@staix/agent-hub 0.18.0 → 0.19.0

package/src/cli/main.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
-import { conductorOperation } from "../hub/operational-authority.ts";
+import { conductorOperation, OPERATIONAL_PERSON_GUIDANCE } from "../hub/operational-authority.ts";
 import type { DeliverableRow } from "../hub/tasks.ts";
 import { kimiSourceRow } from "../hub/budget-notes.ts";
 import { hubGitSync, hubGitEnv } from "../hub/git.ts";
@@ -487,12 +487,17 @@ function startupDiagnostic(error: unknown): string {
   return message.replace(/[\p{Cc}\p{Cf}]/gu, " ").replace(/\s+/g, " ").trim().slice(0, 512) || "invalid startup configuration";
 }
 
-function fail(message: string, refusalAudited=false): never {
-  if(operationalAuditReady){if(refusalAudited)operationalRefusalRecorded=true;if(!operationalRefusalRecorded)audit("refused");}
+function fail(message: string, refusalAudited=false, authorityRefused?:boolean): never {
+  if(operationalAuditReady && authorityRefused!==false){if(refusalAudited)operationalRefusalRecorded=true;if(!operationalRefusalRecorded)audit("refused");}
   console.error(`ahub: ${message}`);
   process.exit(1);
 }
 
+function operationalIncomplete(result: {complete?:boolean;incompleteReason?:unknown;truncated?:boolean}, history: "log"|"event"): void {
+  if(result.complete===false)console.error(`ahub: operational output is incomplete: ${typeof result.incompleteReason==="string"?terminalText(result.incompleteReason).replace(/[\r\n]+/g," ").slice(0,200):"public privacy or history coverage unavailable"}`);
+  else if(result.truncated)console.error(`ahub: operational ${history} history is truncated`);
+}
+
 async function taskOp(op: string, a: Record<string, unknown>, throwOnError = false, connection?: ControlClient, timeoutMs?: number): Promise<string> {
   const hub = connection ?? await connect();
   try {
@@ -501,11 +506,11 @@ async function taskOp(op: string, a: Record<string, unknown>, throwOnError = fal
     if (!res.ok) {
       if (throwOnError) throw new Error(res.error);
       if(res.refusalAudited===true)operationalRefusalRecorded=true;
-      audit("refused");
+      if(!operationalAuditReady || res.authorityRefused!==false)audit("refused");
       // #711: an agent shell refused something only the person may do is told why it counts as an agent. The refusal and the authority stay as they were.
       const cause = agentShellCause(identity, String(res.error));
       if (cause) console.error(`ahub: ${res.error}\n${cause}`), process.exit(1);
-      fail(res.error);
+      fail(res.error,res.refusalAudited===true,res.authorityRefused);
     }
     return res.text;
   } finally { if (!connection) hub.close(); }
@@ -1065,7 +1070,7 @@ const commands: Record<string, () => Promise<void> | void> = {
         const { one, rest: flags } = takeFlags(rest, ["--peer"], []);
         if (flags.length) fail("usage: ahub queue list [--peer <id>] [--json] [--full] [--color=auto|always|never]");
         const result = await hub.request({ t: "queue", op: "list", ...(one["--peer"] ? { peer: one["--peer"] } : {}) });
-        if (!result.ok) fail(result.error,result.refusalAudited===true);
+        if (!result.ok) fail(result.error,result.refusalAudited===true,result.authorityRefused);
         if (options.json) return console.log(JSON.stringify(result.deliveries, null, 2));
         printOutput(renderQueue(result.deliveries, options.columns, Date.now()), options.color);
         return;
@@ -1077,7 +1082,7 @@ const commands: Record<string, () => Promise<void> | void> = {
         if (others.length || !one["--peer"] || (one["--state"] !== undefined && !["queued", "needs_review"].includes(one["--state"]))) fail("usage: ahub queue discard --peer <id> --reason <text> [--state queued|needs_review] [--yes]");
         if (yes && !one["--reason"]?.trim()) fail("ahub queue discard needs --reason <text> with --yes: it is recorded on every discarded delivery");
         const result = await hub.request({ t: "queue", op: "discard", peer: one["--peer"], ...(one["--state"] ? { state: one["--state"] } : {}), ...(yes ? { confirmed: true, reason: one["--reason"] } : {}) }, 60_000);
-        if (!result.ok) fail(result.error,result.refusalAudited===true);
+        if (!result.ok) fail(result.error,result.refusalAudited===true,result.authorityRefused);
         if (options.json) return console.log(JSON.stringify(result, null, 2));
         if (!yes) return console.log(`${result.count} ${result.state} deliver${result.count === 1 ? "y" : "ies"} for ${result.peer}; nothing discarded. Run again with --reason <text> --yes to discard them.`);
         console.log(`discarded ${result.discarded} of ${result.count} ${result.state} deliver${result.count === 1 ? "y" : "ies"} for ${result.peer}${result.refused ? `; ${result.refused} refused (${Object.entries(result.refusedBy ?? {}).map(([why, n]) => `${why} ${n}`).join(", ")})` : ""}`);
@@ -1088,7 +1093,7 @@ const commands: Record<string, () => Promise<void> | void> = {
       if (operation === "show") {
         if (flags.length) fail("usage: ahub queue show <id>");
         const shown = await hub.request({ t: "queue", op: "show", id });
-        if (!shown.ok) fail(shown.error,shown.refusalAudited===true);
+        if (!shown.ok) fail(shown.error,shown.refusalAudited===true,shown.authorityRefused);
         if (options.json) return console.log(JSON.stringify(shown.delivery, null, 2));
         return printOutput(renderQueueShow(shown.delivery, options.columns, Date.now()), options.color);
       }
@@ -1098,11 +1103,11 @@ const commands: Record<string, () => Promise<void> | void> = {
       let revision = parsedRevision;
       if (revision === undefined) {
         const shown = await hub.request({ t: "queue", op: "show", id });
-        if (!shown.ok) fail(shown.error,shown.refusalAudited===true);
+        if (!shown.ok) fail(shown.error,shown.refusalAudited===true,shown.authorityRefused);
         revision = shown.delivery.revision;
       }
       const result = await hub.request({ t: "queue", op: "resolve", id, revision, action: one["--action"], reason: one["--reason"] });
-      if (!result.ok) fail(result.error,result.refusalAudited===true);
+      if (!result.ok) fail(result.error,result.refusalAudited===true,result.authorityRefused);
       if (options.json) console.log(JSON.stringify(result.delivery, null, 2));
       else printOutput(renderQueueShow(result.delivery, options.columns, Date.now()), options.color);
     } finally { hub.close(); }
@@ -1566,7 +1571,7 @@ const commands: Record<string, () => Promise<void> | void> = {
       const reply = await hub.request({ t: "peer_stop", peer }, 35_000);
       if (reply.ok !== true) {
         const error = String(reply.error ?? "peer stop request refused");
-        fail(/unknown (?:control )?(?:message|request|command)(?:\b|:)|this hub does not know "peer_stop"/i.test(error) ? `${error}; upgrade the running hub to use ahub stop` : error,reply.refusalAudited===true);
+        fail(/unknown (?:control )?(?:message|request|command)(?:\b|:)|this hub does not know "peer_stop"/i.test(error) ? `${error}; upgrade the running hub to use ahub stop` : error,reply.refusalAudited===true,reply.authorityRefused);
       }
       console.log(`${peer}: ${reply.state}`);
     } finally { hub.close(); }
@@ -1602,7 +1607,7 @@ const commands: Record<string, () => Promise<void> | void> = {
     const hub = await connect();
     try {
       requireNamedPeerFeature(hub, peer);
-      const request = async (message: Record<string, unknown>) => { const reply = await hub.request(message, 35_000); if (reply.ok !== true) fail(String(reply.error ?? "roster request refused"),reply.refusalAudited===true); return reply; };
+      const request = async (message: Record<string, unknown>) => { const reply = await hub.request(message, 35_000); if (reply.ok !== true) fail(String(reply.error ?? "roster request refused"),reply.refusalAudited===true,reply.authorityRefused); return reply; };
       if (sub === "list") {
         const view = await request({ t: "settings_get" });
         if (!Array.isArray(view.roster)) fail("upgrade the running hub to use ahub roster");
@@ -1668,7 +1673,7 @@ const commands: Record<string, () => Promise<void> | void> = {
         const reply = await hub.request(message, 35_000);
         if (reply.ok !== true) {
           const error = String(reply.error ?? "settings request refused");
-          fail(/unknown (?:control )?(?:message|request|command)(?:\b|:)|this hub does not know "settings_/i.test(error) ? `${error}; upgrade the running hub to use ahub settings` : error,reply.refusalAudited===true);
+          fail(/unknown (?:control )?(?:message|request|command)(?:\b|:)|this hub does not know "settings_/i.test(error) ? `${error}; upgrade the running hub to use ahub settings` : error,reply.refusalAudited===true,reply.authorityRefused);
         }
         return reply;
       };
@@ -1798,14 +1803,14 @@ const commands: Record<string, () => Promise<void> | void> = {
 
   logs: async () => {
     if (identity.role !== "tools") return exec("tail", [args.includes("-f") ? "-f" : "-n100", join(stateDir, "hub.log")]);
-    const hub=await connect();const pending:string[]=[];let ready=false;
-    hub.onPush=message=>{if(message.t==="operational_log" && typeof message.line==="string"){if(ready)console.log(message.line);else if(pending.length<100)pending.push(message.line);}};
+    const hub=await connect();const pending:string[]=[];let ready=false,incompleteShown=false;
+    hub.onPush=message=>{if(message.t==="operational_log" && typeof message.line==="string"){if(message.complete===false && !incompleteShown){operationalIncomplete(message,"log");incompleteShown=true;}if(ready)console.log(message.line);else if(pending.length<100)pending.push(message.line);}};
     try {
       const result=await hub.request({t:"conductor_operational",op:"logs",follow:args.includes("-f")});
-      if(result.ok!==true)fail(String(result.error??"operational logs unavailable"),result.refusalAudited===true);
+      if(result.ok!==true)fail(String(result.error??"operational logs unavailable"),result.refusalAudited===true,result.authorityRefused);
       for(const line of result.lines??[])console.log(line);
       ready=true;for(const line of pending)console.log(line);
-      if(result.truncated)console.error("ahub: operational log history is truncated");
+      if(!incompleteShown){operationalIncomplete(result,"log");if(result.complete===false)incompleteShown=true;}
       if(args.includes("-f"))await new Promise<void>(resolve=>{
         const finish=()=>{process.off("SIGINT",finish);resolve();};
         hub.onClose=finish;process.once("SIGINT",finish);
@@ -1815,7 +1820,7 @@ const commands: Record<string, () => Promise<void> | void> = {
   export: async () => {
     if(identity.role==="tools") {
       const hub=await connect();
-      try {const result=await hub.request({t:"conductor_operational",op:"export",since:since()});if(result.ok!==true)fail(String(result.error??"operational export unavailable"),result.refusalAudited===true);for(const row of result.events??[])console.log(JSON.stringify(row));if(result.truncated)console.error("ahub: operational event history is truncated");}
+      try {const result=await hub.request({t:"conductor_operational",op:"export",since:since()});if(result.ok!==true)fail(String(result.error??"operational export unavailable"),result.refusalAudited===true,result.authorityRefused);for(const row of result.events??[])console.log(JSON.stringify(row));operationalIncomplete(result,"event");}
       finally {hub.close();}
       return;
     }
@@ -2230,7 +2235,7 @@ const commands: Record<string, () => Promise<void> | void> = {
     }
     if (args.includes("--orphans")) {
       if(identity.role==="tools" && args.includes("--kill")) {
-        const hub=await connect();try {const result=await hub.request({t:"conductor_operational",op:"orphans"},10_000);if(result.ok!==true)fail(String(result.error??"orphan inspection unavailable"),result.refusalAudited===true);console.log(JSON.stringify(result,null,2));}finally{hub.close();}return;
+        const hub=await connect();try {const result=await hub.request({t:"conductor_operational",op:"orphans"},10_000);if(result.ok!==true)fail(String(result.error??"orphan inspection unavailable"),result.refusalAudited===true,result.authorityRefused);console.log(JSON.stringify(result,null,2));}finally{hub.close();}return;
       }
       return orphanDoctor(args.includes("--kill"), options);
     }
@@ -2392,16 +2397,17 @@ function inspectDoctorRouting(cwd: string): { routing?: Routing; errors: string[
 async function runConductorCommand(): Promise<void> {
   const operation=conductorOperation(cmd,args);
   if(operation) {
-    const denial=()=>peerCommandRefusal(identity.role==="tools"?identity.peer:"unknown",commandLabel);
+    const unavailable=`conductor authorization unavailable; nothing was executed; ${OPERATIONAL_PERSON_GUIDANCE}`;
     const descriptor=readControl(stateDir);
-    if(!descriptor?.instanceId || !descriptor.projectId || !descriptor.pid || !descriptor.pidSignature || processLiveness(descriptor.pid,descriptor.pidSignature)!=="live")fail(denial());
+    if(!descriptor?.instanceId || !descriptor.projectId || !descriptor.pid || !descriptor.pidSignature || processLiveness(descriptor.pid,descriptor.pidSignature)!=="live")fail(unavailable);
     let hub:ControlClient;
-    try {hub=await connect(750);} catch {fail(denial());}
+    try {hub=await connect(3000);} catch {fail(unavailable);}
     let release:(()=>void)|undefined;
     try {
       let result:any;
-      try {result=await hub.request({t:"conductor_operational",op:"authorize",command:operation},750);} catch {fail(denial());}
-      if(result.ok!==true || !hub.instanceId)fail(`${denial()}${result.error?`; ${String(result.error)}`:""}`,result.refusalAudited===true);
+      try {result=await hub.request({t:"conductor_operational",op:"authorize",command:operation},3000);} catch {fail(unavailable);}
+      if(result.ok!==true)fail(result.authorityRefused===true || result.authorityRefused===false?String(result.error??unavailable):unavailable,result.refusalAudited===true,result.authorityRefused);
+      if(!hub.instanceId)fail(unavailable);
       release=ControlClient.pinInstance(stateDir,hub.instanceId);
       await commands[cmd]!();
     } finally {release?.();hub.close();}

package/src/cli/output.ts

@@ -14,6 +14,8 @@ export interface StatusOutput {
   retainedConfig?: readonly { key: string; reason: string }[];
   /** #572 AC3: advisory, present while the project root checkout is on a branch other than the default. */
   mainCheckout?: string;
+  /** #843 AC3: installed agent CLIs not on a verified version; ids, version, state and a receipt path only. */
+  agentDrift?: readonly { id: string; version: string; state: string; receipt: string }[];
   taskStalls?: readonly { task: number; cause: { kind: string; peer?: string; dependency?: number; code: string } }[];
   pendingTaskOffers?: readonly { task: number; peer: string }[];
   isolatedChecks?: { pending?: number; orphans?: string[]; unknownReceipts?: readonly string[]; maintenanceUnavailable?: boolean };
@@ -204,6 +206,7 @@ export function renderStatus(data: StatusOutput, columns?: number, now = Date.no
   if (data.cwd) out.push(...lines(data.cwd, columns));
   for (const pending of data.pendingRestart ?? []) out.push(...detail("pending restart", `${pending.key}: ${pending.reason}`, columns, "attention"));
   if (data.mainCheckout) out.push(...detail("main checkout", data.mainCheckout, columns, "attention"));
+  for (const drift of data.agentDrift ?? []) out.push(...detail("agent CLI drift", `${drift.id} ${drift.version} ${drift.state}; last receipt ${drift.receipt}`, columns, "attention"));
   if (data.retainedConfig?.length) {
     out.push(...detail("config retained", `${data.retainedConfig.map(row => row.key).join(", ")}; run ahub settings reload`, columns, "attention"));
     for (const pending of data.retainedConfig) out.push(...detail("retained reason", `${pending.key}: ${pending.reason}`, columns, "attention"));
@@ -262,6 +265,7 @@ export function renderStatus(data: StatusOutput, columns?: number, now = Date.no
     if (p.permissionNote) out.push(...detail("permission", p.permissionNote, columns, "muted"));
     if (typeof p.statusNotice?.message === "string" && p.statusNotice.message) out.push(...detail("status notice", p.statusNotice.message, columns, "attention"));
     if (p.requestedModel && p.servedBy && p.requestedModel !== p.servedBy) out.push(...detail("requested model", p.requestedModel, columns));
+    if (p.reviewScope === "code" || p.reviewScope === "full") out.push(...detail("review scope", p.reviewScope === "code" ? "code only (cannot run tests or read CI; the merger gates on exact-head CI)" : "full", columns, "muted")); // #852
     if (typeof p.modelSource === "string" && p.modelSource) out.push(...detail("model source", flat(p.modelSource), columns, "muted")); // an extra Jcode instance (#685): names only, never a URL or token
     if (typeof p.importantWaitingSince === "number" && p.importantWaitingNote) out.push(...detail("important waiting", `${p.importantWaitingNote.replace(/^\d+ important messages? waiting/, "important messages waiting")}`, columns, "attention"));
     if (typeof p.oldestQueuedAt === "number") out.push(...detail(`${id} oldest queued`, relative(p.oldestQueuedAt, now), columns, "muted"));

package/src/hub/agent-drift.ts

@@ -0,0 +1,61 @@
+import { COMPAT, type CompatId } from "../adapters/compat.ts";
+import type { AgentVersionRow } from "../cli/agents.ts";
+import { HUB, newEnvelope, sanitize, type PeerId } from "./envelope.ts";
+
+/** #843 AC3: an installed gated CLI whose version is not `verified`. Ids, version, state and one receipt path, never output of the CLI. */
+export interface DriftedAgent { id: CompatId; version: string; state: "in-line" | "trusted" | "refused"; receipt: string }
+
+/** A version string that is safe to carry in a notice and a marker: what `COMPAT[id].parse` yields for a real CLI. */
+const SAFE_VERSION = /^[0-9A-Za-z][0-9A-Za-z.+_-]{0,63}$/;
+
+/**
+ * Pure: which rows are drift. A missing executable is not drift (no executable, no version), and a CLI whose
+ * version could not be read has no (id, version) to announce, so `unknown` is never drift either.
+ */
+export function driftedAgents(rows: readonly AgentVersionRow[]): DriftedAgent[] {
+  const out: DriftedAgent[] = [];
+  for (const row of rows) {
+    const { verdict } = row;
+    if (!row.executable || verdict.state === "verified" || verdict.state === "unknown") continue;
+    const version = verdict.version;
+    if (!version || !SAFE_VERSION.test(version)) continue;
+    out.push({ id: row.id, version, state: verdict.state, receipt: COMPAT[row.id].receipt });
+  }
+  return out;
+}
+
+/** Durable key of one notice: the (id, version) and the planner it was queued for. */
+export const driftMarker = (agent: Pick<DriftedAgent, "id" | "version">, planner: PeerId): string => `${agent.id}:${agent.version}@${planner}`;
+
+export const driftNoticeBody = (agent: DriftedAgent): string =>
+  sanitize(`Agent CLI drift: ${agent.id} ${agent.version} ${agent.state}; last receipt ${agent.receipt}`);
+
+export interface DriftDeps {
+  /** True when the (id, version, planner) marker is new and now recorded (durable: `Board.recordAgentDriftNotice`). */
+  record(marker: string): boolean;
+  /** Undo a record whose notice could not be queued, so the next sweep tries again. */
+  forget(marker: string): void;
+  /** The effective planner holders from the settled role map. */
+  planners(): readonly PeerId[];
+  isRostered(peer: PeerId): boolean;
+  publish(env: ReturnType<typeof newEnvelope>): PeerId[];
+}
+
+/**
+ * One notice per (id, version) to each effective planner, kept durably per recipient: a planner that was queued is
+ * never told again, and one that could not be queued (or was not rostered yet) is retried alone by the next sweep.
+ * With no rostered planner nothing is recorded. Returns the notices queued.
+ */
+export function noticeDrift(drift: readonly DriftedAgent[], deps: DriftDeps): number {
+  const planners = deps.planners().filter(peer => deps.isRostered(peer));
+  let sent = 0;
+  for (const agent of drift) for (const planner of planners) {
+    const marker = driftMarker(agent, planner);
+    if (!deps.record(marker)) continue;
+    try {
+      if (!deps.publish(newEnvelope(HUB, driftNoticeBody(agent), { to: [planner], kind: "task" })).includes(planner)) throw new Error("the notice was not queued");
+      sent++;
+    } catch { deps.forget(marker); }
+  }
+  return sent;
+}

package/src/hub/board.ts

@@ -72,6 +72,10 @@ export interface HistoryEntry {
   reviewCost?: ReviewCost;
   /** #223 R4: on a verdict, whether the reviewer's context was new for it; set by the hub, never by the reviewer. */
   reviewContext?: "fresh" | "continuing";
+  /** #852: a verdict by a `code`-scope reviewer says so; a `full` reviewer's verdict carries nothing, so existing rows are unchanged. */
+  reviewScope?: "code";
+  /** #852 AC3: a `code`-scope reviewer's changes_requested with no open finding. It is recorded, returns the task to its owner and counts toward nothing. */
+  evidenceOnly?: true;
   /** Structured review report bound to the reviewed artifact, stored in the existing history JSON. */
   reviewFindings?: ReviewFindingSet;
   /**
@@ -259,6 +263,8 @@ export class Board {
     this.db.run("CREATE TABLE IF NOT EXISTS task_stalls (task INTEGER PRIMARY KEY, payload TEXT NOT NULL)");
     // #481 S7: one row per log-tier band breach episode already announced, so a restart never repeats the notice.
     this.db.run("CREATE TABLE IF NOT EXISTS band_notices (marker TEXT PRIMARY KEY, at INTEGER NOT NULL)");
+    // #843 AC3: one row per (agent id, installed version, planner) already queued, so a restart never repeats it.
+    this.db.run("CREATE TABLE IF NOT EXISTS agent_drift_notices (marker TEXT PRIMARY KEY, at INTEGER NOT NULL)");
     // Derived status-cache generation: only Board task/stall writes advance it, never journal writes.
     this.db.run("CREATE TABLE IF NOT EXISTS board_status_revision (id INTEGER PRIMARY KEY CHECK(id=1), revision INTEGER NOT NULL)");
     this.db.run("INSERT OR IGNORE INTO board_status_revision VALUES (1,0)");
@@ -373,6 +379,12 @@ export class Board {
     if (!/^[a-z_]{1,64}:#[1-9][0-9]{0,9}:log$/.test(marker)) throw new Error("invalid band notice marker");
     return this.db.query("INSERT OR IGNORE INTO band_notices(marker, at) VALUES(?, ?)").run(marker, Date.now()).changes > 0;
   }
+  /** True when the (id, version, planner) marker was new and is now recorded; false when it was announced before. */
+  recordAgentDriftNotice(marker: string): boolean {
+    if (!/^[a-z][a-z0-9-]{0,31}:[0-9A-Za-z][0-9A-Za-z.+_-]{0,63}@[0-9A-Za-z][0-9A-Za-z._-]{0,63}$/.test(marker)) throw new Error("invalid agent drift marker");
+    return this.db.query("INSERT OR IGNORE INTO agent_drift_notices(marker, at) VALUES(?, ?)").run(marker, Date.now()).changes > 0;
+  }
+  forgetAgentDriftNotice(marker: string): void { this.db.query("DELETE FROM agent_drift_notices WHERE marker=?").run(marker); }
   clearStall(task: number): void { this.taskWrite(() => this.db.query("DELETE FROM task_stalls WHERE task=?").run(task)); }
   stalls(): TaskStall[] {
     return (this.db.query("SELECT payload FROM task_stalls ORDER BY task").all() as { payload: string }[]).flatMap(row => {
@@ -398,7 +410,7 @@ export class Board {
 
   /** The only way a task changes. Validates the move, records who did what, returns the new row. */
   /** A `plan` in the patch replaces the old one whole: a new plan is the owner's current intent, not an addition. */
-  update(id: number, by: PeerId, event: string, patch: Partial<Pick<Task, "state" | "owner" | "planner" | "reviewer" | "reserved" | "refs" | "plan" | "rejections" | "signals" | "sdlc" | "role" | "cancelled" | "codeSymbols">>, note?: string, extra: Pick<HistoryEntry, "plannerReason" | "planAuthor" | "selfReview" | "profile" | "sweep" | "reason" | "from" | "capacity" | "withheld" | "noWrites" | "reviewCost" | "reviewContext" | "reviewFindings" | "unmetCriteria" | "deliverables" | "planObservation" | "planDeparture" | "planDepartureInvalidated" | keyof ReviewerHistory> = {}, expectedFlowRevision?: number, codeSymbolsAuthority?: typeof HOST_CODE_SYMBOLS): Task {
+  update(id: number, by: PeerId, event: string, patch: Partial<Pick<Task, "state" | "owner" | "planner" | "reviewer" | "reserved" | "refs" | "plan" | "rejections" | "signals" | "sdlc" | "role" | "cancelled" | "codeSymbols">>, note?: string, extra: Pick<HistoryEntry, "plannerReason" | "planAuthor" | "selfReview" | "profile" | "sweep" | "reason" | "from" | "capacity" | "withheld" | "noWrites" | "reviewCost" | "reviewContext" | "reviewScope" | "evidenceOnly" | "reviewFindings" | "unmetCriteria" | "deliverables" | "planObservation" | "planDeparture" | "planDepartureInvalidated" | keyof ReviewerHistory> = {}, expectedFlowRevision?: number, codeSymbolsAuthority?: typeof HOST_CODE_SYMBOLS): Task {
     const task = this.get(id);
     if (!task) throw new Error(`no task #${id}`);
     if (expectedFlowRevision !== undefined && (!Number.isSafeInteger(expectedFlowRevision) || expectedFlowRevision < 0 || task.history.length !== expectedFlowRevision)) throw new Error("task flow revision changed");
@@ -454,7 +466,7 @@ export class Board {
     // Disabling reporting must not let plan or repository refs edits/reverts resurrect prior consent.
     const repositoryRefsChanged = patch.refs !== undefined && JSON.stringify([task.refs.repo, task.refs.paths]) !== JSON.stringify([next.refs.repo, next.refs.paths]);
     const departureInvalidated = extra.planDepartureInvalidated === true || hasDeparture && (planChanged || repositoryRefsChanged);
-    const history = [...task.history, { at: Date.now(), by, event, ...plannerHistory, ...authorHistory, ...(extra.selfReview === true ? { selfReview: true as const } : {}), ...(planRevision ? { planRevision } : {}), ...(extra.planObservation ? { planObservation: extra.planObservation } : {}), ...(extra.planDeparture ? { planDeparture: extra.planDeparture } : {}), ...(departureInvalidated ? { planDepartureInvalidated: true as const } : {}), ...reviewMetadata, ...(note ? { note } : {}), ...(patch.cancelled?.supersededBy ? { supersededBy: patch.cancelled.supersededBy } : {}), ...("owner" in patch ? { owner: next.owner } : {}), ...(extra.profile ? { profile: extra.profile } : {}), ...(extra.sweep ? { sweep: extra.sweep } : {}), ...(extra.reason && TASK_MOVE_REASONS.includes(extra.reason) ? { reason: extra.reason } : {}), ...(extra.from ? { from: extra.from } : {}), ...(extra.capacity === true ? { capacity: true as const } : {}), ...(extra.withheld && (note || reviewFindings) ? { withheld: true as const } : {}), ...(reviewFindings ? { reviewFindings } : {}), ...(unmetCriteria?.length ? { unmetCriteria } : {}), ...(deliverables ? { deliverables } : {}), ...(extra.reviewContext === "fresh" || extra.reviewContext === "continuing" ? { reviewContext: extra.reviewContext } : {}), ...(extra.reviewCost ? { reviewCost: extra.reviewCost } : {}), ...(event === "done" && extra.noWrites === true ? { noWrites: true as const } : {}) }];
+    const history = [...task.history, { at: Date.now(), by, event, ...plannerHistory, ...authorHistory, ...(extra.selfReview === true ? { selfReview: true as const } : {}), ...(planRevision ? { planRevision } : {}), ...(extra.planObservation ? { planObservation: extra.planObservation } : {}), ...(extra.planDeparture ? { planDeparture: extra.planDeparture } : {}), ...(departureInvalidated ? { planDepartureInvalidated: true as const } : {}), ...reviewMetadata, ...(note ? { note } : {}), ...(patch.cancelled?.supersededBy ? { supersededBy: patch.cancelled.supersededBy } : {}), ...("owner" in patch ? { owner: next.owner } : {}), ...(extra.profile ? { profile: extra.profile } : {}), ...(extra.sweep ? { sweep: extra.sweep } : {}), ...(extra.reason && TASK_MOVE_REASONS.includes(extra.reason) ? { reason: extra.reason } : {}), ...(extra.from ? { from: extra.from } : {}), ...(extra.capacity === true ? { capacity: true as const } : {}), ...(extra.withheld && (note || reviewFindings) ? { withheld: true as const } : {}), ...(reviewFindings ? { reviewFindings } : {}), ...(unmetCriteria?.length ? { unmetCriteria } : {}), ...(deliverables ? { deliverables } : {}), ...(extra.reviewContext === "fresh" || extra.reviewContext === "continuing" ? { reviewContext: extra.reviewContext } : {}), ...(extra.reviewScope === "code" ? { reviewScope: "code" as const } : {}), ...(extra.evidenceOnly === true && event === "changes_requested" ? { evidenceOnly: true as const } : {}), ...(extra.reviewCost ? { reviewCost: extra.reviewCost } : {}), ...(event === "done" && extra.noWrites === true ? { noWrites: true as const } : {}) }];
     this.taskWrite(() => {
       const result = this.db.query("UPDATE tasks SET state = ?, owner = ?, reviewer = ?, reserved = ?, refs = ?, plan = ?, rejections = ?, signals = ?, history = ?, sdlc = ?, task_role = ?, cancelled = ?, updated = ?, planner = ? WHERE id = ?")
         .run(next.state, next.owner, next.reviewer, next.reserved ?? null, JSON.stringify(next.refs), JSON.stringify(next.plan ?? {}), next.rejections, JSON.stringify(next.signals), JSON.stringify(history), next.sdlc ? JSON.stringify(next.sdlc) : null, next.role ?? null, next.cancelled ? JSON.stringify(next.cancelled) : null, Date.now(), planner, id);

package/src/hub/check-runner.ts

@@ -53,8 +53,10 @@ interface RunnerTransport {
   kind: "remote"; image: string; platform: string;
   probe(command: ContainerCommand, cleanup: ContainerCommand): Promise<RunnerState>;
   isolate(command: ContainerCommand): Promise<void>;
-  runArgs(receipt: RunReceipt, labels: string[]): string[];
+  runArgs(receipt: RunReceipt, labels: string[], volume?: string): string[];
   copy(command: ContainerCommand, source: string, container: string, signal: AbortSignal): Promise<void>;
+  /** Remote only: bring the lockfile-keyed dependency volume to a verified prepared state and return its name. */
+  prepareDeps?(command: ContainerCommand, receipt: RunReceipt, source: string, signal: AbortSignal, labels: string[]): Promise<string>;
   execArgs(container: string, words: readonly string[]): string[];
   cleanup(command: ContainerCommand, name: string): Promise<boolean>;
   listArgs: string[];
@@ -111,6 +113,7 @@ function runContainer(executable: string, args: string[], options: { signal?: Ab
 export class ContainerRunner {
   private readonly command: ContainerCommand;
   private readonly entries = new Map<string, Entry>();
+  private readonly saves = new Map<string, Promise<void>>();
   private readonly queue: Entry[] = [];
   private active?: Entry;
   private closing = false;
@@ -233,11 +236,25 @@ export class ContainerRunner {
     await this.save(receipt);
     if (entry === this.active && entry) await this.cleanup(receipt.container);
   }
-  private async save(receipt: RunReceipt): Promise<void> {
+  /**
+   * Saves of one run's receipt go one at a time, in the order they were asked for, and each turn serializes the receipt when it runs, not when it was asked (#867): the run's own
+   * completion path and `markStale` save the same receipt concurrently, and an earlier snapshot written last must not undo a stale mark. Each write has its own temp name, so two
+   * writers never share one, and a failed write or rename removes its temp. A failed save rejects only its own caller; the next turn still runs.
+   */
+  private save(receipt: RunReceipt): Promise<void> {
+    const run = receipt.run;
+    const turn = (this.saves.get(run) ?? Promise.resolve()).then(() => this.write(receipt));
+    const tail = turn.catch(() => {});
+    this.saves.set(run, tail);
+    void tail.then(() => { if (this.saves.get(run) === tail) this.saves.delete(run); });
+    return turn;
+  }
+  private async write(receipt: RunReceipt): Promise<void> {
     await mkdir(this.records, { recursive: true, mode: 0o700 });
     const path = join(this.records, `${receipt.run}.json`);
-    const temp = `${path}.${process.pid}.tmp`;
-    await writeFile(temp, JSON.stringify(receipt), { mode: 0o600 }); await rename(temp, path);
+    const temp = `${path}.${process.pid}.${randomUUID()}.tmp`;
+    try { await writeFile(temp, JSON.stringify(receipt), { mode: 0o600 }); await rename(temp, path); }
+    catch (error) { await rm(temp, { force: true }).catch(() => {}); throw error; }
   }
   private async drain(): Promise<void> {
     if (this.active) return;
@@ -409,7 +426,10 @@ export class ContainerRunner {
       attemptedContainer = true;
       // Cold VM startup and a <=1.5 GiB source/dependency transfer need their own bounded allowances.
       const labels = ["--label", `agenthub.project=${this.options.projectKey}`, "--label", `agenthub.hub=${process.pid}:${this.signature}`, "--label", `agenthub.run=${r.run}`];
-      const run = await command(this.transport?.runArgs(r, labels) ?? ["run", "--detach", "--rm", "--name", r.container, ...labels, "--network", NETWORK, "--no-dns", "--cpus", "2", "--memory", "4g", "--workdir", "/work", CHECK_IMAGE, "sleep", "600"], 120_000);
+      // Preparation and verification containers reuse this run's name and labels, so cancel, timeout, shutdown, cleanup
+      // confirmation and the orphan sweep need no second ownership path. Each one is confirmed gone before the check starts.
+      const volume = await this.transport?.prepareDeps?.(transportCommand, r, src, entry.abort.signal, labels); this.ensureCurrent(entry);
+      const run = await command(this.transport?.runArgs(r, labels, volume) ?? ["run", "--detach", "--rm", "--name", r.container, ...labels, "--network", NETWORK, "--no-dns", "--cpus", "2", "--memory", "4g", "--workdir", "/work", CHECK_IMAGE, "sleep", "600"], 120_000);
       this.ensureCurrent(entry);
       if (run.code !== 0) { if (this.transport) throw new RemoteTransportError(); throw new Error("runner unavailable: container start failed"); }
       if (this.transport) await this.transport.copy(transportCommand, src, r.container, entry.abort.signal);
@@ -631,8 +651,50 @@ function runRemoteDocker(executable: string, remote: RemoteRunnerConfig, args: s
     });
   });
 }
+const DEPENDENCY_PREFIX = "agenthub-check-deps-";
+const DEPS_PROJECT = "agenthub.deps.project", DEPS_KEY = "agenthub.deps.key";
+/** Newest dependency volumes kept per project, the current one included; older ones are pruned. */
+export const KEEP_DEPENDENCY_VOLUMES = 3;
+/** Content key of a dependency volume: the commit's lockfile hash, Bun version, image architecture and image digest. */
+export function dependencyKey(parts: { lockfile: string; manifest: string; bun: string; arch: string; image: string }): string {
+  return createHash("sha256").update(["agenthub-deps-v2", parts.lockfile, parts.manifest, parts.bun, parts.arch, parts.image].join("\n")).digest("hex");
+}
+/** Files besides bun.lock that decide what `bun install --frozen-lockfile` produces: manifests, Bun and registry config, patches. */
+const INSTALL_INPUT = /(?:^|\/)(?:package\.json|bunfig\.toml|\.npmrc)$|^patches\//;
+/** Scripts bun runs during the root or a workspace install. They can read tracked source, so no manifest hash can bind their output. */
+const INSTALL_LIFECYCLE = ["preinstall", "install", "postinstall", "prepublish", "preprepare", "prepare", "postprepare"];
+/** Hash of every install-affecting file in the staged source, by path and content, so a changed manifest or config never reuses a volume. */
+export async function dependencyManifest(source: string): Promise<string> {
+  const files: string[] = [];
+  const walk = async (dir: string, prefix: string): Promise<void> => {
+    for (const entry of await readdir(dir, { withFileTypes: true })) {
+      const path = prefix ? `${prefix}/${entry.name}` : entry.name;
+      if (entry.isDirectory()) { if (entry.name !== "node_modules" && entry.name !== ".git") await walk(join(dir, entry.name), path); }
+      else if (entry.isFile() && INSTALL_INPUT.test(path)) files.push(path);
+      if (files.length > 10_000) throw new Error("install inputs exceed file limit");
+    }
+  };
+  await walk(source, "");
+  const digest = createHash("sha256");
+  for (const path of files.sort()) {
+    const data = await readFile(join(source, path));
+    if (path.endsWith("package.json")) {
+      // A lifecycle script makes node_modules depend on source outside the key. Refuse it rather than reuse a stale volume or
+      // key on the whole tree; the install stays exactly `bun install --frozen-lockfile`, never `--ignore-scripts`.
+      let manifest: unknown;
+      try { manifest = JSON.parse(data.toString("utf8")); } catch { throw new RemoteDependencyError(); }
+      const scripts = manifest && typeof manifest === "object" ? (manifest as { scripts?: unknown }).scripts : undefined;
+      if (scripts !== undefined && (!scripts || typeof scripts !== "object" || Array.isArray(scripts) || INSTALL_LIFECYCLE.some(name => Object.hasOwn(scripts, name)))) throw new RemoteDependencyError();
+    }
+    digest.update(`${path}\0${hash(data)}\0`);
+  }
+  return digest.digest("hex");
+}
+export function dependencyVolume(projectKey: string, key: string): string { return `${DEPENDENCY_PREFIX}${projectKey}-${key.slice(0, 32)}`; }
 /** Distinguish transport failures from deterministic request/snapshot refusals without leaking remote stderr. */
 class RemoteTransportError extends Error { constructor() { super("remote runner unavailable"); } }
+/** The prepared dependency volume could not be proven; a fixed reason, never remote output. */
+class RemoteDependencyError extends Error { constructor() { super("remote dependencies unavailable"); } }
 
 /** Same production strategy for transport-only component/native checks; production uses RemoteRunner's dependency gate. */
 export function remoteRunnerTransport(options: RunnerOptions): RunnerTransport {
@@ -677,6 +739,12 @@ export function remoteRunnerTransport(options: RunnerOptions): RunnerTransport {
     } catch { return false; }
   };
   const hardening = ["--pull", "never", "--network", "none", "--user", "65532:65532", "--read-only", "--tmpfs", "/tmp:rw,nosuid,nodev,size=64m,mode=1777", "--tmpfs", "/home/check:rw,nosuid,nodev,size=16m,uid=65532,gid=65532", "--tmpfs", "/work:rw,nosuid,nodev,size=512m,mode=0755,uid=65532,gid=65532", "--env", "HOME=/home/check", "--env", "TMPDIR=/tmp", "--cap-drop", "ALL", "--security-opt", "no-new-privileges", "--pids-limit", "64", "--cpus", "4", "--memory", "4g"];
+  // Network is "none" for every run except the single dependency-preparation container.
+  const hardenedFor = (network: "none" | "bridge") => { const args = [...hardening]; args[args.indexOf("--network") + 1] = network; return args; };
+  const mount = (volume: string, readonly: boolean) => ["--mount", `type=volume,src=${volume},dst=/work/node_modules${readonly ? ",readonly" : ""}`];
+  const readyFile = "/work/node_modules/.agenthub-deps-ready";
+  // Observed by the readiness probe: the Bun version and architecture the image actually runs.
+  let observed: { bun: string; arch: string } | undefined;
   const execArgs = (container: string, words: readonly string[]) => ["exec", "--user", "65532:65532", "--workdir", "/work", container, ...words];
   const copy = async (command: ContainerCommand, source: string, container: string, signal: AbortSignal) => {
     try {
@@ -714,10 +782,11 @@ export function remoteRunnerTransport(options: RunnerOptions): RunnerTransport {
           const launched = await command(["run", "--detach", "--rm", "--name", name, "--label", `agenthub.project=${options.projectKey}`, "--label", `agenthub.probe=${probeId}`, ...hardening, remote.image, "sleep", "600"]);
           if (launched.code !== 0) throw new RemoteTransportError();
           await copy(command, source, name, new AbortController().signal);
-          const result = await command(execArgs(name, ["bun", "-e", 'const {networkInterfaces}=await import("node:os"); if(process.getuid?.()!==65532||Object.keys(networkInterfaces()).some(name=>name!=="lo")||await Bun.file("/work/source-proof").text()!=="AHUB_REMOTE_SOURCE")process.exit(2); await Bun.write("/tmp/ready","ok"); try{await Bun.write("/root-write-proof","no");process.exit(3)}catch{} console.log(JSON.stringify({marker:"AHUB_REMOTE_READY",arch:process.arch,platform:process.platform}));']));
-          const observed = result.code === 0 ? JSON.parse(result.stdout) as { marker?: string; arch?: string; platform?: string } : undefined;
-          architecture = observed?.arch === "x64" ? "amd64" : observed?.arch;
-          if (observed?.marker !== "AHUB_REMOTE_READY" || observed.platform !== "linux" || architecture !== metadata.arch) throw new RemoteTransportError();
+          const result = await command(execArgs(name, ["bun", "-e", 'const {networkInterfaces}=await import("node:os"); if(process.getuid?.()!==65532||Object.keys(networkInterfaces()).some(name=>name!=="lo")||await Bun.file("/work/source-proof").text()!=="AHUB_REMOTE_SOURCE")process.exit(2); await Bun.write("/tmp/ready","ok"); try{await Bun.write("/root-write-proof","no");process.exit(3)}catch{} console.log(JSON.stringify({marker:"AHUB_REMOTE_READY",arch:process.arch,platform:process.platform,bun:Bun.version}));']));
+          const proof = result.code === 0 ? JSON.parse(result.stdout) as { marker?: string; arch?: string; platform?: string; bun?: string } : undefined;
+          architecture = proof?.arch === "x64" ? "amd64" : proof?.arch;
+          if (proof?.marker !== "AHUB_REMOTE_READY" || proof.platform !== "linux" || architecture !== metadata.arch || !/^\d+\.\d+\.\d+$/.test(proof.bun ?? "")) throw new RemoteTransportError();
+          observed = { bun: proof.bun!, arch: architecture! };
         } finally { clean = await cleanup(teardown, name); }
         if (!clean) throw new RemoteTransportError();
         return { available: true, platform: `linux/${architecture} (remote docker ${server.Version!.match(/^\d+\.\d+\.\d+/)![0]})` };
@@ -725,20 +794,81 @@ export function remoteRunnerTransport(options: RunnerOptions): RunnerTransport {
       finally { if (probeRoot) await rm(probeRoot, { recursive: true, force: true }).catch(() => {}); }
     },
     async isolate() { /* Fixed --network none needs no mutable host network. */ },
-    runArgs(receipt, labels) {
-      // ponytail: root and prepared dependency readiness remain reserved until 793b; no host path is used.
-      return ["run", "--detach", "--rm", "--name", receipt.container, ...labels, ...hardening,
-        "--mount", `type=volume,src=agenthub-check-deps-unprepared-${options.projectKey},dst=/work/node_modules,readonly`, "--workdir", "/work", remote.image, "sleep", "600"];
+    runArgs(receipt, labels, volume) {
+      // A check never runs without a verified prepared volume, and only ever mounts it read-only; no host path is used.
+      if (!volume) throw new RemoteDependencyError();
+      return ["run", "--detach", "--rm", "--name", receipt.container, ...labels, ...hardenedFor("none"), ...mount(volume, true), "--workdir", "/work", remote.image, "sleep", "600"];
+    },
+    async prepareDeps(command, receipt, source, signal, labels) {
+      if (!observed) throw new RemoteTransportError();
+      const key = dependencyKey({ lockfile: receipt.lockfile, manifest: await dependencyManifest(source), bun: observed.bun, arch: observed.arch, image: digest });
+      const volume = dependencyVolume(options.projectKey, key), name = receipt.container;
+      const ok = (result: CommandResult) => { if (result.code === 255 || result.code === 125) throw new RemoteTransportError(); if (result.code !== 0) throw new RemoteDependencyError(); return result; };
+      // Every step container carries this run's name and labels, so it is confirmed gone before the next one starts.
+      const gone = async () => { if (!await cleanup(command, name)) throw new RemoteTransportError(); };
+      const owner = async (): Promise<"missing" | "ours" | "foreign"> => {
+        const result = await command(["volume", "inspect", volume, "--format", `{"project":{{json (index .Labels "${DEPS_PROJECT}")}},"key":{{json (index .Labels "${DEPS_KEY}")}}}`]);
+        if (result.code === 255) throw new RemoteTransportError();
+        if (result.code !== 0) return "missing";
+        try { const labelled = JSON.parse(result.stdout) as { project?: unknown; key?: unknown }; return labelled.project === options.projectKey && labelled.key === key ? "ours" : "foreign"; } catch { return "foreign"; }
+      };
+      const marker = `await Bun.file(${JSON.stringify(readyFile)})`;
+      const verify = async (): Promise<boolean> => {
+        // Network none, volume read-only: proves the marker for this exact key and that the mount cannot be written.
+        const script = `const t=await ${marker}.text().catch(()=>"");if(t!==${JSON.stringify(key)})process.exit(2);try{await Bun.write(${JSON.stringify(readyFile)},"x");process.exit(3)}catch{}`;
+        const result = await command(["run", "--rm", "--name", name, ...labels, ...hardenedFor("none"), ...mount(volume, true), "--workdir", "/work", remote.image, "bun", "-e", script], { timeoutMs: 60_000 });
+        if (result.code === 255) throw new RemoteTransportError();
+        await gone();
+        return result.code === 0;
+      };
+      const prune = async () => {
+        // Bounded rule: keep the newest few of this project's own prepared volumes, always the current one; nothing else is touched.
+        const listed = await command(["volume", "ls", "--quiet", "--filter", `label=${DEPS_PROJECT}=${options.projectKey}`]);
+        if (listed.code !== 0) return;
+        const own = new RegExp(`^${DEPENDENCY_PREFIX}${options.projectKey}-[a-f0-9]{32}$`);
+        const names = listed.stdout.split("\n").map(line => line.trim()).filter(line => own.test(line));
+        if (names.length <= KEEP_DEPENDENCY_VOLUMES || names.length > 500) return;
+        const rows = await command(["volume", "inspect", ...names, "--format", `{"name":{{json .Name}},"created":{{json .CreatedAt}},"project":{{json (index .Labels "${DEPS_PROJECT}")}},"key":{{json (index .Labels "${DEPS_KEY}")}}}`]);
+        if (rows.code !== 0) return;
+        // Only a volume this runner demonstrably made is a candidate: exact name pattern, our project label and a key label that matches
+        // the name. A volume with an absent or inconsistent key label is someone else's or damaged: it is neither counted nor removed.
+        const volumes = rows.stdout.trim().split("\n").flatMap(line => { try { return [JSON.parse(line) as { name?: unknown; created?: unknown; project?: unknown; key?: unknown }]; } catch { return []; } })
+          .filter((row): row is { name: string; created: string; project: string; key: string } => typeof row.name === "string" && own.test(row.name) && row.project === options.projectKey && typeof row.created === "string"
+            && typeof row.key === "string" && /^[a-f0-9]{64}$/.test(row.key) && row.name === dependencyVolume(options.projectKey, row.key))
+          .sort((a, b) => Date.parse(b.created) - Date.parse(a.created) || a.name.localeCompare(b.name));
+        const keep = new Set([volume, ...volumes.filter(row => row.name !== volume).slice(0, KEEP_DEPENDENCY_VOLUMES - 1).map(row => row.name)]);
+        for (const row of volumes) if (!keep.has(row.name)) await command(["volume", "rm", row.name]).catch(() => {});
+      };
+      let state = await owner();
+      if (state === "ours" && await verify()) { await prune(); return volume; }
+      if (state === "ours") ok(await command(["volume", "rm", volume])); // Half-prepared or tampered: discard, never repair in place.
+      if (state === "foreign") throw new RemoteDependencyError();
+      try {
+        ok(await command(["volume", "create", "--label", `${DEPS_PROJECT}=${options.projectKey}`, "--label", `${DEPS_KEY}=${key}`, volume]));
+        if (await owner() !== "ours") throw new RemoteDependencyError();
+        // The one step with a network. Same hardening as a check apart from that, the volume writable and a cache inside the work tmpfs.
+        ok(await command(["run", "--rm", "--name", name, ...labels, "--pull", "never", "--network", "none", "--user", "0:0", "--read-only", "--cap-drop", "ALL", "--cap-add", "CHOWN", "--security-opt", "no-new-privileges", "--pids-limit", "16", "--memory", "256m", "--mount", `type=volume,src=${volume},dst=/deps`, remote.image, "chown", "65532:65532", "/deps"], { timeoutMs: 60_000 }));
+        await gone();
+        ok(await command(["run", "--detach", "--rm", "--name", name, ...labels, ...hardenedFor("bridge"), "--env", "BUN_INSTALL_CACHE_DIR=/work/.bun-cache", ...mount(volume, false), "--workdir", "/work", remote.image, "sleep", "600"], { timeoutMs: 120_000 }));
+        await copy(command, source, name, signal);
+        ok(await command(execArgs(name, ["bun", "install", "--frozen-lockfile"]), { timeoutMs: 300_000 }));
+        ok(await command(execArgs(name, ["bun", "-e", `await Bun.write(${JSON.stringify(readyFile)},${JSON.stringify(key)})`]), { timeoutMs: 60_000 }));
+        await gone();
+        if (!await verify()) throw new RemoteDependencyError();
+      } catch (error) {
+        // A failed preparation never leaves a candidate behind; the next run would discard it anyway, because only a verified marker admits a volume.
+        await cleanup(command, name).catch(() => false);
+        await command(["volume", "rm", volume]).catch(() => {});
+        throw error;
+      }
+      await prune();
+      return volume;
     },
   };
 }
-/** Same lifecycle, but no production checks capability until 793b proves prepared dependencies. */
+/** Same lifecycle; each run first proves or prepares its lockfile-keyed read-only dependency volume (#793b). */
 export class RemoteRunner extends ContainerRunner {
   constructor(options: RunnerOptions) {
     super(options, remoteRunnerTransport(options));
   }
-  override async available(signal?: AbortSignal): Promise<RunnerState> {
-    const transport = await super.available(signal);
-    return transport.available ? { ...transport, available: false, reason: "remote dependencies unprepared" } : transport;
-  }
 }