+    callId: `surface-scan:${digest({ strategy: WEB_SCANNER_STRATEGY, targetRevision, profile })}`,
+    tool: profile.tool,
+    args: { profileId: profile.id }
+  };
+}
+function webScannerPlan(target, targetRevision, endpoints, config, scope, live) {
+  return config.profiles.map((profile) => {
+    const method = profile.tool === "sqli_confirm" ? profile.request?.method ?? "GET" : "GET";
+    const urls = profile.tool === "nuclei_scan" ? profile.template.paths.map((path) => new URL(path, profile.url).href) : [profile.url];
+    const matches = urls.map((url) => endpoints.flatMap((endpoint) => endpoint.shape.method === method && !endpoint.shape.operation && (profile.tool !== "sqli_confirm" || !profile.request || endpoint.shape.contentType === profile.request.contentType) ? endpoint.samples.flatMap((sample) => sample.url === url && sample.source === "observation" && sample.evidenceRef && sample.status !== null && sample.status >= 200 && sample.status < 300 && (sample.identity?.id ?? null) === (profile.identity ?? null) ? [{ endpoint, sample }] : []) : [])[0]);
+    const matched = matches.flatMap((match) => match ? [match] : []);
+    const blocked = urls.some((url) => !webRequestAllowed(target, { url, method }, scope)) ? "The profile contains a request outside the shared website scope." : profile.identity && !live?.sessions.some((session) => session.id === profile.identity && session.capabilities?.includes("scanners")) ? "The profile requires an explicitly admitted scanner session." : matched.length !== urls.length ? `Every exact profile URL needs a successful observed ${method} for its configured identity and body format; hints, other methods, login failures and other identities do not qualify.` : profile.tool === "sqli_confirm" && !matched[0].endpoint.shape.inputs.some((input) => input.location === (profile.request ? "body" : "query") && input.name === `${profile.request?.contentType === "application/json" ? "/" : ""}${profile.parameter}`) ? "The approved SQLMap parameter was not observed in its granted input location." : profile.tool === "zap_scan" && profile.rules.includes(40012) && !matched[0].endpoint.shape.inputs.some((input) => input.location === "query" && new URL(profile.url).searchParams.has(input.name)) ? "The GET-only ZAP reflected-input preset requires an observed query input; body/form coverage needs a separately supported adapter." : undefined;
+    return {
+      strategyVersion: WEB_SCANNER_STRATEGY,
+      profileId: profile.id,
+      profileDigest: digest(profile),
+      tool: profile.tool,
+      version: profile.version,
+      callId: profile.tool === "sqli_confirm" ? null : webScannerCall(targetRevision, profile).callId,
+      selection: blocked ? "blocked" : profile.tool === "sqli_confirm" ? "deferred" : "ready",
+      reason: blocked ?? (profile.tool === "sqli_confirm" ? "An exact pending CWE-89 candidate is required; SQLMap runs in verification, never from a discovery lead alone." : "Observed exact requests match this operator-owned profile. Execution still requires current admission, preflight and approval."),
+      endpointIds: [...new Set(matched.map(({ endpoint }) => endpoint.id))],
+      evidenceRefs: [
+        ...new Set(matched.map(({ sample }) => sample.evidenceRef))
+      ]
+    };
+  });
+}
+
+// apps/harness/src/storage/web-surface.ts
+var ResponseSchema = object({
+  kind: literal("web-response"),
+  request: object({
+    url: url().max(2048),
+    method: string(),
+    body: string().optional(),
+    headers: record(string(), string()).optional(),
+    inputNames: array(EndpointInputSchema).max(64).optional()
+  }),
+  status: number().int().min(100).max(599),
+  bodyComplete: boolean().optional(),
+  identity: WebIdentitySchema.optional()
+});
+var LeadSchema = object({
+  url: string().min(1).max(2048),
+  method: EndpointLeadSchema.shape.method,
+  kind: EndpointLeadSchema.shape.kind.optional(),
+  inputs: EndpointLeadSchema.shape.inputs.optional(),
+  parameters: array(string()).max(64).optional(),
+  contentType: EndpointLeadSchema.shape.contentType.optional(),
+  operation: EndpointLeadSchema.shape.operation.optional(),
+  authentication: EndpointLeadSchema.shape.authentication.optional(),
+  stateChanging: boolean().optional(),
+  limitations: EndpointLeadSchema.shape.limitations.optional()
+});
+async function webSurface(journal, runId, config, client = journal.pool) {
+  await journal.read(runId, client);
+  const endpoints = new Map;
+  const omissions = [];
+  let omitted = 0;
+  const omission = (source, url2, reason, evidenceRef = null) => {
+    omitted++;
+    if (omissions.length < 500)
+      omissions.push({
+        source: source.slice(0, 256),
+        url: url2.slice(0, 2048),
+        reason: reason.slice(0, 512),
+        evidenceRef
+      });
+  };
+  const descriptions = config.descriptions ?? [];
+  const declared = descriptions.flatMap((description) => description.routes.map((route) => ({ route, description })));
+  const add = (value, source, sourceId, evidenceRef = null, status = null, identity) => {
+    const parsed = LeadSchema.safeParse(value);
+    if (!parsed.success) {
+      omission(sourceId, "", "Malformed or unsupported endpoint lead.", evidenceRef);
+      return;
+    }
+    const point = parsed.data;
+    let normalized;
+    let declaration;
+    try {
+      if (source === "observation")
+        declaration = declared.find(({ route }) => route.method === point.method && route.operation === (point.operation ?? null) && route.contentType === (point.contentType ?? null) && matchesEndpointTemplate(route.url, point.url));
+      const queryInputs = requestInputs({
+        url: point.url,
+        method: point.method
+      }).inputs;
+      const inputs = new Map([
+        ...queryInputs,
+        ...(point.parameters ?? []).flatMap((key) => endpointInput("query", key) ?? []),
+        ...declaration?.route.inputs.filter((entry) => entry.location === "path") ?? [],
+        ...point.inputs ?? []
+      ].map((entry) => [`${entry.location}:${entry.name}`, entry]));
+      const declaredUrl = source === "operator" ? point.url : declaration?.route.url;
+      normalized = endpointShape({
+        ...point,
+        inputs: [...inputs.values()],
+        contentType: point.contentType ?? null,
+        ...declaredUrl ? {
+          declaredPath: new URL(declaredUrl).pathname.replace(/%7B/gi, "{").replace(/%7D/gi, "}")
+        } : {}
+      });
+    } catch {
+      normalized = undefined;
+    }
+    if (!normalized) {
+      omission(sourceId, point.url, "URL, method or input shape is unsupported or exceeds the retained bound.", evidenceRef);
+      return;
+    }
+    const { shape, confidence } = normalized;
+    const observedInputs = shape.inputs.filter(({ location }) => location === "header" || location === "cookie");
+    shape.inputs = shape.inputs.filter(({ location }) => location !== "header" && location !== "cookie");
+    const permitted = config.scope && webRequestAllowed(config.target, { url: point.url, method: point.method }, config.scope);
+    const inaccessible = status !== null && [401, 403, 404, 405].includes(status);
+    const state = !permitted ? "ignored" : source === "operator" ? "supplied" : source === "lead" ? "lead" : inaccessible ? "inaccessible" : "observed";
+    const reason = !permitted ? "Origin, path or method is outside the admitted website scope; discovery does not grant dispatch authority." : source === "operator" ? "Pinned operator-supplied API declaration; successful concrete requests have not been established by this declaration." : source === "lead" ? "Discovery lead without a matching committed concrete response." : inaccessible ? `Concrete request returned HTTP ${status}; this response does not establish access to the route.` : `Concrete request and HTTP ${status} response retained; this is discovery evidence, not vulnerability coverage.`;
+    const id = endpointIdentity(shape);
+    const sample = {
+      url: point.url,
+      evidenceRef,
+      status,
+      source,
+      sourceId,
+      ...observedInputs.length ? { inputs: observedInputs } : {},
+      ...identity ? { identity } : {}
+    };
+    const existing = endpoints.get(id);
+    const gaps = [
+      ...point.limitations ?? [],
+      ...declaration?.route.limitations ?? [],
+      ...confidence === "heuristic" ? [
+        "Numeric or identifier-like path segments were grouped heuristically; concrete samples retain the original paths."
+      ] : []
+    ];
+    if (existing) {
+      if (!existing.samples.some((entry) => entry.url === sample.url && entry.evidenceRef === sample.evidenceRef && entry.sourceId === sample.sourceId)) {
+        if (existing.samples.length < 32)
+          existing.samples.push(sample);
+        else {
+          existing.omittedSamples++;
+          if (sample.source === "observation" && !existing.samples.some((entry) => entry.source === "observation"))
+            existing.samples[31] = sample;
+        }
+      }
+      const rank = {
+        ignored: 0,
+        unsupported: 0,
+        lead: 1,
+        supplied: 2,
+        inaccessible: 3,
+        observed: 4
+      };
+      if (rank[state] > rank[existing.state]) {
+        existing.state = state;
+        existing.reason = reason;
+      }
+      if (source === "operator") {
+        if (existing.authentication !== "unknown" && existing.authentication !== point.authentication)
+          gaps.push("Supplied descriptions disagree about authentication; inspect their pinned definitions and establish runtime controls.");
+        existing.authentication = point.authentication ?? "unknown";
+        existing.shape = shape;
+        existing.shapeConfidence = confidence;
+        existing.stateChanging = point.stateChanging ?? existing.stateChanging;
+      }
+      existing.limitations = [
+        ...new Set([...existing.limitations, ...gaps])
+      ].slice(0, 32);
+      return;
+    }
+    if (endpoints.size >= 1000) {
+      omission(sourceId, point.url, "Additional endpoint shapes exceed the 1,000-shape surface bound.", evidenceRef);
+      return;
+    }
+    endpoints.set(id, {
+      id,
+      shape,
+      shapeConfidence: confidence,
+      state,
+      reason,
+      authentication: point.authentication ?? declaration?.route.authentication ?? "unknown",
+      stateChanging: point.stateChanging ?? !["GET", "HEAD", "OPTIONS"].includes(point.method),
+      samples: [sample],
+      omittedSamples: 0,
+      limitations: [...new Set(gaps)].slice(0, 32)
+    });
+  };
+  add({ url: config.target, method: "GET", kind: "page" }, "lead", "target");
+  for (const { route, description } of declared)
+    add(route, "operator", description.id);
+  for (const description of descriptions) {
+    omitted += description.omitted;
+    if (description.omitted && omissions.length < 500)
+      omissions.push({
+        source: description.id,
+        url: "",
+        reason: `${description.omitted} API routes were omitted during bounded offline intake; see the description limitations.`,
+        evidenceRef: null
+      });
+  }
+  const actions = (await journal.actions(runId, client)).filter((action) => action.artifactRef && action.state === "completed" && isWebsiteCoverageTool(action.tool) && action.tool !== "coverage_record");
+  const responseRefs = new Map;
+  const artifacts = await Promise.all(actions.map(async (action) => ({
+    action,
+    value: JSON.parse((await journal.artifact(runId, action.artifactRef, client)).bytes)
+  })));
+  for (const { action, value } of artifacts) {
+    for (const point of [...value.leads ?? [], ...value.endpoints ?? []])
+      add(point, "lead", action.callId, action.artifactRef);
+    for (const blocked of value.blocked ?? [])
+      omission(action.callId, String(blocked.url ?? ""), `Browser route not dispatched: ${String(blocked.reason ?? "unknown")}`, action.artifactRef);
+    if (Number.isSafeInteger(value.omitted) && value.omitted > 0) {
+      omitted += value.omitted;
+      if (omissions.length < 500)
+        omissions.push({
+          source: action.callId,
+          url: "",
+          reason: `${value.omitted} discoveries were omitted by the tool's input/output or traversal bound.`,
+          evidenceRef: action.artifactRef
+        });
+    }
+    for (const valueRef of value.network?.responseRefs ?? []) {
+      const ref = ArtifactRefSchema.safeParse(valueRef);
+      if (ref.success)
+        responseRefs.set(ref.data, action.callId);
+    }
+  }
+  for (const testCase of config.live?.testCases ?? []) {
+    const request = config.live.requests.find((entry) => entry.url === testCase.endpoint.url && entry.method === testCase.endpoint.method);
+    add({
+      ...testCase.endpoint,
+      kind: testCase.endpoint.operation ? "graphql" : "response",
+      ...request ? requestInputs({
+        ...request,
+        headers: {
+          ...request.headers,
+          ...request.contentType ? { "content-type": request.contentType } : {}
+        }
+      }) : {},
+      authentication: "required",
+      stateChanging: !["GET", "HEAD", "OPTIONS"].includes(testCase.endpoint.method),
+      limitations: [
+        "Operator-approved executable case; effect, control and cleanup results have not yet been established."
+      ]
+    }, "operator", `case:${testCase.id}`);
+  }
+  const captures = await client.query("SELECT response_ref,call_id FROM harness_mastra.web_requests WHERE run_id=$1 AND state='completed' AND response_ref IS NOT NULL ORDER BY dispatched_at,id", [runId]);
+  for (const capture of captures.rows)
+    responseRefs.set(capture.response_ref, capture.call_id);
+  const responses = await Promise.all([...responseRefs].map(async ([ref, callId]) => ({
+    ref,
+    callId,
+    response: ResponseSchema.parse(JSON.parse((await journal.artifact(runId, ref, client)).bytes))
+  })));
+  for (const { ref, callId, response } of responses) {
+    if (response.bodyComplete === false)
+      omission(callId, response.request.url, "The response exceeded its admitted byte bound; only a body prefix was retained and the remaining content was not inspected.", ref);
+    const details = requestInputs(response.request);
+    for (const operation of details.operations?.length ? details.operations : [undefined])
+      add({
+        ...response.request,
+        ...details,
+        kind: "response",
+        ...operation ? { operation } : {}
+      }, "observation", callId, ref, response.status, response.identity);
+    omitted += details.omitted;
+  }
+  const authorization = config.live?.comparisons && config.permissionPolicy ? await authorizationObservations(journal, runId, undefined, client).then((observations) => config.live.comparisons.map((definition) => authorizationAssessment(definition, config.live, config.permissionPolicy, observations))) : undefined;
+  return WebSurfaceSchema.parse({
+    version: "1.0.0",
+    strategyVersion: "web-surface-v1",
+    runId,
+    target: config.target,
+    targetRevision: config.targetRevision,
+    endpoints: [...endpoints.values()].sort((a, b) => a.shape.origin.localeCompare(b.shape.origin) || a.shape.path.localeCompare(b.shape.path) || a.shape.method.localeCompare(b.shape.method) || a.id.localeCompare(b.id)),
+    descriptions: descriptions.map(({ routes: _routes, ...description }) => description),
+    ...authorization ? { authorization } : {},
+    ...config.scanners && config.scope ? {
+      scannerPlan: webScannerPlan(config.target, config.targetRevision, [...endpoints.values()], config.scanners, config.scope, config.live)
+    } : {},
+    omissions,
+    omitted,
+    interpretation: "Observed requests, supplied API descriptions and discovery leads are distinct. Surface discovery is not vulnerability coverage or proof of route completeness."
+  });
+}
+
+// apps/harness/src/storage/investigation-journal.ts
+var GRANT_MAX_BYTES = 262144;
+var GRANT_MAX_LABEL = `${GRANT_MAX_BYTES / 1024} KiB`;
+var sourceAssistance = strictObject({
+  repository: RepositoryConfigSchema,
+  binding: SourceDeploymentBindingSchema,
+  allowPatchProposals: literal(true).optional(),
+  testProfiles: array(RepositoryTestProfileSchema).min(1).max(8).optional()
+});
+var AgentAConfigSchema = strictObject({
+  buildIdentityRef: string().min(1).max(2048),
+  callbacks: CallbackPolicySchema.optional(),
+  adapters: AdapterPolicySchema.optional(),
+  captures: array(WebCaptureSchema).max(16),
+  permissionPolicy: PermissionPolicySchema.optional(),
+  live: LiveWebSchema.optional(),
+  website: WebScopeSchema.optional(),
+  websiteFamilies: array(WebsiteFamilySchema).min(1).max(10).refine((values) => new Set(values).size === values.length).optional(),
+  apiDescriptions: array(ApiDescriptionSchema).max(4).optional(),
+  scanners: ActiveScannersSchema.optional(),
+  portScan: PortScanProfileSchema.optional(),
+  sourceAssistance: sourceAssistance.optional(),
+  ownershipProof: OwnershipProofSchema.optional(),
+  ownershipProofs: array(OwnershipProofSchema).max(8).optional(),
+  bashProfiles: BashProfilesSchema.optional(),
+  experiments: ExperimentPolicySchema.optional()
+});
+var AgentBConfigSchema = strictObject({
+  repository: RepositoryConfigSchema,
+  change: ChangeContextSchema.extend({
+    baseRevision: CommitSchema,
+    headRevision: CommitSchema
+  }).optional(),
+  allowPatchProposals: literal(true).optional(),
+  testProfiles: array(RepositoryTestProfileSchema).min(1).max(8).optional(),
+  semgrep: SemgrepProfileSchema.optional(),
+  secretScan: SecretScanProfileSchema.optional(),
+  dependencyScan: DependencyScanProfileSchema.optional(),
+  joern: JoernProfileSchema.optional(),
+  bashProfiles: BashProfilesSchema.optional(),
+  experiments: ExperimentPolicySchema.optional()
+});
+var GymsVerifierSchema = strictObject({
+  origin: url(),
+  credentialFile: string().startsWith("/"),
+  credentialSha256: string().regex(/^[a-f0-9]{64}$/),
+  targetIdentity: TargetIdentitySchema,
+  rangeEndpoint: url(),
+  context: VerificationPolicySchema,
+  pocInputs: array(string().max(2048)).max(16),
+  proofDirectory: string().startsWith("/"),
+  timeoutMs: number().int().min(100).max(120000)
+});
+var StagesSchema = strictObject({
+  maxWorkers: number().int().min(1).max(8),
+  maxWorkItems: number().int().min(1).max(1000).optional(),
+  huntPartitions: number().int().min(1).max(8).default(1),
+  websiteWork: WebsiteWorkPolicySchema.optional(),
+  goal: strictObject({
+    objective: string().min(1).max(16384)
+  }).optional()
+});
+var InvestigationGrantSchema = discriminatedUnion("mode", [
+  strictObject({
+    mode: literal("pentest"),
+    plan: InvestigationPlanBindingSchema.optional(),
+    model: InvestigationModelSchema.optional(),
+    boundary: _enum([
+      "captured-evidence-only",
+      "gvisor-captured-evidence",
+      "gvisor-brokered-web",
+      "docker-captured-evidence",
+      "docker-brokered-web"
+    ]),
+    sandbox: SandboxConfigSchema.optional(),
+    target: url().max(2048),
+    stages: StagesSchema.optional(),
+    config: AgentAConfigSchema,
+    verifiers: array(GymsVerifierSchema).min(1).max(8).optional()
+  }),
+  strictObject({
+    mode: literal("codereview"),
+    plan: InvestigationPlanBindingSchema.optional(),
+    model: InvestigationModelSchema.optional(),
+    boundary: _enum([
+      "trusted-mirror-read-only",
+      "gvisor-repository",
+      "docker-repository"
+    ]),
+    sandbox: SandboxConfigSchema.optional(),
+    target: string().min(1).max(2048),
+    stages: StagesSchema.optional(),
+    config: AgentBConfigSchema,
+    verifiers: array(GymsVerifierSchema).min(1).max(8).optional()
+  })
+]);
+async function loadInvestigationGrant(path) {
+  try {
+    return investigationGrant(JSON.parse(await privateFile(path, GRANT_MAX_BYTES)));
+  } catch {
+    throw new HarnessError("investigation_config", `Use a private, operator-owned UTF-8 JSON investigation grant (maximum ${GRANT_MAX_LABEL}). No supplied contents are logged.`);
+  }
+}
+function deepFreeze(value) {
+  if (value && typeof value === "object")
+    for (const entry of Object.values(value))
+      deepFreeze(entry);
+  return Object.freeze(value);
+}
+var admittedGrants = new WeakSet;
+function investigationGrant(input) {
+  if (typeof input === "object" && input && admittedGrants.has(input))
+    return input;
+  const grant = InvestigationGrantSchema.parse(input);
+  if (grant.plan && !grant.stages)
+    throw new HarnessError("investigation_config", "Versioned plans require the admitted five-stage execution path.");
+  const route = grantRoute(grant);
+  if (grant.mode === "pentest" !== (route.kind === "web"))
+    throw new HarnessError("investigation_scope", "The grant mode must match its target: codereview for a GitHub repository or pull request, pentest for a site.");
+  if (grant.verifiers && (grant.verifiers.length > 1 && !grant.stages || new Set(grant.verifiers.map((verifier) => `${verifier.targetIdentity.rangeId}/${verifier.targetIdentity.instanceId}`)).size !== grant.verifiers.length || new Set(grant.verifiers.map((verifier) => verifier.rangeEndpoint)).size !== grant.verifiers.length))
+    throw new HarnessError("investigation_config", "More than one verifier requires staged execution, and every verifier needs a distinct explicitly granted target instance and endpoint.");
+  const isolated = grant.boundary.startsWith("gvisor-") || grant.boundary.startsWith("docker-");
+  if (isolated !== (grant.sandbox !== undefined) || grant.sandbox && grant.boundary.startsWith("gvisor-") !== (sandboxRuntime(grant.sandbox) === GVISOR_RUNTIME))
+    throw new HarnessError("investigation_config", "The investigation boundary must match its pinned sandbox image, Unix socket and selected runtime; runtime or host fallback is forbidden.");
+  if ((grant.config.bashProfiles || grant.config.experiments) && (!grant.sandbox || !sandboxAllowsExecution(grant.sandbox, "bash_run")))
+    throw new HarnessError("investigation_scope", "Bash profiles and custom experiments require an explicitly granted gVisor boundary.");
+  if (grant.mode === "pentest") {
+    const target = new URL(grant.target);
+    const live = grant.config.live;
+    const scanners = grant.config.scanners;
+    const website = grant.config.website;
+    const ports = grant.config.portScan;
+    if (ports && (ports.host !== target.hostname || !grant.sandbox || website && (!website.addresses.includes(ports.address) || Date.parse(ports.expiresAt) > Date.parse(website.expiresAt))))
+      throw new HarnessError("investigation_scope", "TCP discovery requires an explicitly approved target host, pinned address, expiry and sandbox.");
+    if (grant.config.adapters && (website?.environment !== "registered" || grant.config.adapters.buildIdentityRef !== grant.config.buildIdentityRef || [
+      ...grant.config.adapters.protocols,
+      ...grant.config.adapters.agents
+    ].some((entry) => !withinHttpScope(new URL(grant.target), new URL(entry.endpoint.url)))))
+      throw new HarnessError("investigation_scope", "Adapters require the registered disposable build and target endpoints inside its admitted URL.");
+    if (website) {
+      if (website.ownershipTestMode && !PENTEST_CONFIG.ownershipTestMode)
+        throw new HarnessError("investigation_scope", "This backend does not admit ownership test mode. Prepare a new engagement with verified ownership or passive methods.");
+      const proof = grant.config.ownershipProof;
+      const proofs = [
+        ...proof ? [proof] : [],
+        ...grant.config.ownershipProofs ?? []
+      ];
+      if (website.ownershipTestMode && proofs.length)
+        throw new HarnessError("investigation_scope", "Ownership test mode cannot also claim verified ownership.");
+      if (website.autoScope && !proofs.some((entry) => entry.method === "dns-txt" && entry.apex === website.autoScope.apex))
+        throw new HarnessError("investigation_scope", "Automatic origins require an operator-approved profile and a recorded DNS proof for the exact apex.");
+      if (website.environment === "live" && !website.ownershipTestMode && website.scopes?.some((scope) => scope.methods.some((method) => !WEBSITE_PASSIVE_METHODS.includes(method)) && !proofs.some((entry) => ownsHost(entry, new URL(scope.url).hostname))))
+        throw new HarnessError("investigation_scope", "Every active website scope requires its own host or apex ownership proof.");
+      const validateTarget = (url2) => website.environment === "registered" ? validateRegisteredWebTarget(url2, website) : validateWebTarget(url2);
+      validateTarget(grant.target);
+      if (website.registration && website.registration.identity.targetRevision !== grant.config.buildIdentityRef)
+        throw new HarnessError("investigation_scope", "The registered deployment revision must match the run's build identity.");
+      if (website.scopes) {
+        for (const scope of website.scopes)
+          validateTarget(scope.url);
+        if (website.scopes[0]?.url !== grant.target || new Set(website.scopes.map((scope) => scope.url)).size !== website.scopes.length)
+          throw new HarnessError("investigation_scope", "Website scopes must start with the target and be unique.");
+      }
+      if (scanners?.endpoints.some((endpoint) => !(website.scopes ?? [
+        { url: grant.target, addresses: website.addresses }
+      ]).some((scope) => new URL(scope.url).origin === endpoint.origin && scope.addresses[0] === endpoint.address)))
+        throw new HarnessError("investigation_scope", "Scanner endpoints must use the website grant’s pinned origin and address.");
+      if (live && [
+        ...live.requests,
+        ...live.sessions.map((session) => session.healthRequest)
+      ].some((request) => webExplicitAddress(website, grant.target, request) !== live.address || request.contentType !== undefined && !website.requestHeaders?.includes("content-type") || Object.keys(request.headers ?? {}).some((name) => !website.requestHeaders?.includes(name))))
+        throw new HarnessError("investigation_scope", "Live session requests must share the website's admitted paths, methods, headers and pinned address.");
+    }
+    if (scanners)
+      validateActiveScanners(scanners, grant.target, grant.config.buildIdentityRef);
+    if (grant.config.ownershipProof && grant.config.ownershipProof.host !== target.hostname)
+      throw new HarnessError("investigation_scope", "A recorded ownership proof must name the target host.");
+    if ((grant.boundary === "gvisor-brokered-web" || grant.boundary === "docker-brokered-web") !== Boolean(live || scanners || website || ports) || !live && !scanners && !website && !ports && !grant.config.captures.length)
+      throw new HarnessError("investigation_scope", "Live web access requires an explicit brokered container boundary; offline runs require captures.");
+    if (live) {
+      try {
+        validateLiveWeb(live, grant.target, website?.environment === "registered");
+      } catch {
+        throw new HarnessError("investigation_scope", "The live grant contains unbound requests, sessions or network scope.");
+      }
+      if (!grant.config.permissionPolicy || live.sessions.some((session) => !grant.config.permissionPolicy.identities.some((identity) => identity.id === session.id && identity.role === session.expected.role && identity.tenant === session.expected.tenant)))
+        throw new HarnessError("investigation_scope", "Live sessions must bind the approved permission policy identities.");
+    }
+    if (live && grant.config.permissionPolicy)
+      for (const comparison of live.comparisons ?? []) {
+        authorizationIdentities(comparison, live, grant.config.permissionPolicy);
+        const request = live.requests.find((entry) => entry.id === comparison.requestId);
+        if (!["GET", "HEAD"].includes(request.method))
+          throw new HarnessError("investigation_scope", "Authorization pair fixtures currently require read-only requests; state-changing flows need an admitted cleanup workflow.");
+      }
+    for (const testCase of live?.testCases ?? [])
+      if (!website || testCase.disposable.buildIdentityRef !== grant.config.buildIdentityRef || [...testCase.control.steps, ...testCase.test.steps].some((group) => group.length > website.concurrency))
+        throw new HarnessError("investigation_scope", "Executable cases require the exact disposable build and sufficient admitted concurrency.");
+    for (const profile of scanners?.profiles ?? [])
+      if (profile.identity && (!live || !website || !live.sessions.some((session) => session.id === profile.identity && session.capabilities?.includes("scanners")) || new URL(profile.url).origin !== target.origin))
+        throw new HarnessError("investigation_scope", "Authenticated scanners require a matching explicit session capability and a shared website policy.");
+    const ids = new Set;
+    const policy = grant.config.permissionPolicy;
+    if (policy && (policy.target !== grant.target || policy.buildIdentityRef !== grant.config.buildIdentityRef || grant.config.captures.some((capture) => !policy.identities.some((identity) => identity.id === capture.identity))))
+      throw new HarnessError("investigation_scope", "Expected permissions must bind this exact target, build and capture identities.");
+    for (const capture of grant.config.captures) {
+      const url2 = new URL(capture.url);
+      if (!withinHttpScope(target, url2) || ids.has(capture.id))
+        throw new HarnessError("investigation_scope", "Captures must have unique IDs and remain under the exact granted origin and path.");
+      ids.add(capture.id);
+    }
+  } else if (route.kind === "local") {
+    if (route.target !== grant.config.repository.repository || grant.config.change)
+      throw new HarnessError("investigation_scope", "A local review must name the pinned directory and carries no change.");
+  } else if (route.kind === "package") {
+    const source = grant.config.repository;
+    if (!packageSourceMatches(route, source.package) || source.repository !== packageIdentity(source.package) || source.commit !== source.package.sha256 || !source.snapshotFile || source.gitDirectory || source.retrieval || grant.config.change)
+      throw new HarnessError("investigation_scope", "A package review must bind the requested package and version to its verified published archive snapshot.");
+  } else {
+    if (route.kind === "web" || route.repository !== grant.config.repository.repository)
+      throw new HarnessError("investigation_scope", "Repository target must name the pinned repository: a GitHub repository or pull request URL for it.");
+    const change = grant.config.change;
+    const pullRequestId = route.kind === "pull_request" ? route.pullRequestId : undefined;
+    if ((pullRequestId !== undefined || change) && (change?.repository !== grant.config.repository.repository || change.pullRequestId !== pullRequestId || change.headRevision !== grant.config.repository.commit))
+      throw new HarnessError("investigation_scope", "The approved change must bind this exact repository, PR identity and head revision.");
+  }
+  const source = grant.mode === "codereview" ? grant.config : grant.config.sourceAssistance;
+  if (grant.mode === "pentest" && source) {
+    const binding = grant.config.sourceAssistance.binding;
+    if (binding.repository !== source.repository.repository || binding.revision !== source.repository.commit || binding.buildIdentityRef !== grant.config.buildIdentityRef || !grant.config.website?.registration || digest(binding.targetIdentity) !== digest(grant.config.website.registration.identity))
+      throw new HarnessError("investigation_scope", "Source assistance requires the approved repository, source revision and exact registered deployment identity. An operator mapping is not independent deployment attestation.");
+  }
+  if (source) {
+    const repository = source.repository;
+    if (repository.package && route.kind !== "package")
+      throw new HarnessError("investigation_scope", "Published package provenance requires a matching package target.");
+    if (!hasRepositorySource(repository))
+      throw new HarnessError("investigation_scope", "A repository requires exactly one trusted mirror or digest-bound source snapshot.");
+  }
+  if (source?.testProfiles) {
+    const profiles = source.testProfiles;
+    if (!grant.sandbox || !sandboxAllowsExecution(grant.sandbox, "test_run") || new Set(profiles.map((profile) => profile.id)).size !== profiles.length || profiles.some((profile) => !source.repository.paths.includes(profile.entrypoint)))
+      throw new HarnessError("investigation_scope", "Test profiles require gVisor isolation, unique IDs and explicitly approved entrypoints.");
+  }
+  if (grant.mode === "codereview" && (grant.config.semgrep || grant.config.secretScan || grant.config.joern || grant.config.dependencyScan) && !grant.sandbox)
+    throw new HarnessError("investigation_scope", "Source scanners require an explicitly admitted container boundary.");
+  if (grant.mode === "codereview" && grant.config.joern && !grant.stages)
+    throw new HarnessError("investigation_scope", "Joern requires a staged candidate verification job.");
+  if (grant.mode === "codereview" && grant.config.dependencyScan?.paths.some((path) => !grant.config.repository.paths.includes(path)))
+    throw new HarnessError("investigation_scope", "Dependency scanner paths must belong to the approved repository snapshot.");
+  deepFreeze(grant);
+  admittedGrants.add(grant);
+  return grant;
+}
+function grantRoute(grant) {
+  if (grant.mode === "pentest")
+    return routeTarget(grant.target);
+  if (grant.config.repository.package || /^(npm|pypi|cargo|oci):/.test(grant.target))
+    return routeTarget(grant.target);
+  if (grant.target.startsWith("/"))
+    return routeTarget(grant.target);
+  const { repository } = grant.config.repository;
+  const pullRequestId = grant.config.change?.pullRequestId;
+  if (grant.target === repository)
+    return sourceRoute(repository, pullRequestId);
+  const route = routeTarget(grant.target);
+  return route.kind === "repository" && pullRequestId !== undefined ? sourceRoute(route.repository, pullRequestId) : route;
+}
+function grantCapabilities(grant, route) {
+  const scanners = grant.mode === "codereview" ? SCANNER_CAPABILITIES.flatMap(({ profile, capability }) => grant.config[profile] ? [capability] : []) : [];
+  return {
+    defaults: [route.capabilities[0], ...scanners],
+    accepted: [
+      ...route.capabilities,
+      ...grant.mode === "codereview" && grant.config.change ? ["pull_requests"] : [],
+      ...scanners
+    ]
+  };
+}
+function investigationScope(grant) {
+  return grant.mode === "pentest" && grant.config.website?.scopes ? grant.config.website.scopes.map((scope) => scope.url) : [grant.target];
+}
+function investigationRunConfig(grant, profile) {
+  const route = grantRoute(grant);
+  return RunConfigSchema.parse({
+    contractVersion: CONTRACT_VERSION,
+    model: profile.route.model,
+    capabilities: grantCapabilities(grant, route).defaults,
+    targetKind: route.targetKind,
+    scope: investigationScope(grant),
+    ...grant.mode === "codereview" && grant.config.change ? { change: grant.config.change } : {}
+  });
+}
+function validateInvestigationRun(target, input, profile, grant) {
+  const route = grantRoute(grant);
+  const granted = grantCapabilities(grant, route);
+  const change = grant.mode === "codereview" ? grant.config.change : undefined;
+  const requested = RunConfigSchema.parse(input);
+  const capabilities = requested.capabilities ?? granted.defaults;
+  const config = RunConfigSchema.parse({
+    ...requested,
+    targetKind: requested.targetKind ?? route.targetKind,
+    capabilities,
+    scope: requested.scope ?? investigationScope(grant),
+    ...requested.change === undefined && change ? { change } : {}
+  });
+  if (grant.model && (grant.model.id !== profile.route.model || grant.model.provider !== profile.route.provider))
+    throw new HarnessError("scope_denied", "The model and provider must match the operator's grant.");
+  if (target !== grant.target || config.model !== profile.route.model || config.targetKind !== route.targetKind || capabilities.some((capability) => !granted.accepted.includes(capability)))
+    throw new HarnessError("unsupported_profile", "The run must match its explicitly configured investigation grant, boundary and model. Ungranted tools are not enabled.");
+  if (canonicalJson(config.scope ?? null) !== canonicalJson(investigationScope(grant)))
+    throw new HarnessError("scope_denied", "The investigation requires its exact configured scope.");
+  if (canonicalJson(config.change ?? null) !== canonicalJson(grant.mode === "codereview" ? grant.config.change ?? null : null))
+    throw new HarnessError("scope_denied", "PR identity, base and head must match the immutable review grant.");
+  return config;
+}
+function admitInvestigationModel(profile, grant) {
+  if (profile.pricing && !grant.model)
+    throw new HarnessError("scope_denied", "New paid investigations require a grant naming the permitted model and provider. Retain the original grant for recovery of existing runs.");
+}
+
+class InvestigationJournal extends PostgresJournal {
+  profile;
+  runtimeDigest;
+  reportScope = "assessment";
+  grant;
+  identity;
+  constructor(connection, profile, grant, authority, evidenceStore, runtimeDigest) {
+    super(connection, profile, authority, evidenceStore);
+    this.profile = profile;
+    this.runtimeDigest = runtimeDigest;
+    this.grant = investigationGrant(grant);
+    this.identity = canonicalJson(this.grant);
+    if (this.grant.sandbox && !runtimeDigest)
+      throw new HarnessError("investigation_config", "An isolated grant must be given the sandbox runtime digest that binds its task policy.");
+  }
+  get runtimeVersion() {
+    const isolation = this.grant.sandbox ? `/${this.runtimeDigest(this.grant.sandbox.image, sandboxRuntime(this.grant.sandbox))}` : "";
+    const scan = this.prescans.length ? "/prescan-v2" : "";
+    const recon = stagedWebsite(this.grant) ? "/site-recon-v2/stage-agents-v1/website-checks-v1" : "";
+    const changes = this.grant.mode === "codereview" && this.grant.config.change && this.grant.plan ? "/change-review-v1" : "";
+    return `${super.runtimeVersion}/investigator-v1/${this.grant.boundary}:${digest(this.identity)}${isolation}${scan}${recon}${changes}`;
+  }
+  get workerLimit() {
+    return this.grant.stages?.maxWorkers ?? 0;
+  }
+  get reportPlan() {
+    return executionPlan(this.grant.plan, this.grant.mode === "pentest" ? this.grant.config.websiteFamilies : undefined);
+  }
+  get reportRepository() {
+    return this.grant.mode === "codereview" ? this.grant.config.repository : this.grant.config.sourceAssistance?.repository;
+  }
+  get reportSourceBinding() {
+    return this.grant.mode === "pentest" ? this.grant.config.sourceAssistance?.binding : undefined;
+  }
+  get work() {
+    return new WorkJournal(this, {
+      scopeDigest: digest(this.grant),
+      targetRevision: this.grant.mode === "codereview" ? this.grant.config.repository.commit : this.grant.config.buildIdentityRef,
+      strategyVersion: workStrategy(this.grant.plan),
+      dispatchLimit: Math.min(this.grant.stages?.websiteWork?.maxItems ?? this.grant.stages?.maxWorkItems ?? 1000, this.reportPlan?.maxWorkItems ?? 1000)
+    }, this.grant);
+  }
+  get websiteWorklist() {
+    const grant = this.grant;
+    return stagedWebsite(grant) && grant.stages.websiteWork ? new WebsiteWorklist(this, grant.target, grant.config.website, {
+      ...grant.stages.websiteWork,
+      maxItems: Math.min(grant.stages.websiteWork.maxItems, this.reportPlan?.maxWorkItems ?? 1000),
+      maxRounds: Math.min(grant.stages.websiteWork.maxRounds, this.reportPlan?.web.maxRounds ?? 12)
+    }, grant.config.websiteFamilies ?? this.reportPlan?.web.classes, grant.config.live, grant.config.permissionPolicy) : undefined;
+  }
+  get prescans() {
+    if (this.grant.mode === "pentest")
+      return this.grant.config.website ? [
+        {
+          callId: `prescan:web_discover:${digest(this.identity)}`,
+          tool: "web_discover",
+          args: {}
+        }
+      ] : [];
+    const config = this.grant.config;
+    return [
+      ...config.secretScan ? ["secret_scan"] : [],
+      ...config.dependencyScan ? ["dependency_scan"] : [],
+      ...config.semgrep ? ["semgrep_scan"] : []
+    ].map((tool) => ({
+      callId: `prescan:${tool}:${digest(this.identity)}`,
+      tool,
+      args: {}
+    }));
+  }
+  get packageImportScans() {
+    const grant = this.grant;
+    if (grant.mode !== "codereview" || grant.config.repository.package?.ecosystem !== "npm" || !grant.sandbox || !sandboxAllowsExecution(grant.sandbox, "package_import_probe"))
+      return [];
+    return grant.config.repository.paths.filter(packageJavaScript).sort().map((path) => ({
+      callId: `prescan:package_import_probe:${digest({ identity: this.identity, path })}`,
+      tool: "package_import_probe",
+      args: { path }
+    }));
+  }
+  sourceChangeScan(path) {
+    return {
+      callId: `prescan:change_inspect:${digest({ identity: this.identity, path })}`,
+      tool: "change_inspect",
+      args: { paths: [path] }
+    };
+  }
+  get sourceChangeScans() {
+    const grant = this.grant;
+    if (grant.mode !== "codereview" || !grant.config.change || !grant.plan)
+      return [];
+    return [...grant.config.repository.paths].sort().map((path) => this.sourceChangeScan(path));
+  }
+  async sourceContextScan(runId, client = this.pool) {
+    const grant = this.grant;
+    const plan = this.reportPlan;
+    if (grant.mode !== "codereview" || !plan || grant.config.change)
+      return;
+    const saved = await sourceManifest(client, runId);
+    if (!saved)
+      return;
+    const manifest = saved.manifest;
+    if (manifest.repository !== grant.config.repository.repository || manifest.headRevision !== grant.config.repository.commit || saved.authorityDigest !== digest(grant.config.repository))
+      throw new HarnessError("evidence_integrity", "Source planning requires the admitted immutable inventory.");
+    const head = manifest.revisions.find((revision) => revision.commit === manifest.headRevision);
+    const paths = head.entries.filter((entry) => entry.admitted && ["javascript", "typescript"].includes(entry.language)).sort((a, b) => Number(/(route|controller|handler|middleware|auth)/i.test(b.path)) - Number(/(route|controller|handler|middleware|auth)/i.test(a.path)) || a.path.localeCompare(b.path)).slice(0, Math.min(8, plan.source.indexFiles)).map((entry) => entry.path);
+    return {
+      scan: paths.length ? {
+        callId: `prescan:repo_context:${digest({ identity: this.identity, plan })}`,
+        tool: "repo_context",
+        args: {
+          paths,
+          depth: plan.source.indexDepth,
+          maxFiles: plan.source.indexFiles
+        }
+      } : undefined
+    };
+  }
+  get websiteChecks() {
+    const grant = this.grant;
+    if (!stagedWebsite(grant))
+      return [];
+    return [
+      ...grant.config.website.browserVersion ? [{ tool: "web_browse", args: { url: grant.target, actions: [] } }] : [],
+      ...(grant.config.live?.sessions ?? []).map((session) => ({
+        tool: "session_health",
+        args: { identity: session.id }
+      }))
+    ].map((scan) => ({
+      ...scan,
+      callId: `website-check:${scan.tool}:${digest({ identity: this.identity, args: scan.args })}`
+    }));
+  }
+  get portScans() {
+    const grant = this.grant;
+    return grant.mode === "pentest" && grant.config.portScan ? [
+      {
+        callId: `prescan:port_scan:${digest(grant.config.portScan)}`,
+        tool: "port_scan",
+        args: {}
+      }
+    ] : [];
+  }
+  get websiteScans() {
+    const grant = this.grant;
+    return stagedWebsite(grant) ? (grant.config.scanners?.profiles ?? []).filter((profile) => profile.tool !== "sqli_confirm").map((profile) => webScannerCall(grant.config.buildIdentityRef, profile)) : [];
+  }
+  verificationScans(finding) {
+    if (this.grant.mode === "codereview" && this.grant.stages && this.grant.config.joern) {
+      const repository = this.grant.config.repository;
+      const trace = joernCandidate(finding, {
+        repository: repository.repository,
+        revision: repository.commit,
+        paths: repository.paths
+      });
+      return trace ? [
+        {
+          callId: `verify-joern:${digest({ findingId: finding.id, profile: this.grant.config.joern, trace })}`,
+          tool: "joern_confirm",
+          args: { findingId: finding.id }
+        }
+      ] : [];
+    }
+    if (this.grant.mode !== "pentest" || !this.grant.stages)
+      return [];
+    return (this.grant.config.scanners?.profiles ?? []).filter((profile) => profile.tool === "sqli_confirm" && sqlmapCandidate(finding, profile)).map((profile) => ({
+      callId: `verify-sqli:${digest({ findingId: finding.id, profile })}`,
+      tool: "sqli_confirm",
+      args: { profileId: profile.id, findingId: finding.id }
+    }));
+  }
+  async assertActionProposal(client, runId, callId, tool, argsDigest, args, childId) {
+    if (!childId && stagedWebsite(this.grant) && callId === SITE_RECON_SCAN.callId && tool === SITE_RECON_SCAN.tool && argsDigest === digest(SITE_RECON_SCAN.args)) {
+      const completed = await client.query("SELECT 1 FROM harness_mastra.child_jobs WHERE run_id=$1 AND job_key=$2 AND state='completed'", [runId, SITE_RECON_JOB]);
+      if (completed.rowCount)
+        return;
+    }
+    if (!childId && callId === "environment-check-v1" && tool === "environment_check" && argsDigest === digest({}) && environmentRequirements(this.grant))
+      return;
+    if (!childId && [
+      ...this.prescans,
+      ...this.packageImportScans,
+      ...this.portScans,
+      ...this.websiteChecks,
+      ...this.websiteScans
+    ].some((scan) => callId === scan.callId && tool === scan.tool && argsDigest === digest(scan.args)))
+      return;
+    if (!childId && tool === "change_inspect" && this.grant.mode === "codereview" && this.grant.config.change && this.grant.plan) {
+      const selected = object({ paths: array(string()).length(1) }).safeParse(args);
+      if (selected.success && this.grant.config.repository.paths.includes(selected.data.paths[0])) {
+        const scan = this.sourceChangeScan(selected.data.paths[0]);
+        if (callId === scan.callId && argsDigest === digest(scan.args))
+          return;
+      }
+    }
+    if (!childId && tool === "repo_context") {
+      const planned = await this.sourceContextScan(runId, client);
+      if (planned?.scan && planned.scan.callId === callId && argsDigest === digest(planned.scan.args))
+        return;
+    }
+    const candidate = object({ findingId: string() }).safeParse(args);
+    if (["sqli_confirm", "joern_confirm"].includes(tool) && childId && candidate.success) {
+      const records = await client.query("SELECT f.finding,j.job_key FROM harness_mastra.child_jobs j JOIN harness_mastra.findings f ON f.run_id=j.run_id AND f.id=$3 WHERE j.run_id=$1 AND j.id=$2 AND f.status='candidate' AND f.result='pending'", [runId, childId, candidate.data.findingId]);
+      const row = records.rows[0];
+      if (row && ownsVerificationJob(row.job_key, row.finding.id) && this.verificationScans(row.finding).some((scan) => scan.callId === callId && scan.tool === tool && digest(scan.args) === argsDigest))
+        return;
+    }
+    if (tool === "joern_confirm")
+      throw new HarnessError("scanner_denied", "Joern runs only once in its admitted candidate verification job.");
+    await super.assertActionProposal(client, runId, callId, tool, argsDigest, args, childId);
+  }
+  async assertInvestigation(lease, context) {
+    const run = await this.read(lease.runId);
+    if (context.profile.runtimeVersion !== this.profile.runtimeVersion || run.chat || context.mode !== this.grant.mode || canonicalJson(context.config) !== canonicalJson(this.grant.config) || canonicalJson(context.capabilities) !== canonicalJson(run.config.capabilities))
+      throw new HarnessError("investigation_identity", "The execution context must match its durable grant, model route and accounting.");
+    await this.assertRecoverable(lease);
+  }
+  validateRun(target, input) {
+    return validateInvestigationRun(target, input, this.profile, this.grant);
+  }
+  admitRun() {
+    admitInvestigationModel(this.profile, this.grant);
+  }
+  parseEvent(input) {
+    return EventSchema.parse(input);
+  }
+  describeRun(target, config) {
+    return {
+      target,
+      mode: this.grant.mode,
+      capabilities: config.capabilities
+    };
+  }
+  async appendInvestigationSummary(lease, summary) {
+    await this.fenced(lease, async ({ client }) => {
+      const previous = await client.query("SELECT 1 FROM harness_mastra.events WHERE run_id=$1 AND payload->>'type'='step' AND payload->>'stepId'='investigation-summary-v1'", [lease.runId]);
+      if (!previous.rowCount)
+        await this.append(client, lease.runId, {
+          type: "step",
+          stepId: "investigation-summary-v1",
+          summary
+        });
+    });
+  }
+  async recordedExternal(client, runId, kind, key, requestDigest) {
+    const previous = (await client.query("SELECT * FROM harness_mastra.external_operations WHERE run_id=$1 AND kind=$2 AND operation_key=$3", [runId, kind, key])).rows[0];
+    if (!previous)
+      return;
+    if (previous.request_digest !== requestDigest)
+      throw new HarnessError("operation_conflict", "A recorded external operation cannot be replaced with a different intent.");
+    if (previous.state !== "completed")
+      throw new HarnessError("uncertain_execution", "The external operation may already have executed. Reconcile it before attempting any replacement; no retry was sent.");
+    return {
+      runId,
+      kind,
+      key,
+      owner: previous.owner,
+      requestDigest,
+      artifactRef: previous.artifact_ref
+    };
+  }
+  async completedExternal(runId, kind, key, intent) {
+    await this.read(runId);
+    const recorded = await this.recordedExternal(this.pool, runId, kind, key, digest(intent));
+    return recorded?.artifactRef;
+  }
+  async reserveExternal(runId, kind, key, intent, lease) {
+    if (!key || key.length > 256 || Buffer.byteLength(canonicalJson(intent)) > 65536 || captureEvidence(intent).bytes !== canonicalJson(intent))
+      throw new HarnessError("operation_denied", "Invalid bounded external operation intent.");
+    return this.transaction(async (client) => {
+      const row = await this.locked(client, runId);
+      const run = this.record(row);
+      if (lease)
+        await this.checkDispatch(client, row, lease);
+      else if (run.terminal?.outcome !== "completed" || !run.terminal.cleanupOk)
+        throw new HarnessError("operation_denied", "External assessment stages require a completed run with verified cleanup.");
+      const requestDigest = digest(intent);
+      const recorded = await this.recordedExternal(client, runId, kind, key, requestDigest);
+      if (recorded)
+        return recorded;
+      const parsed = kind === "gyms" ? VerificationIntentSchema.parse(intent) : undefined;
+      const unresolved = await client.query("SELECT e.kind,e.intent,c.state,c.parent_epoch,c.lease_until>clock_timestamp() AS live FROM harness_mastra.external_operations e LEFT JOIN harness_mastra.child_jobs c ON c.id=e.child_id AND c.run_id=e.run_id WHERE e.run_id=$1 AND e.state='dispatched'", [runId]);
+      const parallel = parsed && lease?.child && this.grant.verifiers?.some((verifier) => canonicalJson(verifier.targetIdentity) === canonicalJson(TargetIdentitySchema.strip().parse(parsed.request.identity)));
+      if (unresolved.rows.some((operation) => !parallel || operation.kind !== "gyms" || operation.state !== "running" || operation.parent_epoch !== lease?.epoch || !operation.live))
+        throw new HarnessError("uncertain_execution", "Another external operation is unresolved; a new ID cannot bypass it.");
+      if (parsed) {
+        const candidate = (await this.findings(runId, client)).find((entry) => entry.finding.id === parsed.request.candidate.id);
+        if (!candidate || !["pending", "needs_human"].includes(candidate.result) || parsed.request.identity.runId !== runId || key !== `${parsed.request.candidate.id}/${parsed.request.identity.attemptId}` || candidateRevision(candidate.finding) !== candidateRevision(parsed.request.candidate))
+          throw new HarnessError("verification_denied", "Only the exact committed undecided candidate can be verified.");
+      }
+      const identity = parsed?.request.identity;
+      const slot = identity ? digest({ rangeId: identity.rangeId, instanceId: identity.instanceId }) : null;
+      if (slot) {
+        await client.query("SELECT pg_advisory_xact_lock(hashtext($1))", [
+          slot
+        ]);
+        const occupied = await client.query("SELECT 1 FROM harness_mastra.external_operations WHERE verification_slot=$1 AND state='dispatched' LIMIT 1", [slot]);
+        if (occupied.rowCount)
+          throw new HarnessError("uncertain_execution", "This verification instance has an unresolved operation.");
+      }
+      const owner = randomUUID2();
+      await client.query("INSERT INTO harness_mastra.external_operations(run_id,kind,operation_key,owner,request_digest,intent,state,child_id,verification_slot) VALUES ($1,$2,$3,$4,$5,$6,'dispatched',$7,$8)", [
+        runId,
+        kind,
+        key,
+        owner,
+        requestDigest,
+        intent,
+        lease?.child?.id ?? null,
+        slot
+      ]);
+      return { runId, kind, key, owner, requestDigest };
+    });
+  }
+  async dispatchedExternal(client, operation, lease) {
+    const stored = (await client.query("SELECT intent FROM harness_mastra.external_operations WHERE run_id=$1 AND kind=$2 AND operation_key=$3 AND owner=$4 AND request_digest=$5 AND state='dispatched' AND ($6::uuid IS NULL OR child_id=$6)", [
+      operation.runId,
+      operation.kind,
+      operation.key,
+      operation.owner,
+      operation.requestDigest,
+      lease?.child?.id ?? null
+    ])).rows[0];
+    if (!stored)
+      throw new HarnessError("operation_denied", "No matching dispatched external operation exists.");
+    return stored.intent;
+  }
+  async completeExternal(operation, value, verification, lease) {
+    const result = captureEvidence(value);
+    if (Buffer.byteLength(result.bytes) > 65536 || result.bytes !== canonicalJson(value))
+      throw new HarnessError("operation_denied", "External operation result exceeds the capture bound or is not already redacted.");
+    if (operation.kind !== "gyms" && verification)
+      throw new HarnessError("operation_denied", "Delivery cannot confirm a finding.");
+    const { run, authority, intent } = await this.transaction(async (client) => {
+      const row = await this.locked(client, operation.runId);
+      if (lease)
+        await this.checkOwner(client, row, lease);
+      return {
+        run: this.record(row),
+        authority: row.authority ?? null,
+        intent: await this.dispatchedExternal(client, operation, lease)
+      };
+    });
+    let admitted;
+    let inconclusive;
+    if (operation.kind === "gyms") {
+      const parsed = VerificationIntentSchema.parse(intent);
+      const verdict = validateOracleVerdict(parsed.request, value);
+      if (verdict.artifactRef || verification) {
+        if (!verification || Buffer.byteLength(verification.proof) > 65536 || captureEvidence(JSON.parse(verification.proof)).bytes !== verification.proof || verdict.artifactRef !== `sha256:${sha256(verification.proof)}`)
+          throw new HarnessError("verification_denied", "The protected verifier proof must be exact canonical redacted evidence bound to its verdict.");
+      }
+      if (verdict.result === "needs_human" && verification?.finding)
+        throw new HarnessError("verification_denied", "Inconclusive reproduction cannot supply a decided finding.");
+      if (verdict.result === "needs_human" && verification)
+        inconclusive = verdict;
+      if (verdict.result !== "needs_human") {
+        if (!verification?.finding)
+          throw new HarnessError("verification_denied", "Decided verification requires its independently admitted finding.");
+        admitted = await admitIndependentVerification(parsed.request.candidate, {
+          result: verdict.result,
+          method: verdict.method,
+          artifactRef: verdict.artifactRef,
+          receipt: verdict.receipt
+        }, {
+          ...parsed.context,
+          runId: run.id,
+          capabilities: run.config.capabilities ?? [],
+          now: new Date,
+          getToolCall: completedToolCalls(run.id, await this.actions(run.id)),
+          getArtifact: async (runId, ref) => runId === run.id && ref === verdict.artifactRef ? { bytes: verification.proof, redacted: true } : this.artifact(runId, ref)
+        });
+        if (canonicalJson(admitted) !== canonicalJson(verification.finding))
+          throw new HarnessError("verification_denied", "The requested update differs from the admitted verification.");
+        const current = (await this.findings(run.id)).find((entry) => entry.finding.id === admitted.id);
+        if (!current || !["pending", "needs_human"].includes(current.result) || candidateRevision(current.finding) !== candidateRevision(admitted))
+          throw new HarnessError("verification_denied", "The candidate was decided concurrently; no verdict was overwritten.");
+      }
+    }
+    const capture = await this.storeCapture(run.id, result.bytes, authority);
+    const proofCapture = verification ? await this.storeCapture(run.id, verification.proof, authority) : undefined;
+    await this.transaction(async (client) => {
+      const row = await this.locked(client, run.id);
+      if (lease)
+        await this.checkOwner(client, row, lease);
+      const completed = await client.query("UPDATE harness_mastra.external_operations SET state='completed',artifact_ref=$6,completed_at=clock_timestamp() WHERE run_id=$1 AND kind=$2 AND operation_key=$3 AND owner=$4 AND request_digest=$5 AND state='dispatched' AND ($7::uuid IS NULL OR child_id=$7)", [
+        run.id,
+        operation.kind,
+        operation.key,
+        operation.owner,
+        operation.requestDigest,
+        capture.ref,
+        lease?.child?.id ?? null
+      ]);
+      if (completed.rowCount !== 1)
+        throw new HarnessError("operation_denied", "External completion has no matching dispatch.");
+      await this.insertArtifact(client, run.id, capture);
+      if (proofCapture)
+        await this.insertArtifact(client, run.id, proofCapture);
+      if (inconclusive && proofCapture) {
+        const current = (await this.findings(run.id, client)).find((entry) => entry.finding.id === inconclusive.identity.candidateId);
+        if (!current || !["pending", "needs_human"].includes(current.result) || candidateRevision(current.finding) !== inconclusive.identity.candidateRevision)
+          throw new HarnessError("verification_denied", "The candidate changed during inconclusive reproduction.");
+        if (current.result === "pending")
+          await this.humanSettlement(client, run.id, current, proofCapture.ref);
+        else {
+          const finding = {
+            ...current.finding,
+            verification: {
+              result: "needs_human",
+              artifactRef: proofCapture.ref
+            }
+          };
+          await client.query("UPDATE harness_mastra.findings SET finding=$3 WHERE run_id=$1 AND id=$2", [run.id, finding.id, finding]);
+          await this.append(client, run.id, {
+            type: "finding.update",
+            findingId: finding.id,
+            status: "candidate",
+            verification: finding.verification
+          });
+        }
+      }
+      if (admitted && proofCapture) {
+        const updated = await client.query("UPDATE harness_mastra.findings SET status=$3,result=$4,finding=$5 WHERE run_id=$1 AND id=$2 AND candidate_revision=$6 AND result IN ('pending','needs_human')", [
+          run.id,
+          admitted.id,
+          admitted.status,
+          admitted.verification.result,
+          admitted,
+          candidateRevision(admitted)
+        ]);
+        if (updated.rowCount !== 1)
+          throw new HarnessError("verification_denied", "The candidate was decided concurrently; no verdict was overwritten.");
+        await this.append(client, run.id, {
+          type: "finding.update",
+          findingId: admitted.id,
+          status: admitted.status,
+          verification: admitted.verification
+        });
+      }
+    });
+    return capture.ref;
+  }
+  async reportVerification(runId) {
+    await this.read(runId);
+    const result = await this.pool.query("SELECT intent,completed_at FROM harness_mastra.external_operations WHERE run_id=$1 AND kind='gyms' AND state='completed' ORDER BY completed_at", [runId]);
+    const policies = new Map;
+    for (const row of result.rows) {
+      const { context } = VerificationIntentSchema.parse(row.intent);
+      policies.set(digest(context), context);
+    }
+    return {
+      policies: [...policies.values()],
+      verifiedAt: result.rows.at(-1)?.completed_at
+    };
+  }
+  async reportWorklist(runId, surface) {
+    const work = await this.websiteWorklist?.read(runId, surface);
+    return work ? {
+      items: work.items,
+      discoveryOmissions: work.omitted,
+      pendingLimit: work.pendingLimit
+    } : undefined;
+  }
+  async reportWeb(runId, client = this.pool) {
+    const grant = this.grant;
+    return grant.mode === "pentest" && (grant.config.website || grant.config.live || grant.config.apiDescriptions) ? webSurface(this, runId, {
+      target: grant.target,
+      targetRevision: grant.config.buildIdentityRef,
+      scope: grant.config.website ?? (grant.config.live ? liveWebScope(grant.config.live, grant.target) : undefined),
+      descriptions: grant.config.apiDescriptions,
+      live: grant.config.live,
+      permissionPolicy: grant.config.permissionPolicy,
+      scanners: grant.config.website && grant.stages ? grant.config.scanners : undefined
+    }, client) : undefined;
+  }
+  async verificationCoverage(runId) {
+    await this.read(runId);
+    const verified = await this.pool.query("SELECT intent,artifact_ref FROM harness_mastra.external_operations WHERE run_id=$1 AND kind='gyms' AND state='completed'", [runId]);
+    const verifiedIds = new Set;
+    const verdicts = await Promise.all(verified.rows.map(async (row) => {
+      const { request } = VerificationIntentSchema.parse(row.intent);
+      return {
+        request,
+        verdict: validateOracleVerdict(request, JSON.parse((await this.artifact(runId, row.artifact_ref)).bytes))
+      };
+    }));
+    for (const { request, verdict } of verdicts) {
+      if (verdict.result !== "needs_human")
+        verifiedIds.add(request.candidate.id);
+    }
+    const byClass = new Map;
+    for (const record of await this.findings(runId)) {
+      const cwe = record.finding.cwe ?? "unclassified";
+      const entry = byClass.get(cwe) ?? {
+        candidates: 0,
+        confirmed: 0,
+        independentlyVerified: 0
+      };
+      entry.candidates++;
+      if (record.status === "confirmed")
+        entry.confirmed++;
+      if (verifiedIds.has(record.finding.id))
+        entry.independentlyVerified++;
+      byClass.set(cwe, entry);
+    }
+    return [...byClass.entries()].map(([cwe, entry]) => ({ cwe, ...entry })).sort((a, b) => a.cwe.localeCompare(b.cwe));
+  }
+}
+
+// apps/harness/src/storage/website-setup.ts
+var WEBSITE_PRESETS = {
+  quick: {
+    durationMs: 600000,
+    maxRequests: 100,
+    maxPages: 5,
+    maxDepth: 1,
+    maxTotalBytes: 8388608
+  },
+  standard: {
+    durationMs: 900000,
+    maxRequests: 500,
+    maxPages: 10,
+    maxDepth: 2,
+    maxTotalBytes: 33554432
+  },
+  deep: {
+    durationMs: 3600000,
+    maxRequests: 2000,
+    maxPages: 40,
+    maxDepth: 5,
+    maxTotalBytes: 134217728
+  }
+};
+function websiteLimits(policy, request) {
+  const limits = {
+    ...request.trafficPreset ? WEBSITE_PRESETS[request.trafficPreset] : {},
+    ...request.limits
+  };
+  const selected = { ...policy };
+  for (const key of [
+    "maxRequests",
+    "maxTotalBytes",
+    "maxPages",
+    "maxDepth",
+    "requestsPerSecond",
+    "concurrency"
+  ]) {
+    const value = limits[key];
+    if (value !== undefined)
+      selected[key] = Math.min(policy[key], value);
+  }
+  return selected;
+}
+function websiteSetup(profile) {
+  if (profile.mode !== "pentest")
+    return;
+  return {
+    profileId: profile.id,
+    identities: profile.grant.config.live?.sessions.map((entry) => entry.id) ?? [],
+    apiDescriptions: [
+      ...new Set([
+        ...profile.apiDescriptions?.map((entry) => entry.id) ?? [],
+        ...profile.grant.config.apiDescriptions?.map((entry) => entry.id) ?? []
+      ])
+    ],
+    scanners: profile.grant.config.scanners?.profiles.map((entry) => entry.id) ?? [],
+    verifiers: profile.grant.verifiers?.map((entry) => `${entry.targetIdentity.rangeId}/${entry.targetIdentity.instanceId}`) ?? [],
+    ...profile.grant.config.websiteFamilies ? { families: profile.grant.config.websiteFamilies } : {}
+  };
+}
+function selectWebsiteProfile(request, source) {
+  if (source.mode !== "pentest")
+    throw new HarnessError("preparation_denied", "Website setup requires an approved pentest profile.");
+  const profile = structuredClone(source);
+  const select = (values, ids, id) => {
+    if (ids === undefined)
+      return [...values];
+    if (new Set(ids).size !== ids.length || ids.some((key) => !values.some((value) => id(value) === key)))
+      throw new HarnessError("preparation_denied", "Every selected capability must name a unique entry in the approved profile.");
+    return values.filter((value) => ids.includes(id(value)));
+  };
+  const config = profile.grant.config;
+  if (request.families) {
+    if (config.websiteFamilies && request.families.some((family) => !config.websiteFamilies.includes(family)))
+      throw new HarnessError("preparation_denied", "Selected families must remain within the approved profile.");
+    config.websiteFamilies = [...request.families];
+  }
+  if (request.trafficPreset || request.limits) {
+    if (!config.website)
+      throw new HarnessError("preparation_denied", "Traffic selection requires an approved website policy.");
+    config.website = websiteLimits(config.website, request);
+  }
+  if (config.live) {
+    const sessions = select(config.live.sessions, request.identities, (entry) => entry.id);
+    if (sessions.length) {
+      const ids = new Set(sessions.map((entry) => entry.id));
+      const comparisons = config.live.comparisons?.filter((entry) => (!config.websiteFamilies || config.websiteFamilies.includes("authorization")) && [entry.controlRuleId, entry.comparisonRuleId].every((id) => config.permissionPolicy?.rules.some((rule) => rule.id === id && ids.has(rule.identity))));
+      config.live = {
+        ...config.live,
+        sessions,
+        ...comparisons?.length ? { comparisons } : {}
+      };
+      if (!comparisons?.length)
+        delete config.live.comparisons;
+      const testCases = config.live.testCases?.filter((entry) => (!config.websiteFamilies || config.websiteFamilies.includes(entry.family)) && caseSteps(entry).every((step) => ids.has(step.identity)));
+      if (testCases?.length)
+        config.live.testCases = testCases;
+      else
+        delete config.live.testCases;
+    } else
+      delete config.live;
+  } else
+    select([], request.identities, String);
+  if (config.scanners) {
+    const profiles = select(config.scanners.profiles, request.scanners, (entry) => entry.id);
+    if (profiles.length)
+      config.scanners = { ...config.scanners, profiles };
+    else
+      delete config.scanners;
+  } else
+    select([], request.scanners, String);
+  const descriptions = websiteSetup(profile).apiDescriptions;
+  select(descriptions, request.apiDescriptions, String);
+  if (request.apiDescriptions) {
+    if (profile.apiDescriptions) {
+      profile.apiDescriptions = profile.apiDescriptions.filter((entry) => request.apiDescriptions.includes(entry.id));
+      if (!profile.apiDescriptions.length)
+        delete profile.apiDescriptions;
+    }
+    if (config.apiDescriptions)
+      config.apiDescriptions = config.apiDescriptions.filter((entry) => request.apiDescriptions.includes(entry.id));
+  }
+  const verifiers = select(profile.grant.verifiers ?? [], request.verifiers, (entry) => `${entry.targetIdentity.rangeId}/${entry.targetIdentity.instanceId}`);
+  if (verifiers.length)
+    profile.grant.verifiers = verifiers;
+  else
+    delete profile.grant.verifiers;
+  return profile;
+}
+
+// apps/harness/src/storage/investigation-profiles.ts
+var source = InvestigationGrantSchema.options[1];
+var base = {
+  id: IdSchema,
+  authority: RunAuthoritySchema,
+  expiresAt: exports_iso.datetime(),
+  models: array(InvestigationModelSchema).min(1).max(1024),
+  stages: source.shape.stages.unwrap(),
+  defaultDepth: InvestigationDepthSchema.optional()
+};
+var InvestigationProfileSchema = discriminatedUnion("mode", [
+  strictObject({
+    ...base,
+    mode: literal("codereview"),
+    sandbox: SandboxConfigSchema,
+    workspaceRoot: string().startsWith("/"),
+    localRoot: string().startsWith("/").max(256).optional(),
+    maxFiles: number().int().min(1).max(SOURCE_FILES_MAX),
+    maxSourceBytes: number().int().min(1).max(SOURCE_TOTAL_BYTES),
+    sourceExpansion: SourceReadPolicySchema.optional(),
+    githubTokenFile: string().startsWith("/").optional(),
+    allowPatchProposals: literal(true).optional(),
+    testProfiles: source.shape.config.shape.testProfiles,
+    verifiers: source.shape.verifiers,
+    experiments: ExperimentPolicySchema.optional(),
+    secretScan: SecretScanProfileSchema.optional(),
+    dependencyScan: DependencyScanProfileSchema.omit({
+      paths: true
+    }).optional(),
+    semgrep: SemgrepProfileSchema.optional(),
+    joern: JoernProfileSchema.optional()
+  }),
+  strictObject({
+    ...base,
+    mode: literal("pentest"),
+    grant: InvestigationGrantSchema.options[0],
+    apiDescriptions: array(ApiDescriptionReferenceSchema).min(1).max(4).optional()
+  })
+]);
+async function loadReviewVerifiers(path) {
+  try {
+    return source.shape.verifiers.unwrap().parse(JSON.parse(await privateFile(path, 1048576)));
+  } catch {
+    throw new HarnessError("investigation_config", "HARNESS_REVIEW_VERIFIERS_FILE must name a private, operator-owned JSON array of one to eight pinned verifiers (maximum 1 MiB). No supplied contents are logged.");
+  }
+}
+var InvestigationProfilesSchema = array(InvestigationProfileSchema).min(1).max(64).refine((profiles) => new Set(profiles.map((profile) => profile.id)).size === profiles.length).transform((profiles, context) => {
+  try {
+    return profiles.map(routedProfile);
+  } catch {
+    context.addIssue({
+      code: "custom",
+      message: "Every pentest grant URL must route to an http(s) site."
+    });
+    return NEVER;
+  }
+});
+function routedProfile(profile) {
+  if (profile.mode === "codereview")
+    return profile;
+  const { grant } = profile;
+  const { permissionPolicy, website } = grant.config;
+  return {
+    ...profile,
+    grant: {
+      ...grant,
+      target: siteHref(grant.target),
+      config: {
+        ...grant.config,
+        ...permissionPolicy ? {
+          permissionPolicy: {
+            ...permissionPolicy,
+            target: siteHref(permissionPolicy.target)
+          }
+        } : {},
+        ...website?.scopes ? {
+          website: {
+            ...website,
+            scopes: website.scopes.map((scope) => ({
+              ...scope,
+              url: siteHref(scope.url)
+            }))
+          }
+        } : {}
+      }
+    }
+  };
+}
+function siteHref(url) {
+  const route = routeTarget(url);
+  if (route.kind !== "web")
+    throw new HarnessError("investigation_config", "A pentest grant URL must name an http(s) site.");
+  return route.target;
+}
+async function loadInvestigationProfiles(path) {
+  let profiles;
+  try {
+    profiles = InvestigationProfilesSchema.parse(JSON.parse(await privateFile(path, 1048576)));
+  } catch {
+    throw new HarnessError("investigation_config", "Use a private, operator-owned UTF-8 JSON array of investigation profiles (maximum 1 MiB). No supplied contents are logged.");
+  }
+  for (const profile of profiles)
+    if (profile.mode === "codereview" && profile.testProfiles) {
+      const tests = profile.testProfiles;
+      if (!sandboxAllowsExecution(profile.sandbox, "test_run") || new Set(tests.map((test) => test.id)).size !== tests.length || tests.length > profile.maxFiles)
+        throw new HarnessError("investigation_config", "Test profiles require gVisor isolation, unique IDs and no more entrypoints than maxFiles.");
+    }
+  return profiles;
+}
+function admitPreparation(profile, authority, request, now = Date.now()) {
+  const target = routeTarget(request.target);
+  const permitted = digest(profile.authority) === digest(authority) && profile.id === request.profileId && Date.parse(profile.expiresAt) > now && profile.models.some((model) => model.id === request.model) && (!request.setup || profile.mode === "pentest") && (profile.mode === "codereview" ? profile.localRoot ? target.kind === "local" && target.target === profile.localRoot && !profile.sourceExpansion : target.kind === "repository" || target.kind === "pull_request" || target.kind === "package" : target.kind === "web" && !request.paths && profile.grant.target === target.target);
+  if (!permitted)
+    throw new HarnessError("preparation_denied", "The requested target or model is outside the operator's current investigation profile.");
+  const proofs = profile.mode === "pentest" ? [
+    ...profile.grant.config.ownershipProof ? [profile.grant.config.ownershipProof] : [],
+    ...profile.grant.config.ownershipProofs ?? []
+  ] : [];
+  for (const proof of proofs)
+    if (proof.token !== ownershipToken(authority, proof.apex ?? proof.host) || Date.parse(proof.expiresAt) <= now)
+      throw new HarnessError("preparation_denied", "The recorded ownership proof is not bound to this operator and host.");
+}
+function automaticWebsiteProfile(profiles, authority, target, model, now = Date.now()) {
+  const matches = profiles.filter((profile) => profile.mode === "pentest" && profile.grant.config.website && profile.grant.target === target && digest(profile.authority) === digest(authority) && Date.parse(profile.expiresAt) > now && profile.models.some((entry) => entry.id === model.id && entry.provider === model.provider));
+  if (matches.length > 1)
+    throw new HarnessError("preparation_denied", `More than one approved website profile matches. Choose a profileId: ${matches.map((profile) => profile.id).join(", ")}.`);
+  const selected = matches[0];
+  if (selected)
+    admitPreparation(selected, authority, { profileId: selected.id, target, model: model.id }, now);
+  return selected;
+}
+async function preparedWebsiteGrant(profile, request) {
+  if (request.setup)
+    profile = selectWebsiteProfile(request.setup, profile);
+  const grant = InvestigationGrantSchema.options[0].parse(profileGrant(profile, request));
+  if (!profile.apiDescriptions)
+    return grant;
+  const descriptions = [
+    ...grant.config.apiDescriptions ?? [],
+    ...await Promise.all(profile.apiDescriptions.map(async (reference) => {
+      const description = apiDescription(reference, await privateFile(reference.documentFile, 1048576));
+      if (reference.source) {
+        const { originalFile, ...source } = reference.source;
+        if (sha256(await privateFile(originalFile, 1048576)) !== source.sha256)
+          throw new HarnessError("preparation_api", "The original API description differs from its pinned source digest.");
+        description.source = source;
+      }
+      return description;
+    }))
+  ];
+  if (new Set(descriptions.map((entry) => entry.id)).size !== descriptions.length)
+    throw new HarnessError("preparation_api", "API descriptions must have unique operator-owned IDs.");
+  return investigationGrant({
+    ...grant,
+    config: { ...grant.config, apiDescriptions: descriptions }
+  });
+}
+function profileGrant(profile, request, source) {
+  const model = profile.models.find((entry) => entry.id === request.model);
+  const depth = request.depth ?? profile.defaultDepth;
+  const shared = {
+    model,
+    stages: profile.stages,
+    ...depth ? { plan: { version: "1.0.0", depth } } : {}
+  };
+  if (profile.mode === "pentest")
+    return investigationGrant({ ...profile.grant, ...shared });
+  if (!source)
+    throw new HarnessError("preparation_source", "An immutable repository snapshot is required.");
+  const { retrieval: _retrieval, ...repository } = source.repository;
+  const sourceExpansion = routeTarget(request.target).kind === "package" ? undefined : profile.sourceExpansion;
+  return investigationGrant({
+    mode: "codereview",
+    target: request.target,
+    ...shared,
+    sandbox: profile.sandbox,
+    ...profile.verifiers ? { verifiers: profile.verifiers } : {},
+    boundary: sandboxRuntime(profile.sandbox) === "runc" ? "docker-repository" : "gvisor-repository",
+    config: {
+      repository: {
+        ...repository,
+        ...sourceExpansion ? {
+          retrieval: {
+            policy: sourceExpansion,
+            expiresAt: profile.expiresAt,
+            ...profile.githubTokenFile ? { githubTokenFile: profile.githubTokenFile } : {}
+          }
+        } : {}
+      },
+      ...source.change ? { change: source.change } : {},
+      ...profile.allowPatchProposals ? { allowPatchProposals: true } : {},
+      ...profile.testProfiles?.some((test) => repository.paths.includes(test.entrypoint)) ? {
+        testProfiles: profile.testProfiles.filter((test) => repository.paths.includes(test.entrypoint))
+      } : {},
+      ...profile.experiments ? { experiments: profile.experiments } : {},
+      ...profile.secretScan ? { secretScan: profile.secretScan } : {},
+      ...profile.semgrep ? { semgrep: profile.semgrep } : {},
+      ...profile.joern ? { joern: profile.joern } : {},
+      ...profile.dependencyScan && source.dependencyPaths.length ? {
+        dependencyScan: {
+          ...profile.dependencyScan,
+          paths: source.dependencyPaths
+        }
+      } : {}
+    }
+  });
+}
+
+export { liveRoute, liveProfiles, AdapterJournal, CallbackOpenSchema, CallbackReadSchema, CallbackReadResultSchema, CallbackJournal, StageAnalysisSchema, stagedWebsite, stageAnalyses, environmentRequirements, capabilityPlan, PENTEST_CONFIG, SITE_RECON_JOB, SITE_RECON_SCAN, SiteReconFileSchema, captureSiteRecon, completedToolCalls, AgentAConfigSchema, AgentBConfigSchema, GymsVerifierSchema, loadInvestigationGrant, investigationGrant, investigationScope, investigationRunConfig, validateInvestigationRun, admitInvestigationModel, InvestigationJournal, WEBSITE_PRESETS, websiteLimits, websiteSetup, selectWebsiteProfile, InvestigationProfileSchema, loadReviewVerifiers, InvestigationProfilesSchema, loadInvestigationProfiles, admitPreparation, automaticWebsiteProfile, preparedWebsiteGrant, profileGrant };