@mono-agent/agent-app 0.12.0 → 0.14.0

package/dist/background-runtime.js

@@ -4,16 +4,21 @@ import { chmod, cp, lstat, mkdir, open, readFile, readlink, readdir, realpath, r
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import process from "node:process";
 import { accountHomeDirectory } from "./account-home.js";
-import { isBackgroundOperationalEnvName } from "./background-environment.js";
+import { isBackgroundOperationalEnvName, MANAGED_BACKGROUND_WORKER_ENV, } from "./background-environment.js";
+export { MANAGED_BACKGROUND_WORKER_ENV } from "./background-environment.js";
 import { currentProcessIncarnation, isSameProcessIncarnation as matchesProcessIncarnation, processIncarnationFromJson, } from "./process-incarnation.js";
 import { acquireOwnerPrivateLock } from "./owner-private-lock.js";
 const PACKAGE_NAME = "@mono-agent/agent-app";
-export const MANAGED_BACKGROUND_WORKER_ENV = "MONO_AGENT_MANAGED_WORKER";
-const LOCK_WAIT_TIMEOUT_MS = 30_000;
+const LOCK_WAIT_TIMEOUT_MS = 5 * 60_000;
 const LOCK_STALE_AFTER_MS = 5 * 60_000;
 const LOCK_POLL_INTERVAL_MS = 200;
 const PROVISIONAL_RUNTIME_INSTALLED_AT = "1970-01-01T00:00:00.000Z";
 const MAX_RUNTIME_MARKER_BYTES = 16 * 1024;
+const MAX_RUNTIME_REUSE_PROOF_BYTES = 64 * 1024 * 1024;
+const RUNTIME_REUSE_PROOF_SCHEMA = "mono-agent.managed-runtime-reuse-proof.v1";
+const RUNTIME_REUSE_STAT_CONCURRENCY = 64;
+const MANAGED_RUNTIME_LAUNCH_PROOF_SCHEMA = "mono-agent.managed-runtime-launch.v1";
+const MAX_MANAGED_RUNTIME_LAUNCH_PROOF_BYTES = 2 * 1024;
 export function defaultManagedBackgroundRuntimeDeps() {
     return {
         now: () => Date.now(),
@@ -52,47 +57,77 @@ export async function ensureManagedBackgroundRuntime(input, deps = defaultManage
     await assertRegularFile(currentCliPath, "current mono-agent CLI");
     await assertRegularFile(resolve(input.nodePath), "managed runtime Node executable");
     const currentCli = await readFile(currentCliPath);
-    const packageSource = resolve(input.packageSource ?? packageRootForCli(currentCliPath));
-    const sourceDetails = await lstat(packageSource);
+    const packageSourceLexical = resolve(input.packageSource ?? packageRootForCli(currentCliPath));
+    const sourceDetails = await lstat(packageSourceLexical);
     if (!sourceDetails.isDirectory() || sourceDetails.isSymbolicLink()) {
-        throw new Error(`Managed runtime package source ${packageSource} must be a real directory.`);
+        throw new Error(`Managed runtime package source ${packageSourceLexical} must be a real directory.`);
     }
+    const packageSource = await realpath(packageSourceLexical);
     const additionalPackages = await canonicalAdditionalPackages(input.additionalPackages ?? []);
-    const sourceClosure = await captureExecutionClosure(packageSource, additionalPackages);
     const packageVersion = input.packageVersion ?? await packageVersionAt(packageSource);
     if (!isExactVersion(packageVersion)) {
         throw new Error(`Cannot install a durable managed runtime for invalid package version ${JSON.stringify(packageVersion)}.`);
     }
+    const cliSha256 = sha256(currentCli);
+    const nodeAbi = input.nodeAbi ?? requiredNodeAbi();
+    const platform = input.platform ?? process.platform;
+    const arch = input.arch ?? process.arch;
+    const home = resolve(input.homeDir ?? accountHomeDirectory());
+    const versionAbiDir = runtimeVersionAbiDir(home, packageVersion, nodeAbi, platform, arch);
+    await ensurePrivateRuntimeAncestors(home, versionAbiDir);
+    const fastRuntime = await findFastReusableRuntime({
+        home,
+        versionAbiDir,
+        packageVersion,
+        cliSha256,
+        nodeAbi,
+        platform,
+        arch,
+        packageSource,
+        additionalPackages,
+    });
+    if (fastRuntime !== undefined) {
+        await waitForManagedRuntimeLaunchBoundary(fastRuntime.layout, fastRuntime.identity, deps);
+        return await runtimeResult(fastRuntime.layout, fastRuntime.identity, input.nodePath, "fast-reuse");
+    }
+    const sourceClosure = await captureExecutionClosure(packageSource, additionalPackages);
     const identity = {
         packageVersion,
-        cliSha256: sha256(currentCli),
+        cliSha256,
         sourceClosureSha256: sourceClosure.sourceClosureSha256,
-        nodeAbi: input.nodeAbi ?? requiredNodeAbi(),
-        platform: input.platform ?? process.platform,
-        arch: input.arch ?? process.arch,
+        nodeAbi,
+        platform,
+        arch,
     };
-    const home = resolve(input.homeDir ?? accountHomeDirectory());
     const id = safeSegment(deps.randomId());
     const layout = runtimeLayout(home, identity, id, deps.now());
-    await ensurePrivateRuntimeAncestors(home, layout.versionAbiDir);
-    if (await verifyRuntime(layout, identity, additionalPackages)) {
-        await waitForManagedRuntimeLaunchBoundary(layout, identity, deps);
-        return runtimeResult(layout, identity, input.nodePath);
-    }
-    const acquired = await acquireRuntimeLock(layout, identity, additionalPackages, deps);
+    const runtimeWasPresent = await pathExists(layout.installRoot);
+    const acquired = await acquireRuntimeLock(layout, identity, additionalPackages, deps, () => verifyRuntimeFast(layout, identity, packageSource, additionalPackages));
     if (!acquired) {
-        // Another installer may have completed between the final lock poll and the
-        // timeout boundary. Verify one last time before reporting the contention.
+        if (await verifyRuntimeFast(layout, identity, packageSource, additionalPackages)) {
+            await waitForManagedRuntimeLaunchBoundary(layout, identity, deps);
+            return await runtimeResult(layout, identity, input.nodePath, "fast-reuse");
+        }
+        // Preserve compatibility with a finalized v4 runtime when another process
+        // released the lock before it could publish the v5 warm proof.
         if (await verifyRuntime(layout, identity, additionalPackages)) {
             await waitForManagedRuntimeLaunchBoundary(layout, identity, deps);
-            return runtimeResult(layout, identity, input.nodePath);
+            return await runtimeResult(layout, identity, input.nodePath, "full-reuse");
         }
         throw new Error(`Timed out waiting for the managed runtime installation lock at ${layout.lockDir}.`);
     }
     try {
         if (await verifyRuntime(layout, identity, additionalPackages)) {
+            const marker = await readRuntimeMarker(layout.markerPath, identity);
+            if (marker === undefined)
+                throw new Error("The managed runtime marker changed before warm-proof publication.");
+            const sourceReuseProof = await currentSourceReuseProof(packageSource, additionalPackages, sourceClosure);
+            await publishRuntimeReuseProof(layout, identity, packageSource, additionalPackages, sourceReuseProof, marker, deps);
+            if (!(await verifyRuntimeFast(layout, identity, packageSource, additionalPackages))) {
+                throw new Error("The managed runtime warm-reuse proof failed verification after publication.");
+            }
             await waitForManagedRuntimeLaunchBoundary(layout, identity, deps);
-            return runtimeResult(layout, identity, input.nodePath);
+            return await runtimeResult(layout, identity, input.nodePath, "full-reuse");
         }
         await assertSourceClosureUnchanged(packageSource, additionalPackages, sourceClosure, "before staging");
         await rm(layout.stagingDir, { recursive: true, force: true });
@@ -158,10 +193,11 @@ export async function ensureManagedBackgroundRuntime(input, deps = defaultManage
                 if (promotedClosure.sourceClosureSha256 !== identity.sourceClosureSha256) {
                     throw new Error("The promoted managed runtime execution closure does not match its source identity.");
                 }
-                await writeFinalizedRuntimeMarker(layout.markerPath, {
+                const sourceReuseProof = await currentSourceReuseProof(packageSource, additionalPackages, sourceClosure);
+                await publishRuntimeReuseProof(layout, identity, packageSource, additionalPackages, sourceReuseProof, {
                     ...marker,
                     executionProofSha256: promotedClosure.filesystemProofSha256,
-                }, deps);
+                }, deps, true);
             }
         }
         catch (error) {
@@ -171,13 +207,163 @@ export async function ensureManagedBackgroundRuntime(input, deps = defaultManage
         if (!(await verifyRuntime(layout, identity, additionalPackages))) {
             throw new Error("The managed runtime failed verification after atomic promotion.");
         }
+        if (!(await verifyRuntimeFast(layout, identity, packageSource, additionalPackages))) {
+            const marker = await readRuntimeMarker(layout.markerPath, identity);
+            if (marker === undefined)
+                throw new Error("The managed runtime marker changed before warm-proof publication.");
+            const sourceReuseProof = await currentSourceReuseProof(packageSource, additionalPackages, sourceClosure);
+            await publishRuntimeReuseProof(layout, identity, packageSource, additionalPackages, sourceReuseProof, marker, deps);
+        }
+        if (!(await verifyRuntimeFast(layout, identity, packageSource, additionalPackages))) {
+            throw new Error("The managed runtime warm-reuse proof failed verification after atomic promotion.");
+        }
         await waitForManagedRuntimeLaunchBoundary(layout, identity, deps);
-        return runtimeResult(layout, identity, input.nodePath);
+        return await runtimeResult(layout, identity, input.nodePath, runtimeWasPresent ? "repaired" : "installed");
     }
     finally {
         await acquired.release().catch(() => undefined);
     }
 }
+/**
+ * Inspect the controller CLI as inert installation input. The recovery helper
+ * uses this to decide whether launchd owns an older closure without ever
+ * executing mutable checkout bytes.
+ */
+export async function inspectManagedRuntimeSourceIdentity(currentCliPathInput) {
+    const currentCliPath = resolve(currentCliPathInput);
+    await assertRegularFile(currentCliPath, "current mono-agent CLI");
+    const packageSource = packageRootForCli(currentCliPath);
+    const sourceDetails = await lstat(packageSource);
+    if (!sourceDetails.isDirectory() || sourceDetails.isSymbolicLink()) {
+        throw new Error(`Managed runtime package source ${packageSource} must be a real directory.`);
+    }
+    const packageVersion = await packageVersionAt(packageSource);
+    if (!isExactVersion(packageVersion)) {
+        throw new Error(`Cannot inspect a durable managed runtime for invalid package version ${JSON.stringify(packageVersion)}.`);
+    }
+    return {
+        packageVersion,
+        cliSha256: sha256(await readFile(currentCliPath)),
+    };
+}
+/**
+ * Validate the opaque proof carried by a managed LaunchAgent against the exact
+ * CLI that is about to start. This is intentionally lighter than controller
+ * attestation: it rechecks the private layout, marker, CLI, and stored closure
+ * manifest fingerprints without traversing the entire installed dependency
+ * tree on every KeepAlive restart.
+ */
+export async function verifyManagedRuntimeLaunch(input) {
+    const proof = decodeManagedRuntimeLaunchProof(input.launchProof);
+    const currentCliPath = resolve(input.currentCliPath);
+    const packageRoot = packageRootForCli(currentCliPath);
+    const installRoot = dirname(dirname(dirname(packageRoot)));
+    const home = resolve(input.homeDir ?? accountHomeDirectory());
+    const initialInstallRoot = await lstat(installRoot, { bigint: true });
+    if (!privateRuntimeDirectory(initialInstallRoot)) {
+        throw new Error("The managed runtime closure root is not a real owner-private directory.");
+    }
+    const markerPath = join(installRoot, ".mono-agent-runtime.json");
+    const initialBytes = await readPrivateRuntimeMarkerBytes(markerPath);
+    if (initialBytes === undefined)
+        throw new Error("The managed runtime marker is unavailable or unsafe.");
+    const markerValue = parseJson(initialBytes, "managed runtime marker");
+    const identity = runtimeIdentityFromMarkerJson(markerValue);
+    if (identity === undefined)
+        throw new Error("The managed runtime marker has an invalid identity.");
+    const marker = runtimeMarkerFromJson(markerValue, identity);
+    if (marker === undefined)
+        throw new Error("The managed runtime marker is provisional or malformed.");
+    const layout = runtimeLayout(home, identity, "launch", 0);
+    if (layout.installRoot !== installRoot || layout.cliPath !== currentCliPath) {
+        throw new Error("The managed worker CLI is outside its canonical runtime closure.");
+    }
+    if (!(await verifyPrivateRuntimeAncestors(home, layout.versionAbiDir))) {
+        throw new Error("The managed runtime has an unsafe private ancestry.");
+    }
+    if (sha256(initialBytes) !== proof.markerSha256 || marker.installedAt !== proof.installedAt) {
+        throw new Error("The managed runtime marker does not match its LaunchAgent proof.");
+    }
+    if (!(await verifyInstalledPackage(layout, identity))) {
+        throw new Error("The managed runtime CLI or package identity failed verification.");
+    }
+    if (!(await verifyManagedRuntimeCliFingerprint(layout, identity.cliSha256))) {
+        throw new Error("The managed runtime CLI fingerprint is unstable.");
+    }
+    if (!(await verifyClosureManifestFingerprint(layout, marker.closureManifestSha256))) {
+        throw new Error("The managed runtime closure manifest fingerprint is invalid.");
+    }
+    await waitForLaunchBoundary(marker.installedAt, input.now ?? Date.now, input.sleep ?? sleep);
+    const finalBytes = await readPrivateRuntimeMarkerBytes(markerPath);
+    if (finalBytes === undefined || sha256(finalBytes) !== proof.markerSha256 || !finalBytes.equals(initialBytes)) {
+        throw new Error("The managed runtime marker changed during launch verification.");
+    }
+    if (!(await verifyManagedRuntimeCliFingerprint(layout, identity.cliSha256))) {
+        throw new Error("The managed runtime CLI changed during launch verification.");
+    }
+    if (!(await verifyClosureManifestFingerprint(layout, marker.closureManifestSha256))) {
+        throw new Error("The managed runtime closure manifest changed during launch verification.");
+    }
+    const finalInstallRoot = await lstat(installRoot, { bigint: true });
+    if (!privateRuntimeDirectory(finalInstallRoot) || !sameSourceStats(initialInstallRoot, finalInstallRoot)) {
+        throw new Error("The managed runtime closure root changed during launch verification.");
+    }
+    const closureId = `${identity.cliSha256}-${identity.sourceClosureSha256}`;
+    return {
+        installRoot,
+        packageVersion: identity.packageVersion,
+        cliSha256: identity.cliSha256,
+        provenanceDetail: `Runtime provenance: managed closure ${closureId} (`
+            + `${PACKAGE_NAME} ${identity.packageVersion}; ${identity.platform}-${identity.arch}; `
+            + `Node ABI ${identity.nodeAbi}; installed ${marker.installedAt}).`,
+    };
+}
+function encodeManagedRuntimeLaunchProof(proof) {
+    return Buffer.from(JSON.stringify(proof), "utf8").toString("base64url");
+}
+function decodeManagedRuntimeLaunchProof(encoded) {
+    if (typeof encoded !== "string"
+        || encoded.length === 0
+        || encoded.length > MAX_MANAGED_RUNTIME_LAUNCH_PROOF_BYTES * 2
+        || !/^[0-9A-Za-z_-]+$/u.test(encoded)) {
+        throw new Error("The managed runtime launch proof is malformed.");
+    }
+    let bytes;
+    try {
+        bytes = Buffer.from(encoded, "base64url");
+    }
+    catch {
+        throw new Error("The managed runtime launch proof is malformed.");
+    }
+    if (bytes.length === 0
+        || bytes.length > MAX_MANAGED_RUNTIME_LAUNCH_PROOF_BYTES
+        || bytes.toString("base64url") !== encoded) {
+        throw new Error("The managed runtime launch proof is malformed.");
+    }
+    const value = parseJson(bytes, "managed runtime launch proof");
+    if (!isRecord(value) || Object.keys(value).length !== 3) {
+        throw new Error("The managed runtime launch proof has an invalid schema.");
+    }
+    const installedAtMs = typeof value.installedAt === "string" ? Date.parse(value.installedAt) : Number.NaN;
+    if (value.schema !== MANAGED_RUNTIME_LAUNCH_PROOF_SCHEMA
+        || typeof value.markerSha256 !== "string"
+        || !/^[0-9a-f]{64}$/u.test(value.markerSha256)
+        || typeof value.installedAt !== "string"
+        || !Number.isFinite(installedAtMs)
+        || new Date(installedAtMs).toISOString() !== value.installedAt
+        || value.installedAt === PROVISIONAL_RUNTIME_INSTALLED_AT) {
+        throw new Error("The managed runtime launch proof has an invalid schema.");
+    }
+    return value;
+}
+function parseJson(bytes, label) {
+    try {
+        return JSON.parse(bytes.toString("utf8"));
+    }
+    catch {
+        throw new Error(`The ${label} is not valid JSON.`);
+    }
+}
 /**
  * Canonically verify the installed package, freshly recomputed execution
  * closure/filesystem proof, and coherent current manifest behind a provenance
@@ -212,16 +398,8 @@ export async function verifyManagedRuntimeClosureForProvenance(input, deps = {})
             return false;
         if (!(await verifyPrivateRuntimeAncestors(home, layout.versionAbiDir)))
             return false;
-        const expectedMarker = {
-            schema: "mono-agent.managed-runtime.v4",
-            packageName: PACKAGE_NAME,
-            closureManifestSha256: input.closureManifestSha256,
-            executionProofSha256: input.executionProofSha256,
-            ...identity,
-            installedAt: input.installedAt,
-        };
         const markerInitial = await verifiedRuntimeMarker(layout, identity);
-        if (markerInitial === undefined || !sameRuntimeMarker(markerInitial, expectedMarker))
+        if (markerInitial === undefined || !runtimeMarkerMatchesProvenance(markerInitial, input))
             return false;
         const additionalPackages = await managedRuntimeAdditionalPackages(layout);
         if (additionalPackages === undefined)
@@ -242,7 +420,7 @@ export async function verifyManagedRuntimeClosureForProvenance(input, deps = {})
         const markerFinal = await readRuntimeMarker(layout.markerPath, identity);
         if (markerFinal === undefined
             || !sameRuntimeMarker(markerFinal, markerInitial)
-            || !sameRuntimeMarker(markerFinal, expectedMarker)
+            || !runtimeMarkerMatchesProvenance(markerFinal, input)
             || !(await verifyClosureManifest(layout, markerFinal.closureManifestSha256, deps.beforeFinalManifestProof === undefined
                 ? {}
                 : { beforeFinalProof: deps.beforeFinalManifestProof }))) {
@@ -251,7 +429,7 @@ export async function verifyManagedRuntimeClosureForProvenance(input, deps = {})
         const markerAfterManifest = await readRuntimeMarker(layout.markerPath, identity);
         return markerAfterManifest !== undefined
             && sameRuntimeMarker(markerAfterManifest, markerInitial)
-            && sameRuntimeMarker(markerAfterManifest, expectedMarker);
+            && runtimeMarkerMatchesProvenance(markerAfterManifest, input);
     }
     catch {
         return false;
@@ -569,6 +747,15 @@ async function captureExecutionClosure(packageSource, additionalPackages, filesy
         sourceClosureSha256: sha256(Buffer.from(JSON.stringify(stable), "utf8")),
         sourceProofSha256: sha256(Buffer.from(JSON.stringify(proof), "utf8")),
         filesystemProofSha256: sha256(Buffer.from(JSON.stringify(filesystemProof), "utf8")),
+        reuseProof: {
+            sourceProofSha256: sha256(Buffer.from(JSON.stringify(proof), "utf8")),
+            packages: closure.map((node) => ({
+                id: node.id,
+                sourceRoot: node.sourceRoot,
+                entries: requiredMapValue(proofs, node.id, "source package proof"),
+            })),
+            links: [...dependencyProofPaths, ...additionalProofPaths],
+        },
     };
 }
 /**
@@ -626,6 +813,15 @@ async function assertSourceClosureUnchanged(packageSource, additionalPackages, e
         throw new Error(`The managed runtime package closure changed ${phase}; no staged runtime was promoted.`);
     }
 }
+async function currentSourceReuseProof(packageSource, additionalPackages, expected) {
+    if (await verifySourceReuseProofStats(expected.reuseProof))
+        return expected.reuseProof;
+    const current = await captureExecutionClosure(packageSource, additionalPackages);
+    if (current.sourceClosureSha256 !== expected.sourceClosureSha256) {
+        throw new Error("The managed runtime source closure changed before warm-proof publication.");
+    }
+    return current.reuseProof;
+}
 /**
  * Capture exactly the package-owned files copied by `materializeExactExecutionClosure`.
  * `node_modules`, VCS metadata, and dotenv files are deliberately excluded.
@@ -1054,8 +1250,7 @@ async function packageVersionAt(packageRoot) {
     return record.version;
 }
 function runtimeLayout(home, identity, id, nowMs) {
-    const platformAbi = `${safeSegment(identity.platform)}-${safeSegment(identity.arch)}-abi-${safeSegment(identity.nodeAbi)}`;
-    const versionAbiDir = join(home, ".mono-agent", "runtimes", "agent-app", identity.packageVersion, platformAbi);
+    const versionAbiDir = runtimeVersionAbiDir(home, identity.packageVersion, identity.nodeAbi, identity.platform, identity.arch);
     const closureId = `${identity.cliSha256}-${identity.sourceClosureSha256}`;
     const installRoot = join(versionAbiDir, closureId);
     const suffix = `${Math.max(0, Math.floor(nowMs))}-${id}`;
@@ -1067,11 +1262,17 @@ function runtimeLayout(home, identity, id, nowMs) {
         packageLockPath: join(installRoot, "package-lock.json"),
         closureManifestPath: join(installRoot, ".mono-agent-closure.json"),
         markerPath: join(installRoot, ".mono-agent-runtime.json"),
+        reuseProofDir: join(versionAbiDir, ".reuse-proofs"),
+        reuseProofPath: join(versionAbiDir, ".reuse-proofs", `${closureId}.json`),
         lockDir: join(versionAbiDir, `.${closureId}.lock`),
         stagingDir: join(versionAbiDir, `.${closureId}.staging-${suffix}`),
         quarantineDir: join(versionAbiDir, "quarantine", `${closureId}-${suffix}`),
     };
 }
+function runtimeVersionAbiDir(home, packageVersion, nodeAbi, platform, arch) {
+    const platformAbi = `${safeSegment(platform)}-${safeSegment(arch)}-abi-${safeSegment(nodeAbi)}`;
+    return join(home, ".mono-agent", "runtimes", "agent-app", packageVersion, platformAbi);
+}
 function runtimeLayoutForRoot(layout, root) {
     return {
         ...layout,
@@ -1083,7 +1284,552 @@ function runtimeLayoutForRoot(layout, root) {
         markerPath: join(root, ".mono-agent-runtime.json"),
     };
 }
-async function acquireRuntimeLock(layout, identity, additionalPackages, deps) {
+async function findFastReusableRuntime(input) {
+    let entries;
+    try {
+        entries = await readdir(input.versionAbiDir, { withFileTypes: true });
+    }
+    catch {
+        return undefined;
+    }
+    const prefix = `${input.cliSha256}-`;
+    for (const entry of entries.sort((left, right) => compareCodeUnits(left.name, right.name))) {
+        if (!entry.isDirectory() || !entry.name.startsWith(prefix))
+            continue;
+        const sourceClosureSha256 = entry.name.slice(prefix.length);
+        if (!/^[0-9a-f]{64}$/u.test(sourceClosureSha256))
+            continue;
+        const identity = {
+            packageVersion: input.packageVersion,
+            cliSha256: input.cliSha256,
+            sourceClosureSha256,
+            nodeAbi: input.nodeAbi,
+            platform: input.platform,
+            arch: input.arch,
+        };
+        const layout = runtimeLayout(input.home, identity, "fast-reuse", 0);
+        if (await verifyRuntimeFast(layout, identity, input.packageSource, input.additionalPackages)) {
+            return { layout, identity };
+        }
+    }
+    return undefined;
+}
+async function verifyRuntimeFast(layout, identity, packageSource, additionalPackages) {
+    try {
+        const home = dirname(dirname(dirname(dirname(dirname(layout.versionAbiDir)))));
+        if (!(await verifyPrivateRuntimeAncestors(home, layout.versionAbiDir)))
+            return false;
+        const [initialRoot, initialProofDir] = await Promise.all([
+            lstat(layout.installRoot, { bigint: true }),
+            lstat(layout.reuseProofDir, { bigint: true }),
+        ]);
+        if (!privateRuntimeDirectory(initialRoot) || !privateRuntimeDirectory(initialProofDir))
+            return false;
+        const [markerBytes, proofBytes] = await Promise.all([
+            readPrivateRuntimeMarkerBytes(layout.markerPath),
+            readPrivateRuntimeReuseProofBytes(layout.reuseProofPath),
+        ]);
+        if (markerBytes === undefined || proofBytes === undefined)
+            return false;
+        const marker = runtimeMarkerFromJson(parseJson(markerBytes, "managed runtime marker"), identity);
+        if (marker?.schema !== "mono-agent.managed-runtime.v5"
+            || marker.reuseProofSha256 !== sha256(proofBytes)) {
+            return false;
+        }
+        const proof = runtimeReuseProofFromJson(parseJson(proofBytes, "managed runtime reuse proof"), identity, packageSource, additionalPackages, marker);
+        if (proof === undefined)
+            return false;
+        const [installed, cliStable, manifestStable] = await Promise.all([
+            verifyInstalledPackage(layout, identity),
+            verifyManagedRuntimeCliFingerprint(layout, identity.cliSha256),
+            verifyClosureManifestFingerprint(layout, marker.closureManifestSha256),
+        ]);
+        if (!installed
+            || !cliStable
+            || !manifestStable
+            || !(await runtimeReuseProofMatchesManifest(layout, proof.runtime))) {
+            return false;
+        }
+        if (!(await verifyReuseProofStats(layout, proof)))
+            return false;
+        if (!(await verifyReuseProofStats(layout, proof)))
+            return false;
+        const [markerBytesAfter, proofBytesAfter, finalRoot, finalProofDir] = await Promise.all([
+            readPrivateRuntimeMarkerBytes(layout.markerPath),
+            readPrivateRuntimeReuseProofBytes(layout.reuseProofPath),
+            lstat(layout.installRoot, { bigint: true }),
+            lstat(layout.reuseProofDir, { bigint: true }),
+        ]);
+        return markerBytesAfter !== undefined
+            && proofBytesAfter !== undefined
+            && markerBytesAfter.equals(markerBytes)
+            && proofBytesAfter.equals(proofBytes)
+            && privateRuntimeDirectory(finalRoot)
+            && privateRuntimeDirectory(finalProofDir)
+            && sameSourceStats(initialRoot, finalRoot)
+            && sameSourceStats(initialProofDir, finalProofDir);
+    }
+    catch {
+        return false;
+    }
+}
+async function publishRuntimeReuseProof(layout, identity, packageSource, additionalPackages, source, marker, deps, finalizeLaunchBoundary = false) {
+    if (!(await verifySourceReuseProofStats(source))) {
+        throw new Error("The managed runtime source closure changed before warm-proof publication.");
+    }
+    const runtime = await captureRuntimeClosureReuseProof(layout, marker);
+    const proof = {
+        schema: RUNTIME_REUSE_PROOF_SCHEMA,
+        identity,
+        packageSource,
+        additionalPackages,
+        source,
+        runtime,
+    };
+    const contents = privateJsonContents(proof);
+    const bytes = Buffer.from(contents, "utf8");
+    if (bytes.length > MAX_RUNTIME_REUSE_PROOF_BYTES) {
+        throw new Error("The managed runtime warm-reuse proof exceeds its safe size limit.");
+    }
+    await ensurePrivateReuseProofDirectory(layout.reuseProofDir);
+    await writeFile(layout.reuseProofPath, contents, { encoding: "utf8", mode: 0o600 });
+    await chmod(layout.reuseProofPath, 0o600);
+    const stored = await readPrivateRuntimeReuseProofBytes(layout.reuseProofPath);
+    if (stored === undefined || !stored.equals(bytes)) {
+        throw new Error("The managed runtime warm-reuse proof changed while it was published.");
+    }
+    const nextMarker = {
+        schema: "mono-agent.managed-runtime.v5",
+        packageName: PACKAGE_NAME,
+        packageVersion: identity.packageVersion,
+        cliSha256: identity.cliSha256,
+        sourceClosureSha256: identity.sourceClosureSha256,
+        nodeAbi: identity.nodeAbi,
+        platform: identity.platform,
+        arch: identity.arch,
+        closureManifestSha256: marker.closureManifestSha256,
+        executionProofSha256: marker.executionProofSha256,
+        reuseProofSha256: sha256(bytes),
+        installedAt: marker.installedAt,
+    };
+    if (finalizeLaunchBoundary) {
+        await writeFinalizedRuntimeMarker(layout.markerPath, nextMarker, deps);
+    }
+    else {
+        await writePrivateJson(layout.markerPath, nextMarker);
+    }
+    if (!(await verifySourceReuseProofStats(source))) {
+        throw new Error("The managed runtime source closure changed during warm-proof publication.");
+    }
+}
+async function captureRuntimeClosureReuseProof(layout, marker) {
+    const stored = await fingerprintClosureFile(layout.closureManifestPath, ".mono-agent-closure.json");
+    if (stored.sha256 !== marker.closureManifestSha256) {
+        throw new Error("The managed runtime closure manifest changed before warm-proof capture.");
+    }
+    const manifest = runtimeClosureManifestFromJson(parseJson(stored.bytes, "managed runtime closure manifest"));
+    if (manifest === undefined)
+        throw new Error("The managed runtime closure manifest is malformed.");
+    const excludedRootEntries = new Set([".mono-agent-closure.json", ".mono-agent-runtime.json"]);
+    const rootEntries = (await readdir(layout.installRoot))
+        .filter((name) => !excludedRootEntries.has(name))
+        .sort(compareCodeUnits);
+    const entries = await mapWithConcurrency(manifest.entries, RUNTIME_REUSE_STAT_CONCURRENCY, async (entry) => ({
+        path: entry.path,
+        proof: await captureFilesystemPathProof(runtimePathFromPortableRelative(layout.installRoot, entry.path), entry.path),
+    }));
+    const result = {
+        rootEntries,
+        entries,
+        closureManifestSha256: marker.closureManifestSha256,
+        executionProofSha256: marker.executionProofSha256,
+    };
+    if (!(await verifyRuntimeReuseProofStats(layout, result))) {
+        throw new Error("The managed runtime closure changed during warm-proof capture.");
+    }
+    return result;
+}
+async function verifyReuseProofStats(layout, proof) {
+    const [sourceValid, runtimeValid] = await Promise.all([
+        verifySourceReuseProofStats(proof.source),
+        verifyRuntimeReuseProofStats(layout, proof.runtime),
+    ]);
+    return sourceValid && runtimeValid;
+}
+async function verifySourceReuseProofStats(proof) {
+    try {
+        const targets = [
+            ...proof.packages.flatMap((pkg) => pkg.entries.map((entry) => ({
+                path: entry.path === "."
+                    ? pkg.sourceRoot
+                    : runtimePathFromPortableRelative(pkg.sourceRoot, entry.path),
+                logicalPath: entry.path,
+                proof: entry,
+            }))),
+            ...proof.links,
+        ];
+        const matches = await mapWithConcurrency(targets, RUNTIME_REUSE_STAT_CONCURRENCY, async (target) => {
+            const current = await captureFilesystemPathProof(target.path, target.logicalPath);
+            return sameSourceProofEntry(target.proof, current);
+        });
+        return matches.every(Boolean);
+    }
+    catch {
+        return false;
+    }
+}
+async function verifyRuntimeReuseProofStats(layout, proof) {
+    try {
+        const excludedRootEntries = new Set([".mono-agent-closure.json", ".mono-agent-runtime.json"]);
+        const rootEntries = (await readdir(layout.installRoot))
+            .filter((name) => !excludedRootEntries.has(name))
+            .sort(compareCodeUnits);
+        if (JSON.stringify(rootEntries) !== JSON.stringify(proof.rootEntries))
+            return false;
+        const matches = await mapWithConcurrency(proof.entries, RUNTIME_REUSE_STAT_CONCURRENCY, async (entry) => {
+            const current = await captureFilesystemPathProof(runtimePathFromPortableRelative(layout.installRoot, entry.path), entry.path);
+            return sameSourceProofEntry(entry.proof, current);
+        });
+        return matches.every(Boolean);
+    }
+    catch {
+        return false;
+    }
+}
+async function runtimeReuseProofMatchesManifest(layout, proof) {
+    try {
+        const bytes = await readFile(layout.closureManifestPath);
+        if (sha256(bytes) !== proof.closureManifestSha256)
+            return false;
+        const manifest = runtimeClosureManifestFromJson(parseJson(bytes, "managed runtime closure manifest"));
+        if (manifest === undefined || manifest.entries.length !== proof.entries.length)
+            return false;
+        return manifest.entries.every((entry, index) => {
+            const proven = proof.entries[index];
+            return proven !== undefined
+                && proven.path === entry.path
+                && proven.proof.type === entry.type
+                && fileMode(BigInt(proven.proof.mode)) === entry.mode
+                && (entry.type !== "symlink" || proven.proof.target === entry.target);
+        });
+    }
+    catch {
+        return false;
+    }
+}
+async function ensurePrivateReuseProofDirectory(path) {
+    await mkdir(path, { recursive: false, mode: 0o700 }).catch((error) => {
+        if (!isErrno(error, "EEXIST"))
+            throw error;
+    });
+    const details = await lstat(path, { bigint: true });
+    if (!privateRuntimeDirectory(details)) {
+        throw new Error(`Managed runtime reuse-proof directory ${path} must be owner-private.`);
+    }
+    await chmod(path, 0o700);
+}
+async function readPrivateRuntimeReuseProofBytes(path) {
+    let handle;
+    try {
+        handle = await open(path, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW | fsConstants.O_NONBLOCK);
+        const before = await handle.stat({ bigint: true });
+        if (!privateRuntimeReuseProofFile(before))
+            return undefined;
+        const bytes = await handle.readFile();
+        const [after, named] = await Promise.all([
+            handle.stat({ bigint: true }),
+            lstat(path, { bigint: true }),
+        ]);
+        if (!privateRuntimeReuseProofFile(after)
+            || !privateRuntimeReuseProofFile(named)
+            || !sameSourceStats(before, after)
+            || !sameSourceStats(before, named)) {
+            return undefined;
+        }
+        return bytes;
+    }
+    catch {
+        return undefined;
+    }
+    finally {
+        await handle?.close();
+    }
+}
+function privateRuntimeReuseProofFile(details) {
+    const owned = typeof process.getuid !== "function" || details.uid === BigInt(process.getuid());
+    return details.isFile()
+        && !details.isSymbolicLink()
+        && details.nlink === 1n
+        && details.size <= BigInt(MAX_RUNTIME_REUSE_PROOF_BYTES)
+        && (details.mode & 63n) === 0n
+        && owned;
+}
+function runtimeReuseProofFromJson(value, identity, packageSource, additionalPackages, marker) {
+    if (!hasExactKeys(value, ["schema", "identity", "packageSource", "additionalPackages", "source", "runtime"])) {
+        return undefined;
+    }
+    if (value.schema !== RUNTIME_REUSE_PROOF_SCHEMA
+        || !sameRuntimeIdentityJson(value.identity, identity)
+        || value.packageSource !== packageSource
+        || !Array.isArray(value.additionalPackages)
+        || JSON.stringify(value.additionalPackages) !== JSON.stringify(additionalPackages)) {
+        return undefined;
+    }
+    const source = sourceClosureReuseProofFromJson(value.source, packageSource);
+    const runtime = runtimeClosureReuseProofFromJson(value.runtime, marker);
+    return source === undefined || runtime === undefined
+        ? undefined
+        : {
+            schema: RUNTIME_REUSE_PROOF_SCHEMA,
+            identity,
+            packageSource,
+            additionalPackages,
+            source,
+            runtime,
+        };
+}
+function sourceClosureReuseProofFromJson(value, packageSource) {
+    if (!hasExactKeys(value, ["sourceProofSha256", "packages", "links"]))
+        return undefined;
+    if (typeof value.sourceProofSha256 !== "string"
+        || !/^[0-9a-f]{64}$/u.test(value.sourceProofSha256)
+        || !Array.isArray(value.packages)
+        || !Array.isArray(value.links)) {
+        return undefined;
+    }
+    const packages = [];
+    const roots = new Set();
+    for (const [index, rawPackage] of value.packages.entries()) {
+        if (!hasExactKeys(rawPackage, ["id", "sourceRoot", "entries"]))
+            return undefined;
+        if (rawPackage.id !== index
+            || typeof rawPackage.sourceRoot !== "string"
+            || !isCanonicalAbsolutePath(rawPackage.sourceRoot)
+            || roots.has(rawPackage.sourceRoot)
+            || !Array.isArray(rawPackage.entries)) {
+            return undefined;
+        }
+        const entries = proofEntriesFromJson(rawPackage.entries, true);
+        if (entries === undefined || entries[0]?.path !== ".")
+            return undefined;
+        roots.add(rawPackage.sourceRoot);
+        packages.push({ id: index, sourceRoot: rawPackage.sourceRoot, entries });
+    }
+    if (packages[0]?.sourceRoot !== packageSource)
+        return undefined;
+    const links = [];
+    const linkPaths = new Set();
+    for (const rawLink of value.links) {
+        if (!hasExactKeys(rawLink, ["path", "logicalPath", "proof"]))
+            return undefined;
+        if (typeof rawLink.path !== "string"
+            || !isCanonicalAbsolutePath(rawLink.path)
+            || linkPaths.has(rawLink.path)
+            || typeof rawLink.logicalPath !== "string"
+            || rawLink.logicalPath.length === 0) {
+            return undefined;
+        }
+        const proof = sourceProofEntryFromJson(rawLink.proof);
+        if (proof === undefined || proof.path !== rawLink.logicalPath)
+            return undefined;
+        linkPaths.add(rawLink.path);
+        links.push({ path: rawLink.path, logicalPath: rawLink.logicalPath, proof });
+    }
+    return { sourceProofSha256: value.sourceProofSha256, packages, links };
+}
+function runtimeClosureReuseProofFromJson(value, marker) {
+    if (!hasExactKeys(value, [
+        "rootEntries",
+        "entries",
+        "closureManifestSha256",
+        "executionProofSha256",
+    ]))
+        return undefined;
+    if (value.closureManifestSha256 !== marker.closureManifestSha256
+        || value.executionProofSha256 !== marker.executionProofSha256
+        || !Array.isArray(value.rootEntries)
+        || !Array.isArray(value.entries)) {
+        return undefined;
+    }
+    const rootEntries = [];
+    const rootNames = new Set();
+    for (const name of value.rootEntries) {
+        if (typeof name !== "string"
+            || name.length === 0
+            || name === "."
+            || name === ".."
+            || name.includes("/")
+            || name.includes("\\")
+            || name.includes("\0")
+            || rootNames.has(name)
+            || name === ".mono-agent-closure.json"
+            || name === ".mono-agent-runtime.json") {
+            return undefined;
+        }
+        rootNames.add(name);
+        rootEntries.push(name);
+    }
+    if (JSON.stringify(rootEntries) !== JSON.stringify([...rootEntries].sort(compareCodeUnits)))
+        return undefined;
+    const entries = [];
+    const entryPaths = new Set();
+    for (const rawEntry of value.entries) {
+        if (!hasExactKeys(rawEntry, ["path", "proof"]))
+            return undefined;
+        if (typeof rawEntry.path !== "string"
+            || !isSafePortableRelativePath(rawEntry.path)
+            || entryPaths.has(rawEntry.path)) {
+            return undefined;
+        }
+        const proof = sourceProofEntryFromJson(rawEntry.proof);
+        if (proof === undefined || proof.path !== rawEntry.path)
+            return undefined;
+        entryPaths.add(rawEntry.path);
+        entries.push({ path: rawEntry.path, proof });
+    }
+    return {
+        rootEntries,
+        entries,
+        closureManifestSha256: marker.closureManifestSha256,
+        executionProofSha256: marker.executionProofSha256,
+    };
+}
+function runtimeClosureManifestFromJson(value) {
+    if (!hasExactKeys(value, ["schema", "entries"]) || value.schema !== "mono-agent.execution-closure.v1") {
+        return undefined;
+    }
+    if (!Array.isArray(value.entries))
+        return undefined;
+    const entries = [];
+    const paths = new Set();
+    for (const rawEntry of value.entries) {
+        if (!isRecord(rawEntry) || typeof rawEntry.type !== "string")
+            return undefined;
+        const expectedKeys = rawEntry.type === "file"
+            ? ["path", "type", "mode", "sha256"]
+            : rawEntry.type === "symlink"
+                ? ["path", "type", "mode", "target"]
+                : ["path", "type", "mode"];
+        if (!hasExactKeys(rawEntry, expectedKeys)
+            || typeof rawEntry.path !== "string"
+            || !isSafePortableRelativePath(rawEntry.path)
+            || paths.has(rawEntry.path)
+            || typeof rawEntry.mode !== "string"
+            || !/^0[0-7]{3}$/u.test(rawEntry.mode)) {
+            return undefined;
+        }
+        if (rawEntry.type === "file") {
+            if (typeof rawEntry.sha256 !== "string" || !/^[0-9a-f]{64}$/u.test(rawEntry.sha256))
+                return undefined;
+            entries.push({ path: rawEntry.path, type: "file", mode: rawEntry.mode, sha256: rawEntry.sha256 });
+        }
+        else if (rawEntry.type === "symlink") {
+            if (typeof rawEntry.target !== "string" || rawEntry.target.includes("\0"))
+                return undefined;
+            entries.push({ path: rawEntry.path, type: "symlink", mode: rawEntry.mode, target: rawEntry.target });
+        }
+        else if (rawEntry.type === "directory") {
+            entries.push({ path: rawEntry.path, type: "directory", mode: rawEntry.mode });
+        }
+        else {
+            return undefined;
+        }
+        paths.add(rawEntry.path);
+    }
+    return { schema: "mono-agent.execution-closure.v1", entries };
+}
+function proofEntriesFromJson(values, allowRoot) {
+    const entries = [];
+    const paths = new Set();
+    for (const value of values) {
+        const entry = sourceProofEntryFromJson(value);
+        if (entry === undefined
+            || (entry.path !== "." && !isSafePortableRelativePath(entry.path))
+            || (!allowRoot && entry.path === ".")
+            || paths.has(entry.path)) {
+            return undefined;
+        }
+        paths.add(entry.path);
+        entries.push(entry);
+    }
+    return entries;
+}
+function sourceProofEntryFromJson(value) {
+    if (!isRecord(value))
+        return undefined;
+    const type = value.type;
+    const expectedKeys = type === "symlink"
+        ? ["path", "type", "dev", "ino", "nlink", "mode", "size", "mtimeNs", "ctimeNs", "target"]
+        : ["path", "type", "dev", "ino", "nlink", "mode", "size", "mtimeNs", "ctimeNs"];
+    if (!hasExactKeys(value, expectedKeys)
+        || typeof value.path !== "string"
+        || (type !== "directory" && type !== "file" && type !== "symlink")
+        || ![value.dev, value.ino, value.nlink, value.mode, value.size, value.mtimeNs, value.ctimeNs]
+            .every((entry) => typeof entry === "string" && /^-?\d+$/u.test(entry))
+        || (type === "symlink" && (typeof value.target !== "string" || value.target.includes("\0")))) {
+        return undefined;
+    }
+    return value;
+}
+function sameRuntimeIdentityJson(value, identity) {
+    return hasExactKeys(value, ["packageVersion", "cliSha256", "sourceClosureSha256", "nodeAbi", "platform", "arch"])
+        && value.packageVersion === identity.packageVersion
+        && value.cliSha256 === identity.cliSha256
+        && value.sourceClosureSha256 === identity.sourceClosureSha256
+        && value.nodeAbi === identity.nodeAbi
+        && value.platform === identity.platform
+        && value.arch === identity.arch;
+}
+function hasExactKeys(value, keys) {
+    return isRecord(value)
+        && Object.keys(value).length === keys.length
+        && keys.every((key) => Object.hasOwn(value, key));
+}
+function isCanonicalAbsolutePath(path) {
+    return isAbsolute(path) && resolve(path) === path && !path.includes("\0");
+}
+function isSafePortableRelativePath(path) {
+    if (path.length === 0 || path === "." || path.includes("\\") || path.includes("\0") || isAbsolute(path)) {
+        return false;
+    }
+    const segments = path.split("/");
+    return segments.every((segment) => segment.length > 0 && segment !== "." && segment !== "..");
+}
+function runtimePathFromPortableRelative(root, path) {
+    if (!isSafePortableRelativePath(path)) {
+        throw new Error(`Managed runtime proof path ${JSON.stringify(path)} is unsafe.`);
+    }
+    const target = join(root, ...path.split("/"));
+    assertPathInsideRoot(root, target, `proof path ${path}`);
+    return target;
+}
+async function mapWithConcurrency(values, concurrency, mapper) {
+    const results = new Array(values.length);
+    let nextIndex = 0;
+    const workers = Array.from({ length: Math.min(Math.max(1, concurrency), values.length) }, async () => {
+        for (;;) {
+            const index = nextIndex;
+            nextIndex += 1;
+            if (index >= values.length)
+                return;
+            results[index] = await mapper(values[index], index);
+        }
+    });
+    await Promise.all(workers);
+    return results;
+}
+async function pathExists(path) {
+    try {
+        await lstat(path);
+        return true;
+    }
+    catch (error) {
+        if (isErrno(error, "ENOENT"))
+            return false;
+        throw error;
+    }
+}
+async function acquireRuntimeLock(layout, identity, additionalPackages, deps, isSatisfied = () => verifyRuntime(layout, identity, additionalPackages)) {
     const incarnation = await (deps.currentProcessIncarnation ?? currentProcessIncarnation)();
     return acquireOwnerPrivateLock({
         path: layout.lockDir,
@@ -1110,7 +1856,7 @@ async function acquireRuntimeLock(layout, identity, additionalPackages, deps) {
                 : undefined;
         },
         invalidOwner: "ownerless",
-        isSatisfied: () => verifyRuntime(layout, identity, additionalPackages),
+        isSatisfied,
         sleep: deps.sleep,
         staleRace: "return",
         beforeStaleRename: async () => {
@@ -1231,7 +1977,22 @@ function sameRuntimeMarker(left, right) {
         && left.nodeAbi === right.nodeAbi
         && left.platform === right.platform
         && left.arch === right.arch
-        && left.installedAt === right.installedAt;
+        && left.installedAt === right.installedAt
+        && (left.schema !== "mono-agent.managed-runtime.v5"
+            || (right.schema === "mono-agent.managed-runtime.v5"
+                && left.reuseProofSha256 === right.reuseProofSha256));
+}
+function runtimeMarkerMatchesProvenance(marker, input) {
+    return marker.packageName === PACKAGE_NAME
+        && marker.closureManifestSha256 === input.closureManifestSha256
+        && marker.executionProofSha256 === input.executionProofSha256
+        && marker.packageVersion === input.packageVersion
+        && marker.cliSha256 === input.cliSha256
+        && marker.sourceClosureSha256 === input.sourceClosureSha256
+        && marker.nodeAbi === input.nodeAbi
+        && marker.platform === input.platform
+        && marker.arch === input.arch
+        && marker.installedAt === input.installedAt;
 }
 async function verifiedRuntimeMarker(layout, identity) {
     try {
@@ -1250,6 +2011,17 @@ async function verifiedRuntimeMarker(layout, identity) {
     }
 }
 async function readRuntimeMarker(path, identity) {
+    const bytes = await readPrivateRuntimeMarkerBytes(path);
+    if (bytes === undefined)
+        return undefined;
+    try {
+        return runtimeMarkerFromJson(JSON.parse(bytes.toString("utf8")), identity);
+    }
+    catch {
+        return undefined;
+    }
+}
+async function readPrivateRuntimeMarkerBytes(path) {
     let handle;
     try {
         handle = await open(path, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW | fsConstants.O_NONBLOCK);
@@ -1267,7 +2039,7 @@ async function readRuntimeMarker(path, identity) {
             || !sameSourceStats(before, named)) {
             return undefined;
         }
-        return runtimeMarkerFromJson(JSON.parse(bytes.toString("utf8")), identity);
+        return bytes;
     }
     catch {
         return undefined;
@@ -1285,10 +2057,17 @@ function privateRuntimeMarkerFile(details) {
         && (details.mode & 63n) === 0n
         && owned;
 }
+function privateRuntimeDirectory(details) {
+    const owned = typeof process.getuid !== "function" || details.uid === BigInt(process.getuid());
+    return details.isDirectory()
+        && !details.isSymbolicLink()
+        && (details.mode & 63n) === 0n
+        && owned;
+}
 function runtimeMarkerFromJson(value, identity) {
     if (!isRecord(value))
         return undefined;
-    const exactKeys = [
+    const commonKeys = [
         "schema",
         "packageName",
         "closureManifestSha256",
@@ -1301,10 +2080,13 @@ function runtimeMarkerFromJson(value, identity) {
         "arch",
         "installedAt",
     ];
+    const exactKeys = value.schema === "mono-agent.managed-runtime.v5"
+        ? [...commonKeys, "reuseProofSha256"]
+        : commonKeys;
     const installedAtMs = typeof value.installedAt === "string" ? Date.parse(value.installedAt) : Number.NaN;
     const valid = Object.keys(value).length === exactKeys.length
         && exactKeys.every((key) => Object.hasOwn(value, key))
-        && value.schema === "mono-agent.managed-runtime.v4"
+        && (value.schema === "mono-agent.managed-runtime.v4" || value.schema === "mono-agent.managed-runtime.v5")
         && value.packageName === PACKAGE_NAME
         && value.packageVersion === identity.packageVersion
         && value.cliSha256 === identity.cliSha256
@@ -1316,6 +2098,8 @@ function runtimeMarkerFromJson(value, identity) {
         && /^[0-9a-f]{64}$/u.test(value.closureManifestSha256)
         && typeof value.executionProofSha256 === "string"
         && /^[0-9a-f]{64}$/u.test(value.executionProofSha256)
+        && (value.schema !== "mono-agent.managed-runtime.v5"
+            || (typeof value.reuseProofSha256 === "string" && /^[0-9a-f]{64}$/u.test(value.reuseProofSha256)))
         && typeof value.installedAt === "string"
         && Number.isFinite(installedAtMs)
         && new Date(installedAtMs).toISOString() === value.installedAt
@@ -1325,6 +2109,32 @@ function runtimeMarkerFromJson(value, identity) {
         && value.installedAt !== PROVISIONAL_RUNTIME_INSTALLED_AT;
     return valid ? value : undefined;
 }
+function runtimeIdentityFromMarkerJson(value) {
+    if (!isRecord(value))
+        return undefined;
+    if (typeof value.packageVersion !== "string"
+        || !isExactVersion(value.packageVersion)
+        || typeof value.cliSha256 !== "string"
+        || !/^[0-9a-f]{64}$/u.test(value.cliSha256)
+        || typeof value.sourceClosureSha256 !== "string"
+        || !/^[0-9a-f]{64}$/u.test(value.sourceClosureSha256)
+        || typeof value.nodeAbi !== "string"
+        || value.nodeAbi.length === 0
+        || typeof value.platform !== "string"
+        || value.platform.length === 0
+        || typeof value.arch !== "string"
+        || value.arch.length === 0) {
+        return undefined;
+    }
+    return {
+        packageVersion: value.packageVersion,
+        cliSha256: value.cliSha256,
+        sourceClosureSha256: value.sourceClosureSha256,
+        nodeAbi: value.nodeAbi,
+        platform: value.platform,
+        arch: value.arch,
+    };
+}
 async function verifyInstalledPackage(layout, identity) {
     try {
         const packageRoot = dirname(layout.packageJsonPath);
@@ -1386,6 +2196,28 @@ async function verifyClosureManifest(layout, expectedSha256, deps = {}) {
         return false;
     }
 }
+async function verifyClosureManifestFingerprint(layout, expectedSha256) {
+    try {
+        await assertRegularFile(layout.closureManifestPath, "managed runtime closure manifest");
+        const stored = await fingerprintClosureFile(layout.closureManifestPath, ".mono-agent-closure.json");
+        if (stored.sha256 !== expectedSha256)
+            return false;
+        const parsed = JSON.parse(stored.bytes.toString("utf8"));
+        return parsed.schema === "mono-agent.execution-closure.v1" && Array.isArray(parsed.entries);
+    }
+    catch {
+        return false;
+    }
+}
+async function verifyManagedRuntimeCliFingerprint(layout, expectedSha256) {
+    try {
+        const captured = await fingerprintClosureFile(layout.cliPath, "node_modules/@mono-agent/agent-app/dist/cli.js");
+        return captured.sha256 === expectedSha256;
+    }
+    catch {
+        return false;
+    }
+}
 async function captureRuntimeClosureManifest(layout, deps = {}) {
     const entries = [];
     const proofs = [];
@@ -1544,18 +2376,21 @@ async function writeFinalizedRuntimeMarker(path, marker, deps) {
     throw new Error("Could not publish a stable managed runtime launch boundary.");
 }
 async function waitForManagedRuntimeLaunchBoundary(layout, identity, deps) {
-    const marker = await verifiedRuntimeMarker(layout, identity);
+    const marker = await readRuntimeMarker(layout.markerPath, identity);
     if (marker === undefined) {
         throw new Error("The managed runtime marker became invalid before launch.");
     }
-    const boundaryMs = Date.parse(marker.installedAt);
+    await waitForLaunchBoundary(marker.installedAt, deps.now, deps.sleep);
+}
+async function waitForLaunchBoundary(installedAt, now, sleepFor) {
+    const boundaryMs = Date.parse(installedAt);
     const safeStartMs = (Math.floor(boundaryMs / 1_000) + 1) * 1_000;
-    const nowMs = deps.now();
+    const nowMs = now();
     if (safeStartMs - nowMs > 5_000) {
         throw new Error("The managed runtime launch boundary is implausibly far in the future.");
     }
     if (nowMs < safeStartMs)
-        await deps.sleep(safeStartMs - nowMs);
+        await sleepFor(safeStartMs - nowMs);
 }
 function privateJsonContents(value) {
     return `${JSON.stringify(value, undefined, 2)}\n`;
@@ -1611,7 +2446,15 @@ function ownedPrivately(details) {
     const owned = typeof process.getuid !== "function" || Number(details.uid) === process.getuid();
     return owned && (Number(details.mode) & 0o077) === 0;
 }
-function runtimeResult(layout, identity, nodePath) {
+async function runtimeResult(layout, identity, nodePath, verificationMode) {
+    const markerBytes = await readPrivateRuntimeMarkerBytes(layout.markerPath);
+    if (markerBytes === undefined) {
+        throw new Error("The managed runtime marker became unsafe before launch proof publication.");
+    }
+    const marker = runtimeMarkerFromJson(parseJson(markerBytes, "managed runtime marker"), identity);
+    if (marker === undefined) {
+        throw new Error("The managed runtime marker became invalid before launch proof publication.");
+    }
     return {
         cliPath: layout.cliPath,
         nodePath: resolve(nodePath),
@@ -1619,8 +2462,17 @@ function runtimeResult(layout, identity, nodePath) {
         packageVersion: identity.packageVersion,
         cliSha256: identity.cliSha256,
         nodeAbi: identity.nodeAbi,
+        verificationMode,
+        launchProof: encodeManagedRuntimeLaunchProof({
+            schema: MANAGED_RUNTIME_LAUNCH_PROOF_SCHEMA,
+            markerSha256: sha256(markerBytes),
+            installedAt: marker.installedAt,
+        }),
     };
 }
+async function sleep(milliseconds) {
+    await new Promise((resolvePromise) => setTimeout(resolvePromise, milliseconds));
+}
 function requiredNodeAbi() {
     const abi = process.versions.modules;
     if (abi === undefined || abi.trim().length === 0) {