@prismatic-io/lux 0.0.2-preview.29 → 0.0.2-preview.30

package/src/drivers/claude-code/isolation.ts

@@ -0,0 +1,228 @@
+import { mkdir, readdir, realpath, stat, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join, resolve, sep } from "node:path";
+import type { StartContext } from "../../core/index.js";
+import type { ClaudeCodeDriverConfig } from "./index.js";
+
+const isWithin = (parent: string, child: string): boolean =>
+  child === parent || child.startsWith(`${parent}${sep}`);
+
+const permissionPath = (tool: "Edit" | "Read", path: string, directory: boolean): string => {
+  const absolute = resolve(path).replaceAll("\\", "/");
+  return `${tool}(//${absolute.replace(/^\/+/, "")}${directory ? "/**" : ""})`;
+};
+
+/**
+ * Permission rules have no "allow inside deny" override, so isolate a root by
+ * denying every sibling around explicitly allowed descendants.
+ */
+const carvedPermissionDenials = async (
+  tool: "Edit" | "Read",
+  root: string,
+  allowed: readonly string[],
+): Promise<string[]> => {
+  const normalizedRoot = resolve(root);
+  const inside = allowed
+    .map((path) => resolve(path))
+    .filter((path) => isWithin(normalizedRoot, path));
+  if (inside.some((path) => path === normalizedRoot)) return [];
+  if (inside.length === 0) {
+    const metadata = await stat(normalizedRoot);
+    return [permissionPath(tool, normalizedRoot, metadata.isDirectory())];
+  }
+
+  const out: string[] = [];
+  const walk = async (dir: string): Promise<void> => {
+    const entries = await readdir(dir, { withFileTypes: true });
+    entries.sort((a, b) => a.name.localeCompare(b.name));
+    for (const entry of entries) {
+      const path = join(dir, entry.name);
+      if (inside.some((allowedPath) => allowedPath === path)) continue;
+      if (entry.isDirectory() && inside.some((allowedPath) => isWithin(path, allowedPath))) {
+        await walk(path);
+      } else {
+        out.push(permissionPath(tool, path, entry.isDirectory()));
+      }
+    }
+  };
+  await walk(normalizedRoot);
+  return out;
+};
+
+export const carvedReadDenials = (root: string, allowed: readonly string[]): Promise<string[]> =>
+  carvedPermissionDenials("Read", root, allowed);
+
+const existingRealpaths = async (paths: readonly string[]): Promise<string[]> => {
+  const found = await Promise.all(
+    paths.map(async (path) => {
+      try {
+        return await realpath(resolve(path));
+      } catch {
+        return null;
+      }
+    }),
+  );
+  return [...new Set(found.filter((path): path is string => path !== null))];
+};
+
+const compactRoots = (paths: readonly string[]): string[] =>
+  [...new Set(paths)]
+    .sort((a, b) => a.length - b.length || a.localeCompare(b))
+    .filter((path, index, roots) => !roots.slice(0, index).some((root) => isWithin(root, path)));
+
+export const isolatedLaunch = async (
+  config: ClaudeCodeDriverConfig,
+  ctx: StartContext,
+  workspace: string,
+  controlDir: string,
+): Promise<{ env: Record<string, string>; settings: object }> => {
+  const homeRoots = await existingRealpaths([
+    homedir(),
+    ...(config.env?.HOME ? [config.env.HOME] : []),
+  ]);
+  const sensitiveHomePaths = homeRoots.flatMap((home) => [
+    join(home, ".aws"),
+    join(home, ".claude.json"),
+    join(home, ".claude", ".credentials.json"),
+    join(home, ".config", "gcloud"),
+    join(home, ".docker", "config.json"),
+    join(home, ".git-credentials"),
+    join(home, ".gnupg"),
+    join(home, ".kube"),
+    join(home, ".netrc"),
+    join(home, ".npmrc"),
+    join(home, ".ssh"),
+    ...[
+      ".bash_profile",
+      ".bash_login",
+      ".bashrc",
+      ".bash_aliases",
+      ".profile",
+      ".zshenv",
+      ".zprofile",
+      ".zshrc",
+      ".zlogin",
+    ].map((name) => join(home, name)),
+  ]);
+  const stateDir = join(workspace, ".lux-claude");
+  const configDir = join(controlDir, "config");
+  await mkdir(configDir, { recursive: true });
+  // An empty override preserves the CLI's default, unhashed Keychain service.
+  const authConfigOverride =
+    config.env?.CLAUDE_SECURESTORAGE_CONFIG_DIR ??
+    process.env.CLAUDE_SECURESTORAGE_CONFIG_DIR ??
+    config.env?.CLAUDE_CONFIG_DIR ??
+    process.env.CLAUDE_CONFIG_DIR ??
+    "";
+  const authConfigDir = authConfigOverride || join(config.env?.HOME ?? homedir(), ".claude");
+  const cleanShell = process.platform === "win32" ? undefined : join(controlDir, "clean-bash");
+  if (cleanShell)
+    await writeFile(
+      cleanShell,
+      '#!/bin/sh\nunset BASH_ENV ENV\nexec /bin/bash --noprofile --norc "$@"\n',
+      { mode: 0o700 },
+    );
+  const protectedRoots = await existingRealpaths([
+    ...(config.interactionMode === "defer-resume" ? [configDir, authConfigDir] : []),
+    ctx.runDir,
+    ...(ctx.runsRoot ? [ctx.runsRoot] : []),
+    ...(process.env.CLAUDE_CONFIG_DIR ? [process.env.CLAUDE_CONFIG_DIR] : []),
+    ...(config.env?.CLAUDE_CONFIG_DIR ? [config.env.CLAUDE_CONFIG_DIR] : []),
+    ...(process.env.CLAUDE_SECURESTORAGE_CONFIG_DIR
+      ? [process.env.CLAUDE_SECURESTORAGE_CONFIG_DIR]
+      : []),
+    ...(config.env?.CLAUDE_SECURESTORAGE_CONFIG_DIR
+      ? [config.env.CLAUDE_SECURESTORAGE_CONFIG_DIR]
+      : []),
+    ...sensitiveHomePaths,
+    ...(config.isolation?.denyRead ?? []),
+    ...homeRoots.flatMap((home) => [
+      join(home, ".claude", "projects"),
+      join(home, ".claude", "memory"),
+    ]),
+  ]);
+  const denyRoots = compactRoots(protectedRoots);
+  const allowed = compactRoots(
+    await existingRealpaths([
+      ...(cleanShell ? [cleanShell] : []),
+      ...(config.pluginDirs ?? []),
+      ...(config.addDirs ?? []),
+      ...(config.isolation?.allowRead ?? []),
+    ]),
+  );
+  const overlapping = allowed.find(
+    (path) =>
+      (path !== workspace && isWithin(path, workspace)) ||
+      denyRoots.some((root) => isWithin(path, root)) ||
+      protectedRoots.some((root) => isWithin(root, path)),
+  );
+  if (overlapping) {
+    throw new Error(`isolation read carve-out overlaps a protected boundary: ${overlapping}`);
+  }
+  const readOnlyRoots = allowed.filter((path) => !isWithin(workspace, path));
+  const editDenyRoots = compactRoots([...denyRoots, ...readOnlyRoots, controlDir]);
+  const [readDenials, writeDenials] = await Promise.all([
+    Promise.all(denyRoots.map((root) => carvedPermissionDenials("Read", root, allowed))),
+    Promise.all(editDenyRoots.map((root) => carvedPermissionDenials("Edit", root, []))),
+  ]);
+  const denyRules = [...readDenials.flat(), ...writeDenials.flat()];
+  const sandboxSettings = {
+    disableAllHooks: true,
+    permissions: { deny: denyRules },
+    sandbox: {
+      enabled: true,
+      failIfUnavailable: true,
+      allowUnsandboxedCommands: false,
+      filesystem: {
+        denyRead: denyRoots,
+        denyWrite: [...denyRoots, controlDir],
+        allowRead: allowed,
+      },
+      // Filesystem isolation does not disable the live docs and package
+      // registry access that cases are intended to exercise.
+      network: { allowedDomains: ["*"] },
+    },
+  };
+  const tmpDir = join(stateDir, "tmp");
+  const cacheDir = join(stateDir, "cache");
+  const pluginCacheDir = join(stateDir, "plugins");
+  await Promise.all([
+    mkdir(tmpDir, { recursive: true }),
+    mkdir(cacheDir, { recursive: true }),
+    mkdir(pluginCacheDir, { recursive: true }),
+  ]);
+  return {
+    settings: sandboxSettings,
+    env: {
+      ...(config.env ?? {}),
+      ...(config.interactionMode === "defer-resume"
+        ? {
+            CLAUDE_CONFIG_DIR: configDir,
+            CLAUDE_SECURESTORAGE_CONFIG_DIR: authConfigOverride,
+          }
+        : {}),
+      ...(cleanShell ? { CLAUDE_CODE_SHELL: cleanShell } : {}),
+      // Hook shells launch outside the subject sandbox; clear their startup inputs too.
+      BASH_ENV: "",
+      ENV: "",
+      ZDOTDIR: controlDir,
+      CLAUDE_CODE_DISABLE_AUTO_MEMORY: "1",
+      CLAUDE_CODE_DISABLE_CLAUDE_MDS: "1",
+      // The CLI checks presence, not boolean parsing: "0" still disables resume.
+      CLAUDE_CODE_SKIP_PROMPT_HISTORY: config.interactionMode === "defer-resume" ? "" : "1",
+      ...(config.interactionMode === "defer-resume"
+        ? { CLAUDE_CODE_FORCE_SESSION_PERSISTENCE: "1" }
+        : {}),
+      CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: "1",
+      CLAUDE_CODE_SUBPROCESS_ENV_SCRUB: "1",
+      CLAUDE_CODE_AUTO_CONNECT_IDE: "false",
+      CLAUDE_CODE_PLUGIN_CACHE_DIR: pluginCacheDir,
+      CLAUDE_CODE_DISABLE_OFFICIAL_MARKETPLACE_AUTOINSTALL: "1",
+      DISABLE_AUTOUPDATER: "1",
+      TMPDIR: tmpDir,
+      XDG_CACHE_HOME: cacheDir,
+      npm_config_cache: join(cacheDir, "npm"),
+      BUN_INSTALL_CACHE_DIR: join(cacheDir, "bun"),
+    },
+  };
+};

package/src/drivers/codex/config.ts

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { InheritEnvironmentSchema } from "../../core/agent-environment.js";
 import { DurationSchema } from "../../core/duration.js";
 import { applyCatalogEffort, codexCatalog, DEFAULT_CODEX_MODEL } from "../../core/index.js";
 
@@ -36,6 +37,7 @@ export const CodexDriverConfigSchema = z
     cwdMode: z.enum(["artifacts", "runDir"]).default("artifacts"),
     cwd: z.string().optional(),
     env: z.record(z.string(), z.string()).optional(),
+    inheritEnv: InheritEnvironmentSchema.optional(),
     addDirs: z.array(z.string()).optional(),
     profile: z.string().optional(),
     config: z.record(z.string(), CodexConfigValueSchema).optional(),

package/src/drivers/codex/index.ts

@@ -3,6 +3,7 @@ import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { createInterface } from "node:readline";
 import { temporaryDirectory } from "tempy";
+import { agentEnvironment } from "../../core/agent-environment.js";
 import { durationMs } from "../../core/duration.js";
 import {
   type AgentDriver,
@@ -18,10 +19,11 @@ import {
   type TokenUsage,
   TypedEmitter,
 } from "../../core/index.js";
+import { resolveExecutable } from "../../core/platform-process.js";
+import { copyRegularFileNoFollow } from "../../core/secure-copy.js";
 import { walkArtifacts } from "../shared/artifacts.js";
 import { configuredClaudeSourceHashes } from "../shared/experiment-behavior.js";
 import { prepareCodexExperimentConfig } from "../shared/experiment-policy.js";
-import { copyRegularFileNoFollow } from "../shared/secure-copy.js";
 import { subprocessDriver } from "../subprocess/index.js";
 import {
   type AppTurnFacets,
@@ -59,6 +61,7 @@ class CodexAppServerDriverImpl implements AgentDriver {
   private runDir: string | null = null;
   private isolatedWorkspace: string | null = null;
   private isolatedStateDir: string | null = null;
+  private isolationConfig: Record<string, CodexConfigValue> = {};
   private threadId: string | null = null;
   private cliVersion: string | undefined;
   private nextRequestId = 1;
@@ -96,6 +99,7 @@ class CodexAppServerDriverImpl implements AgentDriver {
     let cwd =
       this.config.cwd ?? (this.config.cwdMode === "artifacts" ? ctx.artifactsDir : ctx.runDir);
     let env = this.config.env;
+    let launchCommand = this.config.command;
     if (this.config.isolation) {
       const workspace = await realpath(temporaryDirectory({ prefix: "lux-codex-workspace-" }));
       await cp(ctx.artifactsDir, workspace, { recursive: true });
@@ -123,6 +127,45 @@ class CodexAppServerDriverImpl implements AgentDriver {
         CODEX_CONFIG_HOME: stateDir,
       };
     }
+    if (this.config.isolation) {
+      const reads = await Promise.all(
+        this.config.isolation.allowRead.map((path) => realpath(path)),
+      );
+      const executable = resolveExecutable(
+        this.config.command,
+        { ...agentEnvironment(process.env, this.config.inheritEnv), ...env },
+        undefined,
+        cwd,
+      );
+      if (executable) {
+        launchCommand = await realpath(executable);
+        reads.push(executable, launchCommand);
+      }
+      // Native filesystem tools relaunch the CLI inside the subject sandbox.
+      // Workspace requirements reload process configuration during a turn.
+      // A thread-only profile is accepted at startup but fails that reload.
+      this.isolationConfig = {
+        allow_login_shell: false,
+        project_doc_max_bytes: 0,
+        projects: { [cwd]: { trust_level: "untrusted" } },
+        default_permissions: "lux-isolated",
+        permissions: {
+          "lux-isolated": {
+            filesystem: {
+              ":minimal": "read",
+              [cwd]: "write",
+              ...Object.fromEntries(reads.map((path) => [path, "read"])),
+            },
+            network: { enabled: true },
+          },
+        },
+        features: {
+          ...((this.config.config?.features as Record<string, CodexConfigValue>) ?? {}),
+          shell_snapshot: false,
+          shell_snapshot_v2: false,
+        },
+      };
+    }
     this.collectDir = cwd;
     this.artifactsDir = ctx.artifactsDir;
     this.runDir = ctx.runDir;
@@ -133,16 +176,23 @@ class CodexAppServerDriverImpl implements AgentDriver {
       commandName(this.config.command) === "codex"
         ? await discoverCliVersion(this.config.command)
         : undefined;
-    const managed = spawnManagedProcess(this.config.command, buildAppServerArgs(this.config), {
-      cwd,
-      env: {
-        ...process.env,
-        LUX_RUN_DIR: ctx.runDir,
-        LUX_ARTIFACTS_DIR: ctx.artifactsDir,
-        ...env,
+    const managed = spawnManagedProcess(
+      launchCommand,
+      buildAppServerArgs({
+        ...this.config,
+        config: { ...this.config.config, ...this.isolationConfig },
+      }),
+      {
+        cwd,
+        env: {
+          ...agentEnvironment(process.env, this.config.inheritEnv),
+          LUX_RUN_DIR: ctx.runDir,
+          LUX_ARTIFACTS_DIR: ctx.artifactsDir,
+          ...env,
+        },
+        signal: ctx.abortSignal,
       },
-      signal: ctx.abortSignal,
-    });
+    );
     this.process = managed;
     managed.child.stderr.setEncoding("utf8");
     let stderrTail = "";
@@ -187,35 +237,19 @@ class CodexAppServerDriverImpl implements AgentDriver {
       capabilities: { experimentalApi: true, requestAttestation: false },
     });
     this.notify("initialized");
-    const isolationReads = this.config.isolation
-      ? await Promise.all(this.config.isolation.allowRead.map((path) => realpath(path)))
-      : [];
     const threadConfig: Record<string, CodexConfigValue> = {
       ...codexConfigOverrides(this.config),
       ...(this.config.reasoningEffort
         ? { model_reasoning_effort: this.config.reasoningEffort }
         : {}),
-      ...(this.config.isolation
-        ? {
-            project_doc_max_bytes: 0,
-            projects: { [cwd]: { trust_level: "untrusted" } },
-            permissions: {
-              "lux-isolated": {
-                filesystem: {
-                  ":minimal": "read",
-                  ":workspace_roots": { ".": "write" },
-                  ...Object.fromEntries(isolationReads.map((path) => [path, "read"])),
-                },
-                network: { enabled: true },
-              },
-            },
-          }
-        : {}),
+      ...this.isolationConfig,
     };
     const started = await this.request("thread/start", {
       model: this.config.model,
       cwd,
-      runtimeWorkspaceRoots: this.config.addDirs ?? [],
+      runtimeWorkspaceRoots: this.config.isolation
+        ? [cwd, ...(this.config.addDirs ?? [])]
+        : (this.config.addDirs ?? []),
       approvalPolicy: this.config.approvalPolicy,
       approvalsReviewer: this.config.approvalsReviewer,
       ...(this.config.isolation
@@ -348,6 +382,11 @@ class CodexAppServerDriverImpl implements AgentDriver {
       : withRoot;
   }
 
+  async verificationWorkspace(): Promise<string | undefined> {
+    await this.quiesce();
+    return this.isolatedWorkspace ?? undefined;
+  }
+
   async quiesce(): Promise<void> {
     this.clearIdleTimer();
     await this.process?.terminate();
@@ -714,7 +753,8 @@ class CodexExecDriverImpl implements AgentDriver {
       command: this.config.command,
       args: buildArgs(this.config),
       cwd,
-      env: this.config.env,
+      env: agentEnvironment(process.env, this.config.inheritEnv, this.config.env),
+      inheritEnv: false,
       protocol: "custom",
       parseEvent: makeParseEvent(this.config, cliVersion),
       formatPrompt: (prompt) => prompt,

package/src/drivers/copilot/config.ts

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { InheritEnvironmentSchema } from "../../core/agent-environment.js";
 import { DurationSchema } from "../../core/duration.js";
 import { applyCatalogEffort, copilotCatalog } from "../../core/index.js";
 
@@ -24,6 +25,7 @@ export const CopilotDriverConfigSchema = z
     extraArgs: z.array(z.string()).optional(),
     cwd: z.string().optional(),
     env: z.record(z.string(), z.string()).optional(),
+    inheritEnv: InheritEnvironmentSchema.optional(),
     startupTimeout: DurationSchema.default("30 seconds"),
     idleTimeout: DurationSchema.default("10 minutes"),
     maxInterrupts: z.number().int().positive().default(20),

package/src/drivers/copilot/index.ts

@@ -1,4 +1,5 @@
 import { realpath } from "node:fs/promises";
+import { agentEnvironment } from "../../core/agent-environment.js";
 import { durationMs } from "../../core/duration.js";
 import {
   type AgentDriver,
@@ -70,7 +71,7 @@ class CopilotDriver implements AgentDriver {
       command: this.config.command,
       args: buildCopilotArgs(this.config),
       cwd: this.cwd,
-      env: { ...process.env, ...this.config.env },
+      env: agentEnvironment(process.env, this.config.inheritEnv, this.config.env),
       signal: ctx.abortSignal,
       maxLineBytes: this.config.maxLineBytes,
       maxQueuedBytes: this.config.maxQueuedBytes,

package/src/drivers/cursor/config.ts

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { InheritEnvironmentSchema } from "../../core/agent-environment.js";
 import { DurationSchema } from "../../core/duration.js";
 import { cursorCatalog } from "../../core/index.js";
 
@@ -10,6 +11,7 @@ export const CursorDriverConfigSchema = z
     mode: z.enum(["agent", "plan", "ask"]).default("agent"),
     cwd: z.string().optional(),
     env: z.record(z.string(), z.string()).optional(),
+    inheritEnv: InheritEnvironmentSchema.optional(),
     startupTimeout: DurationSchema.default("30 seconds"),
     idleTimeout: DurationSchema.default("10 minutes"),
     maxInterrupts: z.number().int().positive().default(20),

package/src/drivers/cursor/index.ts

@@ -1,4 +1,5 @@
 import { realpath } from "node:fs/promises";
+import { agentEnvironment } from "../../core/agent-environment.js";
 import { durationMs } from "../../core/duration.js";
 import {
   type AgentDriver,
@@ -65,7 +66,7 @@ class CursorDriver implements AgentDriver {
       command: this.config.command,
       args: buildCursorArgs(this.config),
       cwd: this.cwd,
-      env: { ...process.env, ...this.config.env },
+      env: agentEnvironment(process.env, this.config.inheritEnv, this.config.env),
       signal: ctx.abortSignal,
       maxLineBytes: this.config.maxLineBytes,
       maxQueuedBytes: this.config.maxQueuedBytes,

package/src/drivers/grok-build/config.ts

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { InheritEnvironmentSchema } from "../../core/agent-environment.js";
 import { DurationSchema } from "../../core/duration.js";
 import { applyCatalogEffort, grokBuildCatalog } from "../../core/index.js";
 
@@ -12,6 +13,7 @@ export const GrokBuildDriverConfigSchema = z
     sandbox: z.enum(["workspace", "read-only", "strict"]).default("workspace"),
     cwd: z.string().optional(),
     env: z.record(z.string(), z.string()).optional(),
+    inheritEnv: InheritEnvironmentSchema.optional(),
     startupTimeout: DurationSchema.default("30 seconds"),
     idleTimeout: DurationSchema.default("10 minutes"),
     permissionTimeout: DurationSchema.default("150 seconds"),

package/src/drivers/grok-build/index.ts

@@ -1,4 +1,5 @@
 import { realpath } from "node:fs/promises";
+import { agentEnvironment } from "../../core/agent-environment.js";
 import { durationMs } from "../../core/duration.js";
 import {
   type AgentDriver,
@@ -70,7 +71,7 @@ class GrokBuildDriver implements AgentDriver {
       command: this.config.command,
       args: buildGrokBuildArgs(this.config),
       cwd: this.cwd,
-      env: { ...process.env, ...this.config.env },
+      env: agentEnvironment(process.env, this.config.inheritEnv, this.config.env),
       signal: ctx.abortSignal,
       maxLineBytes: this.config.maxLineBytes,
       maxQueuedBytes: this.config.maxQueuedBytes,

package/src/drivers/subprocess/index.ts

@@ -2,6 +2,7 @@ import type { ChildProcessWithoutNullStreams } from "node:child_process";
 import { createInterface } from "node:readline";
 import { fileURLToPath } from "node:url";
 import { z } from "zod";
+import { agentEnvironment, InheritEnvironmentSchema } from "../../core/agent-environment.js";
 import { DurationSchema, durationMs } from "../../core/duration.js";
 import {
   type AgentDriver,
@@ -35,7 +36,7 @@ export const SubprocessDriverConfigSchema = z
     cwd: z.string().optional(),
     env: z.record(z.string(), z.string()).optional(),
     /** Inherit the host environment. Experiment mode always forces this off. */
-    inheritEnv: z.boolean().optional(),
+    inheritEnv: z.union([InheritEnvironmentSchema, z.literal(false)]).optional(),
     protocol: z.enum(["lux-jsonl", "custom"]).default("lux-jsonl"),
     idleTimeout: DurationSchema.default("2 minutes"),
     maxInterrupts: z.number().positive().default(20),
@@ -151,7 +152,9 @@ class SubprocessDriverImpl implements AgentDriver {
     const managed = spawnManagedProcess(this.config.command, this.config.args ?? [], {
       cwd: this.config.cwd ?? ctx.artifactsDir,
       env: {
-        ...(this.config.inheritEnv === false ? {} : process.env),
+        ...(this.config.inheritEnv === false
+          ? {}
+          : agentEnvironment(process.env, this.config.inheritEnv)),
         ...this.config.env,
         ...(ctx.caseId ? { LUX_CASE_ID: ctx.caseId } : {}),
         LUX_RUN_DIR: ctx.runDir,

package/src/orchestrator/artifact-origin.ts

@@ -0,0 +1,50 @@
+import { isAbsolute, relative, resolve, sep } from "node:path";
+import {
+  type Artifact,
+  contentHash,
+  inspectRunArtifact,
+  readRunArtifactBytes,
+} from "../core/index.js";
+
+const MAX_ORIGIN_BYTES = 10 * 1024 * 1024;
+
+export const identifyArtifactOrigins = async (
+  runDir: string,
+  artifacts: readonly Artifact[],
+  fixtureHashes: ReadonlyMap<string, string>,
+): Promise<Artifact[]> => {
+  const run = { runDir, artifacts };
+  const result: Artifact[] = [];
+  for (const artifact of artifacts) {
+    const { origin: _claimedOrigin, ...captured } = artifact;
+    const inspected = await inspectRunArtifact(run, artifact.path);
+    if (!inspected.stats?.isFile()) {
+      result.push(captured);
+      continue;
+    }
+    const path = relative(resolve(runDir, "artifacts"), inspected.target);
+    const expected =
+      !isAbsolute(path) && path !== ".." && !path.startsWith(`..${sep}`)
+        ? fixtureHashes.get(path)
+        : undefined;
+    if (expected === undefined) {
+      result.push({ ...captured, origin: "generated" });
+      continue;
+    }
+    if (inspected.stats.size > MAX_ORIGIN_BYTES) {
+      result.push(captured);
+      continue;
+    }
+    try {
+      const bytes = await readRunArtifactBytes(run, artifact.path, { maxBytes: MAX_ORIGIN_BYTES });
+      result.push({
+        ...captured,
+        origin: contentHash(bytes) === expected ? "fixture" : "modified",
+      });
+    } catch {
+      // Advisory provenance must not discard the rest of a safely archived index.
+      result.push(captured);
+    }
+  }
+  return result;
+};

package/src/orchestrator/experiment-corpus.ts

@@ -130,14 +130,17 @@ export const agentCorpusHash = async (
         execution.loaded.campaign.profiles.map(async (profileId) => {
           const profile = profileOrThrow(execution.config, profileId);
           const harness = profile.harness ?? execution.config.harness;
-          const driver = resolveDriverReference(
-            bound,
-            profile.driver ?? execution.config.defaultDriver,
+          const driver = bindSubjectRoot(
+            resolveDriverReference(bound, profile.driver ?? execution.config.defaultDriver),
+            execution.loaded.subjectRoot,
           );
-          const answerer = resolveAnswererReference(
-            bound,
-            profile.answerer ?? execution.config.defaultAnswerer,
-            harness,
+          const answerer = bindSubjectRoot(
+            resolveAnswererReference(
+              bound,
+              profile.answerer ?? execution.config.defaultAnswerer,
+              harness,
+            ),
+            execution.loaded.subjectRoot,
           );
           const answererCli = referencedAnswererCli(answerer);
           return {

package/src/orchestrator/experiment-identity.ts

@@ -131,9 +131,9 @@ const trustedExecutableEntrypoints = async (
       );
       for (const profileId of execution.loaded.campaign.profiles) {
         const profile = profileOrThrow(execution.config, profileId);
-        const driver = resolveDriverReference(
-          authored,
-          profile.driver ?? execution.config.defaultDriver,
+        const driver = bindSubjectRoot(
+          resolveDriverReference(authored, profile.driver ?? execution.config.defaultDriver),
+          execution.loaded.subjectRoot,
         );
         for (const command of referencedDriverRuntime(driver, execution.registry).commands)
           add(command);
@@ -197,14 +197,17 @@ export const runtimeCliReferences = async (
       for (const profileId of execution.loaded.campaign.profiles) {
         const profile = profileOrThrow(execution.config, profileId);
         const harness = profile.harness ?? execution.config.harness;
-        const driver = resolveDriverReference(
-          authored,
-          profile.driver ?? execution.config.defaultDriver,
+        const driver = bindSubjectRoot(
+          resolveDriverReference(authored, profile.driver ?? execution.config.defaultDriver),
+          execution.loaded.subjectRoot,
         );
-        const answerer = resolveAnswererReference(
-          authored,
-          profile.answerer ?? execution.config.defaultAnswerer,
-          harness,
+        const answerer = bindSubjectRoot(
+          resolveAnswererReference(
+            authored,
+            profile.answerer ?? execution.config.defaultAnswerer,
+            harness,
+          ),
+          execution.loaded.subjectRoot,
         );
         for (const command of referencedDriverRuntime(driver, execution.registry).commands)
           add(command, execution.config.rootDir);
@@ -271,9 +274,9 @@ export const validateAgentCaseProfileDrivers = async (
     );
     for (const profileId of execution.loaded.campaign.profiles) {
       const profile = profileOrThrow(execution.config, profileId);
-      const reference = resolveDriverReference(
-        authored,
-        profile.driver ?? execution.config.defaultDriver,
+      const reference = bindSubjectRoot(
+        resolveDriverReference(authored, profile.driver ?? execution.config.defaultDriver),
+        execution.loaded.subjectRoot,
       );
       const name = typeof reference === "string" ? reference : reference.name;
       const rawConfig = typeof reference === "object" ? reference.config : undefined;