@quantiya/codevibe-claude-plugin 2.0.7 → 2.0.8

package/node_modules/@quantiya/codevibe-core/dist/local-executor/local-executor-impl.d.ts

@@ -3,15 +3,18 @@ import { AuthorityScope } from './authority';
 import { ClassAEmitter, ClassAEmitterContext, ClassASink, VerificationGateKind } from './class-a-emit';
 import { type DeviceSigningKey } from './class-a-sign';
 import { EmitShellEventFn } from './hook-bridge';
-import { MergeResult, SubmitMergeGateVerdictInput } from './task-group-types';
+import { SubmitMergeGateVerdictInput } from './task-group-types';
 import { TrackRegistry } from './track-registry';
-import { AgentKind, AuthorityAction, ClassBInbound, GateDispatchPayload, HookEvent, ImplementorHandle, LocalExecutor, MergeGateDispatchPayload, ProbeHandle, ProcessRole, ReviewerDispatchPayload, ReviseFeedbackPayload, ReviewerHandle, SpawnArgs, TrackAssignedPayload } from './types';
+import { AgentKind, AuthorityAction, ClassBInbound, GateDispatchPayload, HookEvent, ImplementorHandle, LocalExecutor, MergeGateDispatchPayload, ProbeHandle, ProcessRole, ReviewerDispatchPayload, ReviseFeedbackPayload, ReviewerHandle, SpawnArgs, TrackAssignedPayload, type DurableSessionResourceDisposeOptions, type WorkspaceDisposeOptions } from './types';
 import { type TeamExecution } from './team-execution-flag';
+import { type SnapshotBundlesView, type SnapshotMergeGateResult } from './snapshot-merge';
+import { type WorkspaceRootAuthority } from './workspace-authority';
 import type { RenderedConflict, TrackIntentDiff } from './wb2-review-bundle';
 import type { ConflictModelCaller } from './class2-resolver';
 import type { ConflictResolverContext } from './merge-conflict-resolve';
 import { type ContentCipher } from './conflict-resolution-durable-store';
-import type { TrackTipsView } from './durable-store';
+import type { PromoteManifestInput, SnapshotPromotionJournalV1, TrackTipsView } from './durable-store';
+import { type ReviewedShadowDiffFile, type ShadowEnv } from './workspace-shadow';
 /**
  * CP-7 W2 Stage-2 HIGH (Finding 2) — STRICT delivery sink for the
  * `tier:'none'` (moat-OFF) reduced-trust badge.
@@ -44,7 +47,9 @@ export type StrictBadgeSink = (badge: {
  * inject a mock without constructing the full GraphQL client.
  */
 export interface MergeGateAppSyncClient {
-    submitMergeGateVerdict(input: SubmitMergeGateVerdictInput): Promise<{
+    submitMergeGateVerdict(input: SubmitMergeGateVerdictInput, opts?: {
+        signal?: AbortSignal;
+    }): Promise<{
         outcome: string;
     }>;
 }
@@ -94,6 +99,8 @@ export type SubstrateEngager = (input: {
     taskId: string;
     agentKind: AgentKind;
     workdir: string;
+    /** Exact task-workspace incarnation selected by the orchestration owner. */
+    workdirAuthority?: WorkspaceRootAuthority;
     role: ProcessRole;
     /**
      * A1d (design §8.1) — the spawn demands hard confinement (`SpawnArgs.
@@ -106,12 +113,22 @@ export type SubstrateEngager = (input: {
      */
     requireConfined?: boolean;
 }) => Promise<SubstrateEngageResult>;
+/** Backend lease is 15 minutes; three renewal opportunities fit inside it. */
+export declare const TEAM_TRACK_HEARTBEAT_INTERVAL_MS: number;
 export interface LocalExecutorImplDeps {
     sessionId: string;
     initialScope?: AuthorityScope;
     baseCtx: Omit<ClassAEmitterContext, 'taskId'>;
     adapter: AgentKind;
     sink?: ClassASink;
+    /**
+     * Hosted Class A sink dedicated to team-child progress/lease renewal.
+     * Keeping this explicit prevents pre-task/refusal events from being sent
+     * against a placeholder task id while still making team liveness durable.
+     */
+    teamProgressSink?: ClassASink;
+    /** Production team construction refuses admission without the hosted sink. */
+    requireHostedTrackHeartbeat?: boolean;
     emitShellEvent: EmitShellEventFn;
     logger?: {
         warn: (msg: string, meta?: Record<string, unknown>) => void;
@@ -142,9 +159,9 @@ export interface LocalExecutorImplDeps {
     /** E2E content encryptor. Defaults to `cryptoService` if injected by the shell. */
     contentEncryptor?: MergeGateContentEncryptor;
     /**
-     * Repo root (canonicalized absolute) — the parent under which per-track state
-     * dirs `<repoRoot>/.codevibe/state/<group>/<track>/` live, and the cwd the
-     * MergeGate integration check runs in. Required for team sessions.
+     * Repo root (canonicalized absolute) — anchors validation of the legacy
+     * `state_dir` wire field and is the real folder the MergeGate ultimately
+     * promotes into. No per-track state directory is materialized.
      */
     repoRoot?: string;
     /**
@@ -162,12 +179,27 @@ export interface LocalExecutorImplDeps {
         taskId: string;
         taskGroupId: string;
         trackIndex: number;
+        dispatchGeneration: number;
         agent: AgentKind;
         writePaths: string[];
         autoModifiedFiles: string[];
         /** #590 — the track's own-module test files; part of the declared write
          *  scope (engine disjointness-validated) so a test write stays in-lane. */
         testSurfaces: string[];
+    }) => Promise<'accepted' | 'refused'>;
+    /**
+     * Terminal group-lifecycle bridge. The QuorumLoop owns the real per-track
+     * implementor handles and task snapshots; LocalExecutor's registry contains
+     * membership-only handles. The callback must publish its fence synchronously
+     * when called, then drain/abort/clean the exact members before resolving.
+     */
+    haltTeamTaskGroup?: (info: {
+        taskGroupId: string;
+        members: readonly {
+            taskId: string;
+            trackIndex: number;
+            dispatchGeneration: number;
+        }[];
     }) => Promise<void>;
     /**
      * CP-12 W4 (#593, Stage-2 r1 Codex MED) — corrupt-brief TOMBSTONE predicate
@@ -181,7 +213,7 @@ export interface LocalExecutorImplDeps {
      * Keyed by `(taskGroupId, trackIndex)` (#593 Stage-2 r2) — B.2 recovery
      * aggregates across groups, so a tombstone must be scoped to its group.
      */
-    isTrackTombstoned?: (taskGroupId: string, trackIndex: number) => boolean;
+    isTrackTombstoned?: (taskGroupId: string, trackIndex: number, taskId: string, dispatchGeneration: number) => boolean;
     /**
      * #592 PROVENANCE GUARD (live path, wired to `QuorumLoop.isForeignTeamGroup`).
      * `launchTrack` consults it right after the tombstone gate — BEFORE any registry
@@ -257,41 +289,38 @@ export interface LocalExecutorImplDeps {
      * MergeGate so it never calls this).
      */
     awaitTaskShadowQuiescent?: (taskId: string) => Promise<void>;
-    /**
-     * TEST SEAM — override the bounded await for member track tips in the
-     * `worktree_merge` gate (default {@link TRACK_TIP_AWAIT_MS}). The engine
-     * dispatches `MergeGateDispatch` as soon as the LAST track flips Passed, but
-     * the desktop commits each track's tip asynchronously on its OWN
-     * `TaskAuthorized` receipt — so the dispatch can arrive BEFORE the final
-     * track's commit has even STARTED (the shadow-ops mutex is not yet held, so
-     * the quiescence barrier passes straight through). Dogfood-pinned 2026-07-02:
-     * team-joint-conflict read a missing tip 0.1s before the commit landed →
-     * FAIL verdict stored → the real train's later PASS hit the #C12-1 replay →
-     * "Team halted — merge_integration_failure" AFTER a successful promote.
-     */
+    /** Bounded await for every reviewed member bundle (legacy option name). */
     trackTipAwaitMs?: number;
+    /** Overall deadline shared by initial hosted verdict submit + same-key replay. */
+    mergeGateSubmitTimeoutMs?: number;
     /**
-     * CP-14 — the team execution model. Since the §10 retirement (2026-07-03)
-     * `worktree_merge` is the ONLY model: the merge gate always runs
-     * {@link runWorktreeMergeGate} (merge-train the committed track branches +
-     * promote the integration tip). Retained as a dep for wire/test stability.
+     * CP-14 — the team execution wire model. `worktree_merge` is the only label,
+     * but the live desktop implementation uses reviewed bundles and filesystem
+     * snapshots. Retained as a dep for wire/test stability.
      */
     teamExecution?: TeamExecution;
-    /**
-     * CP-14 Wave A — read the durable committed track tips (the merge-train inputs)
-     * for a group. Backed by `RevertManifestStore.readTrackTips`. REQUIRED when
-     * `teamExecution === 'worktree_merge'` (the gate fails closed without it).
-     */
+    /** Deprecated offline migration reader. The live dispatch path never calls it. */
     readTrackTips?: (taskGroupId: string) => Promise<TrackTipsView>;
-    /**
-     * TEST SEAM (§10 retirement, 2026-07-03) — override the worktree merge gate
-     * body. Defaults to the real {@link runWorktreeMergeBranch} (merge-train +
-     * promote). Mirrors the `runVerificationGatesFn` precedent: unit tests of the
-     * classification/signing/submission flow AROUND the gate inject a fixed
-     * result instead of standing up a real git fixture with track branches (the
-     * merge-train itself has its own fixture-backed suites).
-     */
-    worktreeMergeGateFn?: (payload: MergeGateDispatchPayload, repoRootCanonical: string, gateKinds: VerificationGateKind[]) => Promise<MergeResult>;
+    /** Git-independent reviewed track bundles (the default team merge inputs). */
+    readTrackBundles?: (taskGroupId: string) => Promise<SnapshotBundlesView>;
+    /** Durable all-generation/cross-process fence around gate + hosted submission. */
+    withSnapshotMergeGateFence?: <T>(taskGroupId: string, operation: () => Promise<T>, signal?: AbortSignal) => Promise<T>;
+    /** Persist merged pre-images before the one group promotion mutates user files. */
+    persistSnapshotPreImages?: (taskGroupId: string, ownerTrackIndex: number, entries: PromoteManifestInput[]) => Promise<void>;
+    readSnapshotPromotion?: (taskGroupId: string) => Promise<SnapshotPromotionJournalV1 | null>;
+    prepareSnapshotPromotion?: (taskGroupId: string, operationHash: string, files: readonly ReviewedShadowDiffFile[], workspaceRootAuthority: WorkspaceRootAuthority) => Promise<void>;
+    markSnapshotPromotionApplied?: (taskGroupId: string, operationHash: string) => Promise<void>;
+    /** Optional shadow lifecycle hooks shared with implementor workspaces. */
+    snapshotShadowEnv?: ShadowEnv;
+    /** Mark a successfully accepted group terminal and reclaim its bundle state. */
+    completeSnapshotGroup?: (taskGroupId: string) => Promise<void>;
+    /** Normal-exit retirement of all ordinary durable resources from this session. */
+    disposeSnapshotSessionResources?: () => Promise<void>;
+    /**
+     * Legacy-named TEST SEAM around the merge-gate body. Production defaults to
+     * the reviewed-bundle filesystem snapshot implementation.
+     */
+    worktreeMergeGateFn?: (payload: MergeGateDispatchPayload, repoRootCanonical: string, gateKinds: VerificationGateKind[]) => Promise<SnapshotMergeGateResult>;
     /**
      * Audited-path fix (Fix 1) — surface a hosted-side PolicyRejection to the
      * DESKTOP. The LE already emits a mobile-bound NOTIFICATION via
@@ -387,6 +416,7 @@ export declare class LocalExecutorImpl implements LocalExecutor {
     private scope;
     private taskId;
     private readonly emitter;
+    private readonly trackProgressEmitter?;
     private readonly bridge;
     private readonly classBConsumer;
     private readonly emitShellEvent;
@@ -395,6 +425,11 @@ export declare class LocalExecutorImpl implements LocalExecutor {
     private readonly sessionId;
     private readonly trackRegistry;
     private readonly trackPayloads;
+    private readonly trackHeartbeats;
+    /** Hosted heartbeat requests admitted before a terminal/session fence. */
+    private readonly trackHeartbeatEmits;
+    /** Every accepted TrackAssigned launch coroutine, including pre-bridge awaits. */
+    private readonly trackLaunchPromises;
     private readonly resolvedMergeOutcomes;
     /**
      * CP-14 concurrent-dispatch dedup — the ONE in-flight merge-gate run per
@@ -403,6 +438,20 @@ export declare class LocalExecutorImpl implements LocalExecutor {
      * the #TC-7 replay path (re-submit → server replays the stored outcome).
      */
     private readonly inFlightMergeGates;
+    /** Disposable integration snapshots not owned by the QuorumLoop task map. */
+    private readonly integrationShadows;
+    /** Sticky exact task ids used by the post-drain durable enumeration. */
+    private readonly integrationTaskIdsOwned;
+    /** Group-terminal fence, installed before any halt await or registry abort. */
+    private readonly haltedTaskGroups;
+    private readonly integrationAbort;
+    private workspaceShutdown;
+    /** Auditless advisory spawns admitted before the session shutdown fence. */
+    private readonly advisorySpawnAdmissions;
+    /** Process-tree failures discovered after an advisory handle was returned. */
+    private readonly advisoryProcessCleanupFailures;
+    /** One exact final retirement result, reusable by strict/non-strict callers. */
+    private durableSessionResourceFailures;
     private _lastMergeGateEmitMs;
     private readonly teamDeps;
     private readonly logger;
@@ -434,6 +483,20 @@ export declare class LocalExecutorImpl implements LocalExecutor {
     spawnImplementor(args: SpawnArgs): Promise<ImplementorHandle>;
     spawnReviewer(_args: SpawnArgs): Promise<ReviewerHandle>;
     spawnHealthProbe(args: SpawnArgs): Promise<ProbeHandle>;
+    /**
+     * Publish advisory ownership synchronously before the first spawn await.
+     * Caller cancellation and session shutdown converge on one signal.
+     */
+    private admitAdvisorySpawn;
+    private bindAdvisorySpawn;
+    private settleAdvisorySpawn;
+    /**
+     * Abort and drain every auditless implementor admission to a fixed point.
+     * `handle.done` includes verified process-tree cleanup and registered exit
+     * hooks, so resolving this phase is the safe boundary before a shell turn
+     * removes the image the process was reading.
+     */
+    private drainAdvisorySpawns;
     /**
      * CP-7 PART F — engage the trusted-execution substrate for ONE implementor
      * spawn. Returns the `SpawnArgs` to launch with (substrate-augmented on the
@@ -502,6 +565,12 @@ export declare class LocalExecutorImpl implements LocalExecutor {
      * discards EXACTLY the rejected task's shadow. Optional for non-WS callers.
      */
     consumeClassB(packet: ClassBInbound, envelopeTaskId?: string): Promise<void>;
+    private stopExactTrackHeartbeat;
+    private stopTaskGroupHeartbeats;
+    private stopAllTrackHeartbeats;
+    private startTrackHeartbeat;
+    private retireTaskGroupMembership;
+    private removeExactTrackRegistration;
     /**
      * #C12-14 — launch the implementor for one track. IDEMPOTENT by
      * `(task_group_id, track_index, dispatch_generation)`: a duplicate
@@ -509,13 +578,18 @@ export declare class LocalExecutorImpl implements LocalExecutor {
      * (#C12-17). A strictly-newer generation (dispute re-dispatch, #C12-19)
      * supersedes the stale entry.
      *
-     * Steps: (1) idempotency check; (2) create + canonicalize the per-track
-     * `state_dir` via the existing spawn authority guard (NO bypass —
-     * `fs.realpath` exactly as `spawnSubprocess` requires); (3) advance the
-     * per-track authority scope to `ownership_scope`; (4) spawn the implementor
-     * in `state_dir` with the track's child `task_id`.
+     * Steps: (1) idempotency check; (2) validate the legacy per-track `state_dir`
+     * wire value without creating it; (3) register membership; (4) bridge the
+     * task into the QuorumLoop, which launches in a disposable WorkspaceShadow.
      */
     private launchTrack;
+    /**
+     * Bind membership changes to the durable group fence shared by reviewed
+     * bundle publication and merge-gate execution. A newer track generation can
+     * never replace membership while older reviewed bytes are being integrated
+     * or their hosted verdict is still in flight.
+     */
+    private launchTrackFenced;
     /**
      * CP-12 W4 (#593) — the public team-dispatch recovery entrypoint. Exposes the
      * EXACT private `launchTrack` body (register + brief bridge) so the QuorumLoop
@@ -529,13 +603,6 @@ export declare class LocalExecutorImpl implements LocalExecutor {
      *                    → recovery skips it (no repair, no gate dispatch).
      */
     recoverLaunchTrack(payload: TrackAssignedPayload): Promise<'registered' | 'duplicate' | 'rejected'>;
-    /**
-     * FIX-4 — wrap a track's `SpawnArgs` with the Class A process-lifecycle
-     * audit hooks, mirroring the single-track `spawnWithLifecycle` path but bound
-     * to the TRACK's own `task_id` as the Class A context (so PROCESS_SPAWNED /
-     * PROCESS_EXITED envelopes attribute to the right track, not the team task).
-     */
-    private withTrackLifecycle;
     /**
      * #C12-7/#C12-8 — MergeGate runner. The `owner_track_index` track runs the
      * shared integration check, derives a PASS/FAIL classification from the gate
@@ -549,14 +616,12 @@ export declare class LocalExecutorImpl implements LocalExecutor {
      * SharedFileConflict / ScopeViolation / ReviewerDisagreement / BudgetExhausted.
      */
     /**
-     * CP-14 Wave A — the `worktree_merge` merge-gate branch: build the merge-train
-     * inputs from the durable committed tips + the live member set, run
-     * {@link runWorktreeMergeGate} (merge-train → Tier-1 → promote the integration
-     * tip), and map the outcome to a `MergeResult` for the engine verdict. A
-     * `merged_promoted` ⇒ PASS; ANY halt ⇒ FAIL (the user tree is untouched by
-     * construction — #C14-AON — so there is no content to revert). FAILS CLOSED if
-     * `readTrackTips` is unwired (the gate cannot read its inputs).
+     * Live Git-independent merge branch: await every reviewed track bundle, merge
+     * against exact pre-image hashes, verify in a disposable snapshot, and promote
+     * once. Missing inputs, drift, overlap, or a failed gate all fail closed.
      */
+    private runSnapshotMergeBranch;
+    /** Legacy reader for pre-migration Git branch-tip records. Not live-selected. */
     private runWorktreeMergeBranch;
     /**
      * [P1b] GUARANTEED LOCAL freeze for the merge-gate timer. Wraps the inner gate
@@ -577,6 +642,26 @@ export declare class LocalExecutorImpl implements LocalExecutor {
      * still propagates (the `finally` only emits — it never swallows).
      */
     private runMergeGate;
+    /**
+     * Wait for bundle publishers without owning their fence. Each attempt first
+     * drains the current task lifecycle mutexes, then briefly enters the durable
+     * fence and checks exact task/generation bundle readiness. A ready attempt
+     * retains the same fence continuously through integration and hosted submit.
+     */
+    private runMergeGateFenced;
+    /** True only for a missing exact current-generation bundle; malformed input is classified inside the gate. */
+    private snapshotInputsMissing;
+    /**
+     * Normal session teardown for integration snapshots. Abort their verification
+     * children, await the full in-flight gate coroutines (which own their snapshot
+     * `finally` blocks), then reclaim any remaining directories. Marker TTL cleanup
+     * is only the hard-crash fallback.
+     */
+    private retireIntegrationShadow;
+    private cleanupDurableIntegrationSnapshots;
+    private getDurableSessionResourceFailures;
+    disposeDurableSessionResources(opts?: DurableSessionResourceDisposeOptions): Promise<void>;
+    disposeWorkspaces(opts?: WorkspaceDisposeOptions): Promise<void>;
     /** The single-flight merge-gate run body (P1b freeze wrapper). See {@link runMergeGate}. */
     private runMergeGateExclusive;
     /**
@@ -586,6 +671,7 @@ export declare class LocalExecutorImpl implements LocalExecutor {
      * A thrown exit never returns → the wrapper's boolean stays `false` → freeze.
      */
     private runMergeGateInner;
+    private submitMergeGateVerdictWithDeadline;
     /**
      * PHASE-589+469 W1 (§5.A / §5.C / #TC-2 / #TC-3) — drive the desktop CLI
      * convergence from the AUTHORITATIVE engine `outcome`. Emits, via the SAME
@@ -602,6 +688,7 @@ export declare class LocalExecutorImpl implements LocalExecutor {
      * uses). Team-only path — single-impl never reaches runMergeGate (#TC-8).
      */
     private emitGroupConvergence;
+    private emitGroupConvergenceOwned;
     /**
      * PHASE-589/469 W3.2 (D2) — drive the per-track render flip + group-resolved
      * render for a USER GROUP DECISION (the 5-option escalation COMMIT), through
@@ -640,18 +727,16 @@ export declare class LocalExecutorImpl implements LocalExecutor {
      *      non-negative safe integer. Otherwise a `task_group_id` of
      *      "../../../../tmp/x" makes the DERIVED path itself escape, and the
      *      packet's matching `state_dir` then passes the exact-match check.
-     *   1. Compute the trusted state root `realpath(realpath(repoRoot)/.codevibe/
-     *      state)` (realpath resolves any symlinked component).
-     *   2. DERIVE `realpath(stateRoot)/<task_group_id>/<track_index>`, mkdir -p,
-     *      realpath it (canonical workingDir for the spawn guard).
-     *   3. CONTAINMENT CHECK — the realpath'd derived dir MUST stay strictly under
-     *      the realpath'd state root (catches both `..`-segment AND symlinked-
-     *      component escapes).
-     *   4. Verify the payload's supplied `state_dir` resolves to EXACTLY the
-     *      derived path. A mismatch / escape ⇒ REJECT (return null): no spawn, no
-     *      scope grant. Never feed an attacker-controlled path into the grant.
+     *   1. Canonicalize the repo root and derive the virtual legacy state path
+     *      `<repo>/.codevibe/state/<task_group_id>/<track_index>` lexically.
+     *   2. Reject any existing path component that is a symlink/non-directory.
+     *      Nothing is created: team implementors now run in disposable snapshots,
+     *      so materializing these obsolete state directories would only leak disk
+     *      entries on every TrackAssigned.
+     *   3. Verify the payload's supplied `state_dir` normalizes to EXACTLY the
+     *      derived path. A mismatch / escape ⇒ REJECT (return null).
      *
-     * Returns the canonical derived dir on success, or `null` on a confinement
+     * Returns the normalized derived path on success, or `null` on a confinement
      * violation (logged here; the caller drops the packet).
      */
     private canonicalizeStateDir;
@@ -686,7 +771,8 @@ export declare class LocalExecutorImpl implements LocalExecutor {
      * §2.3 — emit a per-track progress event carrying `track_index` + `task_id`
      * in metadata so mobile/desktop CAN render per-track threads (CP-8 #469
      * renders; W2.b adds the wire attribution only). Emitting a per-track
-     * progress event also renews that track's lease (#C12-18). This path is ONLY
+     * progress event is the UI/status projection only. The independently signed
+     * Class A heartbeat owns backend lease renewal (#C12-18). This path is ONLY
      * for group tracks — single-track events go through the hook bridge and OMIT
      * the field (backward-compatible).
      */
@@ -719,6 +805,10 @@ export declare class LocalExecutorImpl implements LocalExecutor {
     get emitterForTests(): ClassAEmitter;
     /** CP-12 W2.b — expose the per-track registry for idempotency introspection. */
     get trackRegistryForTests(): TrackRegistry;
+    /** @internal exact terminal-retirement assertions. */
+    get trackPayloadCountForTests(): number;
+    /** @internal recurring lease owner count. */
+    get trackHeartbeatCountForTests(): number;
     private contextOrNull;
     /**
      * Context resolver for ClassBConsumer emit paths (refusals + PolicyRejection).

package/node_modules/@quantiya/codevibe-core/dist/local-executor/process-identity.d.ts

@@ -0,0 +1,16 @@
+export interface ProcessIdentity {
+    pid: number;
+    /** Boot-bound, high-resolution OS creation identity. */
+    incarnationId: string;
+}
+export interface ProcessMetadata {
+    identity: ProcessIdentity;
+    processGroupId: number | null;
+}
+/** Same native identity reader embedded into fd-anchored helper processes. */
+export declare const PROCESS_IDENTITY_SYNC_HELPER_SOURCE: string;
+/** Read exact process metadata from one platform-owned source. */
+export declare function readProcessMetadata(pid: number): Promise<ProcessMetadata | null>;
+export declare function readProcessIdentity(pid: number): Promise<ProcessIdentity | null>;
+export declare function currentProcessIdentity(): Promise<ProcessIdentity>;
+export declare function isProcessIdentityAlive(identity: ProcessIdentity): Promise<boolean>;

package/node_modules/@quantiya/codevibe-core/dist/local-executor/process-tree.d.ts

@@ -0,0 +1,123 @@
+import { spawn as nodeSpawn, type ChildProcess } from 'node:child_process';
+import { type ProcessIdentity } from './process-identity';
+import { type WorkspaceRootAuthority } from './workspace-authority';
+export type ProcessTreeOwnership = 'none' | 'posix-host' | 'posix-group' | 'windows-job';
+/**
+ * Spawn through an original-handle POSIX host. The host owns the target's
+ * detached group, drains it on normal completion/cancellation, and exits only
+ * after absence proof. No reusable PID/PGID becomes recovery authority.
+ */
+export declare function spawnPosixOwnedProcess(command: string, args: readonly string[], options: Parameters<typeof nodeSpawn>[2], seams?: {
+    spawnExecutable?: SpawnExecutable;
+    cleanupTimeoutMs?: number;
+    persistOwner?: (owner: ProcessCleanupOwner) => Promise<void>;
+    /** Exact task/verification cwd incarnation held through target launch. */
+    workingDirAuthority?: WorkspaceRootAuthority;
+    /** @internal deterministic directory-durability failure seam. */
+    syncOwnerDirectory?: (dir: string, file: string) => Promise<void>;
+}): ChildProcess;
+/** Original-handle status channel; missing/malformed status fails closed. */
+export declare function processHostCleanupStatus(child: ChildProcess, ownership: ProcessTreeOwnership): Promise<boolean>;
+/** Durable target-group identity emitted before the supervised command settles. */
+export declare function processHostCleanupOwner(child: ChildProcess, ownership: ProcessTreeOwnership): Promise<ProcessCleanupOwner | undefined>;
+/**
+ * Prove that a POSIX host's target group is gone. A well-behaved host reports
+ * its own proof. If the host crashes before it can report, use the already
+ * authenticated target-group identity to recover and prove cleanup. Starting
+ * this promise when the child is wired also prevents inherited output pipes
+ * from deadlocking the later `close` event after a host crash.
+ */
+export declare function ensureProcessHostCleanup(child: ChildProcess, ownership: ProcessTreeOwnership): Promise<boolean>;
+/** Spawn a Windows command inside a kill-on-close Job Object. */
+export declare function spawnWindowsJobProcess(command: string, args: readonly string[], options: Parameters<typeof nodeSpawn>[2], seams?: {
+    spawnExecutable?: SpawnExecutable;
+    systemRoot?: string;
+    desktopIdentity?: ProcessIdentity;
+    hostIdentity?: ProcessIdentity;
+    /** Exact task/verification cwd incarnation held by the native host. */
+    workingDirAuthority?: WorkspaceRootAuthority;
+    /** @internal deterministic A→B seam before the trusted bootstrap launch. */
+    beforeHostSpawn?: (hostDir: string, authority: WorkspaceRootAuthority) => Promise<void> | void;
+    /** @internal deterministic A→B seam before durable owner publication. */
+    beforeOwnerPublication?: (hostDir: string, authority: WorkspaceRootAuthority) => Promise<void> | void;
+    /** @internal isolated process-host root for deterministic tests. */
+    tempRoot?: string;
+}): Promise<ChildProcess>;
+export declare function sweepOrphanWindowsHostDirs(tempRoot: string, seams?: {
+    /** @internal deterministic replacement after authority capture, before owner read. */
+    beforeOwnerRead?: (dir: string, authority: WorkspaceRootAuthority) => Promise<void> | void;
+    /** @internal deterministic replacement after liveness decision, before removal. */
+    beforeOwnerRemoval?: (dir: string, authority: WorkspaceRootAuthority) => Promise<void> | void;
+    /** @internal deterministic liveness seam. */
+    isOwnerAlive?: (owner: ProcessIdentity) => Promise<boolean>;
+    /** @internal deterministic wall clock. */
+    now?: () => number;
+}): Promise<void>;
+/** Crash-durable identity used to retry a cleanup proof without a live handle. */
+export interface ProcessCleanupOwner {
+    pid: number;
+    ownership: 'posix-group';
+    /** Wall-clock lower-bound captured immediately before spawn. */
+    startedAtMs: number;
+    /** OS-native process incarnation, not reusable with the numeric PID/PGID. */
+    incarnationId: string;
+}
+/** Restart/session-start sweep for owners durably published before user code ran. */
+export declare function reapDurableProcessOwners(opts?: {
+    /** @internal isolated registry root for tests. */
+    rootDir?: string;
+    /** @internal deterministic same-inode growth seam. */
+    afterOwnerStat?: (file: string) => Promise<void> | void;
+    /** @internal lower deterministic helper deadline for tests. */
+    helperTimeoutMs?: number;
+    /** @internal deterministic blocked registry enumeration seam. */
+    testHangDirectoryStage?: 'open' | 'read' | 'close';
+    /** @internal deterministic blocked owner-record seam. */
+    testHangOwnerReadStage?: 'open' | 'read' | 'close';
+    /** @internal deterministic owner-record replacement before exact retirement. */
+    beforeOwnerRetirement?: (file: string) => Promise<void> | void;
+}): Promise<{
+    reaped: number;
+    retained: number;
+}>;
+export declare class ProcessTreeTerminationError extends Error {
+    constructor(message: string);
+}
+type SpawnExecutable = (command: string, args: readonly string[], options: Parameters<typeof nodeSpawn>[2]) => ChildProcess;
+type ProcessKill = (pid: number, signal?: NodeJS.Signals | number) => boolean;
+type ReadProcessIncarnation = (pid: number) => Promise<string | null>;
+/** Windows Job Objects drain with their host handle and never persist PID authority. */
+export declare function captureProcessCleanupOwner(args: {
+    pid: number;
+    ownership: ProcessTreeOwnership;
+    startedAtMs: number;
+    /** @internal deterministic native-identity seam. */
+    readProcessIncarnation?: ReadProcessIncarnation;
+}): Promise<ProcessCleanupOwner | undefined>;
+export declare function processTreeOwnership(substrateOwned: boolean, platform?: NodeJS.Platform): ProcessTreeOwnership;
+/**
+ * Terminate a process tree CodeVibe owns. POSIX uses a detached process group;
+ * Windows launches close their original Job Object host handle.
+ */
+export declare function terminateOwnedProcessTree(args: {
+    pid: number;
+    ownership: ProcessTreeOwnership;
+    directKill: () => void;
+    timeoutMs?: number;
+    /** @internal deterministic POSIX signal seam. */
+    processKill?: ProcessKill;
+    /** @internal deterministic POSIX wait seam. */
+    sleep?: (ms: number) => Promise<void>;
+    /** Captured immediately after spawn and required before a POSIX group signal. */
+    cleanupOwner?: ProcessCleanupOwner;
+    /** @internal deterministic OS-incarnation seam. */
+    readProcessIncarnation?: ReadProcessIncarnation;
+}): Promise<void>;
+/** Retry a previously unverified owned tree after restart/session teardown. */
+export declare function retryProcessCleanupOwner(owner: ProcessCleanupOwner, seams?: {
+    processKill?: ProcessKill;
+    readProcessIncarnation?: ReadProcessIncarnation;
+    sleep?: (ms: number) => Promise<void>;
+    timeoutMs?: number;
+}): Promise<void>;
+export {};

package/node_modules/@quantiya/codevibe-core/dist/local-executor/revert-reconcile.d.ts

@@ -42,6 +42,10 @@ export interface ReconcileDeps {
         alreadyReverted: string[];
         conflicts: string[];
     }>;
+    /** Verify exact stored post-images, transition APPLIED, then ACK before GC. */
+    acknowledgeSnapshotPromotion?: (taskGroupId: string) => Promise<void>;
+    /** Exact base/post acceptance finalizer shared with the live decision path. */
+    finalizeAcceptedGroup?: (taskGroupId: string) => Promise<void>;
     /**
      * HIGH-1 / LOCK #589-J — the COMMIT transport for CLAIM-crash recovery. Present
      * for a TEAM session (the same `claimGroupDecision` SDK the live decision uses).

package/node_modules/@quantiya/codevibe-core/dist/local-executor/revert-runner.d.ts

@@ -1,4 +1,5 @@
 import { RevertManifestStore } from './durable-store';
+import { type CasHelperCrashStage } from './workspace-shadow';
 /** The outcome of a group revert (Fork A: clean-where-safe + surface). */
 export interface RevertResult {
     /** Paths reverted (created→deleted, modified/deleted→restored) THIS pass. */
@@ -8,10 +9,22 @@ export interface RevertResult {
     /** Paths the user edited after apply — left as-is, surfaced (NEVER clobbered). */
     conflicts: string[];
 }
+/** @internal deterministic filesystem-race seams used by regression tests. */
+export interface RevertRunnerEnv {
+    afterDisplacement?: (path: string, recoveryName: string) => Promise<void>;
+    /** @internal deterministic race seam immediately before the reverse CAS. */
+    beforeMutationCommit?: (path: string) => Promise<void>;
+    /** @internal deterministic race seam immediately before final-state proof. */
+    beforeFinalVerification?: () => Promise<void>;
+    /** @internal deterministic post-COMMIT helper-death seam. */
+    testCrashHelperStage?: (path: string) => CasHelperCrashStage | undefined;
+    /** @internal swap/race seam before each manifest/journal filesystem proof. */
+    beforeJournalFileRead?: (path: string) => Promise<void> | void;
+}
 /**
  * Revert the whole group's applied tree off its durable manifest + journal.
  * Reverse `promoteOrder`; clean-where-safe; idempotent + crash-resumable.
  *
  * `workingDir` is the real workspace root the team applied into.
  */
-export declare function revertGroup(store: RevertManifestStore, taskGroupId: string, workingDir: string): Promise<RevertResult>;
+export declare function revertGroup(store: RevertManifestStore, taskGroupId: string, workingDir: string, env?: RevertRunnerEnv): Promise<RevertResult>;