@piagent/platform 1.6.0 → 1.7.1

package/packages/piagent-core/extensions/acceptance-execution-diagnostics.js

@@ -0,0 +1,34 @@
+const EXECUTOR_REASONS = new Set([
+  "local-backend-unavailable", "cancelled-before-create", "reserved-execution-id-conflict", "container-create-failed",
+  "container-configuration-rejected", "container-create-incomplete", "cancelled", "timeout", "output-limit", "spawn-error",
+  "container-memory-limit", "worker-exit-failed", "invalid-worker-observation", "container-cleanup-unconfirmed"
+]);
+const CASE_REASONS = new Set([
+  "guest-timeout", "guest-cpu-budget", "guest-wall-deadline", "module-import-unsupported", "module-initialization-failed", "async-module-unsupported",
+  "callable-export-missing", "guest-resource-error", "returned-string-limit", "return-type-unsupported", "guest-observation-failed",
+  "structured-value-unsupported", "value-observation-limit", "referenced-result-unavailable", "async-job-unsupported"
+]);
+
+/** Formatting of authenticated host observations, never a source-failure oracle. */
+export function executionDiagnostics(result) {
+  const execution = result?.execution;
+  if (!execution || !["completed", "timeout", "cancelled", "error"].includes(execution.status)
+    || typeof execution.cleanupConfirmed !== "boolean") throw new TypeError("Invalid executor diagnostic identity");
+  const reasons = new Set();
+  if (execution.status !== "completed") reasons.add(`executor-${execution.status}`);
+  if (execution.observation?.timeoutReason !== undefined) reasons.add(
+    ["guest-cpu-budget", "guest-wall-deadline"].includes(execution.observation.timeoutReason)
+      ? execution.observation.timeoutReason : "unrecognized-timeout-reason");
+  if (!execution.cleanupConfirmed) reasons.add("container-cleanup-unconfirmed");
+  if (execution.reason !== undefined) reasons.add(EXECUTOR_REASONS.has(execution.reason) ? execution.reason : "unrecognized-executor-reason");
+  let unsupportedCaseCount = 0, errorCaseCount = 0;
+  for (const observation of execution.observation?.cases ?? []) {
+    if (!["unsupported", "error"].includes(observation.outcome)) continue;
+    if (observation.outcome === "unsupported") unsupportedCaseCount += 1; else errorCaseCount += 1;
+    reasons.add(CASE_REASONS.has(observation.reason) ? observation.reason : "unrecognized-case-reason");
+  }
+  if (result.checks.some((check) => check.status === "unknown") && !unsupportedCaseCount) reasons.add("required-check-coverage-missing");
+  if (result.checks.some((check) => check.status === "error") && !errorCaseCount) reasons.add("check-execution-error");
+  return Object.freeze({ status: execution.status, cleanupConfirmed: execution.cleanupConfirmed,
+    reasons: Object.freeze([...reasons]), unsupportedCaseCount, errorCaseCount });
+}

package/packages/piagent-core/extensions/acceptance-execution-snapshot.js

@@ -0,0 +1,174 @@
+import { createHash } from "node:crypto";
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { resolveLocalStatePath } from "./local-state-path.js";
+import { workingTreeSnapshot } from "./task-state.js";
+import { workingTreeObservation } from "./working-tree-digest.js";
+import { runIndependentContract } from "./acceptance-independent-contract.js";
+import { MAX_SOURCE_BYTES, executionSourceText, validateModulePaths } from "./acceptance-executor/module-graph.mjs";
+
+export const EXECUTION_SNAPSHOT_VERSION = "approved-module-snapshot-v2";
+const hash = (value) => createHash("sha256").update(value).digest("hex");
+
+function git(root, args) {
+  return execFileSync("git", ["-c", "core.fsmonitor=false", "--no-optional-locks", "-C", root, ...args], {
+    encoding: "utf8", timeout: 3000, maxBuffer: 8192, stdio: ["ignore", "pipe", "pipe"]
+  }).trim();
+}
+
+export function repositoryHeadIdentity(root) {
+  if (fs.realpathSync.native(git(root, ["rev-parse", "--show-toplevel"])) !== root) throw new Error("Execution project must be the repository root");
+  try {
+    const head = git(root, ["rev-parse", "--verify", "--quiet", "HEAD"]);
+    if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(head)) throw new Error("Invalid repository revision");
+    return head;
+  } catch (error) {
+    if (error.status !== 1) throw error;
+    const reference = git(root, ["symbolic-ref", "--quiet", "HEAD"]);
+    if (!reference.startsWith("refs/heads/")) throw new Error("Invalid unborn repository");
+    try { git(root, ["show-ref", "--verify", "--quiet", reference]); }
+    catch (missing) { if (missing.status === 1) return `unborn:${reference}`; throw missing; }
+    throw new Error("Repository revision changed during snapshot");
+  }
+}
+
+function sourceBytes(root, sourcePath) {
+  if (!Number.isInteger(fs.constants.O_NOFOLLOW)) throw new Error("No-follow source capture is unavailable on this platform");
+  const target = resolveLocalStatePath(root, path.join(root, sourcePath), { label: "Execution source", kind: "file" });
+  const descriptor = fs.openSync(target, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+  try {
+    const before = fs.fstatSync(descriptor);
+    if (!before.isFile() || before.nlink !== 1 || before.size > MAX_SOURCE_BYTES) throw new Error("Invalid, linked, or oversized execution source");
+    const bytes = Buffer.alloc(before.size);
+    let offset = 0;
+    while (offset < bytes.length) {
+      const read = fs.readSync(descriptor, bytes, offset, bytes.length - offset, offset);
+      if (read === 0) throw new Error("Execution source short read");
+      offset += read;
+    }
+    resolveLocalStatePath(root, target, { label: "Execution source", kind: "file" });
+    const after = fs.fstatSync(descriptor), atPath = fs.lstatSync(target);
+    const fields = ["dev", "ino", "mode", "nlink", "size", "mtimeMs", "ctimeMs"];
+    if (atPath.isSymbolicLink() || fields.some((key) => before[key] !== after[key] || after[key] !== atPath[key])) {
+      throw new Error("Execution source changed during capture");
+    }
+    const source = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
+    if (!Buffer.from(source, "utf8").equals(bytes)) throw new Error("Execution source cannot roundtrip losslessly");
+    return { source, sourceDigest: hash(bytes), sourceBytes: bytes.length, sourceMode: before.mode & 0o7777 };
+  } finally { fs.closeSync(descriptor); }
+}
+
+/** Read only explicitly host-authorized regular source files; never discover imports through IO. */
+export function captureExecutionSnapshot({ projectRoot, sourcePath, modulePaths, authorizeSourceRead } = {}) {
+  if (typeof projectRoot !== "string" || !path.isAbsolute(projectRoot) || typeof sourcePath !== "string"
+    || sourcePath.length > 1024 || sourcePath.includes("\0") || sourcePath.includes("\\") || path.isAbsolute(sourcePath)
+    || sourcePath.split("/").some((part) => !part || [".", "..", ".git", ".pi", "node_modules"].includes(part))
+    || typeof authorizeSourceRead !== "function") throw new TypeError("Invalid execution snapshot request");
+  const dependencies = modulePaths === undefined ? undefined : validateModulePaths(sourcePath, modulePaths);
+  const paths = [sourcePath, ...(dependencies ?? [])], root = fs.realpathSync.native(projectRoot);
+  const authorize = (candidate) => {
+    if (authorizeSourceRead({ projectRoot: root, sourcePath: candidate }) !== true) throw new Error("Execution source read is not authorized");
+  };
+  paths.forEach(authorize);
+  const head = repositoryHeadIdentity(root);
+  const captured = paths.map((candidate) => { if (dependencies) authorize(candidate); return { path: candidate, ...sourceBytes(root, candidate) }; });
+  const size = captured.reduce((bytes, file) => bytes + file.sourceBytes, 0);
+  if (size > MAX_SOURCE_BYTES) throw new Error("Module source budget exceeded");
+  const observation = workingTreeObservation(workingTreeSnapshot(root, {
+    isProtectedProjectPath: (candidate) => authorizeSourceRead({ projectRoot: root, sourcePath: candidate }) !== true
+  }));
+  // Dependencies can be ignored by Git. Re-read each approved member as well as
+  // binding the ordinary tree, so an already changed member cannot be captured
+  // only in its earlier state. Admission repeats the entire capture after work.
+  if (dependencies) for (const file of captured) {
+    authorize(file.path);
+    const current = sourceBytes(root, file.path);
+    if (current.sourceDigest !== file.sourceDigest || current.sourceMode !== file.sourceMode) throw new Error("Execution source graph changed during capture");
+  }
+  if (!observation.proofCapable || repositoryHeadIdentity(root) !== head) throw new Error("Repository snapshot is incomplete or changed");
+  const moduleGraph = dependencies && Object.freeze({ entry: sourcePath,
+    dependencies: Object.freeze(captured.slice(1).map((file) => Object.freeze({ path: file.path, source: file.source }))) });
+  const source = captured[0].source;
+  const binding = Object.freeze({ version: EXECUTION_SNAPSHOT_VERSION, projectId: hash(root), head,
+    workingTreeDigest: observation.digest, sourcePath, sourceDigest: hash(executionSourceText({ source, moduleGraph })),
+    sourceBytes: size, sourceMode: captured[0].sourceMode,
+    ...(moduleGraph ? { moduleFiles: Object.freeze(captured.map((file) => Object.freeze({ sourcePath: file.path,
+      sourceDigest: file.sourceDigest, sourceBytes: file.sourceBytes, sourceMode: file.sourceMode }))) } : {}) });
+  return Object.freeze({ binding, snapshotDigest: hash(JSON.stringify(binding)), source, ...(moduleGraph ? { moduleGraph } : {}) });
+}
+
+function compositeMaterialBytes(root, binding, maximumBytes) {
+  if (binding.mode === "protected") return Object.freeze({ id: binding.id, mode: binding.mode,
+    relativePath: binding.relativePath, byteLength: 0, sha256: null, text: null });
+  const captured = sourceBytes(root, binding.relativePath);
+  if (captured.sourceBytes > maximumBytes || binding.mode === "frozen" && captured.sourceDigest !== binding.sha256) {
+    throw new Error("Composite material does not match its approved identity");
+  }
+  return Object.freeze({ id: binding.id, mode: binding.mode, relativePath: binding.relativePath,
+    byteLength: captured.sourceBytes, sha256: captured.sourceDigest, text: captured.source });
+}
+
+/** Stable host capture for signed composite bindings; protected bytes are never opened. */
+export function captureCompositeExecutionSnapshot({ projectRoot, materialBindings, declarations } = {}) {
+  if (typeof projectRoot !== "string" || !path.isAbsolute(projectRoot) || !Array.isArray(materialBindings)
+    || !declarations || !Array.isArray(declarations.materials)) throw new TypeError("Invalid composite snapshot request");
+  const root = fs.realpathSync.native(projectRoot), head = repositoryHeadIdentity(root);
+  const declared = new Map(declarations.materials.map(material => [material.id, material.byteLength]));
+  if (declared.size !== declarations.materials.length || materialBindings.length !== declared.size) {
+    throw new TypeError("Composite material declarations do not match bindings");
+  }
+  const protectedPaths = new Set(materialBindings.filter(binding => binding.mode === "protected").map(binding => binding.relativePath));
+  const observe = () => workingTreeObservation(workingTreeSnapshot(root, {
+    isProtectedProjectPath: candidate => protectedPaths.has((path.isAbsolute(candidate) ? path.relative(root, candidate) : candidate).split(path.sep).join("/"))
+  }));
+  const beforeTree = observe();
+  const materials = materialBindings.map(binding => {
+    if (!declared.has(binding.id)) throw new TypeError("Composite material binding is undeclared");
+    return compositeMaterialBytes(root, binding, declared.get(binding.id));
+  });
+  if (materials.reduce((total, material) => total + material.byteLength, 0) > 1024 * 1024) {
+    throw new Error("Composite material byte budget exceeded");
+  }
+  const after = materialBindings.map(binding => compositeMaterialBytes(root, binding, declared.get(binding.id)));
+  const afterTree = observe();
+  const materialIdentity = rows => rows.map(({ text: _text, ...identity }) => identity);
+  if (JSON.stringify(materialIdentity(materials)) !== JSON.stringify(materialIdentity(after))
+    || beforeTree.digest !== afterTree.digest || repositoryHeadIdentity(root) !== head) {
+    throw new Error("Composite source or material changed during capture");
+  }
+  const identities = materialIdentity(materials);
+  return Object.freeze({ projectId: hash(root), projectHead: head,
+    sourceDigest: hash(JSON.stringify([head, beforeTree.digest])), materialSnapshotDigest: hash(JSON.stringify(identities)),
+    workingTreeDigest: beforeTree.digest, proofCapable: beforeTree.proofCapable,
+    materials: Object.freeze(materials), identities: Object.freeze(identities) });
+}
+
+export function snapshotPlanSource(snapshot) {
+  return { source: snapshot.source, ...(snapshot.moduleGraph ? { moduleGraph: snapshot.moduleGraph } : {}) };
+}
+
+/**
+ * Host-only bridge. Expected checks and backend configuration must come from
+ * an approved contract adapter. No receipt or source-repair authority is minted.
+ * The legacy dirty-tree digest alone cannot bind a clean checkout's HEAD or
+ * ignored source bytes, so both are bound independently here.
+ */
+export async function runSnapshotBoundContract({ projectRoot, sourcePath, modulePaths, authorizeSourceRead, exportName, checks,
+  profile, imageId, dockerSocket, dockerCommand, timeoutMs, startupAllowanceMs, signal, executionRunId } = {}) {
+  const request = { projectRoot, sourcePath, modulePaths, authorizeSourceRead };
+  const before = captureExecutionSnapshot(request);
+  const nodeProfile = profile !== undefined;
+  const result = await runIndependentContract({
+    planText: JSON.stringify({ schemaVersion: nodeProfile ? 2 : 1, ...(nodeProfile ? { profile } : {}),
+      ...snapshotPlanSource(before), exportName, checks }), imageId, dockerSocket,
+    ...(dockerCommand === undefined ? {} : { dockerCommand }), timeoutMs, startupAllowanceMs, signal, executionRunId
+  });
+  let after;
+  try { after = captureExecutionSnapshot(request); }
+  catch { return Object.freeze({ verdict: "unknown", reason: "post-execution-snapshot-unavailable", before: before.binding, result }); }
+  if (before.snapshotDigest !== after.snapshotDigest || result.execution.sourceDigest !== before.binding.sourceDigest) {
+    return Object.freeze({ verdict: "unknown", reason: "execution-snapshot-drift", before: before.binding, after: after.binding, result });
+  }
+  return Object.freeze({ verdict: result.verdict, snapshotDigest: before.snapshotDigest, binding: before.binding, result });
+}

package/packages/piagent-core/extensions/acceptance-executor/.dockerignore

@@ -0,0 +1,21 @@
+*
+!Dockerfile
+!package.json
+!package-lock.json
+!worker.mjs
+!protocol.mjs
+!values.mjs
+!capabilities.mjs
+!callback-intrinsics.mjs
+!jobs.mjs
+!references.mjs
+!reference-identity.mjs
+!intrinsics.mjs
+!module-graph.mjs
+!guest.mjs
+!budget.mjs
+!invocation.mjs
+!node-profile.mjs
+!node_modules/
+!node_modules/**
+!structured-clone.mjs

package/packages/piagent-core/extensions/acceptance-executor/Dockerfile

@@ -0,0 +1,5 @@
+FROM piagent-da2-node-g0:20260831-1231@sha256:ae73771c2e50bcbfd18c19efe4c01cb800dbb66c408e2fc17d2de7e28cd18339
+WORKDIR /executor
+COPY Dockerfile package.json package-lock.json worker.mjs protocol.mjs values.mjs intrinsics.mjs module-graph.mjs guest.mjs budget.mjs capabilities.mjs callback-intrinsics.mjs jobs.mjs references.mjs reference-identity.mjs invocation.mjs structured-clone.mjs node-profile.mjs ./
+USER 65534:65534
+ENTRYPOINT ["timeout", "--signal=KILL", "8s", "node", "--max-old-space-size=96", "/executor/worker.mjs"]

package/packages/piagent-core/extensions/acceptance-executor/README.md

@@ -0,0 +1,103 @@
+# Isolated contract worker (experimental)
+
+This experimental worker supplies bounded behavioral observations for JavaScript modules in an explicitly approved in-memory source graph, including primitive/Date inputs, bounded array/record data and explicit multi-call histories. Worker v9 retains v8 capabilities and adds opt-in bounded error-message observation. It is reachable through host-approved verification; the worker itself cannot approve completion. External/package imports, timers, arbitrary object graphs and unsupported values must not silently count as supported behavior.
+
+## Authority and isolation
+
+- The host selects an authorized local Docker socket and a previously built, approved image by its full `sha256:` ID. A model-supplied image or expected-result plan is not trusted verifier configuration.
+- QuickJS-WASM executes candidate code without host callbacks, process/IO bindings or expected answers. Cases get a fresh realm unless they belong to one explicit contiguous sequence. A reset destroys that realm; only explicitly referenced, actually observed inert data can cross the reset.
+- The host retains expectations and compares typed observations. Candidate `JSON.stringify`, `toJSON`, exception names and stdout are not verdict authorities. Reflection/Date/error intrinsics are captured before initialization; data-property creation uses captured functions and null-prototype descriptors. Proxy tracking uses null-prototype handlers to prevent candidate-added inherited traps from exposing an untracked factory. Returned accessors and tracked proxies are not traversed.
+- The container has no workspace/socket mounts, network access, root user, elevated capabilities, or writable root filesystem. The controller inspects the actual configuration before starting it. Image pulling and host-execution fallbacks are disabled.
+- QuickJS uses a 32 MiB memory ceiling, 512 KiB stack ceiling, and a 300,000-microsecond per-case **executing-thread** CPU budget. Both user and system CPU on that thread count, including parsing, host marshalling and observation work. Background compiler/support threads do not consume the case allowance; they remain charged by the unchanged container-wide CPU-time rlimit (10 seconds soft / 12 seconds hard), one-CPU quota and wall watchdog. This changes the accounting domain from worker v5, not merely its numeric limit. Scheduler waiting does not consume the case budget. The absolute 5-second request wall deadline is not renewed by another case. Both limits are polled during interpretation and before admitting a completed observation; a poll can overshoot, and native operations still require the watchdog. The container retains its 256 MiB memory limit, 32-PID limit and separate 8-second OS watchdog. An outer host deadline can stop an attached run. Engine interrupts alone are not treated as sufficient isolation.
+- Cleanup is limited to the newly created container with the exact run label, image ID, and container ID. Unconfirmed cleanup invalidates the observation. No Docker pruning or deletion of user containers is performed.
+
+These are tested containment controls, not a guarantee against every engine or kernel vulnerability. Backend/image admission, verifier installation integrity, and project execution authorization must remain separate runtime gates.
+
+## Building and verifying
+
+This directory has its own locked dependencies and is deliberately separate from the platform's shared `node_modules`. Install them with `npm ci --ignore-scripts --workspaces=false --no-audit --no-fund`. The lock pins QuickJS core, the release-sync WASM package, and FFI types to 0.32.0, including package integrity hashes. No dependency lifecycle scripts are required.
+
+Build this directory with `BASE_IMAGE` set to a locally available, approved repository-qualified Node digest (`node@sha256:...`, not a bare image ID `sha256:...`). The Dockerfile deliberately has no mutable default base. The build context allowlist contains only worker source, its manifest/lock, and its dedicated dependencies; it never contains a project snapshot, credentials, or expected-result plans. Build with `--network=none --pull=false`; dependency installation is a separate, explicit setup step. Check that the selected builder actually uses the cached base: RUN network isolation does not itself prohibit registry metadata resolution. The local v4 verification used the already cached base with the legacy builder explicitly selected; that deprecated builder is not a future portability guarantee.
+
+Worker v7 retains v6's separate `guest-cpu-budget` and `guest-wall-deadline` diagnostics, including a top-level timeout reason when the request expires between cases. A case that stops on either limit includes its first stopping sample: process CPU, current-thread CPU and elapsed case time, in microseconds. The CPU stop must be justified by at least 300,000 microseconds on the executing thread. Process CPU is retained as a diagnostic of total support overhead, not discarded. The parser requires bounded samples for case resource stops, rejects them on completed/unsupported cases, and rejects older worker observations. A wall deadline between cases has no invented case sample. Neither timeout is a behavioral counterexample. CPU accounting is platform/thread-dependent, not deterministic instruction fuel or a performance promise. Worker source and dependency declarations participate in installed-verifier identity, and the exact built image remains a separate host-approved binding. No production approval or retry allowance is changed by building another image. No experimental V8 compiler flags are enabled.
+
+If Docker's credential helper blocks a local-only build, use a separate temporary Docker client configuration containing an empty JSON object and an explicit local socket. Do not inspect, replace, or weaken the user's credential store. The initial local diagnostic used Docker's legacy builder with that isolated configuration; build portability remains to be validated before release.
+
+Set `PIAGENT_CONTRACT_EXECUTOR_IMAGE_ID` to the built image's full ID and `PIAGENT_CONTRACT_EXECUTOR_SOCKET` to the approved local socket to enable the real executor tests. Without both, tests requiring Docker are visibly skipped, not silently counted as passes. The retained expiry diagnostic additionally requires `PIAGENT_RETAINED_EXPIRY_SOURCE`; its expected source hash is checked before and after read-only execution.
+
+## Remaining integration work
+
+`acceptance-independent-contract.js` keeps expectations outside the guest and captures counterexamples on the host. Its result remains **diagnostic evidence** until separate authenticated admission validates the latest private receipt, current source/Git/project-verifier bindings and approved plan. Existing safety, repair and continuation ceilings remain in force.
+
+## Bounded data and histories (worker v2)
+
+- Tagged `array` values contain dense arrays of tagged values. Tagged `record` values contain unique `{key,value}` entries. This preserves undefined and special numbers and safely represents an own `__proto__` property. Record equality ignores insertion order; array equality preserves order.
+- A tree is limited to depth 8, 256 nodes, 64 entries per collection, 4096 characters per string/key and 64 KiB of aggregate string/key text. Date values are allowed in inputs/argument observations, not returned data. Existing request, source, response, memory and execution-time limits remain unchanged.
+- These are own enumerable data-property snapshots, not claims about hidden object brands, descriptors, arbitrary prototypes or all JavaScript reflection behavior. Exact identity is observed only by the explicit v7 capability below, not inferred from equal snapshots. Cycles, sparse arrays, accessors, symbols, returned proxies and ordinary exotic objects abstain. Proxy construction is intercepted to track those objects; primitive results produced through internal proxy operations remain supported. Intrinsic reflection is not guaranteed to match Node's runtime.
+- A case may specify `sequence`, a named `exportName`, `reset: true`, and `observeArgs: true`. A sequence must be contiguous. A `result` argument names an earlier successful return in that same sequence and supplies a **copy of its observed data**, not a live object handle or an expected value. Forward/self/cross-history references are rejected before execution. Unavailable results prevent dependent calls from running.
+- `observeArgs` captures every resolved argument after a return or throw. The host may require exact `expected.argsAfter` values. Inputs are mutable; observation must not freeze them. Clock observations are per call, including when module state is retained. A captured `Date.now` callable observes the current step's clock rather than its first step's value; its identity survives mocked/real-clock transitions. Only mocked reads contribute to `clockReads`.
+- Counterexamples include the complete input prefix for a stateful failure. Worst-case repeated prefix bytes are bounded to 2 MiB before execution. No invocation history or expected answer is injected into the candidate's global scope.
+
+A realm reset tests a component's checkpoint/restore contract. It is **not** an OS-crash, filesystem-durability, transaction or arbitrary application-state proof. S0 process-death tests and host receipt reconciliation remain separate.
+
+## Approved module graphs (worker v3)
+
+An approved host contract can add `modulePaths`, listing dependencies relative to the project root; `sourcePath` remains the entry. The list is explicit, bounded and authenticated. It is not populated by reading candidate import expressions. For example, a contract whose entry is `src/main.js` may name `src/state.js` and `shared/math.js` as dependencies. Omitting the list retains closed-module execution; an empty list permits only the named entry's identity.
+
+The host captures authorized regular files into `moduleGraph: {entry, dependencies: [{path, source}]}` alongside entry `source`. Entry plus dependencies are limited to 32 files and **128 KiB total source**, not 128 KiB per file. The request/response, memory and time ceilings are unchanged. Each file's bytes, path and mode, graph membership, project identity and Git baseline are bound. Snapshot, execution, durable reuse and authenticated admission use the same graph source identity. A dependency-only change invalidates old evidence. Current project-verifier evidence must cover every member; an ignored dependency cannot borrow the entry's project-verifier pass.
+
+The worker resolves only relative ESM imports to that in-memory allowlist. It supports transitive imports, re-exports, cyclic live bindings and one instance per normalized module path; reset destroys the entire realm and module state. Dynamic imports additionally require the explicit async capability below. No module request reads the host filesystem. Missing files, bare/package specifiers, Node built-ins, URLs, root escapes, encoded names, query/fragment identities and directory imports are unsupported. No extension guessing or package resolution occurs.
+
+Without `awaitResult: true`, returned promises, asynchronous modules and pending QuickJS jobs remain unsupported. Pending-job checks run before a call, after it and after observation. Even in async mode, new jobs caused by observation are not drained after snapshots have already been captured; they abstain. Graph membership is a captured-source identity, not a claim that every branch or export was tested.
+
+## Approved async and identity capabilities (worker v7, retained in v8)
+
+Capabilities belong to each signed case, not an ambient worker switch. `awaitResult: true` drains at most 1,024 guest jobs and observes intrinsic Promise settlement under the unchanged CPU/wall limits. Top-level await and ordinary thenables are supported within these limits. Unresolved work abstains; job exhaustion is an executor error, not a behavioral counterexample.
+
+`callbacks` declares up to eight named, private guest functions, with finite return/throw steps, explicit sync/Promise mode and repeat-last policy. Inputs reference them with `{type:"callback",value:"id"}`, including inside options records. Promise responses settle after 1–32 guest jobs, default one; this is scheduling control, not elapsed time. There are at most 64 invocations and 32,768 trace characters per case. `callbackTrace` records ordered call/settlement events with invocation indices and inert argument snapshots. It is required in both expectations and settled observations whenever callbacks are declared. Candidate-installed thenable behavior in response data, unsupported arguments, exhausted plans, overflow and stale callbacks cause sticky verifier faults. Expected answers never enter these closures.
+
+`observeIdentity: true` requires `returnIdentity` on a return: the indices of direct object arguments identical to the actual result. Primitives are not identity matches. `observeError: true` requires an `errorObservation` on a throw, containing identity against optional approved `errors` and inert own properties. In v8, custom non-enumerable own data properties are included too: an attached checkpoint must not appear absent merely because of its descriptor. Non-enumerable native `message`/`stack` metadata is excluded. Custom getters and symbol keys abstain without invocation. This does not certify descriptors or arbitrary error prototypes. An argument `{type:"error-property",value:"earlier-case",key:"checkpoint"}` copies that earlier throw's observed property in the same history; it cannot copy executable callback references or borrow the expected answer. This also works across a realm reset.
+
+See the [design and qualification obligations](../../../../docs/decisions/harness-next-async-observation-design.md). The pinned engine does not expose Node's unhandled-rejection policy; detached rejections, timers, IO, package/CommonJS resolution and general Node equivalence are not certified. Current project tests remain mandatory. Reusable production family review, independently frozen held-out calibration, minimum-Node packaging and the full release campaign remain separate requirements. Universal JavaScript support is not claimed.
+
+## Nested object identity (worker v8)
+
+An approved case may declare 1–16 `referencePairs`, each with a unique `id` and two selectors (`left`, `right`). A selector has a `root` (`argument`, `return` or `error`) and `path`, an array of at most eight string property keys. An argument root also requires its `index`; an error root requires `observeError: true`. These are bounded data paths, never expressions. Each declared pair requires an ordered `{id, same}` entry in `expected.referenceIdentity` and the settled worker observation. Old worker responses cannot supply v8 evidence.
+
+For example, compare `{root:"error",path:["checkpoint"]}` with `{root:"argument",index:1,path:[]}` to require a new attached checkpoint, or `{root:"return",path:["results"]}` with `{root:"argument",index:1,path:["results"]}` to reject a result array borrowed from an action. Captured identity and own-property descriptor intrinsics run before any candidate-controlled getter or proxy trap. Such unsupported paths abstain instead of executing accessors. Inherited properties are not traversed. Missing paths, absent return/error roots and primitives are not object aliases, so `same:false` alone does **not** establish that a field exists or has the correct shape: the accompanying typed value or error-property expectations must do that. Paths refer to actual objects at the end of this invocation, not pre-call handles or cross-case live references. Existing argument snapshots remain necessary to reject mutation. No resource ceiling or approval rule is relaxed.
+
+## Error messages (worker v9 / Node profile worker v2)
+
+`observeErrorMessage: true` requests a separate `errorMessage` on a throw. It reads
+only the first inert string `message` descriptor in a prototype chain bounded to
+32 objects and checks that complete chain for tracked proxies before error-class
+observation. Getters, proxies, coercion, non-string messages, excessive depth or
+messages longer than 4096 UTF-16 code units produce unsupported/unknown. No stack
+is read. A verified absence throughout the complete inert chain is `null`; this
+is observed missing data, not a stand-in for unavailable observation. Primitive
+throws also have `null` and retain their `non-error` classification.
+
+The host-only expectation is `errorMessage: {includes: "conflict", ignoreCase: true}`.
+The non-empty literal is bounded to 4096 code units. `ignoreCase` is required and
+uses ECMAScript non-Unicode case-insensitive matching; metacharacters are escaped,
+not interpreted as a plan-supplied expression. Missing required observation is
+rejected. Unsupported execution never becomes a behavioral counterexample.
+
+Without this opt-in, message collection and existing `observeError` property
+semantics are unchanged. Observed message text may appear in private diagnostic
+receipts/counterexamples, so do not enable it for contracts containing secrets or
+publish raw observations without review. Expectations never enter the guest.
+Worker/comparison versions and Node-profile/installed-verifier digests change;
+old images and approvals are not qualified by new source tests. This capability
+does not activate any plan, supply completion authority or change benchmark mode.
+
+Node profile worker v4 hashes the same pinned Node executable with a 1 MiB buffer instead of reading its approximately 120 MB body into one temporary. Every byte and the expected SHA-256 remain identical; the request wall, case thread-CPU, container CPU/memory and watchdog limits are unchanged. The worker/profile/source identity changes, so old observations are not current v4 evidence. This addresses measured bootstrap allocation/I/O overhead, not a wider supported API or a retry allowance.
+
+
+### Docker startup and control deadlines
+
+The host executor allows up to 60 seconds for each Docker create, inspect, or removal command. These control requests can wait on daemon maintenance independently of guest execution. An inconclusive create is reconciled by its unique name, owner label and pinned image. A timed-out create is never retried or started; an owned late container is removed. If ownership or removal cannot be established, cleanup remains unconfirmed.
+
+The approved backend may specify `startupAllowanceMs`, an integer from 0 to 60000 (default 0). The attached start command waits at most `timeoutMs + startupAllowanceMs`. This is an additional bound on the entire attached command, not a measurement of time spent before guest startup. The image watchdog and guest CPU/wall limits remain unchanged. An explicit old `timeoutMs` is not silently extended. Cancellation interrupts the attached command; ownership checks and cleanup still run afterward.
+
+Selection recipes, signed host approvals, durable execution identities and benchmark observations bind the allowance. Changing it requires a new approved backend identity and cannot reuse evidence collected with a different allowance. Omitting it and explicitly setting zero have identical execution semantics. A longer allowance does not grant completion, add a retry, or turn uncertain cleanup into success.

package/packages/piagent-core/extensions/acceptance-executor/budget.mjs

@@ -0,0 +1,54 @@
+import { cpuUsage, threadCpuUsage } from "node:process";
+import { performance } from "node:perf_hooks";
+
+export const CASE_THREAD_CPU_MICROS = 300000;
+export const REQUEST_WALL_MS = 5000;
+export const CPU_EXHAUSTED = "guest-cpu-budget";
+export const WALL_EXHAUSTED = "guest-wall-deadline";
+
+// Host-owned clocks, never guest globals or request-supplied limits. Each case
+// charges its executing thread, including host work on that thread. Background
+// compiler/support CPU stays under the container-wide CPU and wall limits; it
+// cannot steal this case's allowance. This is not an instruction/fuel estimate.
+export function createExecutionBudget(overallDeadline, clocks = { now: () => performance.now(), cpu: cpuUsage, threadCpu: threadCpuUsage }) {
+  if (!Number.isFinite(overallDeadline)) throw new TypeError("Invalid execution deadline");
+  const readCpu = (read = clocks.cpu) => {
+    const { user, system } = read();
+    if (![user, system, user + system].every((value) => Number.isSafeInteger(value) && value >= 0)) throw new Error("Invalid resource observation");
+    return user + system;
+  };
+  let initialCpu = readCpu(), previousCpu = initialCpu, reason = null, diagnostic = null, caseActive = false;
+  let initialThread = readCpu(clocks.threadCpu), startedAt = clocks.now();
+  let previousThread = initialThread;
+  if (!Number.isFinite(startedAt)) throw new Error("Invalid resource observation");
+  return {
+    beginCase() {
+      initialCpu = readCpu();
+      if (initialCpu < previousCpu) throw new Error("Invalid resource observation");
+      previousCpu = initialCpu; initialThread = readCpu(clocks.threadCpu); startedAt = clocks.now();
+      if (initialThread < previousThread) throw new Error("Invalid resource observation");
+      previousThread = initialThread;
+      if (!Number.isFinite(startedAt)) throw new Error("Invalid resource observation");
+      reason = null; diagnostic = null; caseActive = true;
+    },
+    poll() {
+      if (reason) return reason;
+      const now = clocks.now(), current = readCpu(), used = current - initialCpu;
+      const currentThread = readCpu(clocks.threadCpu), caseThreadCpuMicros = currentThread - initialThread;
+      if (!Number.isFinite(now) || now < startedAt || current < previousCpu || currentThread < previousThread) throw new Error("Invalid resource observation");
+      previousCpu = current; previousThread = currentThread;
+      if (now >= overallDeadline) reason = WALL_EXHAUSTED;
+      else if (caseActive && caseThreadCpuMicros >= CASE_THREAD_CPU_MICROS) reason = CPU_EXHAUSTED;
+      if (reason) {
+        const caseWallMicros = Math.ceil((now - startedAt) * 1000);
+        if (![caseThreadCpuMicros, caseWallMicros].every(value => Number.isSafeInteger(value) && value >= 0)) {
+          throw new Error("Invalid resource observation");
+        }
+        // Keep both counters so support overhead remains visible to the host.
+        diagnostic = Object.freeze({ caseCpuMicros: used, caseThreadCpuMicros, caseWallMicros });
+      }
+      return reason;
+    },
+    diagnostics() { return diagnostic; }
+  };
+}

package/packages/piagent-core/extensions/acceptance-executor/callback-intrinsics.mjs

@@ -0,0 +1,126 @@
+import { MAX_CALLBACK_CALLS, MAX_CALLBACK_TRACE_CHARS } from "./capabilities.mjs";
+import { MAX_STRING_LENGTH } from "./values.mjs";
+
+// Spliced only into the worker-owned pre-candidate closure. No host callback,
+// expected answer, dynamic code template or globally reachable registry.
+export const CALLBACK_INTRINSICS = `
+  const WM = WeakMap, wmGet = WM.prototype.get, wmSet = WM.prototype.set;
+  const slice = String.prototype.slice, CallbackError = TypeError;
+  const NativePromise = Promise, promiseResolve = NativePromise.resolve;
+  const errorConstructors = [TypeError, RangeError, SyntaxError, ReferenceError, EvalError, URIError, Error];
+  let callbacks = create(null), errorValues = create(null), callbackReferences = new WM();
+  let generation = 0, callbackFault = null, trace = '', calls = 0;
+  const callbackId = value => value !== null && (typeof value === 'object' || typeof value === 'function')
+    ? apply(wmGet, callbackReferences, [value]) : undefined;
+  function fault(reason) { callbackFault ??= reason; throw new CallbackError('callback observation unavailable'); }
+  function callbackValueText(value) {
+    const encoded = observeValue(value, true, true);
+    if (apply(slice, encoded, [0, 9]) !== '{"value":') fault('callback-argument-unsupported');
+    return apply(slice, encoded, [9, -1]);
+  }
+  function beginCapabilities() {
+    generation += 1; callbacks = create(null); errorValues = create(null); callbackReferences = new WM();
+    callbackFault = null; trace = ''; calls = 0;
+  }
+  function appendTrace(entry) {
+    if (trace.length + entry.length + (trace ? 1 : 0) + 2 > ${MAX_CALLBACK_TRACE_CHARS}) fault('callback-trace-limit');
+    trace += (trace ? ',' : '') + entry;
+  }
+  function inertPromiseResponse(value) {
+    if (value === null || typeof value !== 'object') return;
+    let current = value, depth = 0;
+    while (current !== null) {
+      if (++depth > 32 || apply(has, proxies, [current])) fault('callback-response-unsupported');
+      const property = descriptor(current, 'then');
+      if (property) {
+        if (!own(property, 'value') || typeof property.value === 'function') fault('callback-response-unsupported');
+        return;
+      }
+      current = prototype(current);
+    }
+  }
+  async function settleCallback(id, call, outcome, value, delay, epoch) {
+    for (let i = 0; i < delay; i += 1) await undefined;
+    if (epoch !== generation) fault('stale-callback-invocation');
+    // No yield occurs between this inertness check and resolution. Otherwise a
+    // candidate-installed thenable could make a "settle" event premature.
+    if (outcome === 'return') inertPromiseResponse(value);
+    appendTrace('{"callback":' + stringify(id) + ',"call":' + call + ',"event":"settle","outcome":' + stringify(outcome) + '}');
+    if (outcome === 'throw') throw value;
+    return value;
+  }
+  function makeError(id, errorClass, message, properties) {
+    let Constructor;
+    for (let i = 0; i < names.length; i += 1) if (names[i] === errorClass) Constructor = errorConstructors[i];
+    if (!Constructor) fault('callback-error-class-unsupported');
+    const value = new Constructor(message), keys = ownKeys(properties);
+    for (let i = 0; i < keys.length; i += 1) {
+      const key = keys[i], property = descriptor(properties, key);
+      if (!property || !own(property, 'value')) fault('callback-error-properties-unsupported');
+      define(value, key, dataDescriptor(property.value, true));
+    }
+    errorValues[id] = value; return value;
+  }
+  function makeCallback(id, mode, repeatLast, steps, delay) {
+    const epoch = generation; let index = 0;
+    const fn = (...args) => {
+      if (epoch !== generation) fault('stale-callback-invocation');
+      if (calls >= ${MAX_CALLBACK_CALLS}) fault('callback-trace-limit');
+      if (args.length > 16) fault('callback-argument-limit');
+      const call = index;
+      let entry = '{"callback":' + stringify(id) + ',"call":' + call + ',"event":"call","args":[';
+      for (let i = 0; i < args.length; i += 1) entry += (i ? ',' : '') + callbackValueText(args[i]);
+      entry += ']}';
+      appendTrace(entry); calls += 1;
+      if (index >= steps.length && !repeatLast) fault('callback-plan-exhausted');
+      const step = steps[index < steps.length ? index : steps.length - 1]; index += 1;
+      const value = step.outcome === 'throw' ? errorValues[step.error] : step.value;
+      if (mode === 'promise') return settleCallback(id, call, step.outcome, value, delay, epoch);
+      if (step.outcome === 'throw') throw value;
+      return value;
+    };
+    callbacks[id] = fn; apply(wmSet, callbackReferences, [fn, id]); return fn;
+  }
+  function errorMessage(value) {
+    let current = value, message = null, found = false, depth = 0;
+    if (current !== null && typeof current !== 'object' && typeof current !== 'function') return '{"value":null}';
+    while (current !== null) {
+      // Check the entire chain before errorClass may use isPrototypeOf. An own
+      // message must not hide a proxy deeper in the thrown object's prototypes.
+      if (++depth > 32 || apply(has, proxies, [current])) return '{"reason":"error-message-unsupported"}';
+      if (!found) {
+        const property = descriptor(current, 'message');
+        if (property) {
+          if (!own(property, 'value') || typeof property.value !== 'string'
+            || property.value.length > ${MAX_STRING_LENGTH}) return '{"reason":"error-message-unsupported"}';
+          message = property.value; found = true;
+        }
+      }
+      current = prototype(current);
+    }
+    return '{"value":' + (message === null ? 'null' : stringify(message)) + '}';
+  }
+  function errorObservation(value) {
+    if (value !== null && (typeof value === 'object' || typeof value === 'function') && apply(has, proxies, [value])) {
+      return '{"reason":"error-object-unsupported"}';
+    }
+    let identity = null;
+    const ids = ownKeys(errorValues);
+    for (let i = 0; i < ids.length; i += 1) if (same(value, errorValues[ids[i]])) identity = ids[i];
+    const properties = create(null);
+    if (value !== null && (typeof value === 'object' || typeof value === 'function')) {
+      const keys = ownKeys(value);
+      for (let i = 0; i < keys.length; i += 1) {
+        const key = keys[i], property = descriptor(value, key);
+        // Native Error message/stack are diagnostic metadata. Custom own data
+        // (notably checkpoint) exists even when defined as non-enumerable.
+        if (property && !property.enumerable && (key === 'message' || key === 'stack')) continue;
+        if (!property || typeof key !== 'string' || !own(property, 'value')) return '{"reason":"error-properties-unsupported"}';
+        define(properties, key, dataDescriptor(property.value, true));
+      }
+    }
+    const encoded = observeValue(properties, true, true);
+    if (apply(slice, encoded, [0, 9]) !== '{"value":') return '{"reason":"error-properties-unsupported"}';
+    return '{"identity":' + (identity === null ? 'null' : stringify(identity)) + ',"properties":' + apply(slice, encoded, [9, -1]) + '}';
+  }
+`;