@moretea-labs/forge 1.7.2 → 1.8.1

package/scripts/migrate-chatgpt-automation-schedules.ts

@@ -4,8 +4,8 @@ import { dirname, join, resolve } from 'path';
 import { resolveRepoPreferredControllerHome } from '../src/cli/repositories/controller-home';
 import { listRepositories } from '../src/cli/repositories/registry';
 import { migrateChatgptAutomationSchedule } from '../src/runtime/workflow/schedules/chatgpt-automation-migration';
-import { listSchedules, saveSchedule } from '../src/runtime/workflow/schedules/store';
-import type { RepositorySchedule } from '../src/runtime/workflow/schedules/types';
+import { listSchedules, saveSchedule } from '../packages/kernel/scheduler/api/index';
+import type { RepositorySchedule } from '../packages/kernel/scheduler/api/index';
 
 interface Args { controllerHome?: string; apply: boolean; json: boolean; }
 

package/scripts/migrate-windows-wsl-controller-home.ts

@@ -0,0 +1,306 @@
+#!/usr/bin/env bun
+/**
+ * Direct bootstrap migration for the retired repo-local Controller Home.
+ * It deliberately does not invoke Forge Runtime/MCP/CLI/Recovery. The source
+ * Home is preserved as evidence; only the running service authority moves.
+ */
+import { createHash } from 'crypto';
+import {
+  existsSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync,
+  statSync, unlinkSync, writeFileSync,
+} from 'fs';
+import { homedir } from 'os';
+import { basename, dirname, join, resolve } from 'path';
+import { spawnSync } from 'child_process';
+import { stageRuntimeRelease } from '../src/runtime/root/release-materialize';
+import { publishRuntimeRelease } from '../src/runtime/root/release-store';
+
+const home = homedir();
+const sourceRoot = resolve(process.cwd());
+const legacyHome = resolve(join(sourceRoot, '_ops', 'controller-home'));
+const canonicalHome = resolve(join(home, '.forge', 'controller'));
+const rescueRoot = resolve(join(home, '.forge-recovery'));
+const execute = process.argv.includes('--execute');
+
+function option(name: string): string | undefined {
+  const index = process.argv.indexOf(name);
+  return index >= 0 ? process.argv[index + 1] : undefined;
+}
+
+function exactHome(value: string | undefined, expected: string, code: string): string {
+  const resolved = resolve(value ?? expected);
+  if (resolved !== expected) throw new Error(code);
+  return resolved;
+}
+
+function unitFor(prefix: 'runtime' | 'connector', controllerHome: string): string {
+  const suffix = createHash('sha256').update(resolve(controllerHome)).digest('hex').slice(0, 12);
+  return prefix === 'runtime'
+    ? `com.moretea.forge.runtime.${suffix}.service`
+    : `com.moretea.forge.mcp-gateway.${suffix}.service`;
+}
+
+function command(commandName: string, args: string[], allowFailure = false): string {
+  const result = spawnSync(commandName, args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 120_000 });
+  if (!allowFailure && (result.status !== 0 || result.error)) {
+    throw new Error(`HOST_RESCUE_MIGRATION_COMMAND_FAILED: ${commandName} ${args.join(' ')}: ${(result.stderr || result.stdout || result.error?.message || 'unknown error').trim()}`);
+  }
+  return result.stdout ?? '';
+}
+
+function unitActive(unit: string): boolean {
+  return command('systemctl', ['--user', 'is-active', unit], true).trim() === 'active';
+}
+
+function unitPath(unit: string): string {
+  return join(home, '.config', 'systemd', 'user', unit);
+}
+
+function requiredFile(path: string, code: string): void {
+  if (!existsSync(path) || !lstatSync(path).isFile()) throw new Error(code);
+}
+
+function atomicWrite(path: string, content: string, mode = 0o600): void {
+  mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+  const temporary = `${path}.${process.pid}.tmp`;
+  writeFileSync(temporary, content, { encoding: 'utf8', mode });
+  renameSync(temporary, path);
+}
+
+function mapPaths(value: unknown, source: string, destination: string): unknown {
+  if (typeof value === 'string') return value.startsWith(source) ? `${destination}${value.slice(source.length)}` : value;
+  if (Array.isArray(value)) return value.map((entry) => mapPaths(entry, source, destination));
+  if (value && typeof value === 'object') {
+    return Object.fromEntries(Object.entries(value as Record<string, unknown>).map(([key, entry]) => [key, mapPaths(entry, source, destination)]));
+  }
+  return value;
+}
+
+function rewriteJsonPathPrefixes(root: string, source: string, destination: string): void {
+  const relativePaths = [
+    'runtime/connector-service/authority.json',
+    'system/runtime-generation.json',
+  ];
+  for (const path of relativePaths) {
+    const absolute = join(root, path);
+    if (!existsSync(absolute)) continue;
+    const parsed = JSON.parse(readFileSync(absolute, 'utf8')) as unknown;
+    atomicWrite(absolute, `${JSON.stringify(mapPaths(parsed, source, destination), null, 2)}\n`);
+  }
+}
+
+function preserveLegacyReleaseAuthority(root: string, timestamp: string): void {
+  const source = join(root, 'runtime', 'releases', 'authority.json');
+  requiredFile(source, 'HOST_RESCUE_MIGRATION_RUNTIME_AUTHORITY_MISSING');
+  const destination = join(root, 'migration', 'legacy-release-authority', `authority.json.${timestamp}`);
+  mkdirSync(dirname(destination), { recursive: true, mode: 0o700 });
+  renameSync(source, destination);
+}
+
+function moveStaleRuntimeProjection(root: string, timestamp: string): void {
+  for (const relativePath of ['runtime/active-runtime-owner.json', 'runtime/status.json']) {
+    const source = join(root, relativePath);
+    if (!existsSync(source)) continue;
+    const destination = join(root, 'migration', 'legacy-runtime-projections', `${basename(relativePath)}.${timestamp}`);
+    mkdirSync(dirname(destination), { recursive: true, mode: 0o700 });
+    renameSync(source, destination);
+  }
+}
+
+function readActiveRelease(root: string): { releaseId: string; releasePath: string } {
+  const authorityPath = join(root, 'runtime', 'releases', 'authority.json');
+  requiredFile(authorityPath, 'HOST_RESCUE_MIGRATION_RUNTIME_AUTHORITY_MISSING');
+  const authority = JSON.parse(readFileSync(authorityPath, 'utf8')) as { active?: { releaseId?: string; manifestPath?: string } };
+  const releaseId = authority.active?.releaseId;
+  const manifestPath = authority.active?.manifestPath;
+  if (!releaseId || !manifestPath || !manifestPath.startsWith(`${root}/runtime/releases/`)) {
+    throw new Error('HOST_RESCUE_MIGRATION_RUNTIME_AUTHORITY_INVALID');
+  }
+  const releasePath = dirname(manifestPath);
+  for (const path of [join(releasePath, 'forge-runtime'), join(releasePath, 'manifest.json'), join(releasePath, 'package', 'src', 'cli', 'index.ts')]) {
+    requiredFile(path, 'HOST_RESCUE_MIGRATION_ACTIVE_RELEASE_INCOMPLETE');
+  }
+  return { releaseId, releasePath };
+}
+
+function quoteSystemd(value: string): string {
+  return `"${value.replaceAll('%', '%%').replaceAll('\\', '\\\\').replaceAll('"', '\\"')}"`;
+}
+
+function renderRuntimeUnit(root: string, unit: string, release: { releaseId: string; releasePath: string }): string {
+  const runtime = join(release.releasePath, 'forge-runtime');
+  const cli = join(release.releasePath, 'forge-cli');
+  const args = [runtime, '--controller-home', root, '--repo', join(release.releasePath, 'package'), '--release-manifest', join(release.releasePath, 'manifest.json'), '--host', '127.0.0.1', '--port', '8765', '--auth-token-file', join(root, 'mcp', 'runtime-token')];
+  return [
+    '[Unit]', 'Description=Forge Runtime', 'After=network-online.target', '',
+    '[Service]', 'Type=simple', `ExecStart=${args.map(quoteSystemd).join(' ')}`,
+    `Environment=${quoteSystemd(`FORGE_CLI_EXECUTABLE=${cli}`)}`,
+    `Environment=${quoteSystemd(`FORGE_CONTROLLER_HOME=${root}`)}`,
+    `Environment=${quoteSystemd(`FORGE_CONTROLLER_RUNTIME_SOURCE_ROOT=${release.releasePath}`)}`,
+    `Environment=${quoteSystemd('FORGE_RELEASE_CLEAN_WORKSPACE=true')}`,
+    `Environment=${quoteSystemd(`FORGE_RELEASE_ID=${release.releaseId}`)}`,
+    `Environment=${quoteSystemd(`FORGE_RELEASE_PATH=${release.releasePath}`)}`,
+    `Environment=${quoteSystemd(`FORGE_RELEASE_REVISION=${release.releaseId}`)}`,
+    'Restart=on-failure', 'RestartSec=5', '', '[Install]', 'WantedBy=default.target', '',
+  ].join('\n');
+}
+
+function renderConnectorUnit(root: string, unit: string, release: { releaseId: string; releasePath: string }): string {
+  const executable = process.execPath;
+  // OpenAI Secure Tunnel is the external authentication boundary. This
+  // listener is loopback-only, so its upstream connection must be
+  // unauthenticated; tunnel-client cannot complete the local PKCE flow.
+  const args = [executable, join(release.releasePath, 'package', 'src', 'cli', 'index.ts'), 'mcp', 'serve', '--controller-home', root, '--transport', 'http', '--host', '127.0.0.1', '--port', '8767', '--profile', 'controller', '--auth', 'none'];
+  return [
+    '[Unit]', 'Description=Forge ChatGPT Secure Tunnel Gateway', 'After=network-online.target', '',
+    '[Service]', 'Type=simple', `ExecStart=${args.map(quoteSystemd).join(' ')}`,
+    `Environment=${quoteSystemd(`FORGE_CONTROLLER_HOME=${root}`)}`,
+    `Environment=${quoteSystemd('FORGE_CONTROLLER_LIFECYCLE_OWNER=1')}`,
+    'Restart=on-failure', 'RestartSec=5', '', '[Install]', 'WantedBy=default.target', '',
+  ].join('\n');
+}
+
+function writeCanonicalConnectorAuthority(root: string, unit: string, release: { releaseId: string; releasePath: string }): void {
+  atomicWrite(join(root, 'runtime', 'connector-service', 'authority.json'), `${JSON.stringify({
+    schemaVersion: 1,
+    endpoint: 'http://127.0.0.1:8767/mcp',
+    releaseId: release.releaseId,
+    releaseRoot: release.releasePath,
+    packageRoot: join(release.releasePath, 'package'),
+    authMode: 'none',
+    externalAuthorization: 'openai-secure-tunnel',
+    mode: 'systemd-user',
+    persistent: true,
+    servicePath: unitPath(unit),
+    installedAt: new Date().toISOString(),
+  }, null, 2)}\n`);
+}
+
+function localMcpAvailable(url: string): boolean {
+  const status = command('curl', ['--silent', '--show-error', '--output', '/dev/null', '--write-out', '%{http_code}', '--connect-timeout', '3', '--max-time', '8', url], true).trim();
+  return status === '200' || status === '401' || status === '405';
+}
+
+function waitFor(condition: () => boolean, attempts = 20): boolean {
+  for (let attempt = 0; attempt < attempts; attempt += 1) {
+    if (condition()) return true;
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 500);
+  }
+  return false;
+}
+
+const source = exactHome(option('--source-home'), legacyHome, 'HOST_RESCUE_MIGRATION_LEGACY_HOME_REQUIRED');
+const destination = exactHome(option('--destination-home'), canonicalHome, 'HOST_RESCUE_MIGRATION_CANONICAL_HOME_REQUIRED');
+if (!existsSync(join(sourceRoot, '.git'))) throw new Error('HOST_RESCUE_MIGRATION_SOURCE_ROOT_NOT_GIT');
+requiredFile(join(source, 'control-plane.sqlite'), 'HOST_RESCUE_MIGRATION_LEGACY_DB_MISSING');
+requiredFile(join(source, 'runtime', 'releases', 'authority.json'), 'HOST_RESCUE_MIGRATION_LEGACY_RUNTIME_AUTHORITY_MISSING');
+
+const units = {
+  legacyRuntime: unitFor('runtime', source),
+  legacyConnector: unitFor('connector', source),
+  canonicalRuntime: unitFor('runtime', destination),
+  canonicalConnector: unitFor('connector', destination),
+  legacyRecoveryGateway: 'com.moretea.forge-recovery-gateway.service',
+  legacyRecoveryWatchdog: 'com.moretea.forge-recovery-watchdog.service',
+};
+const preflight = {
+  executionEnvironment: 'WINDOWS_WSL',
+  source,
+  destination,
+  sourceDatabaseBytes: statSync(join(source, 'control-plane.sqlite')).size,
+  destinationExists: existsSync(destination),
+  units: Object.fromEntries(Object.entries(units).map(([name, unit]) => [name, { unit, active: unitActive(unit) }])),
+};
+
+if (preflight.units.legacyRuntime.active && preflight.units.canonicalRuntime.active) {
+  throw new Error('HOST_RESCUE_MIGRATION_DUAL_RUNTIME_AUTHORITY_FAIL_CLOSED');
+}
+if (preflight.units.legacyConnector.active && preflight.units.canonicalConnector.active) {
+  throw new Error('HOST_RESCUE_MIGRATION_DUAL_CONNECTOR_AUTHORITY_FAIL_CLOSED');
+}
+if (!preflight.units.legacyRuntime.active || !preflight.units.legacyConnector.active) {
+  throw new Error('HOST_RESCUE_MIGRATION_LEGACY_AUTHORITY_NOT_ACTIVE');
+}
+if (!execute) {
+  process.stdout.write(`${JSON.stringify({ status: 'preflight_only', ...preflight }, null, 2)}\n`);
+  process.exit(0);
+}
+
+const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+const staging = `${destination}.migration-staging-${timestamp}`;
+const destinationBackup = `${destination}.pre-rescue-${timestamp}`;
+const legacyUnitContents = new Map<string, string>();
+for (const unit of [units.legacyConnector, units.legacyRuntime, units.legacyRecoveryGateway, units.legacyRecoveryWatchdog]) {
+  const path = unitPath(unit);
+  if (existsSync(path)) legacyUnitContents.set(path, readFileSync(path, 'utf8'));
+}
+let sourceStopped = false;
+let destinationActivated = false;
+try {
+  command('systemctl', ['--user', 'stop', units.legacyConnector]);
+  command('systemctl', ['--user', 'stop', units.legacyRuntime]);
+  sourceStopped = true;
+  if (unitActive(units.legacyConnector) || unitActive(units.legacyRuntime)) throw new Error('HOST_RESCUE_MIGRATION_LEGACY_STOP_UNVERIFIED');
+  command('rsync', ['-aH', '--numeric-ids', `${source}/`, `${staging}/`]);
+  requiredFile(join(staging, 'control-plane.sqlite'), 'HOST_RESCUE_MIGRATION_STAGED_DB_MISSING');
+  requiredFile(join(staging, 'runtime', 'releases', 'authority.json'), 'HOST_RESCUE_MIGRATION_STAGED_RUNTIME_AUTHORITY_MISSING');
+  if (existsSync(destination)) renameSync(destination, destinationBackup);
+  renameSync(staging, destination);
+  rewriteJsonPathPrefixes(destination, source, destination);
+  moveStaleRuntimeProjection(destination, timestamp);
+  // A Runtime manifest is intentionally bound to its Controller Home. The
+  // copied legacy release therefore remains migration evidence, not an active
+  // canonical release. Build and publish one fresh whole release directly from
+  // the clean source checkout before any canonical unit starts.
+  preserveLegacyReleaseAuthority(destination, timestamp);
+  const stagedRelease = stageRuntimeRelease({ controllerHome: destination, sourceRoot });
+  publishRuntimeRelease(destination, stagedRelease.manifestPath, `windows-wsl-controller-home-migration-${timestamp}`);
+  const release = readActiveRelease(destination);
+  atomicWrite(unitPath(units.canonicalRuntime), renderRuntimeUnit(destination, units.canonicalRuntime, release), 0o644);
+  atomicWrite(unitPath(units.canonicalConnector), renderConnectorUnit(destination, units.canonicalConnector, release), 0o644);
+  writeCanonicalConnectorAuthority(destination, units.canonicalConnector, release);
+  command('systemctl', ['--user', 'daemon-reload']);
+  command('systemctl', ['--user', 'enable', units.canonicalRuntime]);
+  command('systemctl', ['--user', 'enable', units.canonicalConnector]);
+  command('systemctl', ['--user', 'start', units.canonicalRuntime]);
+  if (!waitFor(() => unitActive(units.canonicalRuntime) && localMcpAvailable('http://127.0.0.1:8765/mcp'))) throw new Error('HOST_RESCUE_MIGRATION_CANONICAL_RUNTIME_UNHEALTHY');
+  command('systemctl', ['--user', 'start', units.canonicalConnector]);
+  if (!waitFor(() => unitActive(units.canonicalConnector) && localMcpAvailable('http://127.0.0.1:8767/mcp'))) throw new Error('HOST_RESCUE_MIGRATION_CANONICAL_CONNECTOR_UNHEALTHY');
+  destinationActivated = true;
+  for (const unit of [units.legacyConnector, units.legacyRuntime, units.legacyRecoveryGateway, units.legacyRecoveryWatchdog]) {
+    command('systemctl', ['--user', 'disable', unit], true);
+    const path = unitPath(unit);
+    if (existsSync(path)) unlinkSync(path);
+  }
+  command('systemctl', ['--user', 'daemon-reload']);
+  const receipt = {
+    schemaVersion: 1,
+    status: 'committed',
+    at: new Date().toISOString(),
+    sourceHome: source,
+    canonicalHome: destination,
+    preservedLegacyHome: source,
+    canonicalPriorHome: existsSync(destinationBackup) ? destinationBackup : undefined,
+    release,
+    units: { runtime: units.canonicalRuntime, connector: units.canonicalConnector },
+  };
+  atomicWrite(join(rescueRoot, 'audit', `controller-home-migration-${timestamp}.json`), `${JSON.stringify(receipt, null, 2)}\n`);
+  process.stdout.write(`${JSON.stringify(receipt, null, 2)}\n`);
+} catch (error) {
+  const detail = error instanceof Error ? error.message : String(error);
+  command('systemctl', ['--user', 'stop', units.canonicalConnector], true);
+  command('systemctl', ['--user', 'stop', units.canonicalRuntime], true);
+  if (existsSync(destinationBackup)) {
+    const failedDestination = `${destination}.failed-rescue-${timestamp}`;
+    if (existsSync(destination)) renameSync(destination, failedDestination);
+    renameSync(destinationBackup, destination);
+  }
+  for (const [path, content] of legacyUnitContents) atomicWrite(path, content, 0o644);
+  command('systemctl', ['--user', 'daemon-reload'], true);
+  if (sourceStopped) {
+    command('systemctl', ['--user', 'start', units.legacyRuntime], true);
+    command('systemctl', ['--user', 'start', units.legacyConnector], true);
+  }
+  atomicWrite(join(rescueRoot, 'audit', `controller-home-migration-${timestamp}.failed.json`), `${JSON.stringify({ schemaVersion: 1, status: 'rolled_back', at: new Date().toISOString(), error: detail, ...preflight }, null, 2)}\n`);
+  throw error;
+}

package/scripts/open-source-audit-allowlist.txt

@@ -16,6 +16,7 @@ src/cli/mcp/setup.ts
 tests/readme-dx.test.ts
 
 # Runtime proxy bypass intentionally includes Tailscale's standardized CGNAT CIDR.
+adapters/mcp/proxy-env.ts
 src/cli/mcp/proxy-env.ts
 
 # Scanner / redaction implementations intentionally embed pattern samples.
@@ -30,7 +31,6 @@ tests/runtime/result-store-redaction.test.ts
 # Prefer scrubbing over expanding this list for new files.
 docs/architecture/global-hook-runtime.md
 deploy/release-checklists/**
-evals/benchmark.md
 plans/**
 tasks/**
 examples/agent-architecture.md
@@ -41,6 +41,16 @@ tests/runtime/browser-plugin.test.ts
 tests/runtime/capability-recovery.test.ts
 tests/runtime/low-interception-tooling.test.ts
 tests/runtime/target-architecture.test.ts
+# Cross-platform/browser fixtures intentionally contain synthetic absolute paths
+# and installation locations to prove discovery and identity fencing.
+scripts/portability-bindings.mjs
+tests/runtime/browser-product-discovery.test.ts
+tests/runtime/windows-host-discovery.test.ts
+tests/runtime/standalone-recovery.test.ts
+# Secret-marker rejection tests use non-secret synthetic values by design.
+tests/runtime/assistant-learning.test.ts
+tests/runtime/context-plane.test.ts
 # Supervisor service unit tests use synthetic homeDir placeholders for PATH assembly.
 # Local monitor bridge defaults may reference a development repository id.
 scripts/run-mobile-monitor-bridge.ts
+tests/runtime/browser-session-authority.test.ts # Intentional placeholder user profile used to prove foreign Chrome profiles are never reclaimed.

package/scripts/portability-bindings.mjs

@@ -0,0 +1,70 @@
+const PRODUCT_BINDING_PATTERNS = [
+  { label: "macOS personal absolute path", pattern: /\/Users\/[A-Za-z0-9._-]+\// },
+  { label: "Linux personal absolute path", pattern: /\/home\/[A-Za-z0-9._-]+\// },
+  { label: "Windows personal absolute path", pattern: /[A-Za-z]:\\Users\\[A-Za-z0-9._-]+\\/ },
+  { label: "WSL personal Windows path", pattern: /\/mnt\/[a-z]\/Users\/[A-Za-z0-9._-]+\//i },
+  {
+    label: "fixed macOS browser executable path",
+    pattern: /\/Applications\/(?:Google Chrome|Google Chrome Canary|Chromium|Microsoft Edge|Brave Browser)\.app\/Contents\/MacOS\//,
+  },
+  {
+    label: "fixed Linux browser executable path",
+    pattern: /\/usr\/(?:local\/)?bin\/(?:google-chrome(?:-stable)?|chromium(?:-browser)?|microsoft-edge(?:-stable)?|brave-browser)\b/,
+  },
+  {
+    label: "fixed Windows browser executable path",
+    pattern: /[A-Za-z]:\\(?:Program Files(?: \(x86\))?\\)?(?:Google\\Chrome|Microsoft\\Edge|BraveSoftware\\Brave-Browser)\\Application\\[^\s"']*\.exe/i,
+  },
+  {
+    label: "fixed macOS browser profile path",
+    pattern: /Library\/Application Support\/(?:Google\/Chrome|Chromium|Microsoft Edge|BraveSoftware\/Brave-Browser)\/(?:Default|Profile [0-9]+)/,
+  },
+  {
+    label: "fixed Linux browser profile path",
+    pattern: /\.config\/(?:google-chrome|chromium|microsoft-edge|BraveSoftware\/Brave-Browser)\/(?:Default|Profile [0-9]+)/i,
+  },
+  {
+    label: "fixed Windows browser profile path",
+    pattern: /(?:AppData\\Local|%LOCALAPPDATA%)\\(?:Google\\Chrome|Microsoft\\Edge|BraveSoftware\\Brave-Browser)\\User Data\\(?:Default|Profile [0-9]+)/i,
+  },
+];
+
+export function findPortabilityBindings(path, content) {
+  const findings = [];
+  for (const { label, pattern } of PRODUCT_BINDING_PATTERNS) {
+    if (pattern.test(content)) findings.push({ path, label });
+  }
+  return findings;
+}
+
+export function portabilityBindingDetectorSelfCheck() {
+  const macUserPath = ["", "Users", "alice", "DevProjects", "forge"].join("/");
+  const linuxUserPath = ["", "home", "alice", "forge"].join("/");
+  const wslUserPath = ["", "mnt", "c", "Users", "alice", "forge"].join("/");
+  const bad = [
+    [macUserPath, "macOS personal absolute path"],
+    [linuxUserPath, "Linux personal absolute path"],
+    ["C:\\Users\\alice\\forge", "Windows personal absolute path"],
+    [wslUserPath, "WSL personal Windows path"],
+    ["/Applications/Google Chrome.app/Contents/MacOS/Google Chrome", "fixed macOS browser executable path"],
+    ["/usr/bin/google-chrome-stable", "fixed Linux browser executable path"],
+    ["C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe", "fixed Windows browser executable path"],
+    ["~/Library/Application Support/Google/Chrome/Default", "fixed macOS browser profile path"],
+    ["~/.config/google-chrome/Profile 2", "fixed Linux browser profile path"],
+    ["%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default", "fixed Windows browser profile path"],
+  ];
+  const failures = [];
+  for (const [content, expectedLabel] of bad) {
+    const labels = findPortabilityBindings("fixture", content).map((finding) => finding.label);
+    if (!labels.includes(expectedLabel)) failures.push(`missed ${expectedLabel}`);
+  }
+  for (const safe of [
+    "discoverPreferredNativeBrowserProduct()",
+    "resolveBrowserProfileFromProvider(provider)",
+    "join(homedir(), configuredProfileRoot)",
+  ]) {
+    const findings = findPortabilityBindings("fixture", safe);
+    if (findings.length > 0) failures.push(`false positive for ${JSON.stringify(safe)}: ${findings.map((finding) => finding.label).join(", ")}`);
+  }
+  return failures;
+}

package/scripts/run-bounded-command.mjs

@@ -0,0 +1,60 @@
+#!/usr/bin/env node
+import { spawn } from 'node:child_process';
+
+const args = process.argv.slice(2);
+const separator = args.indexOf('--');
+const timeoutFlag = args.indexOf('--timeout-ms');
+const timeoutValue = timeoutFlag >= 0 ? args[timeoutFlag + 1] : undefined;
+const timeoutMs = Number(timeoutValue);
+const commandArgs = separator >= 0 ? args.slice(separator + 1) : [];
+
+if (!Number.isInteger(timeoutMs) || timeoutMs < 1 || commandArgs.length === 0) {
+  console.error('Usage: node scripts/run-bounded-command.mjs --timeout-ms <positive-integer> -- <command> [args...]');
+  process.exitCode = 64;
+} else {
+  const [command, ...commandArguments] = commandArgs;
+  const child = spawn(command, commandArguments, {
+    stdio: 'inherit',
+    env: process.env,
+    detached: process.platform !== 'win32',
+  });
+  let timedOut = false;
+  let launchFailed = false;
+  let escalation;
+
+  const stop = (signal) => {
+    if (child.pid === undefined) return;
+    try {
+      if (process.platform === 'win32') child.kill(signal);
+      else process.kill(-child.pid, signal);
+    } catch {
+      child.kill(signal);
+    }
+  };
+
+  const timeout = setTimeout(() => {
+    timedOut = true;
+    console.error(`[bounded-command] Timed out after ${timeoutMs}ms: ${commandArgs.join(' ')}`);
+    stop('SIGTERM');
+    escalation = setTimeout(() => stop('SIGKILL'), 5_000);
+    escalation.unref();
+  }, timeoutMs);
+  timeout.unref();
+
+  child.once('error', (error) => {
+    launchFailed = true;
+    clearTimeout(timeout);
+    console.error(`[bounded-command] Failed to start ${command}: ${error.message}`);
+    process.exitCode = 1;
+  });
+  child.once('close', (code) => {
+    clearTimeout(timeout);
+    // The direct child can exit on SIGTERM while a stubborn descendant remains
+    // alive in its detached process group. Before dropping the escalation timer,
+    // synchronously send SIGKILL to that process group once more so timeout
+    // completion cannot orphan compiler/test descendants.
+    if (timedOut && process.platform !== 'win32') stop('SIGKILL');
+    if (escalation) clearTimeout(escalation);
+    process.exitCode = launchFailed ? 1 : (timedOut ? 124 : code ?? 1);
+  });
+}

package/scripts/run-bun-test-file.ts

@@ -8,6 +8,7 @@ import {
 
 export const TEST_FAILURE_CODES = {
   SOURCE_ASSERTION_FAILED: 'TEST_SOURCE_ASSERTION_FAILED',
+  SOURCE_MANIFEST_INVALID: 'TEST_SOURCE_MANIFEST_INVALID',
   FIXTURE_OR_FLAKY_FAILED: 'TEST_FIXTURE_OR_FLAKY_FAILED',
   INFRA_CHILD_START_FAILED: 'TEST_INFRA_CHILD_START_FAILED',
   INFRA_FILE_WALL_TIMEOUT: 'TEST_INFRA_FILE_WALL_TIMEOUT',
@@ -15,10 +16,12 @@ export const TEST_FAILURE_CODES = {
   INFRA_RESIDUAL_PROCESS: 'TEST_INFRA_RESIDUAL_PROCESS',
   INFRA_RUNNER_DID_NOT_CONVERGE: 'TEST_INFRA_RUNNER_DID_NOT_CONVERGE',
   INFRA_WORKTREE_MUTATION: 'TEST_INFRA_WORKTREE_MUTATION',
+  INFRA_UNCLASSIFIED_NONZERO: 'TEST_INFRA_UNCLASSIFIED_NONZERO',
+  INTERRUPTED_SIGNAL: 'TEST_INTERRUPTED_SIGNAL',
 } as const;
 
 export type TestFailureCode = (typeof TEST_FAILURE_CODES)[keyof typeof TEST_FAILURE_CODES];
-export type TestFailureClass = 'source' | 'fixture' | 'infrastructure';
+export type TestFailureClass = 'source' | 'fixture' | 'infrastructure' | 'interrupted';
 
 export interface BunTestFileRunResult {
   exitCode: number;
@@ -28,6 +31,7 @@ export interface BunTestFileRunResult {
   durationMs?: number;
   failureClass?: TestFailureClass;
   failureCode?: TestFailureCode;
+  signal?: NodeJS.Signals;
 }
 
 export const DEFAULT_FILE_WALL_TIMEOUT_MS = 120_000;
@@ -55,7 +59,15 @@ export function classifyBunTestExit(exitCode: number, output = ''): {
   return { failureClass: 'source', failureCode: TEST_FAILURE_CODES.SOURCE_ASSERTION_FAILED };
 }
 
-function mapSupervisorFailure(code: string | undefined): TestFailureCode | undefined {
+export function classifyTestSignal(signal: NodeJS.Signals | null | undefined): {
+  failureClass: 'interrupted';
+  failureCode: typeof TEST_FAILURE_CODES.INTERRUPTED_SIGNAL;
+} | undefined {
+  if (!signal) return undefined;
+  return { failureClass: 'interrupted', failureCode: TEST_FAILURE_CODES.INTERRUPTED_SIGNAL };
+}
+
+export function mapTestSupervisorFailure(code: string | undefined): TestFailureCode | undefined {
   switch (code) {
     case CHILD_SUPERVISOR_FAILURE_CODES.CHILD_START_FAILED:
       return TEST_FAILURE_CODES.INFRA_CHILD_START_FAILED;
@@ -79,7 +91,7 @@ export async function cleanupClosedChildProcessGroup(
   operations?: ClosedChildProcessGroupOperations,
 ): Promise<BunTestFileRunResult> {
   const cleanup = await cleanupOwnedProcessGroup(pid, operations);
-  const failureCode = mapSupervisorFailure(cleanup.failureCode);
+  const failureCode = mapTestSupervisorFailure(cleanup.failureCode);
   return {
     exitCode: failureCode ? 1 : exitCode,
     lingeringPids: cleanup.residualPids,
@@ -115,7 +127,7 @@ export async function runBunTestFile(
   if (result.stdout) process.stdout.write(result.stdout);
   if (result.stderr) process.stderr.write(result.stderr);
 
-  const infrastructureFailure = mapSupervisorFailure(result.failureCode);
+  const infrastructureFailure = mapTestSupervisorFailure(result.failureCode);
   if (result.pidReuseFenced) {
     console.error(`[tests] ownership fence skipped cleanup for reused PID after ${label}`);
   }
@@ -136,13 +148,17 @@ export async function runBunTestFile(
     };
   }
 
-  if (result.signal === 'SIGINT' || result.signal === 'SIGTERM') {
+  const interrupted = classifyTestSignal(result.signal);
+  if (interrupted) {
+    console.error(`[tests] ${interrupted.failureCode}: ${label} terminated by ${result.signal}`);
     return {
-      exitCode: result.signal === 'SIGINT' ? 130 : 143,
+      exitCode: result.signal === 'SIGINT' ? 130 : result.signal === 'SIGTERM' ? 143 : Math.max(1, result.status),
       lingeringPids: [],
       remainingPids: [],
       pidReuseFenced: result.pidReuseFenced,
       durationMs: Math.round(performance.now() - startedAt),
+      signal: result.signal ?? undefined,
+      ...interrupted,
     };
   }
 

package/scripts/run-governed-gate.ts

@@ -4,6 +4,7 @@ import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from '
 import { dirname, join, resolve } from 'path';
 import { runBoundedChild } from '../src/runtime/shared/bounded-child-supervisor';
 import { testContentDigest, workspaceMutationDigest } from '../src/testing/test-governance';
+import { resolveControllerHome } from '../src/cli/repositories/controller-home';
 
 export type Gate = 'task' | 'main' | 'release';
 interface CommandStep { label: string; command: string; args: string[]; timeoutMs: number }
@@ -11,15 +12,16 @@ interface GateStep { label: string; gate: Gate }
 type Step = CommandStep | GateStep;
 
 const ROOT = resolve(import.meta.dir, '..');
-const RECEIPT_ROOT = join(ROOT, '.ai/harness/checks/gates');
+const REPOSITORY_CACHE_KEY = createHash('sha256').update(ROOT).digest('hex').slice(0, 24);
+const RECEIPT_ROOT = join(resolveControllerHome(), 'cache', 'governed-gates', REPOSITORY_CACHE_KEY);
 
 export function stepsFor(gate: Gate): Step[] {
   if (gate === 'task') return [
     { label: 'typecheck', command: 'bun', args: ['run', 'check:type'], timeoutMs: 10 * 60_000 },
     { label: 'static architecture', command: 'bun', args: ['run', 'check:runtime-architecture'], timeoutMs: 5 * 60_000 },
+    { label: 'repository hygiene', command: 'node', args: ['scripts/check-repository-hygiene.mjs'], timeoutMs: 2 * 60_000 },
     { label: 'generated authority', command: 'node', args: ['scripts/sync-generated-authority.mjs', '--check'], timeoutMs: 2 * 60_000 },
     { label: 'source duplication', command: 'node', args: ['scripts/check-source-duplication.mjs'], timeoutMs: 2 * 60_000 },
-    { label: 'controller UI bundle', command: 'bun', args: ['run', 'check:controller-ui'], timeoutMs: 5 * 60_000 },
     { label: 'test manifest', command: 'bun', args: ['run', 'check:test-governance'], timeoutMs: 5 * 60_000 },
     { label: 'affected tests', command: 'bun', args: ['run', 'test'], timeoutMs: 30 * 60_000 },
   ];

package/scripts/run-mobile-monitor-bridge.ts

@@ -49,7 +49,6 @@ const handle = await startLocalBridgeServer({
   defaultRepoId,
   host,
   port,
-  openBrowser: false,
   allowLanMobileIntents: true,
   mode: 'standalone',
 });