@nowcrew/daemon 0.6.19 → 0.6.20

package/dist/atomic-no-replace-rename.js

@@ -0,0 +1,91 @@
+import { createRequire } from "node:module";
+export class AtomicNoReplaceRenameError extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+        this.name = "AtomicNoReplaceRenameError";
+    }
+}
+const RENAME_NOREPLACE = 1;
+const RENAME_EXCL = 0x0000_0004;
+const MOVEFILE_WRITE_THROUGH = 0x0000_0008;
+const ERROR_FILE_EXISTS = 80;
+const ERROR_ALREADY_EXISTS = 183;
+const AT_FDCWD = -100;
+let cached = null;
+let unavailable = false;
+const loadKoffi = () => {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- optional koffi has no bundled TS declarations.
+    const candidate = createRequire(import.meta.url)("koffi");
+    return candidate;
+};
+const posixApi = (koffi, library, declaration, invoke) => {
+    const native = koffi.load(library).func(declaration);
+    return Object.freeze({
+        rename: (source, destination) => invoke(native, source, destination) === 0,
+        error: () => koffi.errno(),
+        destinationExists: (code) => code === koffi.os.errno.EEXIST || code === koffi.os.errno.ENOTEMPTY,
+    });
+};
+const bindNativeApi = () => {
+    const koffi = loadKoffi();
+    if (process.platform === "darwin") {
+        return posixApi(koffi, "libSystem.B.dylib", "int renamex_np(const char *source, const char *destination, uint32_t flags)", (native, source, destination) => native(source, destination, RENAME_EXCL));
+    }
+    if (process.platform === "linux") {
+        return posixApi(koffi, "libc.so.6", "int renameat2(int olddirfd, const char *source, int newdirfd, const char *destination, uint32_t flags)", (native, source, destination) => native(AT_FDCWD, source, AT_FDCWD, destination, RENAME_NOREPLACE));
+    }
+    if (process.platform === "win32") {
+        const library = koffi.load("kernel32.dll");
+        const moveFileEx = library.func("bool __stdcall MoveFileExW(str16 source, str16 destination, uint32_t flags)");
+        const getLastError = library.func("uint32_t __stdcall GetLastError()");
+        return Object.freeze({
+            rename: (source, destination) => Boolean(moveFileEx(source, destination, MOVEFILE_WRITE_THROUGH)),
+            error: () => getLastError(),
+            destinationExists: (code) => code === ERROR_FILE_EXISTS || code === ERROR_ALREADY_EXISTS,
+        });
+    }
+    throw new AtomicNoReplaceRenameError("atomic_no_replace_rename_unavailable");
+};
+const nativeApi = () => {
+    if (cached !== null)
+        return cached;
+    if (unavailable)
+        throw new AtomicNoReplaceRenameError("atomic_no_replace_rename_unavailable");
+    try {
+        cached = bindNativeApi();
+        return cached;
+    }
+    catch (error) {
+        unavailable = true;
+        if (error instanceof AtomicNoReplaceRenameError)
+            throw error;
+        throw new AtomicNoReplaceRenameError("atomic_no_replace_rename_unavailable");
+    }
+};
+/** Loads the mandatory native binding without mutating the filesystem. */
+export function probeAtomicNoReplaceRenameReadiness() {
+    try {
+        nativeApi();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Atomically renames one filesystem object without replacing any destination occupant. macOS uses
+ * `renamex_np(RENAME_EXCL)`, Linux uses `renameat2(RENAME_NOREPLACE)`, and Windows uses MoveFileExW
+ * without `MOVEFILE_REPLACE_EXISTING`. Missing native support fails closed.
+ */
+export async function atomicRenameNoReplace(source, destination) {
+    const api = nativeApi();
+    if (!api.rename(source, destination)) {
+        const code = api.error();
+        if (api.destinationExists(code))
+            return "destination_exists";
+        throw new AtomicNoReplaceRenameError("atomic_no_replace_rename_failed");
+    }
+    return "published";
+}

package/dist/control-plane-url.js

@@ -1,6 +1,6 @@
 import { executionBackendCapability } from "./execution-backend.js";
 import { daemonCapabilities, EXECUTION_PROTOCOL } from "./machine-info.js";
-import { PROJECT_SKILLS_CAPABILITY } from "./project-skills/types.js";
+import { PROJECT_SKILLS_CAPABILITY, PROJECT_SKILL_PROJECTION_V2_CAPABILITY, } from "./project-skills/types.js";
 export function buildControlPlaneUrl(serverUrl, machineToken, runtimePlatform = process.platform, jobObjectProbe, projectSkillsAvailable = true, capabilities = daemonCapabilities(runtimePlatform)) {
     const query = new URLSearchParams({ key: machineToken });
     if (executionBackendCapability(runtimePlatform, jobObjectProbe).supported) {
@@ -8,7 +8,9 @@ export function buildControlPlaneUrl(serverUrl, machineToken, runtimePlatform =
         query.set("execution_max", String(EXECUTION_PROTOCOL.max));
     }
     for (const capability of capabilities) {
-        if (capability !== PROJECT_SKILLS_CAPABILITY || projectSkillsAvailable) {
+        if (projectSkillsAvailable
+            || (capability !== PROJECT_SKILLS_CAPABILITY
+                && capability !== PROJECT_SKILL_PROJECTION_V2_CAPABILITY)) {
             query.append("capability", capability);
         }
     }

package/dist/directory-projection-publication.js

@@ -0,0 +1,105 @@
+import { posix, win32 } from "node:path";
+export class DirectoryProjectionPublicationError extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+        this.name = "DirectoryProjectionPublicationError";
+    }
+}
+const fail = (code) => {
+    throw new DirectoryProjectionPublicationError(code);
+};
+const hasTraversal = (value, platform) => (platform === "win32" ? value.split(/[\\/]/u) : value.split("/"))
+    .some((component) => component === "..");
+const isFullyQualifiedWindowsPath = (value) => {
+    if (/^\\\\[?.]\\/u.test(value))
+        return false;
+    if (/^[A-Za-z]:[\\/]/u.test(value))
+        return true;
+    return /^\\\\[^\\/]+[\\/][^\\/]+(?:[\\/]|$)/u.test(value);
+};
+const normalizeAbsolute = (value, platform, path) => {
+    if (value.length === 0 || value.includes("\0") || hasTraversal(value, platform)) {
+        return fail("directory_projection_path_invalid");
+    }
+    if (platform === "win32" ? !isFullyQualifiedWindowsPath(value) : !path.isAbsolute(value)) {
+        return fail("directory_projection_path_invalid");
+    }
+    return path.normalize(value);
+};
+const samePath = (left, right, path) => path.relative(left, right) === "";
+const isWithin = (parent, candidate, path) => {
+    const relative = path.relative(parent, candidate);
+    return relative !== ""
+        && relative !== ".."
+        && !relative.startsWith(`..${path.sep}`)
+        && !path.isAbsolute(relative);
+};
+const sameComponent = (left, right, path) => (path === win32 ? left.toLowerCase() : left) === (path === win32 ? right.toLowerCase() : right);
+const publicationRootNamesMatch = (stagingRoot, finalRoot, path) => {
+    const finalName = path.basename(finalRoot);
+    const stagingName = path.basename(stagingRoot);
+    const expectedPrefix = `.${finalName}-next-`;
+    const comparableStaging = path === win32 ? stagingName.toLowerCase() : stagingName;
+    const comparablePrefix = path === win32 ? expectedPrefix.toLowerCase() : expectedPrefix;
+    return finalName.length > 0
+        && comparableStaging.startsWith(comparablePrefix)
+        && /^[A-Za-z0-9-]{1,128}$/u.test(stagingName.slice(expectedPrefix.length));
+};
+/**
+ * Maps a projection target through one immutable whole-root publication. Both roots must be direct
+ * siblings, the staging name must bind the exact final basename and a bounded nonce, and the target
+ * must be strictly below staging. No filesystem access or path canonicalization is performed.
+ */
+export function mapDirectoryProjectionFinalTarget(target, publication, platform) {
+    const path = platform === "win32" ? win32 : posix;
+    const normalizedTarget = normalizeAbsolute(target, platform, path);
+    const stagingRoot = normalizeAbsolute(publication.stagingRoot, platform, path);
+    const finalRoot = normalizeAbsolute(publication.finalRoot, platform, path);
+    if (!samePath(path.parse(stagingRoot).root, path.parse(finalRoot).root, path)) {
+        return fail("directory_projection_cross_volume");
+    }
+    if (!samePath(path.dirname(stagingRoot), path.dirname(finalRoot), path)
+        || samePath(stagingRoot, finalRoot, path)
+        || isWithin(stagingRoot, finalRoot, path)
+        || isWithin(finalRoot, stagingRoot, path)
+        || !publicationRootNamesMatch(stagingRoot, finalRoot, path)
+        || !isWithin(stagingRoot, normalizedTarget, path)) {
+        return fail("directory_projection_path_overlap");
+    }
+    const relative = path.relative(stagingRoot, normalizedTarget);
+    const mapped = path.join(finalRoot, relative);
+    if (!isWithin(finalRoot, mapped, path))
+        return fail("directory_projection_path_overlap");
+    return mapped;
+}
+/** Exact marker lineage check used after the whole staging root has moved to its final UUID path. */
+export function hasDirectoryProjectionPublicationLineage(operationTarget, finalTarget, platform) {
+    const path = platform === "win32" ? win32 : posix;
+    let operation;
+    let final;
+    try {
+        operation = normalizeAbsolute(operationTarget, platform, path);
+        final = normalizeAbsolute(finalTarget, platform, path);
+    }
+    catch {
+        return false;
+    }
+    let stagingRoot = operation;
+    let finalRoot = final;
+    while (sameComponent(path.basename(stagingRoot), path.basename(finalRoot), path)) {
+        const nextStaging = path.dirname(stagingRoot);
+        const nextFinal = path.dirname(finalRoot);
+        if (samePath(nextStaging, stagingRoot, path) || samePath(nextFinal, finalRoot, path))
+            return false;
+        stagingRoot = nextStaging;
+        finalRoot = nextFinal;
+    }
+    try {
+        return samePath(mapDirectoryProjectionFinalTarget(operation, { stagingRoot, finalRoot }, platform), final, path);
+    }
+    catch {
+        return false;
+    }
+}

package/dist/directory-projection.js

@@ -3,6 +3,7 @@ import { chmod, cp, lstat, mkdir, open, readFile, readlink, realpath, readdir, r
 import { posix, win32 } from "node:path";
 import { durableAtomicPrivateWrite, durableDirectorySync, durablePrivateUnlink, } from "./atomic-private-write.js";
 import { readExactDirectoryIdentity, sameExactDirectoryIdentity, validExactDirectoryIdentity, } from "./directory-projection-identity.js";
+import { hasDirectoryProjectionPublicationLineage } from "./directory-projection-publication.js";
 export class DirectoryProjectionError extends Error {
     code;
     constructor(code) {
@@ -148,6 +149,9 @@ const normalizedMarker = (marker, path) => {
 const hasPermittedFinalTarget = (operationTarget, finalTarget, path) => {
     if (samePath(operationTarget, finalTarget, path))
         return true;
+    const platform = path === win32 ? "win32" : "linux";
+    if (hasDirectoryProjectionPublicationLineage(operationTarget, finalTarget, platform))
+        return true;
     if (!sameComponent(path.basename(operationTarget), path.basename(finalTarget), path))
         return false;
     const operationRoot = path.dirname(operationTarget);
@@ -824,18 +828,29 @@ export async function isManagedDirectoryProjectionCopy(target, platform, options
         return false;
     const path = platform === "win32" ? win32 : posix;
     let normalizedTarget;
+    let normalizedFinalTarget;
     try {
         normalizedTarget = normalizeAbsolute(target, platform, path);
+        normalizedFinalTarget = options.finalTarget === undefined
+            ? undefined
+            : normalizeAbsolute(options.finalTarget, platform, path);
     }
     catch {
         return false;
     }
     const projectionFs = resolveFileSystem(options);
     const info = await tryLstat(projectionFs, normalizedTarget);
+    const marker = await readMarker(projectionFs, normalizedTarget, path);
+    const normalized = normalizedMarker(marker, path);
     return info !== null
         && info.isDirectory()
         && !info.isSymbolicLink()
-        && markerMatchesFinalTarget(await readMarker(projectionFs, normalizedTarget, path), normalizedTarget, path);
+        && normalized !== null
+        && (normalizedFinalTarget === undefined
+            ? markerMatchesFinalTarget(marker, normalizedTarget, path)
+            : samePath(normalized.target, normalizedTarget, path)
+                && samePath(normalized.finalTarget, normalizedFinalTarget, path)
+                && hasPermittedFinalTarget(normalizedTarget, normalizedFinalTarget, path));
 }
 /**
  * Projects one absolute directory without exposing host paths in errors.
@@ -847,9 +862,10 @@ export async function isManagedDirectoryProjectionCopy(target, platform, options
  * rejected before IO.
  *
  * Windows copy ownership requires a version-2 marker whose normalized `finalTarget` exactly equals the
- * inspected target. A distinct operation target is accepted only for the complete sibling
- * `.skills-next-<id>/<name>` to `skills/<name>` lineage used by Project Skills reconciliation. Legacy,
- * incomplete, POSIX, or mismatched markers never authorize refresh or deletion.
+ * inspected target. A distinct operation target is accepted only when the exact relative suffix maps
+ * through a bounded same-parent staging root: either the legacy `.skills-next-<id>` switch or an immutable
+ * Runtime root `.<rootId>-next-<id>` publication. Legacy, incomplete, POSIX, or mismatched markers never
+ * authorize refresh or deletion.
  *
  * Copy fallback never follows source links, rejects every absolute link form, and permits a relative link
  * only when its completed staging target is both lexically and physically contained by that staging tree.

package/dist/execution-journal.js

@@ -4,6 +4,7 @@ import { basename, join } from "node:path";
 import { z } from "zod";
 import { ExecutionCompletedSchema, EffectivePermissionSchema, } from "./execution-protocol.js";
 import { JournalLockedError, createJournalLease, } from "./execution-journal-lock.js";
+import { provePosixProcessGroupStopped } from "./execution-posix-stop-proof.js";
 export { JournalLockedError, JournalLockCorruptionError } from "./execution-journal-lock.js";
 const ExecutionIdSchema = z.string().uuid();
 const TimestampSchema = z.string().datetime({ offset: true });
@@ -239,6 +240,22 @@ export function createProcessController(dependencies = {}) {
     };
     return {
         inspectIdentity,
+        ownedTreeExists: dependencies.ownedTreeExists ?? (async (pid) => {
+            if (!supervisorTree || platform === "win32")
+                return (await inspectIdentity(pid)) !== null;
+            try {
+                process.kill(-pid, 0);
+                return true;
+            }
+            catch (error) {
+                const code = errorCode(error);
+                if (code === "ESRCH")
+                    return false;
+                if (code === "EPERM")
+                    return true;
+                throw error;
+            }
+        }),
         signal: dependencies.signal ?? (async (pid, signal) => {
             if (!supervisorTree) {
                 process.kill(pid, signal);
@@ -470,6 +487,7 @@ export function createExecutionJournal(agentsRoot, options = {}) {
         }
     };
     const pruneInternal = async () => {
+        const protectedExecutionIds = new Set(options.protectedExecutionIds?.() ?? []);
         const entries = await readAll();
         const acknowledged = entries
             .filter((entry) => (entry.state === "completed" || entry.state === "interrupted")
@@ -477,9 +495,12 @@ export function createExecutionJournal(agentsRoot, options = {}) {
             .sort((left, right) => left.updatedAt.localeCompare(right.updatedAt)
             || left.executionId.localeCompare(right.executionId));
         const cutoff = now().valueOf() - retentionDays * 24 * 60 * 60 * 1_000;
-        const expired = acknowledged.filter((entry) => Date.parse(entry.updatedAt) < cutoff);
-        const retained = acknowledged.filter((entry) => Date.parse(entry.updatedAt) >= cutoff);
-        const overLimit = retained.slice(0, Math.max(0, retained.length - maxEntries));
+        const unprotected = acknowledged.filter((entry) => !protectedExecutionIds.has(entry.executionId));
+        const protectedCount = acknowledged.length - unprotected.length;
+        const expired = unprotected.filter((entry) => Date.parse(entry.updatedAt) < cutoff);
+        const retained = unprotected.filter((entry) => Date.parse(entry.updatedAt) >= cutoff);
+        const unprotectedLimit = Math.max(0, maxEntries - protectedCount);
+        const overLimit = retained.slice(0, Math.max(0, retained.length - unprotectedLimit));
         const toDelete = new Set([...expired, ...overLimit].map((entry) => entry.executionId));
         for (const executionId of toDelete) {
             await unlink(recordPath(executionId));
@@ -546,12 +567,16 @@ export function createExecutionJournal(agentsRoot, options = {}) {
         });
     };
     const inspectForRecovery = async (pid) => {
+        let identity;
         try {
-            return await processController.inspectIdentity(pid);
+            identity = await processController.inspectIdentity(pid);
         }
         catch (error) {
             throw new JournalRecoveryError(`Failed to inspect running process ${pid}`, error);
         }
+        if (identity?.trim() === "")
+            throw new JournalRecoveryError(`Process ${pid} has no identity`);
+        return identity;
     };
     const waitForRecovery = async (milliseconds, phase) => {
         try {
@@ -566,6 +591,17 @@ export function createExecutionJournal(agentsRoot, options = {}) {
             throw new JournalRecoveryError(`Execution ${entry.executionId} lacks process identity`);
         }
         const { pid, processIdentity } = entry;
+        if (platform !== "win32") {
+            await provePosixProcessGroupStopped({
+                pid,
+                expectedIdentity: processIdentity,
+                controller: processController,
+                terminationGraceMs,
+                killVerificationDelayMs,
+                failure: (message, cause) => new JournalRecoveryError(message, cause),
+            });
+            return;
+        }
         const initialIdentity = await inspectForRecovery(pid);
         if (initialIdentity === null || initialIdentity !== processIdentity)
             return;

package/dist/execution-posix-stop-proof.js

@@ -0,0 +1,82 @@
+function errorCode(error) {
+    return error instanceof Error && "code" in error && (typeof error.code === "string"
+        || typeof error.code === "number")
+        ? error.code
+        : undefined;
+}
+/**
+ * Proves a POSIX supervisor process group is gone before its journal is made terminal.
+ * POSIX does not reuse a PGID while that group still exists. A live leader with a
+ * different identity therefore proves the journal-owned group has already ended. A
+ * missing leader while the PGID remains live is not an ownership proof: there is no
+ * portable primitive that atomically binds a later group signal to the journal owner,
+ * so recovery fails closed without signaling that group.
+ */
+export async function provePosixProcessGroupStopped(options) {
+    const { controller, expectedIdentity, failure, pid } = options;
+    const inspect = async () => {
+        let identity;
+        try {
+            identity = await controller.inspectIdentity(pid);
+        }
+        catch (error) {
+            throw failure(`Failed to inspect running process ${pid}`, error);
+        }
+        if (identity !== null && identity.trim().length === 0) {
+            throw failure(`Running process ${pid} has an unverifiable identity`);
+        }
+        return identity;
+    };
+    const treeExists = async () => {
+        try {
+            return await controller.ownedTreeExists(pid);
+        }
+        catch (error) {
+            throw failure(`Failed to inspect owned process tree ${pid}`, error);
+        }
+    };
+    const wait = async (milliseconds, phase) => {
+        try {
+            await controller.wait(milliseconds);
+        }
+        catch (error) {
+            throw failure(`Failed while waiting ${phase}`, error);
+        }
+    };
+    const ownedGroupExists = async () => {
+        const currentIdentity = await inspect();
+        if (currentIdentity !== null && currentIdentity !== expectedIdentity)
+            return false;
+        const exists = await treeExists();
+        if (!exists)
+            return false;
+        if (currentIdentity === null) {
+            throw failure(`Cannot prove ownership of live process group ${pid} without its leader`);
+        }
+        return true;
+    };
+    const signal = async (requestedSignal) => {
+        try {
+            await controller.signal(pid, requestedSignal);
+            return false;
+        }
+        catch (error) {
+            if (errorCode(error) === "ESRCH" && !(await ownedGroupExists()))
+                return true;
+            throw failure(`Failed to ${requestedSignal === "SIGTERM" ? "terminate" : "kill"} process ${pid}`, error);
+        }
+    };
+    if (!(await ownedGroupExists()))
+        return;
+    if (await signal("SIGTERM"))
+        return;
+    await wait(options.terminationGraceMs, "for process-group termination");
+    if (!(await ownedGroupExists()))
+        return;
+    if (await signal("SIGKILL"))
+        return;
+    await wait(options.killVerificationDelayMs, "to verify process-group kill");
+    if (!(await ownedGroupExists()))
+        return;
+    throw failure(`Process group ${pid} still exists after SIGKILL`);
+}

package/dist/execution-runner.js

@@ -14,10 +14,13 @@ import { readBoundImDecisionFile, resetBoundImDecisionFile } from "./bound-im-de
 import { RuntimeCancelledError } from "./runtime-cancellation.js";
 import { supervisorLaunch } from "./supervised-runtime.js";
 import { appendAgentMemoryContext } from "./agent-memory/policy.js";
+import { ProjectSkillRuntimeOwnershipUnverifiedError, } from "./project-skills/reconciler.js";
 import { projectSkillExecutionProjection, projectSkillProjectionErrorCode } from "./project-skills/execution-adapter.js";
+import { redactProjectSkillRuntimeRootError, } from "./project-skills/runtime-launch.js";
 import { createProjectRegistry } from "./project-skills/registry.js";
 import { ProjectContextUnavailableError, resolveProjectContext } from "./project-workspaces/resolver.js";
 import { PROJECT_WORKSPACES_CAPABILITY } from "./machine-info.js";
+import { PROJECT_SKILL_PROJECTION_V2_CAPABILITY } from "./project-skills/types.js";
 export { supervisorLaunch } from "./supervised-runtime.js";
 const ACTIVITY_KIND = {
     init: "working",
@@ -217,6 +220,10 @@ function rejection(executionId, reason, message, at) {
 export function projectWorkspaceCapabilityRejection(spec, capabilities, at) {
     const projectContext = spec.workspace.projectContext;
     const nativeRuntime = spec.runtime.name === "codex" || spec.runtime.name === "claude";
+    if (spec.agent.projectSkillBindingGeneration !== undefined
+        && (!nativeRuntime || !capabilities?.includes(PROJECT_SKILL_PROJECTION_V2_CAPABILITY))) {
+        return rejection(spec.executionId, "capability_missing", `${PROJECT_SKILL_PROJECTION_V2_CAPABILITY} is unavailable`, at);
+    }
     return projectContext !== undefined
         && projectContext.projectIds.length > 0
         && (!nativeRuntime || !capabilities?.includes(PROJECT_WORKSPACES_CAPABILITY))
@@ -423,6 +430,21 @@ export async function runExecution(config, input, dependencies) {
     const resetBoundImDecision = dependencies.resetBoundImDecision ?? resetBoundImDecisionFile;
     const telemetry = new TelemetryQueue(dependencies.report, bestEffortTimeoutMs, positiveTelemetryLimit(dependencies.telemetryMaxPendingFrames, DEFAULT_TELEMETRY_MAX_PENDING_FRAMES), Math.max(config.executionLimits.maxEventBytes, positiveTelemetryLimit(dependencies.telemetryMaxPendingBytes, DEFAULT_TELEMETRY_MAX_PENDING_BYTES)));
     const supervisorState = { active: null, abortOnce: null };
+    const proveActiveSupervisorStopped = async (error, retainProjectSkillLease = false) => {
+        if (error instanceof ProjectSkillRuntimeOwnershipUnverifiedError)
+            throw error;
+        if (supervisorState.active === null || supervisorState.abortOnce === null)
+            return;
+        try {
+            await supervisorState.abortOnce();
+        }
+        catch (abortError) {
+            if (retainProjectSkillLease)
+                throw new ProjectSkillRuntimeOwnershipUnverifiedError();
+            const detail = abortError instanceof Error ? abortError.message : String(abortError);
+            throw new AggregateError([error, abortError], `Failed to stop the execution supervisor: ${detail}`);
+        }
+    };
     let launchClosed = false;
     const launchAttempts = new Set();
     const closeLaunchGate = async () => {
@@ -557,6 +579,22 @@ export async function runExecution(config, input, dependencies) {
                 },
             } : {}),
         };
+        // This is the sole production brand owner. Pre-spawn rejection has no process; startGuarded
+        // aborts its own failures, and this wrapper awaits full-tree stop for every later rejection.
+        const projectSkillLeaseSafeLaunchOwner = Object.freeze({
+            claim(launch) {
+                const safeLaunch = async (root) => {
+                    try {
+                        return await launch(root);
+                    }
+                    catch (error) {
+                        await proveActiveSupervisorStopped(error, true);
+                        throw redactProjectSkillRuntimeRootError(error, root);
+                    }
+                };
+                return safeLaunch;
+            },
+        });
         const localDependencies = {
             ...(dependencies.cancellation === undefined ? {} : { cancellation: dependencies.cancellation }),
             ...(dependencies.startupGate === undefined ? {} : { startupGate: dependencies.startupGate }),
@@ -564,6 +602,7 @@ export async function runExecution(config, input, dependencies) {
                 ? {}
                 : { startupTimeoutMs: dependencies.startupTimeoutMs }),
             ...(dependencies.projectSkills === undefined ? {} : { projectSkills: dependencies.projectSkills }),
+            projectSkillLeaseSafeLaunchOwner,
             ...(dependencies.abilityRelease === undefined ? {} : { abilityRelease: dependencies.abilityRelease }),
             launchRuntime: async (request) => {
                 if (launchClosed || dependencies.cancellation?.isRequested())
@@ -574,7 +613,26 @@ export async function runExecution(config, input, dependencies) {
                 try {
                     const processStartedAt = now().toISOString();
                     const launchControl = { cancel: null };
-                    const guarded = await dependencies.journal.startGuarded(spec.executionId, processStartedAt, () => startSupervisor(supervisorLaunch(request)), {
+                    const startOwnedSupervisor = async () => {
+                        const handle = await startSupervisor(supervisorLaunch(request));
+                        let abortPromise = null;
+                        const abortOnce = () => {
+                            if (abortPromise === null) {
+                                try {
+                                    abortPromise = Promise.resolve(handle.abort());
+                                }
+                                catch (error) {
+                                    abortPromise = Promise.reject(error);
+                                }
+                            }
+                            return abortPromise;
+                        };
+                        const ownedHandle = { ...handle, abort: abortOnce };
+                        supervisorState.active = ownedHandle;
+                        supervisorState.abortOnce = abortOnce;
+                        return ownedHandle;
+                    };
+                    const guarded = await dependencies.journal.startGuarded(spec.executionId, processStartedAt, startOwnedSupervisor, {
                         beforeRelease: ({ handle, abort }) => {
                             supervisorState.active = handle;
                             let stopPromise = null;
@@ -736,17 +794,19 @@ export async function runExecution(config, input, dependencies) {
         const cancelled = error instanceof ExecutionCancelledError || error instanceof RuntimeCancelledError;
         if (cancelled) {
             await closeLaunchGate();
-            await dependencies.cancellation?.waitForStop();
-        }
-        else if (supervisorState.active !== null && supervisorState.abortOnce !== null) {
             try {
-                await supervisorState.abortOnce();
+                await dependencies.cancellation?.waitForStop();
             }
-            catch (abortError) {
-                const detail = abortError instanceof Error ? abortError.message : String(abortError);
-                throw new AggregateError([error, abortError], `Failed to stop the execution supervisor: ${detail}`);
+            catch (stopError) {
+                if (spec.agent.projectSkillBindingGeneration !== undefined) {
+                    throw new ProjectSkillRuntimeOwnershipUnverifiedError();
+                }
+                throw stopError;
             }
         }
+        else {
+            await proveActiveSupervisorStopped(error, spec.agent.projectSkillBindingGeneration !== undefined);
+        }
         completion = cancelled
             ? ExecutionCompletedSchema.parse({
                 type: "execution:completed",