@moretea-labs/forge 1.7.1 → 1.8.0

package/src/runtime/execution/process-runtime/command-facade.ts

@@ -9,7 +9,6 @@
  */
 
 import type { RepositoryRecord } from '../../../cli/repositories/types';
-import { repositoryGitStatus } from '../../../cli/repositories/structured-git';
 import { classifyRepositoryCommand, fixedShellWrapperCommand, shellSegments, shellWordsPreservingQuotes } from '../../../cli/repositories/command-classifier';
 import {
   executeRepositoryCommandAsync,
@@ -34,7 +33,7 @@ import { DEFAULT_INTERACTIVE_WAIT_MS } from './types';
 import { durationAwareInteractiveWaitMs } from './interactive-admission';
 import { isFocusedCheckCommand } from '../thin-harness/execution-router';
 import { assertExecutionIdentity, type ResolvedExecutionIdentity } from '../../control-plane/execution/execution-identity';
-import { readWorkHandle, transitionWorkHandle } from '../../control-plane/execution/work-handle-store';
+import { settleWorkHandleExpectedHeadAfterRepositoryCommand } from '../../control-plane/execution/work-head-settlement';
 import {
   cancelLightweightProcess,
   getLightweightProcessHandle,
@@ -114,77 +113,6 @@ const emptyEffects = {
   projectionUpdateCount: 0,
 };
 
-export type WorkHeadSettlementReason =
-  | 'settled'
-  | 'no_work'
-  | 'command_not_successful'
-  | 'work_handle_missing'
-  | 'identity_mismatch'
-  | 'terminal_handle'
-  | 'branch_changed'
-  | 'head_unavailable'
-  | 'head_unchanged'
-  | 'concurrent_lifecycle_write';
-
-export interface WorkHeadSettlementResult {
-  settled: boolean;
-  reason: WorkHeadSettlementReason;
-  previousHead?: string;
-  currentHead?: string;
-}
-
-/**
- * Settle the one legitimate post-command Work HEAD transition without weakening
- * the pre-command execution identity fence. The command has already been
- * admitted only if repo/checkout/branch/expectedHead matched the WorkHandle.
- * After success, adopt the exact current HEAD only while the same checkout and
- * branch still own the Work. CAS failure is a bounded no-op: finalization keeps
- * failing closed instead of accepting a concurrent lifecycle writer.
- */
-export function settleWorkHandleExpectedHeadAfterRepositoryCommand(input: {
-  controllerHome: string;
-  repository: RepositoryRecord;
-  executionIdentity: ResolvedExecutionIdentity;
-  workId?: string;
-  ok?: boolean;
-  cancelled?: boolean;
-  timedOut?: boolean;
-}): WorkHeadSettlementResult {
-  const workId = input.workId?.trim();
-  if (!workId) return { settled: false, reason: 'no_work' };
-  if (input.ok !== true || input.cancelled === true || input.timedOut === true) {
-    return { settled: false, reason: 'command_not_successful' };
-  }
-  const handle = readWorkHandle(input.controllerHome, input.repository.repoId, workId);
-  if (!handle) return { settled: false, reason: 'work_handle_missing' };
-  if (
-    handle.repositoryId !== input.executionIdentity.repositoryId
-    || handle.checkoutId !== input.executionIdentity.checkoutId
-    || handle.workId !== input.executionIdentity.workId
-  ) return { settled: false, reason: 'identity_mismatch' };
-  if (handle.state === 'merged' || handle.state === 'cleaned' || handle.state === 'failed_terminal_cleanup') {
-    return { settled: false, reason: 'terminal_handle' };
-  }
-  const status = repositoryGitStatus(input.repository);
-  if (!status.branch || status.branch !== handle.branch) {
-    return { settled: false, reason: 'branch_changed', previousHead: handle.expectedHead, currentHead: status.head ?? undefined };
-  }
-  const currentHead = status.head?.trim();
-  if (!currentHead) return { settled: false, reason: 'head_unavailable', previousHead: handle.expectedHead };
-  if (currentHead === handle.expectedHead) {
-    return { settled: false, reason: 'head_unchanged', previousHead: handle.expectedHead, currentHead };
-  }
-  try {
-    transitionWorkHandle(input.controllerHome, handle, handle.state, { expectedHead: currentHead });
-    return { settled: true, reason: 'settled', previousHead: handle.expectedHead, currentHead };
-  } catch (error) {
-    if (error instanceof Error && error.message.includes('CONTROL_PLANE_REVISION_CONFLICT')) {
-      return { settled: false, reason: 'concurrent_lifecycle_write', previousHead: handle.expectedHead, currentHead };
-    }
-    throw error;
-  }
-}
-
 const STANDALONE_RECOVERY_LIFECYCLE_COMMANDS = new Set([
   'restart-runtime',
   'bootstrap-cutover',
@@ -237,9 +165,15 @@ function repositoryCommandRecoveryLifecycle(command: string | readonly string[])
   return wrapped ? recoveryLifecycleFromShell(wrapped) : undefined;
 }
 
-function gitCommitWordsRequireExplicitPathScope(words: readonly string[]): boolean | undefined {
+export type RepositoryGitCommitCommandScope =
+  | { kind: 'not_commit' }
+  | { kind: 'explicit_paths'; paths: string[] }
+  | { kind: 'staged_index' }
+  | { kind: 'unsafe'; reason: 'scope_widening' | 'compound_unscoped_commit' };
+
+function gitCommitWordsScope(words: readonly string[]): RepositoryGitCommitCommandScope {
   const executable = commandBasename(words[0] ?? '');
-  if (executable !== 'git') return undefined;
+  if (executable !== 'git') return { kind: 'not_commit' };
   const args = words.slice(1);
   let index = 0;
   while (index < args.length && args[index]?.startsWith('-')) {
@@ -248,29 +182,45 @@ function gitCommitWordsRequireExplicitPathScope(words: readonly string[]): boole
     else if (['--git-dir=', '--work-tree=', '--namespace='].some((prefix) => option.startsWith(prefix))) index += 1;
     else index += 1;
   }
-  if (args[index]?.toLowerCase() !== 'commit') return undefined;
+  if (args[index]?.toLowerCase() !== 'commit') return { kind: 'not_commit' };
   const commitArgs = args.slice(index + 1);
   const pathSeparator = commitArgs.indexOf('--');
   const paths = pathSeparator >= 0 ? commitArgs.slice(pathSeparator + 1).filter(Boolean) : [];
-  const widensScope = commitArgs.some((arg) => ['-a', '--all', '-i', '--include', '--interactive', '-p', '--patch'].includes(arg));
-  return paths.length === 0 || widensScope;
+  const wideningFlags = ['-a', '--all', '-i', '--include', '--interactive', '-p', '--patch', '--amend', '--pathspec-from-file'];
+  const widensScope = commitArgs.some((arg) => wideningFlags.some((flag) => arg === flag || arg.startsWith(`${flag}=`)));
+  if (widensScope) return { kind: 'unsafe', reason: 'scope_widening' };
+  return paths.length > 0 ? { kind: 'explicit_paths', paths } : { kind: 'staged_index' };
+}
+
+function aggregateShellCommitScope(shellCommand: string): RepositoryGitCommitCommandScope {
+  const segments = shellSegments(shellCommand);
+  const commits = segments
+    .map((segment) => gitCommitWordsScope(shellWordsPreservingQuotes(segment)))
+    .filter((scope) => scope.kind !== 'not_commit');
+  if (commits.length === 0) return { kind: 'not_commit' };
+  const unsafe = commits.find((scope): scope is Extract<RepositoryGitCommitCommandScope, { kind: 'unsafe' }> => scope.kind === 'unsafe');
+  if (unsafe) return unsafe;
+  if (segments.length > 1 && commits.some((scope) => scope.kind === 'staged_index')) {
+    return { kind: 'unsafe', reason: 'compound_unscoped_commit' };
+  }
+  const staged = commits.find((scope) => scope.kind === 'staged_index');
+  if (staged) return staged;
+  const paths = commits.flatMap((scope) => scope.kind === 'explicit_paths' ? scope.paths : []);
+  return { kind: 'explicit_paths', paths: [...new Set(paths)] };
 }
 
-function rawGitCommitRequiresExplicitPathScope(command: string | readonly string[]): boolean {
+export function classifyRawGitCommitScope(command: string | readonly string[]): RepositoryGitCommitCommandScope {
   const normalized = normalizeRepositoryCommand(command);
   if (normalized.kind === 'argv') {
-    const direct = gitCommitWordsRequireExplicitPathScope([
+    const direct = gitCommitWordsScope([
       normalized.executable ?? '',
       ...(normalized.args ?? []),
     ]);
-    if (direct !== undefined) return direct;
+    if (direct.kind !== 'not_commit') return direct;
     const wrapped = fixedShellWrapperCommand(normalized.value as string[]);
-    if (!wrapped) return false;
-    return shellSegments(wrapped)
-      .some((segment) => gitCommitWordsRequireExplicitPathScope(shellWordsPreservingQuotes(segment)) === true);
+    return wrapped ? aggregateShellCommitScope(wrapped) : { kind: 'not_commit' };
   }
-  return shellSegments(normalized.shellCommand ?? '')
-    .some((segment) => gitCommitWordsRequireExplicitPathScope(shellWordsPreservingQuotes(segment)) === true);
+  return aggregateShellCommitScope(normalized.shellCommand ?? '');
 }
 
 function toProcessCommand(command: string | readonly string[], cwd: string): ProcessCommandSpec {
@@ -305,7 +255,8 @@ export function classifyRepositoryCommandRoute(
   if (repositoryCommandRecoveryLifecycle(command)) {
     return { route: 'reject', reason: 'standalone_recovery_lifecycle_required' };
   }
-  if (rawGitCommitRequiresExplicitPathScope(command)) {
+  const commitScope = classifyRawGitCommitScope(command);
+  if (commitScope.kind === 'unsafe') {
     return { route: 'reject', reason: 'git_commit_requires_explicit_path_scope' };
   }
   if (options.forceDurable) {

package/src/runtime/execution/process-runtime/index.ts

@@ -2,6 +2,7 @@ export * from './types';
 export * from './store';
 export * from './resource-claims';
 export * from './runtime';
+export * from './check-classification';
 export * from './check-facade';
 export * from './check-receipt';
 export * from './command-facade';

package/src/runtime/execution/process-runtime/interactive-admission.ts

@@ -28,5 +28,6 @@ export function durationAwareInteractiveWaitMs(
   const normalized = normalizeRepositoryCommand(command);
   if (normalized.kind !== 'argv') return DEFAULT_COMPLETION_GRACE_MS;
   const executable = normalized.executable?.split(/[\\/]/).at(-1)?.toLowerCase();
-  return executable && SHORT_COMMANDS.has(executable) ? shortCommandWaitMs : DEFAULT_COMPLETION_GRACE_MS;
+  const shortGitMerge = executable === 'git' && normalized.args?.[0] === 'merge';
+  return executable && (SHORT_COMMANDS.has(executable) || shortGitMerge) ? shortCommandWaitMs : DEFAULT_COMPLETION_GRACE_MS;
 }

package/src/runtime/execution/process-runtime/lightweight-managed.ts

@@ -93,6 +93,12 @@ interface LightweightEntry {
 
 const entries = new Map<string, LightweightEntry>();
 
+export function hasActiveLightweightProcesses(controllerHome: string): boolean {
+  return [...entries.values()].some((entry) => (
+    entry.controllerHome === controllerHome && entry.result === undefined
+  ));
+}
+
 interface LightweightRunningReceipt {
   schemaVersion: 1;
   repoId: string;
@@ -740,7 +746,31 @@ export async function startLightweightRepositoryCommand(
     // degradation is represented by RepositoryCommandExecution.evidenceError;
     // this catch is the final fail-safe for any later post-processing exception.
     if (entry.exitObservation && entry.result) return entry.result;
-    throw error;
+
+    // Command preparation can fail before spawn (for example a repository-scope
+    // or external-filesystem grant denial). In deferred-start mode that rejection
+    // must belong to this lightweight Process; allowing it to escape would become
+    // an unhandled Runtime rejection and could terminate unrelated in-flight work.
+    const message = error instanceof Error ? error.message : String(error);
+    const failed: LightweightExecutionResult = {
+      ok: false,
+      exitCode: 1,
+      timedOut: false,
+      cancelled: false,
+      stdout: visibleOutput(entry.stdout, maxOutputBytes),
+      stderr: visibleOutput([entry.stderr, message].filter(Boolean).join('\n'), maxOutputBytes),
+    };
+    entry.result = failed;
+    entry.finishedAtMs = Date.now();
+    input.execution.signal?.removeEventListener('abort', onCallerAbort);
+    try {
+      input.onCompleted?.(failed);
+    } catch (callbackError) {
+      const callbackMessage = callbackError instanceof Error ? callbackError.message : String(callbackError);
+      failed.stderr = visibleOutput([failed.stderr, callbackMessage].filter(Boolean).join('\n'), maxOutputBytes);
+    }
+    persistTerminalReceipt(input.controllerHome, entry);
+    return failed;
   });
   entry.promise = input.deferStart
     ? new Promise<LightweightExecutionResult>((resolve, reject) => {
@@ -974,6 +1004,7 @@ export async function startLightweightControllerCheck(
   }, { once: true });
   entry.promise = runControllerCheckAsync(input.repoRoot, input.checkId, {
     requestedTimeoutMs: input.timeoutMs,
+    storageAuthority: { controllerHome: input.controllerHome, repoId: input.repoId },
     subscriberId: processId,
     onSpawn: (pid) => {
       entry.pid = pid;

package/src/runtime/execution/process-runtime/persisted-check.ts

@@ -4,6 +4,7 @@ import { dirname, resolve } from 'path';
 import { fileURLToPath } from 'url';
 import {
   controllerCheckExecutionIdentity,
+  controllerCheckLiveExecutionStateFingerprint,
   listControllerChecks,
   snapshotControllerCheck,
 } from '../../../cli/controller/check-runner';
@@ -16,6 +17,7 @@ import {
 } from '../../../cli/runtime-invocation';
 import { readRuntimeGeneration, resolveControllerRuntimeSourceRoot } from '../../control-plane/runtime-generation';
 import { cleanupWorkVerificationSnapshot, materializeWorkVerificationSnapshot } from '../../control-plane/execution/work-verification-snapshot';
+import { resolveBunExecutable } from '../../shared/process-environment';
 import {
   checkRequiresDurableWorkflow,
   processCheckSemanticScopeKey,
@@ -37,6 +39,7 @@ import { durationAwareInteractiveWaitMs } from './interactive-admission';
 export const DEFAULT_WORK_CHECK_LEASE_WAIT_MS = 30_000;
 
 const PERSISTED_CHECK_SOURCE_ENTRY = 'src/runtime/execution/process-runtime/check-runner-sidecar.ts';
+const PERSISTED_CHECK_NODE_LOADER = 'src/runtime/shared/node-ts-loader.mjs';
 
 export function resolvePersistedCheckCliInvocation(
   cliEntry: string,
@@ -78,6 +81,52 @@ export function resolveRuntimeCliEntry(controllerHome?: string): string {
   return resolveRuntimeCliTarget(controllerHome).entry;
 }
 
+export function shouldUseCandidatePersistedCheckRunner(input: {
+  repoId: string;
+  runtimeSourceRepoId?: string;
+  verificationSnapshot: boolean;
+  liveCertification: boolean;
+}): boolean {
+  return input.verificationSnapshot
+    && !input.liveCertification
+    && Boolean(input.runtimeSourceRepoId && input.runtimeSourceRepoId === input.repoId);
+}
+
+export function resolveCandidatePersistedCheckRunnerTarget(
+  candidateRoot: string,
+  sourceRevision: string,
+  options: { bunExecutable?: string; entryExists?: (path: string) => boolean } = {},
+): { cliTarget: CliRuntimeTarget; runtimeExecutable: string; executionStateFingerprint: string } {
+  const root = resolve(candidateRoot);
+  const revision = sourceRevision.trim();
+  if (!revision) throw new Error('PERSISTED_CHECK_CANDIDATE_REVISION_REQUIRED');
+  const entryExists = options.entryExists ?? existsSync;
+  const sourceEntry = resolve(root, PERSISTED_CHECK_SOURCE_ENTRY);
+  if (!entryExists(sourceEntry)) {
+    throw new Error(`PERSISTED_CHECK_CANDIDATE_RUNNER_MISSING: ${sourceEntry}`);
+  }
+  const runtimeExecutable = options.bunExecutable?.trim() || resolveBunExecutable();
+  const cliTarget: CliRuntimeTarget = {
+    entry: sourceEntry,
+    cwd: root,
+    runtimeKind: 'bun_source',
+    sourceRevision: revision,
+    immutable: false,
+    explanation: 'self-hosting Work verification snapshot candidate Check Runner',
+  };
+  const executionStateFingerprint = createHash('sha256')
+    .update(JSON.stringify({
+      schemaVersion: 1,
+      authority: 'self_hosting_work_verification_candidate',
+      runnerEntry: PERSISTED_CHECK_SOURCE_ENTRY,
+      runtimeKind: cliTarget.runtimeKind,
+      sourceRevision: revision,
+    }))
+    .digest('hex')
+    .slice(0, 24);
+  return { cliTarget, runtimeExecutable, executionStateFingerprint };
+}
+
 export function persistedCheckSemanticScopeKey(
   input: Pick<RunCheckFacadeInput, 'workId' | 'verificationBinding' | 'checkoutId'>,
   reuseScope: 'repository' | 'checkout',
@@ -108,25 +157,35 @@ export function resolvePersistedCheckProcessInvocation(
   if (cliTarget.runtimeKind === 'compiled_bun_release') {
     return { executable, args };
   }
+  const entryExists = options.entryExists ?? existsSync;
   const sourceEntry = resolve(cliTarget.cwd, PERSISTED_CHECK_SOURCE_ENTRY);
-  if (!(options.entryExists ?? existsSync)(sourceEntry)) {
+  if (!entryExists(sourceEntry)) {
     throw new Error(`PERSISTED_CHECK_SOURCE_RUNNER_MISSING: ${sourceEntry}`);
   }
+  let nodeSourceLoaderEntry: string | undefined;
+  if (cliTarget.runtimeKind === 'node_source') {
+    nodeSourceLoaderEntry = resolve(cliTarget.cwd, PERSISTED_CHECK_NODE_LOADER);
+    if (!entryExists(nodeSourceLoaderEntry)) {
+      throw new Error(`PERSISTED_CHECK_NODE_LOADER_MISSING: ${nodeSourceLoaderEntry}`);
+    }
+  }
   return resolvePersistedCheckCliInvocation(sourceEntry, args, {
     runtimeExecutable: executable,
     runtimeKind: cliTarget.runtimeKind,
     sourceRevision: cliTarget.sourceRevision,
     immutable: false,
+    ...(nodeSourceLoaderEntry ? { nodeSourceLoaderEntry } : {}),
     ...(cliTarget.runtimeKind === 'package_launcher' ? { launcherEntry: cliTarget.entry } : {}),
   });
 }
 
 /**
  * Run a registered check through Process Runtime while keeping check-runner
- * evidence authoritative. The managed OS process invokes the same immutable
- * forge CLI bundle with a hidden internal subcommand; that subcommand
- * executes runControllerCheck, writes the Artifact atomically, mirrors bounded
- * stdout/stderr, and exits with the exact check status.
+ * evidence authoritative. Ordinary repositories and live-runtime certification
+ * use the active immutable Runtime runner. Self-hosting Forge Work verification
+ * instead executes the exact candidate snapshot sidecar so pre-cutover evidence
+ * cannot be interpreted by an older Runtime release. Process/lease/receipt
+ * authority remains in the active Runtime in both cases.
  */
 export async function runPersistedCheckViaProcessRuntime(
   input: RunCheckFacadeInput,
@@ -169,6 +228,23 @@ export async function runPersistedCheckViaProcessRuntime(
       };
     }
   }
+  // Check-definition authority belongs to the canonical repository, while Work source
+  // verification may execute from an immutable snapshot that intentionally excludes
+  // machine-local registry files such as .forge/checks.json. Freeze the exact
+  // registered definition before materializing the source-under-test snapshot.
+  const check = listControllerChecks(input.repoRoot).find((entry) => entry.id === input.checkId);
+  if (!check) {
+    return {
+      mode: 'durable',
+      checkId: input.checkId,
+      durable: {
+        reason: 'check_not_found_or_requires_registry_lookup',
+        suggestedOperation: 'list_checks then run_check with a known check_id',
+      },
+      durableSideEffects: emptyEffects,
+    };
+  }
+  const checkSnapshot = snapshotControllerCheck(input.repoRoot, input.checkId);
   const verificationSnapshot = input.verificationSnapshot
     ? materializeWorkVerificationSnapshot({
         controllerHome: input.controllerHome,
@@ -181,18 +257,9 @@ export async function runPersistedCheckViaProcessRuntime(
   const cleanupVerificationSnapshot = () => {
     if (verificationSnapshot) cleanupWorkVerificationSnapshot(verificationSnapshot.root);
   };
-  const check = listControllerChecks(executionRoot).find((entry) => entry.id === input.checkId);
-  if (!check) {
+  if (check.id !== checkSnapshot.id) {
     cleanupVerificationSnapshot();
-    return {
-      mode: 'durable',
-      checkId: input.checkId,
-      durable: {
-        reason: 'check_not_found_or_requires_registry_lookup',
-        suggestedOperation: 'list_checks then run_check with a known check_id',
-      },
-      durableSideEffects: emptyEffects,
-    };
+    throw new Error(`CHECK_DEFINITION_AUTHORITY_MISMATCH: ${input.checkId}`);
   }
   if (input.forceDurable || (checkRequiresDurableWorkflow(input.checkId, check) && input.allowDurableCheckExecution !== true)) {
     cleanupVerificationSnapshot();
@@ -237,17 +304,48 @@ export async function runPersistedCheckViaProcessRuntime(
     executionIdentity.repositoryId,
     executionIdentity.checkoutId,
     check.effects,
+    check.executionAuthority,
   );
-  const checkSnapshot = snapshotControllerCheck(executionRoot, input.checkId);
   const checkFingerprint = createHash('sha256')
     .update(JSON.stringify(checkSnapshot))
     .digest('hex');
-  const semanticCheck = controllerCheckExecutionIdentity(
+  const liveCertification = check.executionAuthority === 'live_controller_home';
+  if (liveCertification && input.allowDurableCheckExecution !== true) {
+    cleanupVerificationSnapshot();
+    throw new Error('LIVE_CHECK_CONTROLLER_OWNERSHIP_REQUIRED');
+  }
+  const liveExecutionStateFingerprint = liveCertification
+    ? controllerCheckLiveExecutionStateFingerprint(input.controllerHome)
+    : undefined;
+  const preliminarySemanticCheck = controllerCheckExecutionIdentity(
     executionRoot,
     input.checkId,
     timeoutMs,
     checkSnapshot,
+    liveExecutionStateFingerprint,
   );
+  const runtimeGeneration = verificationSnapshot && !liveCertification
+    ? readRuntimeGeneration(input.controllerHome)
+    : undefined;
+  const candidateRunner = shouldUseCandidatePersistedCheckRunner({
+    repoId: input.repoId,
+    runtimeSourceRepoId: runtimeGeneration?.source.sourceRepositoryId,
+    verificationSnapshot: Boolean(verificationSnapshot),
+    liveCertification,
+  })
+    ? resolveCandidatePersistedCheckRunnerTarget(executionRoot, preliminarySemanticCheck.revision)
+    : undefined;
+  const executionStateFingerprint = candidateRunner?.executionStateFingerprint
+    ?? liveExecutionStateFingerprint;
+  const semanticCheck = candidateRunner
+    ? controllerCheckExecutionIdentity(
+        executionRoot,
+        input.checkId,
+        timeoutMs,
+        checkSnapshot,
+        executionStateFingerprint,
+      )
+    : preliminarySemanticCheck;
   const processCheckExecution = {
     schemaVersion: 1 as const,
     checkId: semanticCheck.checkId,
@@ -259,7 +357,7 @@ export async function runPersistedCheckViaProcessRuntime(
     reuseScope: semanticCheck.reuseScope,
     scopeKey: persistedCheckSemanticScopeKey(input, semanticCheck.reuseScope),
   };
-  const cliTarget = resolveRuntimeCliTarget(input.controllerHome);
+  const cliTarget = candidateRunner?.cliTarget ?? resolveRuntimeCliTarget(input.controllerHome);
   const checkResultReceiptPath = allocatePersistedCheckResultReceiptPath(
     input.controllerHome,
     input.repoId,
@@ -268,20 +366,29 @@ export async function runPersistedCheckViaProcessRuntime(
   const checkArgs = [
     '--repo',
     executionRoot,
+    '--controller-home',
+    input.controllerHome,
+    '--repo-id',
+    input.repoId,
     '--check-id',
     input.checkId,
     '--timeout-ms',
     String(timeoutMs),
     '--expected-check-fingerprint',
     checkFingerprint,
+    '--check-snapshot',
+    Buffer.from(JSON.stringify(checkSnapshot)).toString('base64url'),
     '--result-receipt',
     checkResultReceiptPath,
     ...(verificationSnapshot ? [
-      '--isolated-controller-home', verificationSnapshot.isolatedControllerHome,
+      ...(liveCertification ? ['--live-controller-home'] : ['--isolated-controller-home', verificationSnapshot.isolatedControllerHome]),
+      ...(executionStateFingerprint ? ['--execution-state-fingerprint', executionStateFingerprint] : []),
       '--cleanup-root', verificationSnapshot.root,
     ] : []),
   ];
-  const invocation = resolvePersistedCheckProcessInvocation(cliTarget, checkArgs);
+  const invocation = resolvePersistedCheckProcessInvocation(cliTarget, checkArgs, candidateRunner
+    ? { runtimeExecutable: candidateRunner.runtimeExecutable }
+    : {});
   let handle;
   try {
     handle = await spawnManagedProcess({

package/src/runtime/execution/process-runtime/resource-claims.ts

@@ -6,8 +6,13 @@
 import type { ResourceClaimSpec } from '../jobs/types';
 import { readFileSync } from 'fs';
 import { join } from 'path';
-import type { ControllerCheckEffects } from '../../../cli/controller/check-runner';
-import { classifyRepositoryCommand, fixedShellWrapperCommand } from '../../../cli/repositories/command-classifier';
+import type { ControllerCheckEffects, ControllerCheckExecutionAuthority } from '../../../cli/controller/check-runner';
+import {
+  classifyRepositoryCommand,
+  fixedShellWrapperCommand,
+  shellSegments,
+  shellWordsPreservingQuotes,
+} from '../../../cli/repositories/command-classifier';
 import { normalizeRepositoryCommand } from '../../../cli/repositories/command-normalization';
 import { isFocusedCheckCommand } from '../thin-harness/execution-router';
 import type { ProcessResourceClaim } from './types';
@@ -235,6 +240,52 @@ function viteServiceClaims(
   ]);
 }
 
+const HOMEBREW_HOST_MUTATION_SUBCOMMANDS = new Set([
+  'install',
+  'uninstall',
+  'reinstall',
+  'upgrade',
+  'update',
+  'cleanup',
+  'autoremove',
+  'tap',
+  'untap',
+]);
+
+function homebrewHostMutationClaims(command: string | readonly string[]): ResourceClaimSpec[] | undefined {
+  const canonical = normalizeRepositoryCommand(command);
+  let words: string[];
+
+  if (canonical.kind === 'argv') {
+    const argv = [canonical.executable ?? '', ...(canonical.args ?? [])];
+    const wrapped = fixedShellWrapperCommand(argv);
+    if (wrapped) {
+      const segments = shellSegments(wrapped);
+      if (segments.length !== 1) return undefined;
+      words = shellWordsPreservingQuotes(segments[0]!);
+    } else {
+      words = argv;
+    }
+  } else {
+    const segments = shellSegments(canonical.shellCommand ?? '');
+    if (segments.length !== 1) return undefined;
+    words = shellWordsPreservingQuotes(segments[0]!);
+  }
+
+  const program = words[0]?.split(/[\\/]/).at(-1)?.toLowerCase();
+  if (program !== 'brew') return undefined;
+  const subcommand = words[1]?.toLowerCase();
+  if (!subcommand || !HOMEBREW_HOST_MUTATION_SUBCOMMANDS.has(subcommand)) return undefined;
+
+  // Keep local formula files, Brewfiles, and other path-shaped operands under
+  // conservative repository workspace coordination. Formula/cask identifiers
+  // are deliberately narrow so an ambiguous command still fails closed.
+  const positional = words.slice(2).filter((arg) => arg && !arg.startsWith('-'));
+  if (positional.some((arg) => !/^[A-Za-z0-9@+_.-]+$/.test(arg))) return undefined;
+
+  return [claimHostService('package-manager:homebrew', 'write')];
+}
+
 function hostOnlyCommandClaims(command: string | readonly string[], repoId: string, checkoutId?: string, repoRoot?: string): ResourceClaimSpec[] | undefined {
   const localServer = localHttpServerClaims(command);
   if (localServer) return localServer;
@@ -242,6 +293,8 @@ function hostOnlyCommandClaims(command: string | readonly string[], repoId: stri
   if (loopbackCurl) return loopbackCurl;
   const vite = viteServiceClaims(command, repoId, checkoutId, repoRoot);
   if (vite) return vite;
+  const homebrew = homebrewHostMutationClaims(command);
+  if (homebrew) return homebrew;
   const canonical = normalizeRepositoryCommand(command);
   if (canonical.kind === 'shell') {
     return browserAppleScriptHeredocClaims(canonical.shellCommand ?? '');
@@ -508,6 +561,7 @@ export function claimsForCheck(
   repoId: string,
   checkoutId?: string,
   effects?: ControllerCheckEffects,
+  executionAuthority?: ControllerCheckExecutionAuthority,
 ): ResourceClaimSpec[] {
   const heavy = /(?:^|:)(?:test(?::coverage)?|check:(?:ci|forge-runtime|public-export|release(?:-[a-z0-9-]+)?))$/.test(checkId)
     || /release|migration|integrate/i.test(checkId);
@@ -520,7 +574,10 @@ export function claimsForCheck(
         : [claimWorkspaceWrite(checkoutId)];
   // Heavy-check is an additional cross-check serialization fence, not a
   // substitute for the resources the check actually reads or writes.
-  return heavy ? normalizeClaims([claimHeavyCheck(repoId), ...baseClaims]) : baseClaims;
+  const liveAuthorityClaims = executionAuthority === 'live_controller_home' ? [claimRelease(repoId)] : [];
+  return heavy
+    ? normalizeClaims([claimHeavyCheck(repoId), ...liveAuthorityClaims, ...baseClaims])
+    : normalizeClaims([...liveAuthorityClaims, ...baseClaims]);
 }
 
 export function scopeResourceClaims(