@starci/hfs 4.7.47 → 4.9.0

package/runtime/engine/db/provision-authority.mjs

@@ -1,76 +0,0 @@
-// Read-only joins of a native dispatch and its accepted goal grant; no prompt text grants authority.
-import { canonicalJSON } from '../canonical-json.mjs';
-import { sha256 } from '../digest.mjs';
-import { byCodeUnit } from '../by-code-unit.mjs';
-import { pathKey } from '../../scripts/lib/path-key.mjs';
-
-const denied = reason => ({ ok: false, reason });
-const parse = text => { try { return JSON.parse(text); } catch { return null; } };
-
-/**
- * Verify a provider-plan grant against the exact live job, latest attempt, filed admission and
- * current owner-approved goal. The native caller-binding owner supplies `caller`; argv does not.
- * This verifies retained conversation acceptance, not cryptographic human identity.
- */
-export function provisionGoalGrant(db, { caller, operationId, planSha, ledgerId, repoRoot, worktree }) {
-  const guard = caller?.guard;
-  if (!guard || caller.seat || guard.schema !== 'starci/op-guard@1' || guard.role !== 'op'
-    || caller.classification?.role !== 'op' || caller.classification.jobId !== guard.jobId
-    || caller.classification.workflowId !== guard.workflowId
-    || guard.workflowId === 'supervisor' || guard.terminal !== caller.terminal
-    || !guard.jobId || !guard.op || !guard.ledgerRepo || !guard.workflowWorktree
-    || pathKey(guard.ledgerRepo) !== pathKey(repoRoot) || pathKey(guard.workflowWorktree) !== pathKey(worktree)
-    || (caller.ledgerId !== undefined && caller.ledgerId !== ledgerId)
-    || (caller.workflowId !== undefined && caller.workflowId !== guard.workflowId))
-    return denied('provision-native-caller-unverified');
-  const job = db.prepare('SELECT * FROM jobs WHERE job_id=?').get(guard.jobId);
-  const attempt = db.prepare('SELECT * FROM op_attempts WHERE job_id=? ORDER BY attempt_id DESC LIMIT 1').get(guard.jobId);
-  const attemptId = attempt?.attempt_id;
-  if (!Number.isSafeInteger(attemptId) || attemptId < 1
-    || (caller.attemptId !== undefined && Number(caller.attemptId) !== attemptId)
-    || (caller.dispatchId !== undefined && caller.dispatchId !== attempt.dispatch_id)) return denied('provision-native-attempt-unverified');
-  if (job?.kind !== 'op' || job.status !== 'running' || job.workflow_id !== guard.workflowId || job.op_id !== guard.op
-    || !attempt || attempt.job_id !== guard.jobId || attempt.workflow_id !== guard.workflowId
-    || attempt.op_id !== guard.op || !attempt.dispatch_id || attempt.terminal_handle !== caller.terminal
-    || attempt.managed !== 1 || attempt.started_at === null || attempt.attested_at === null
-    || attempt.reported_at !== null || attempt.settled_at !== null || attempt.released_at !== null || attempt.end_state !== null
-    || !attempt.worktree_path || pathKey(attempt.worktree_path) !== pathKey(worktree))
-    return denied('provision-native-attempt-stale');
-  const workflow = db.prepare('SELECT * FROM workflows WHERE workflow_id=?').get(guard.workflowId);
-  const goal = db.prepare('SELECT * FROM goals WHERE workflow_id=? ORDER BY revision DESC LIMIT 1').get(guard.workflowId);
-  const unit = db.prepare('SELECT * FROM work_units WHERE workflow_id=? AND unit_id=?').get(guard.workflowId, job.unit_id);
-  const goalJson = parse(goal?.json), payload = parse(job.payload_json);
-  if (workflow?.phase !== 'running' || workflow.archived_at !== null || goal?.approved_by !== 'owner'
-    || !goal.markdown?.trim() || !goal.goal_identity || workflow.goal_identity !== goal.goal_identity || !goalJson || goalJson.provisional === true
-    || !unit || unit.goal_revision !== goal.revision || unit.current_job_id !== job.job_id
-    || payload?.goal_binding?.revision !== goal.revision || payload?.goal_binding?.identity !== goal.goal_identity)
-    return denied('provision-goal-grant-stale');
-  const contract = db.prepare('SELECT * FROM contracts WHERE attempt_id=?').get(attemptId);
-  const context = parse(contract?.context_json), packet = context?.packet;
-  if (contract?.workflow_id !== guard.workflowId || contract.job_id !== job.job_id || !contract.markdown?.trim()
-    || packet?.op !== guard.op || packet.context?.workflow?.id !== guard.workflowId
-    || packet.context?.workflow?.goal_revision !== goal.revision || packet.context?.workflow?.goal_identity !== goal.goal_identity
-    || context.contract?.schema !== 'starci/contract-version@1' || context.contract?.op !== guard.op
-    || !/^[a-f0-9]{64}$/u.test(context.contract?.digest ?? '') || !context.worktree || pathKey(context.worktree) !== pathKey(worktree)
-    || !job.lease_token || context.lease?.token !== job.lease_token || !context.lease?.fencing || typeof context.lease.fencing !== 'object' || Array.isArray(context.lease.fencing))
-    return denied('provision-filed-contract-unverified');
-  const leases = db.prepare('SELECT resource_key,generation,token,expires_at FROM leases WHERE job_id=?').all(job.job_id);
-  const fencing = context.lease.fencing;
-  if (Object.keys(fencing).length !== leases.length || leases.some(lease => fencing[lease.resource_key] !== job.generation
-    || lease.generation !== job.generation || lease.token !== job.lease_token || lease.expires_at <= Date.now()))
-    return denied('provision-filed-contract-unverified');
-  const grants = goalJson.provisionGrants, approval = goalJson.provisionGrantsApproval;
-  if (!Array.isArray(grants) || new Set(grants.map(grant => grant?.operation)).size !== grants.length || grants.some(grant => !grant || Object.keys(grant).sort(byCodeUnit).join(',') !== 'digest,op,operation'
-    || typeof grant.op !== 'string' || typeof grant.operation !== 'string' || !/^[a-f0-9]{64}$/u.test(grant.digest ?? '')))
-    return denied('provision-goal-grant-unsupported');
-  if (approval?.source !== 'owner-goal-entry' || approval.digest !== sha256(canonicalJSON(grants))
-    || approval.assurance !== 'conversation-context-not-authenticated') return denied('provision-goal-grant-unaccepted');
-  if (goal.revision === 0 ? goal.approval_ref !== approval.digest
-    : goal.approval_ref !== goalJson.revision?.approvalToken || !/^rev-[a-f0-9]{64}$/u.test(goal.approval_ref ?? ''))
-    return denied('provision-goal-grant-unaccepted');
-  const matches = grants.filter(grant => grant.op === guard.op && grant.operation === operationId && grant.digest === planSha);
-  if (matches.length !== 1) return denied('provision-goal-grant-missing');
-  return { ok: true, kind: 'owner-goal', workflow: guard.workflowId, goalRevision: goal.revision,
-    goalIdentity: goal.goal_identity, op: guard.op, job: job.job_id, attempt: attemptId,
-    dispatch: attempt.dispatch_id, operation: operationId, digest: planSha, assurance: approval.assurance };
-}

package/runtime/engine/db/provision-operations.mjs

@@ -1,146 +0,0 @@
-// Standalone operation writes are reached only through the ledger writer's typed namespace.
-import { sha256 } from '../digest.mjs';
-import { provisionGoalGrant } from './provision-authority.mjs';
-import { describeSchema, readSchemaObjects } from './machine-schema.mjs';
-
-const failures = new WeakSet();
-const need = (condition, code) => {
-  if (!condition) { const error = Object.assign(new Error(code), { code }); failures.add(error); throw error; }
-};
-/** Recognize only this writer's fixed invariant refusals; arbitrary database errors stay private. */
-export const isProvisionOperationFailure = error => typeof error === 'object' && error !== null && failures.has(error);
-
-const SCHEMA_FAILURE = 'STARCI_LEDGER_SCHEMA_REFUSED';
-const SCHEMA_BEGIN = '-- starci:provision-schema:begin';
-const SCHEMA_END = '-- starci:provision-schema:end';
-const identifierKey = name => name.toLowerCase();
-const provisionName = name => identifierKey(name).startsWith('provision_');
-
-function canonicalProvisionSchema(canonicalSql) {
-  const begin = canonicalSql.indexOf(SCHEMA_BEGIN), end = canonicalSql.indexOf(SCHEMA_END);
-  need(begin >= 0 && end > begin && canonicalSql.lastIndexOf(SCHEMA_BEGIN) === begin
-    && canonicalSql.lastIndexOf(SCHEMA_END) === end, SCHEMA_FAILURE);
-  const canonical = describeSchema(canonicalSql);
-  const objects = canonical.objects.filter(row => provisionName(row.name));
-  const names = new Set(objects.map(row => identifierKey(row.name)));
-  const tables = new Set(objects.filter(row => row.type === 'table').map(row => identifierKey(row.name)));
-  const blobRefs = canonical.blobRefs.filter(row => tables.has(identifierKey(row.table_name)));
-  need(objects.length > 0 && tables.size > 0 && blobRefs.length > 0, SCHEMA_FAILURE);
-  return { sql: canonicalSql.slice(begin + SCHEMA_BEGIN.length, end), objects, names, tables, blobRefs };
-}
-
-function provisionSchemaState(db, schema) {
-  const all = readSchemaObjects(db);
-  need(['blobs', 'blob_ref_columns'].every(name => all.some(row => row.type === 'table' && row.name === name)), SCHEMA_FAILURE);
-  return {
-    objects: all.filter(row => provisionName(row.name) || schema.names.has(identifierKey(row.name)) || schema.tables.has(identifierKey(row.tbl_name))),
-    blobRefs: db.prepare('SELECT table_name,column_name FROM blob_ref_columns ORDER BY table_name,column_name').all()
-      .filter(row => provisionName(row.table_name) || schema.tables.has(identifierKey(row.table_name))),
-  };
-}
-
-function exactProvisionSchema(actual, expected) {
-  const objects = rows => JSON.stringify(rows.map(row => [row.type, row.name, row.tbl_name, row.identity]));
-  return objects(actual.objects) === objects(expected.objects)
-    && JSON.stringify(actual.blobRefs) === JSON.stringify(expected.blobRefs);
-}
-
-/** Install only a wholly absent canonical domain inside the ledger's fenced write transaction. */
-function ensureProvisionSchema(db, schema) {
-  const before = provisionSchemaState(db, schema);
-  if (before.objects.length || before.blobRefs.length) {
-    need(exactProvisionSchema(before, schema), SCHEMA_FAILURE);
-    return;
-  }
-  db.exec(schema.sql);
-  need(exactProvisionSchema(provisionSchemaState(db, schema), schema), SCHEMA_FAILURE);
-}
-
-/** Read one provider operation; older compatible ledgers without this additive store return null. */
-export function provisionOperation(db, operationId) {
-  if (!db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name='provision_operations'").get()) return null;
-  return db.prepare('SELECT * FROM provision_operations WHERE operation_id=?').get(operationId) ?? null;
-}
-
-/** Prior completed operations bind the exact public plan, including credential references and destination. */
-export function priorProvisionOperations(db, { planSha, excludeId }) {
-  return db.prepare("SELECT * FROM provision_operations WHERE plan_sha=? AND operation_id<>? AND state IN ('applied','verified') ORDER BY updated_at DESC LIMIT 1")
-    .all(planSha, excludeId);
-}
-
-function journal(db, row, kind, at) {
-  const prior = db.prepare('SELECT digest FROM provision_events WHERE operation_id=? ORDER BY seq DESC LIMIT 1').get(row.operation_id)?.digest ?? null;
-  const digest = sha256(JSON.stringify([prior, row.operation_id, kind, row.state, row.receipt_sha, at]));
-  db.prepare('INSERT INTO provision_events(operation_id,kind,state,receipt_sha,prev_digest,digest,created_at) VALUES(?,?,?,?,?,?,?)')
-    .run(row.operation_id, kind, row.state, row.receipt_sha, prior, digest, at);
-  return row;
-}
-
-/** Prepare immutable intent. A reused identifier must retain the exact original plan and target. */
-function prepareProvisionOperation(db, { operationId, action, targetId, transport, endpointIdentity, coordinationKey, planSha, at = Date.now() }) {
-  need(typeof operationId === 'string' && /^[a-zA-Z0-9][a-zA-Z0-9-]{0,127}$/u.test(operationId), 'provision-operation-id-invalid');
-  const previous = provisionOperation(db, operationId);
-  if (previous) {
-    need(previous.action === action && previous.transport === transport && previous.endpoint_identity === endpointIdentity
-      && previous.coordination_key === coordinationKey && previous.plan_sha === planSha, 'provision-operation-intent-conflict');
-    return previous;
-  }
-  db.prepare("INSERT INTO provision_operations(operation_id,action,target_id,transport,endpoint_identity,coordination_key,plan_sha,state,code,created_at,updated_at) VALUES(?,?,?,?,?,?,?,'planned','plan-prepared',?,?)")
-    .run(operationId, action, targetId, transport, endpointIdentity, coordinationKey, planSha, at, at);
-  return journal(db, provisionOperation(db, operationId), 'prepared', at);
-}
-
-/** Record the native terminal's scoped acceptance; a digest flag alone never reaches this writer. */
-function acceptProvisionOperation(db, { operationId, planSha, at = Date.now() }) {
-  const row = provisionOperation(db, operationId);
-  need(row && row.plan_sha === planSha, 'provision-plan-digest-mismatch');
-  need(['planned', 'accepted', 'unknown', 'partial'].includes(row.state), 'provision-accept-state-refused');
-  if (row.accepted_by === 'owner-terminal') return row;
-  db.prepare("UPDATE provision_operations SET state=CASE WHEN state='planned' THEN 'accepted' ELSE state END,accepted_by='owner-terminal',approval_ref=?,accepted_at=?,updated_at=?,code='owner-plan-accepted' WHERE operation_id=?")
-    .run(planSha, at, at, operationId);
-  return journal(db, provisionOperation(db, operationId), 'accepted', at);
-}
-
-/** Consume an exact accepted goal grant after the native binding check, rejoining current rows atomically. */
-function authorizeProvisionGrant(db, { operationId, planSha, caller, ledgerId, repoRoot, worktree, authoritySha, at = Date.now() }) {
-  const authority = provisionGoalGrant(db, { operationId, planSha, caller, ledgerId, repoRoot, worktree });
-  need(authority.ok, 'provision-goal-grant-refused');
-  const row = provisionOperation(db, operationId);
-  need(row && row.plan_sha === planSha, 'provision-plan-digest-mismatch');
-  db.prepare("UPDATE provision_operations SET state=CASE WHEN state='planned' THEN 'accepted' ELSE state END,accepted_by='owner-goal',approval_ref=?,accepted_at=COALESCE(accepted_at,?),updated_at=? WHERE operation_id=?")
-    .run(authoritySha, at, at, operationId);
-  return journal(db, provisionOperation(db, operationId), 'goal-authorized', at);
-}
-
-/** Atomically claim one accepted execution or explicit unknown-outcome reconciliation. */
-function claimProvisionOperation(db, { operationId, planSha, reconcile = false, at = Date.now(), pid = process.pid }) {
-  const row = provisionOperation(db, operationId);
-  need(row && row.plan_sha === planSha && row.accepted_at !== null, 'provision-acceptance-required');
-  need(reconcile ? ['unknown', 'partial', 'running'].includes(row.state) : row.state === 'accepted', 'provision-reconcile-required');
-  db.prepare("UPDATE provision_operations SET state='running',owner_pid=?,generation=generation+1,updated_at=?,code=? WHERE operation_id=?")
-    .run(pid, at, reconcile ? 'reconciliation-started' : 'execution-started', operationId);
-  return journal(db, provisionOperation(db, operationId), reconcile ? 'reconciling' : 'started', at);
-}
-
-/** Persist safe checkpoints and terminal receipts under the execution generation that owns them. */
-function updateProvisionOperation(db, { operationId, generation, state = 'running', receiptSha = null, metadataSha = null, writeAck = false, code, at = Date.now(), pid = process.pid }) {
-  const row = provisionOperation(db, operationId);
-  need(row?.state === 'running' && row.generation === generation && row.owner_pid === pid, 'provision-executor-stale');
-  need(['running', 'applied', 'verified', 'failed', 'unknown', 'partial'].includes(state), 'provision-state-invalid');
-  db.prepare('UPDATE provision_operations SET state=?,receipt_sha=COALESCE(?,receipt_sha),metadata_sha=COALESCE(?,metadata_sha),write_ack=MAX(write_ack,?),code=?,updated_at=? WHERE operation_id=?')
-    .run(state, receiptSha, metadataSha, writeAck ? 1 : 0, code, at, operationId);
-  return journal(db, provisionOperation(db, operationId), state === 'running' ? 'checkpoint' : 'finished', at);
-}
-
-/** Canonical schema text is injected once; schema work stays lazy inside the existing typed transaction. */
-export function provisionWrites(canonicalSql) {
-  let schema;
-  return Object.freeze({
-    prepareProvisionOperation(db, args) {
-      schema ??= canonicalProvisionSchema(canonicalSql);
-      ensureProvisionSchema(db, schema);
-      return prepareProvisionOperation(db, args);
-    },
-    acceptProvisionOperation, authorizeProvisionGrant, claimProvisionOperation, updateProvisionOperation,
-  });
-}

package/runtime/packages/grammar/scripts/build-stamp.mjs

@@ -1,98 +0,0 @@
-import { createHash } from "node:crypto"
-import { existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs"
-import { dirname, join, relative, resolve } from "node:path"
-import { fileURLToPath, pathToFileURL } from "node:url"
-
-/**
- * The build stamp ties a built `dist/` to the exact source it was built from.
- *
- * `npm run build` ends by writing `dist/.build-stamp.json`: the package version, the source digest
- * (below), a digest of the built files, and the build time. The root check
- * `scripts/checks/check-grammar-dist.mjs` recomputes the source digest and refuses a dist whose stamp is
- * missing or names other source, so a stale build can no longer pass for the current one.
- *
- * The source digest covers everything that decides what `dist/` contains: every file under `src/`
- * except stories, test helpers, specs and tests (they never ship), `tsconfig.build.json`,
- * `packages/grammar/scripts/copy-css.mjs`, and the `exports` and `files` fields of `package.json`. Line endings are
- * normalised so a CRLF checkout of the same commit has the same digest.
- */
-
-export const STAMP_FILE = ".build-stamp.json"
-export const STAMP_SCHEMA = "starci/grammar-build-stamp@1"
-export const DIGEST_ALGORITHM = "starci/grammar-source-digest@1"
-
-const DEV_ONLY_DIRS = new Set(["stories", "__test__"])
-const DEV_ONLY_FILE = /\.(?:stories|spec|test)\./
-
-const slash = (value) => value.replaceAll("\\", "/")
-const normalised = (buffer) => Buffer.from(buffer.toString("latin1").replaceAll("\r\n", "\n"), "latin1")
-
-function filesUnder(dir, keep = () => true) {
-    if (!existsSync(dir)) return []
-    return readdirSync(dir, { withFileTypes: true }).flatMap((entry) => {
-        const full = join(dir, entry.name)
-        if (entry.isDirectory()) return keep(entry, true) ? filesUnder(full, keep) : []
-        return entry.isFile() && keep(entry, false) ? [full] : []
-    })
-}
-
-/** The order `.sort()` gives without a compare function (UTF-16 code units): the stamp digest depends on it. */
-const byCodeUnit = (a, b) => (a < b ? -1 : a > b ? 1 : 0)
-
-function hashEntries(entries) {
-    const hash = createHash("sha256")
-    for (const [name, bytes] of entries.sort(([a], [b]) => byCodeUnit(a, b))) {
-        hash.update(name)
-        hash.update("\0")
-        hash.update(bytes === null ? "<absent>" : bytes)
-        hash.update("\0")
-    }
-    return `sha256:${hash.digest("hex")}`
-}
-
-/** The files the source digest reads, relative to the package root, in digest order. */
-export function sourceInputs(packageRoot) {
-    const src = filesUnder(join(packageRoot, "src"), (entry, isDir) =>
-        isDir ? !DEV_ONLY_DIRS.has(entry.name) : !DEV_ONLY_FILE.test(entry.name))
-    return [...src.map((file) => slash(relative(packageRoot, file))), "tsconfig.build.json", "scripts/copy-css.mjs"].sort(byCodeUnit)
-}
-
-/** The digest of everything that decides the content of `dist/`. */
-export function sourceDigest(packageRoot) {
-    const entries = sourceInputs(packageRoot).map((name) => {
-        const file = join(packageRoot, name)
-        return [name, existsSync(file) ? normalised(readFileSync(file)) : null]
-    })
-    const manifest = JSON.parse(readFileSync(join(packageRoot, "package.json"), "utf8"))
-    entries.push(["package.json#exports+files", Buffer.from(JSON.stringify({ exports: manifest.exports ?? null, files: manifest.files ?? null }))])
-    return hashEntries(entries)
-}
-
-/** The digest of the built files themselves (everything in `dist/` except the stamp). */
-export function distDigest(packageRoot) {
-    const dist = join(packageRoot, "dist")
-    const files = filesUnder(dist).map((file) => slash(relative(dist, file))).filter((name) => name !== STAMP_FILE)
-    return hashEntries(files.map((name) => [name, normalised(readFileSync(join(dist, name)))]))
-}
-
-export function writeStamp(packageRoot, { now = new Date() } = {}) {
-    const manifest = JSON.parse(readFileSync(join(packageRoot, "package.json"), "utf8"))
-    if (!existsSync(join(packageRoot, "dist"))) throw new Error("Cannot stamp a build that has no dist/ directory.")
-    const stamp = {
-        schema: STAMP_SCHEMA,
-        package: manifest.name,
-        version: manifest.version,
-        algorithm: DIGEST_ALGORITHM,
-        sourceDigest: sourceDigest(packageRoot),
-        distDigest: distDigest(packageRoot),
-        builtAt: now.toISOString(),
-    }
-    writeFileSync(join(packageRoot, "dist", STAMP_FILE), `${JSON.stringify(stamp, null, 2)}\n`)
-    return stamp
-}
-
-if (process.argv[1] && pathToFileURL(resolve(process.argv[1])).href === import.meta.url) {
-    const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..")
-    const stamp = writeStamp(packageRoot)
-    console.log(`dist/${STAMP_FILE}: ${stamp.package}@${stamp.version} ${stamp.sourceDigest.slice(0, 19)}`)
-}

package/runtime/scripts/agent/codex-app-server.mjs

@@ -1,79 +0,0 @@
-// scripts/agent/codex-app-server.mjs — the runtime's `codex app-server` client (kept out of trust.mjs, which is over
-// its size budget).
-//
-// Codex computes the hash it trusts a hook by; launch trust asks it through the app-server protocol the way Orca
-// trusts its own hooks (scripts/agent/trust.mjs trustCodexToolGuard). The client is a node one-shot: it spawns
-// `codex app-server`, sends initialize then each request, and prints one stdout line — the results array, or
-// {failed} when codex ended (or never started) before answering. Without that line an early exit only drained the
-// client's event loop: exit 0, nothing printed, and codex's stderr discarded — so "answered nothing (exit 0)" was
-// the client's exit, never codex's. The failure names codex's exit/signal, the request it left unanswered, its
-// stderr tail, `codex --version` and the CODEX_HOME it ran with; its text starts with APP_SERVER_FAILURE, which
-// scripts/agent/provider-outage.mjs reads as a worker-start strike of the codex circuit.
-//
-// The probe is a runtime-owned child: it gets the caller's env without the seat identity or the seat's guard-shim
-// PATH (scripts/lib/seat-env.mjs). A launch-trust call made under a Kernel seat otherwise inherits both — and
-// `codex`'s own launcher resolves `node` through PATH, so the seat's tool wrapper bound the seat's role to it and
-// refused the probe as a raw tool call (RIGHTS_RAW_TOOL, exit 2; `codex --version` printed the same refusal).
-import { runNode } from '../api/node/run-node.mjs';
-import { parseJson } from '../lib/json.mjs';
-import { withoutSeatEnv, withoutSeatShim } from '../lib/seat-env.mjs';
-
-// Every launch-trust app-server failure starts with this text; provider-outage.mjs classifies it.
-export const APP_SERVER_FAILURE = 'codex app-server answered nothing';
-
-const APP_SERVER_CLIENT = String.raw`
-const { spawn, spawnSync } = require('node:child_process');
-const reqs = JSON.parse(process.argv[1]);
-const p = spawn('codex app-server', { shell: true, stdio: ['pipe', 'pipe', 'pipe'], windowsHide: true });
-const out = []; let buf = ''; let next = 0; let ready = false; let err = '';
-const send = (o) => p.stdin.write(JSON.stringify(o) + '\n');
-const ask = () => { if (next >= reqs.length) { console.log(JSON.stringify(out)); p.kill(); process.exit(0); } send({ id: 100 + next, ...reqs[next] }); };
-const fail = (exit, signal, spawnError) => {
-  const v = spawnSync('codex --version', { shell: true, encoding: 'utf8', timeout: 15000, windowsHide: true });
-  const version = String(v.stdout || v.stderr || '').trim() || null;
-  console.log(JSON.stringify({ failed: { exit, signal, spawnError, stage: ready ? reqs[next].method : 'initialize', stderr: err.trim(), version } }));
-  process.exit(3);
-};
-p.stdin.on('error', () => {});
-p.stderr.on('data', (d) => { err = (err + d).slice(-4000); });
-p.stdout.on('data', (d) => { buf += d; let i; while ((i = buf.indexOf('\n')) >= 0) { const line = buf.slice(0, i); buf = buf.slice(i + 1); let m; try { m = JSON.parse(line); } catch { continue; }
-  if (m.id === 1) { ready = true; send({ method: 'initialized' }); ask(); }
-  else if (m.id === 100 + next) { out.push(m.error ? { error: m.error } : m.result); next += 1; ask(); } } });
-p.on('error', (e) => fail(null, null, e.message));
-p.on('close', (code, signal) => fail(code, signal, null));
-send({ id: 1, method: 'initialize', params: { clientInfo: { name: 'starci-launch-trust', version: '1' } } });
-`;
-
-const tail = (text, n) => { const t = String(text ?? '').replace(/\s+/g, ' ').trim(); return t.length > n ? '...' + t.slice(-n) : t; };
-
-// The error of an app-server call that returned no results: what ended it (codex's exit/signal or the client's own),
-// codex's stderr tail and version, and the CODEX_HOME it ran with.
-function appServerFailure({ home, timeoutMs, r, failed }) {
-  const parts = [];
-  if (failed) {
-    parts.push(
-      failed.spawnError ? 'did not start: ' + failed.spawnError
-        : 'exited ' + (failed.exit ?? 'on ' + failed.signal) + ' before answering ' + failed.stage,
-      failed.stderr ? 'stderr: ' + tail(failed.stderr, 400) : 'no stderr',
-      failed.version ? 'codex --version: ' + tail(failed.version, 120) : 'codex --version printed nothing');
-  } else {
-    parts.push('client exit ' + r.status + (r.error ? ': ' + r.error.message : ''));
-    if (r.error?.code === 'ETIMEDOUT') parts.push('no answer within ' + timeoutMs + 'ms');
-    const stderr = tail(r.stderr, 400);
-    if (stderr) parts.push('client stderr: ' + stderr);
-  }
-  parts.push('CODEX_HOME ' + home);
-  return APP_SERVER_FAILURE + ' (' + parts.join('; ') + ')';
-}
-
-/**
- * The app-server calls of one Codex home, in order: `requests` [{method, params}] -> results[] (an error result is
- * {error}). No results throws the precise failure (appServerFailure).
- */
-export function codexAppServer({ home, requests, timeoutMs = 60_000, env = process.env }) {
-  const r = runNode(['-e', APP_SERVER_CLIENT, JSON.stringify(requests)], { timeout: timeoutMs,
-    env: { ...withoutSeatShim(withoutSeatEnv(env)), CODEX_HOME: home } });
-  const last = parseJson(String(r.stdout ?? '').trim().split(/\r?\n/).pop() ?? '', null);
-  if (Array.isArray(last)) return last;
-  throw new Error(appServerFailure({ home, timeoutMs, r, failed: last?.failed ?? null }));
-}

package/runtime/scripts/agent/codex-mirror-source.mjs

@@ -1,34 +0,0 @@
-// scripts/agent/codex-mirror-source.mjs — the system Codex home a launch also trusts, beside Orca's managed Codex home.
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-
-/**
- * The system Codex home (<home>/.codex). Orca starts a Codex worker in one of two homes and the launch cannot know
- * which until Orca spawns it: the managed home (<userData>/codex-runtime-home/home), whose config.toml Orca rebuilds
- * from this home's at every launch keeping only its own `[projects.*]` and `[hooks.state.*]` tables (a
- * `[[hooks.PreToolUse]]` block written to the managed file alone is gone seconds after `worker-start`, observed
- * 2026-10-07 18:32), or this home itself, once Codex has approved Orca's status hook in it (Orca 1.4.221 on Windows,
- * as on macOS and Linux). Launch trust therefore records the project, the notices and the guard in both.
- *
- * Null when the launch's Codex home is no Orca-chosen one (an explicit CODEX_HOME): Orca neither mirrors from nor
- * starts the worker in the system home then. A trust home (specs) re-roots the source under `<root>/system`, a
- * directory of its own beside the managed `<root>/.codex`.
- */
-function codexMirrorSource({ env = process.env } = {}) {
-  const root = env.STARCI_AGENT_TRUST_HOME || null;
-  if (root) return path.join(root, 'system', '.codex');
-  return env.CODEX_HOME ? null : path.join(os.homedir(), '.codex');
-}
-
-/**
- * The Codex homes one launch records trust in: the active home(s) plus the system home when it has a config.toml.
- * A system home without one stays untouched: Orca refuses a blank mirror source, and a file created for the launch
- * alone would replace the owner's settings in the mirror and mask them in the home Orca starts the worker in.
- */
-export function codexLaunchHomes({ homes, env = process.env }) {
-  const source = codexMirrorSource({ env });
-  const key = (dir) => path.resolve(dir).toLowerCase();
-  const present = source && fs.existsSync(path.join(source, 'config.toml')) && !homes.some((h) => key(h.dir) === key(source));
-  return present ? [...homes, { kind: 'system-codex-home', dir: path.resolve(source) }] : homes;
-}

package/runtime/scripts/agent/host-agents.mjs

@@ -1,80 +0,0 @@
-// The host-agent preflight of one launch (contract change host-agent-preflight): before anything is trusted or started,
-// the agent the route names must be usable on THIS host. Three refusals, each typed:
-//   agent-disabled-on-host   Orca's own settings (orca-data.json of the active profile, settings.disabledTuiAgents) disable it;
-//   agent-binary-missing     its CLI binary (the card's start.cli, or Orca's agentCmdOverrides command) is not on PATH;
-//   agent-bypass-missing     Orca's settings.agentDefaultArgs for the agent lack the card's bypassFlag (an approval prompt no one answers);
-//   model-not-listed         the model is no model the runtime declares for that provider (a provider that declares none, like Cursor whose
-//                            models Orca lists dynamically, is not judged) (registry.yaml models + the pools' model pins);
-//                            a card with no model flag (Devin) takes no model.
-// No agent list is hard-coded: the card, Orca's settings and PATH decide. A test process reads none of them unless a spec passes
-// its own `settingsFile` / `pathDirs` (the host's real settings must not decide a spec's verdict).
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { parseYaml } from '../../engine/yaml.mjs';
-import { isSpecRun } from '../lib/env.mjs';
-import { appDataBase } from '../lib/app-data.mjs';
-
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
-const readYaml = (rel) => { try { return parseYaml(fs.readFileSync(path.join(root, rel), 'utf8')); } catch { return null; } };
-const readJson = (file) => { try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch { return null; } };
-
-/** Orca's userData folder (STARCI_ORCA_USER_DATA re-roots it, as for Orca's CODEX_HOME in agent/trust.mjs). */
-export function orcaUserData({ env = process.env, platform = process.platform, home = os.homedir() } = {}) {
-  if (env.STARCI_ORCA_USER_DATA) return env.STARCI_ORCA_USER_DATA;
-  return path.join(appDataBase({ env, platform, home }), 'orca');
-}
-
-/** The settings file of Orca's active profile: <userData>/profiles/<activeProfileId>/orca-data.json. */
-function orcaSettingsFile(opts = {}) {
-  const data = orcaUserData(opts);
-  const profile = readJson(path.join(data, 'orca-profile-index.json'))?.activeProfileId ?? 'local-default';
-  return path.join(data, 'profiles', profile, 'orca-data.json');
-}
-
-/** The models the runtime declares for `provider`: the registry `models` entries plus every pool's pins. */
-function modelsOfProvider(provider) {
-  const found = new Set();
-  const registry = readYaml('modules/models/registry.yaml');
-  for (const [id, row] of Object.entries(registry?.models ?? {})) if (row?.provider === provider) found.add(id);
-  for (const pool of Object.values(registry?.pools ?? {})) {
-    if (pool?.provider !== provider) continue;
-    if (typeof pool.defaultModel === 'string') found.add(pool.defaultModel);
-    for (const v of Object.values(pool.models ?? {})) if (typeof v === 'string') found.add(v);
-  }
-  return found;
-}
-
-const onPath = (binary, { pathDirs, platform, env = process.env }) => {
-  const exts = platform === 'win32' ? ['', ...(env.PATHEXT || '.EXE;.CMD;.BAT').split(';').map((e) => e.toLowerCase())] : [''];
-  return pathDirs.some((dir) => exts.some((ext) => { try { return fs.statSync(path.join(dir, binary + ext)).isFile(); } catch { return false; } }));
-};
-
-/**
- * {ok:true} or {ok:false, code, error}. `card` is the agent card (loadAdapter). Injectable for specs: settingsFile, pathDirs,
- * platform, env, models (a Set replacing the declared models).
- */
-export function hostAgentVerdict({ provider, model = null, card, env = process.env, platform = process.platform, settingsFile = null, pathDirs = null, models = null }) {
-  if (!settingsFile && !pathDirs && isSpecRun(env)) return { ok: true, skipped: 'a test process does not read the host agents' };
-  const agent = card?.start?.agentArgument ?? provider;
-  const settings = readJson(settingsFile ?? orcaSettingsFile({ env, platform }))?.settings ?? {};
-  if ((settings.disabledTuiAgents ?? []).includes(agent)) {
-    return { ok: false, code: 'agent-disabled-on-host', error: `agent '${agent}' is disabled in Orca's settings (disabledTuiAgents): enable it in Orca or route the role to another agent` };
-  }
-  const flag = card?.start?.bypassFlag;
-  if (flag && !String(settings.agentDefaultArgs?.[agent] ?? '').includes(flag)) {
-    return { ok: false, code: 'agent-bypass-missing', error: `agent '${agent}' has no '${flag}' in Orca's agentDefaultArgs: a worker would stop at an approval prompt no one answers; add it in Orca's settings` };
-  }
-  const override = settings.agentCmdOverrides?.[agent];
-  const binary = (typeof override === 'string' && override.trim() ? override.trim().split(/\s+/)[0] : null) ?? card?.start?.cli ?? agent;
-  const dirs = pathDirs ?? String(env.PATH || env.Path || '').split(path.delimiter).filter(Boolean);
-  if (!path.isAbsolute(binary) && !onPath(binary, { pathDirs: dirs, platform, env })) {
-    return { ok: false, code: 'agent-binary-missing', error: `agent '${agent}' needs the CLI binary '${binary}', which is not on PATH: install it or route the role to another agent` };
-  }
-  if (card?.start?.modelArgument !== false && model) {
-    const listed = models ?? modelsOfProvider(provider);
-    if (listed.size && !listed.has(model)) return { ok: false, code: 'model-not-listed', error: `model '${model}' is not a model the runtime declares for provider '${provider}' (modules/models/registry.yaml: models, pools)` };
-  }
-  return { ok: true };
-}

package/runtime/scripts/agent/launch-trust-policy.mjs

@@ -1,53 +0,0 @@
-// Current launch-root identity and owner-profile authorization. This module
-// resolves authority only; the trust writer keeps all provider file effects.
-import fs from 'node:fs';
-import path from 'node:path';
-import { revParseQuery } from '../api/git/rev-parse-query.mjs';
-import { launchTrustSettings } from '../../engine/config.mjs';
-
-/** The launch cwd as a directory, or null for an Orca selector ('active', 'id:…'). */
-function launchDirectory(worktree) {
-  if (typeof worktree !== 'string' || !worktree.trim()) return null;
-  const p = worktree.startsWith('path:') ? worktree.slice(5) : worktree;
-  try { return fs.statSync(p).isDirectory() ? path.resolve(p) : null; } catch { return null; }
-}
-
-/** Paths Codex keys trust by: the cwd, its git toplevel and the main worktree root. */
-export function codexTrustPaths(cwd) {
-  const out = [path.resolve(cwd)];
-  const git = (...args) => {
-    try {
-      const r = revParseQuery(args, { dir: cwd, timeout: 10000 });
-      return r.status === 0 ? r.stdout.trim() : null;
-    } catch { return null; }
-  };
-  const top = git('--show-toplevel');
-  if (top) out.push(path.resolve(top));
-  const common = git('--path-format=absolute', '--git-common-dir');
-  if (common && path.basename(common) === '.git') out.push(path.resolve(path.dirname(common)));
-  const seen = new Set();
-  return out.filter((p) => {
-    const k = process.platform === 'win32' ? p.toLowerCase() : p;
-    if (seen.has(k)) return false;
-    seen.add(k);
-    return true;
-  });
-}
-
-/** Resolve an existing checkout to exact current owner roots; never authorize by path prefix. */
-export function launchTrustVerdict({cwd,config,platform=process.platform,roots=codexTrustPaths}={}){
-  const dir=launchDirectory(cwd);
-  if(!dir)return {ok:false,status:'declined',reason:'automatic trust requires a resolved existing launch directory'};
-  let policy;try{policy=config===undefined?launchTrustSettings():launchTrustSettings(config);}catch(error){return {ok:false,status:'declined',reason:String(error.message)};}
-  if(policy?.profile!=='automatic')return {ok:false,status:'declined',reason:policy?.profile==='declined'?'owner declined automatic launch trust':'current owner launchTrust profile is not adopted'};
-  const key=p=>{const real=fs.realpathSync(p);return platform==='win32'?real.toLowerCase():real;};
-  try{
-    const paths=roots(dir);
-    const approved=new Map(policy.roots.map(root=>[key(root),root]));
-    // A worktree is authorized by its exact Git main root. A non-Git directory
-    // needs its own exact root entry; a child of an approved directory is insufficient.
-    const root=paths.at(-1);
-    if(!root||!approved.has(key(root)))return {ok:false,status:'declined',reason:'launch repository is outside the exact owner-approved roots'};
-    return {ok:true,dir,paths,approval:{approvedBy:policy.approvedBy,approvalRef:policy.approvalRef,root:approved.get(key(root))}};
-  }catch(error){return {ok:false,status:'declined',reason:`cannot verify launch roots: ${error.message}`};}
-}