@stigmer/runner 3.40.1 → 3.41.0

package/src/activities/execute-deep-agent/__tests__/hermetic/thrown-turn-drains-publishes.test.ts

@@ -0,0 +1,159 @@
+/**
+ * Hermetic: a THROWN TURN still carries every artifact it published — the
+ * native harness drains its in-flight inline publishes before the runtime
+ * writes the terminal status (stigmer#1116).
+ *
+ * The model writes a report in round one (`write_file`), and
+ * `streaming-side-effects.ts` hands the path to `InlinePublisher`, whose
+ * upload runs beside the stream. Round two's model call fails mid-stream
+ * (the scripted model's `fail` ending: a provider error), so the turn never
+ * reaches its settle — the one place that used to drain the publishes. The
+ * adapter classifies the throw as `failed`, and the runtime writes the
+ * turn's terminal status as soon as the adapter returns. The report is an
+ * edit on the tree, and the hermetic environment runs in capture mode (it
+ * carries artifact storage, as every hosted runner does), so that status is
+ * the file review's WAITING_FOR_APPROVAL with the failure's rows riding it
+ * and its phase deferred (`terminal-table.ts` `awaitingReviewArm`): the
+ * production shape of this fault.
+ *
+ * The order is made deterministic, not left to I/O timing: the upload is
+ * held until the turn asks for its publishes to drain, or until the
+ * activity has returned, whichever comes first. With the drain on the
+ * turn's every exit, the drain asks first and the artifact is on the
+ * persisted status. Without it the activity returns first, the upload
+ * lands afterwards on a status nobody persists again, and the assertion on
+ * the persisted artifacts fails — the defect this pins.
+ */
+
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from "vitest";
+import type { AgentExecutionStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import { ExecutionPhase, MessageType } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+
+vi.mock("../../../../shared/model-client.js", async () =>
+  (await import("../../__test-utils__/scripted-model-module.js")).scriptedModelClientModule(),
+);
+vi.mock("../../../../client/stigmer-client.js", async () =>
+  (await import("../../../../__test-utils__/hermetic-activity.js")).hermeticStigmerClientModule(),
+);
+
+import {
+  ScriptedClock,
+  createHermeticEnvironment,
+  type HermeticEnvironment,
+} from "../../../../__test-utils__/hermetic-activity.js";
+import { stubRegistryFetch } from "../../../../__test-utils__/model-registry-fixture.js";
+import {
+  FIXTURE,
+  beginDeepAgentScenario,
+  deepAgentExecutionRecord,
+  runDeepAgentTurn,
+} from "../../__test-utils__/hermetic-deep-agent.js";
+import { LocalArtifactStorage } from "../../../../shared/artifact-storage.js";
+import { StreamingSideEffects } from "../../streaming-side-effects.js";
+import { TERMINAL_COPY } from "../../../../harness/terminal-table.js";
+
+const REPORT = "report.md";
+const REPORT_BODY = "# Report\n\nWritten before the provider failed.\n";
+const WRITE_CALL_ID = "call-hermetic-write-0001";
+const PROVIDER_FAULT = "provider stream failed mid-turn";
+
+function systemMessages(status: AgentExecutionStatus): string[] {
+  return status.messages.filter((m) => m.type === MessageType.MESSAGE_SYSTEM).map((m) => m.content);
+}
+
+describe("ExecuteDeepAgent hermetic — a thrown turn drains its inline publishes", () => {
+  let env: HermeticEnvironment;
+  let registry: ReturnType<typeof stubRegistryFetch>;
+  const clock = new ScriptedClock();
+
+  beforeAll(() => {
+    env = createHermeticEnvironment();
+    registry = stubRegistryFetch();
+    clock.install();
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  afterAll(() => {
+    clock.uninstall();
+    registry.restore();
+    env.dispose();
+  });
+
+  it("persists the turn's end with the artifact it published before the model call threw", async () => {
+    // ── Arrange ──────────────────────────────────────────────────────────────
+    const record = deepAgentExecutionRecord({ message: "Write the report." });
+    const scenario = beginDeepAgentScenario({
+      env,
+      clock,
+      record,
+      script: () => ({
+        turns: [
+          {
+            text: "Writing the report.",
+            toolCalls: [{ id: WRITE_CALL_ID, name: "write_file", args: { file_path: `/${REPORT}`, content: REPORT_BODY } }],
+            usage: { inputTokens: 1_300, outputTokens: 60 },
+          },
+          { text: "Now summarising", ends: { kind: "fail", error: new Error(PROVIDER_FAULT) } },
+        ],
+      }),
+    });
+
+    // The artifact's upload waits on `held`; the first of "the turn drains"
+    // and "the activity returned" releases it (the header's deterministic
+    // order). Capture mode's own blobs share the store and are never held:
+    // the runtime writes them after the adapter returns.
+    const artifactKey = `artifacts/${FIXTURE.executionId}/${REPORT}`;
+    let release = (): void => undefined;
+    const held = new Promise<void>((resolve) => {
+      release = resolve;
+    });
+    const upload = LocalArtifactStorage.prototype.upload;
+    const uploads = vi.spyOn(LocalArtifactStorage.prototype, "upload").mockImplementation(async function (
+      this: LocalArtifactStorage,
+      ...args: Parameters<LocalArtifactStorage["upload"]>
+    ) {
+      if (args[0] === artifactKey) await held;
+      return upload.apply(this, args);
+    });
+    const drain = StreamingSideEffects.prototype.drainPublishes;
+    const drains = vi.spyOn(StreamingSideEffects.prototype, "drainPublishes").mockImplementation(async function (
+      this: StreamingSideEffects,
+    ) {
+      release();
+      return drain.apply(this);
+    });
+
+    // ── Act ──────────────────────────────────────────────────────────────────
+    const invocation = await runDeepAgentTurn(scenario);
+    release();
+
+    // ── Assert: the turn failed, deferred behind the review, and returned ────
+    expect(invocation.outcome.kind, "a provider failure RETURNS the status").toBe("returned");
+    const final = record.lastFullStatus!;
+    expect(final.phase, "the edit reaches review before the failure settles").toBe(
+      ExecutionPhase.EXECUTION_WAITING_FOR_APPROVAL,
+    );
+    expect(final.error, "a deferred terminal writes no error yet").toBe("");
+    expect(systemMessages(final), "the failure's rows ride the review").toEqual([
+      TERMINAL_COPY.internalFailure.row,
+      `Error details: [Error] ${PROVIDER_FAULT}`,
+    ]);
+
+    // ── Assert: the artifact reached the terminal status ─────────────────────
+    expect(
+      uploads.mock.calls.map(([key]) => key).filter((key) => key === artifactKey),
+      "the write was published inline, once",
+    ).toHaveLength(1);
+    expect(final.artifacts.map((a) => [a.name, a.storageKey])).toEqual([[REPORT, artifactKey]]);
+    expect(drains, "the thrown turn drained its publishes").toHaveBeenCalled();
+    expect(existsSync(join(env.artifactPath, final.artifacts[0].storageKey)), "the bytes reached the store").toBe(true);
+
+    // ── Assert: hermeticity ──────────────────────────────────────────────────
+    expect(registry.urls.every((u) => u.includes("/model-registry"))).toBe(true);
+  });
+});

package/src/activities/execute-deep-agent/__tests__/inline-publisher.test.ts

@@ -6,6 +6,7 @@ import { tmpdir } from "node:os";
 import { create } from "@bufbuild/protobuf";
 import { type AgentExecutionStatus, AgentExecutionStatusSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
 import { ExecutionArtifactKind } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { ExecutionArtifactSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/artifact_pb";
 import { InlinePublisher } from "../inline-publisher.js";
 import { TranscriptBuilder } from "../../../harness/transcript/builder.js";
 import { LocalWorkspaceBackend } from "../../../shared/workspace/local-backend.js";
@@ -71,6 +72,7 @@ describe("InlinePublisher", () => {
       workspaceBackend: backend,
       artifactStorage: storage,
       artifacts: sb,
+      record: status,
       executionId: "exec-123",
     });
   });
@@ -97,6 +99,25 @@ describe("InlinePublisher", () => {
     expect(status.artifacts[0].sandboxPath).toBe("src/main.ts");
   });
 
+  it("stamps createdAt when the publish is asked for, never when the upload returns", async () => {
+    // The stream asks for the publish as it folds the write's finish, and the
+    // upload runs on beside the stream; a slow store must not move the stamp.
+    vi.useFakeTimers({ toFake: ["Date"], now: Date.UTC(2026, 0, 1) });
+    try {
+      const askedAt = new Date().toISOString();
+      vi.mocked(storage.upload).mockImplementationOnce(async (key: string) => {
+        vi.setSystemTime(Date.now() + 5_000);
+        return key;
+      });
+
+      await publisher.publish("src/main.ts");
+
+      expect(status.artifacts[0].createdAt).toBe(askedAt);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
   it("deduplicates by path + content hash", async () => {
     await publisher.publish("src/main.ts");
     await publisher.publish("src/main.ts");
@@ -124,6 +145,64 @@ describe("InlinePublisher", () => {
     expect(publisher.publishedPaths.has("src/main.ts")).toBe(true);
   });
 
+  // A reinvocation seeds the earlier turns' rows onto the status before the
+  // turn's publisher exists; the safety net then asks for those paths again.
+  describe("against rows the status already lists (stigmer/stigmer#1448)", () => {
+    function seedRow(sandboxPath: string, content: string): void {
+      status.artifacts.push(create(ExecutionArtifactSchema, {
+        name: sandboxPath.split("/").at(-1) ?? sandboxPath,
+        sandboxPath,
+        kind: ExecutionArtifactKind.FILE,
+        storageKey: `artifacts/exec-123/${sandboxPath.split("/").at(-1)}`,
+        contentHash: sha256(content),
+      }));
+    }
+
+    it("uploads nothing for a file whose bytes the status already lists, and counts it as brought up to date", async () => {
+      seedRow("src/main.ts", "console.log('hello');");
+      const seeded = status.artifacts[0];
+
+      await publisher.publish("src/main.ts");
+
+      expect(storage.uploadedKeys, "the unchanged file is not sent again").toEqual([]);
+      expect(status.artifacts, "the seeded row is kept as it was").toEqual([seeded]);
+      expect(publisher.publishedPaths.has("src/main.ts")).toBe(true);
+    });
+
+    it("uploads and replaces the row when the file changed since the status listed it", async () => {
+      seedRow("src/main.ts", "an earlier turn's bytes");
+
+      await publisher.publish("src/main.ts");
+
+      expect(storage.uploadedKeys).toEqual(["artifacts/exec-123/main.ts"]);
+      expect(status.artifacts).toHaveLength(1);
+      expect(status.artifacts[0].contentHash).toBe(sha256("console.log('hello');"));
+    });
+
+    it("still reads the file, so a rewrite made outside a write tool is caught", async () => {
+      seedRow("src/main.ts", "console.log('hello');");
+
+      await publisher.publish("src/main.ts");
+
+      expect(backend.readFile).toHaveBeenCalledWith("src/main.ts");
+    });
+
+    it("leaves an earlier turn's path out of publishedPaths until this turn checks it", () => {
+      seedRow("src/main.ts", "console.log('hello');");
+
+      expect(publisher.publishedPaths.size).toBe(0);
+    });
+
+    it("uploads a file the status lists under another path", async () => {
+      seedRow("docs/main.ts", "console.log('hello');");
+
+      await publisher.publish("src/main.ts");
+
+      expect(storage.uploadedKeys).toEqual(["artifacts/exec-123/main.ts"]);
+      expect(status.artifacts.map((a) => a.sandboxPath)).toEqual(["docs/main.ts", "src/main.ts"]);
+    });
+  });
+
   it("swallows errors without throwing (fire-and-forget)", async () => {
     const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
     const failBackend = mockWorkspaceBackend({});
@@ -132,6 +211,7 @@ describe("InlinePublisher", () => {
       workspaceBackend: failBackend,
       artifactStorage: storage,
       artifacts: sb,
+      record: status,
       executionId: "exec-err",
     });
 
@@ -176,6 +256,7 @@ describe("InlinePublisher", () => {
       workspaceBackend: secretBackend,
       artifactStorage: storage,
       artifacts: sb,
+      record: status,
       executionId: "exec-secret",
     });
 
@@ -193,6 +274,7 @@ describe("InlinePublisher", () => {
       workspaceBackend: jsonBackend,
       artifactStorage: storage,
       artifacts: sb,
+      record: status,
       executionId: "exec-ct",
     });
 
@@ -221,6 +303,7 @@ describe("InlinePublisher with LocalWorkspaceBackend (disk-backed)", () => {
       workspaceBackend: backend,
       artifactStorage: storage,
       artifacts: sb,
+      record: status,
       executionId: "exec-disk",
     });
 
@@ -250,6 +333,7 @@ describe("InlinePublisher with LocalWorkspaceBackend (disk-backed)", () => {
       workspaceBackend: backend,
       artifactStorage: storage,
       artifacts: sb,
+      record: status,
       executionId: "exec-miss",
     });
 

package/src/activities/execute-deep-agent/__tests__/platform-route.test.ts

@@ -3,16 +3,20 @@
 // builds (`createCasCaptureBackend` + `mountPlatformRoute`, parent and
 // sub-agents alike). The stock virtual-rooted backend refuses to follow the
 // workspace link out of the root; the route mounts the platform dir instead,
-// read-only, on the turns the link exists. What is pinned:
+// read-only, on the turns the link exists, and an empty route on every other
+// turn. What is pinned:
 //  - the stock backend's refusal (why the route exists);
 //  - reads, listings and search through the route, for the shell-capable and
 //    the plan-mode backend, with `execute` kept exactly where it was;
 //  - every mutation through the route refused, and a root delete refused
 //    before it touches the workspace or the platform dir;
-//  - no route on a turn without the link.
+//  - on a turn without the link, `.stigmer/` still the platform's: nothing
+//    readable, every write refused and nothing created in the workspace (the
+//    write that used to make a real directory there, #1123), and the root
+//    listing without it.
 
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
-import { mkdtemp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { lstat, mkdtemp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { FilesystemBackend, isSandboxBackend } from "deepagents";
@@ -120,23 +124,56 @@ describe("platform route", () => {
     });
   });
 
-  it("mounts nothing on a turn without the link", async () => {
-    const workspace = await createCasCaptureBackend({ rootDir: workspaceDir, observer: observer(), shellEnv: {} });
-    expect(await mountPlatformRoute(workspace, { workspaceDir, platformDir })).toBe(workspace);
-    expect(await mountPlatformRoute(workspace, { workspaceDir, platformDir: undefined })).toBe(workspace);
+  describe.each(["shell", "plan"] as const)("the %s backend on a turn without the link", (mode) => {
+    it("refuses every write under .stigmer/ and creates nothing in the workspace", async () => {
+      const backend = v2(await productionBackend(mode));
+      expect(backend).toBeInstanceOf(PlatformRoutedBackend);
+      expect((await backend.write(`${PLATFORM_ROUTE_PREFIX}notes/draft.md`, "x")).error).toMatch(/read-only/);
+      expect((await backend.edit(`/${SKILL}`, "My Skill", "Your Skill")).error).toMatch(/read-only/);
+      const uploads = (await backend.uploadFiles!([[`${PLATFORM_ROUTE_PREFIX}up.bin`, new Uint8Array([1])]])) ?? [];
+      expect(uploads.map((u) => u.error)).toEqual(["permission_denied"]);
+      await expect(lstat(join(workspaceDir, ".stigmer")), "no real directory in the user's tree").rejects.toMatchObject({
+        code: "ENOENT",
+      });
+    });
+
+    it("exposes nothing of the platform dir, which still holds earlier turns' content", async () => {
+      const backend = v2(await productionBackend(mode));
+      expect((await backend.read(`/${SKILL}`)).error).toMatch(/no platform content/);
+      expect((await backend.ls(PLATFORM_ROUTE_PREFIX)).error).toMatch(/no platform content/);
+      const found = (await backend.glob("**/SKILL.md", "/")).files ?? [];
+      expect(found).toEqual([]);
+    });
+
+    it("lists the workspace at the root without .stigmer/", async () => {
+      const backend = v2(await productionBackend(mode));
+      const root = ((await backend.ls("/")).files ?? []).map((f) => f.path);
+      expect(root).toContain("/main.go");
+      expect(root).not.toContain(PLATFORM_ROUTE_PREFIX);
+    });
+
+    it("keeps `execute` exactly where the workspace backend had it", async () => {
+      const backend = await productionBackend(mode);
+      expect(isSandboxBackend(backend)).toBe(mode === "shell");
+    });
   });
 
-  it("mounts nothing when the link points somewhere else", async () => {
+  it("exposes nothing when the link points somewhere else", async () => {
     const other = await mkdtemp(join(tmpdir(), "platform-route-other-"));
     try {
       await ensureStigmerSymlink(workspaceDir, other);
-      const workspace = await createCasCaptureBackend({ rootDir: workspaceDir, observer: observer() });
-      expect(await mountPlatformRoute(workspace, { workspaceDir, platformDir })).toBe(workspace);
+      const backend = v2(await productionBackend("plan"));
+      expect((await backend.read(`/${SKILL}`)).error).toMatch(/no platform content/);
     } finally {
       await rm(other, { recursive: true, force: true });
     }
   });
 
+  it("mounts nothing for a session without a platform dir", async () => {
+    const workspace = await createCasCaptureBackend({ rootDir: workspaceDir, observer: observer(), shellEnv: {} });
+    expect(await mountPlatformRoute(workspace, { workspaceDir, platformDir: undefined })).toBe(workspace);
+  });
+
   it("a workspace entry of its own is untouched by the route", async () => {
     await mkdir(join(workspaceDir, "src"));
     await writeFile(join(workspaceDir, "src/a.ts"), "export {};\n");

package/src/activities/execute-deep-agent/__tests__/streaming-side-effects.test.ts

@@ -76,6 +76,40 @@ describe("StreamingSideEffects", () => {
     expect(publish).not.toHaveBeenCalled();
   });
 
+  it("drainPublishes waits for every publish fired so far, and a second drain returns at once", async () => {
+    resetSeq();
+    const landed: string[] = [];
+    const releases: Array<() => void> = [];
+    const publish = vi.fn(
+      (path: string) =>
+        new Promise<void>((resolve) => {
+          releases.push(() => {
+            landed.push(path);
+            resolve();
+          });
+        }),
+    );
+    const effects = new StreamingSideEffects({ inlinePublisher: { publish } as unknown as InlinePublisher });
+    feed(effects, makeToolStarted("toolu_7", "write_file", { file_path: "/ws/a.ts", content: "a" }));
+    feed(effects, makeToolFinished("toolu_7", "ok"));
+    feed(effects, makeToolStarted("toolu_8", "write_file", { file_path: "/ws/b.ts", content: "b" }));
+    feed(effects, makeToolFinished("toolu_8", "ok"));
+
+    let drained = false;
+    const drain = effects.drainPublishes().then(() => {
+      drained = true;
+    });
+    releases[0]();
+    await Promise.resolve();
+    expect(drained, "one publish still in flight holds the drain").toBe(false);
+    releases[1]();
+    await drain;
+    expect(landed).toEqual(["/ws/a.ts", "/ws/b.ts"]);
+
+    await effects.drainPublishes();
+    expect(publish, "a second drain fires nothing new").toHaveBeenCalledTimes(2);
+  });
+
   it("does nothing at all without a publisher", () => {
     resetSeq();
     const effects = new StreamingSideEffects({});

package/src/activities/execute-deep-agent/__tests__/turn-stream.test.ts

@@ -45,7 +45,7 @@ import type { WorkspaceBackend } from "../../../shared/workspace/types.js";
 import type { ModelPricing } from "../../../shared/model-pricing.js";
 import { CasCaptureObserver } from "../cas-capture-observer.js";
 import type { DeepAgentEngine, DeepAgentGateState, DeepAgentGraphInput, DeepAgentWorkspace } from "../turn-setup.js";
-import { consumeDeepAgentStream, createDeepAgentTranscript, type StreamableRun } from "../turn-stream.js";
+import { consumeDeepAgentStream, createDeepAgentTranscript, type DeepAgentTranscript, type StreamableRun } from "../turn-stream.js";
 import type { V3ProtocolEvent } from "../v3-event-recorder.js";
 import {
   makeMessageFinish,
@@ -129,6 +129,8 @@ interface Harness {
   readonly engine: DeepAgentEngine;
   readonly streamEvents: ReturnType<typeof vi.fn>;
   readonly blobs: Map<string, Buffer>;
+  /** The transcript the last `run` streamed into; its side effects hold the turn's publishes. */
+  readonly transcript: () => DeepAgentTranscript;
   run(run: StreamableRun): ReturnType<typeof consumeDeepAgentStream>;
 }
 
@@ -150,14 +152,19 @@ function harness(options: { gate?: DeepAgentGateState; files?: Record<string, st
   };
   const workspace = workspaceOver(options.files ?? {});
   const graphInput: DeepAgentGraphInput = { kind: "message", input: { messages: [{ role: "user", content: "Say hello." }] } };
+  let transcript: DeepAgentTranscript | undefined;
   return {
     sink,
     engine,
     streamEvents,
     blobs,
+    transcript: () => {
+      if (transcript === undefined) throw new Error("harness: no run yet");
+      return transcript;
+    },
     run(run) {
       streamEvents.mockResolvedValue(run);
-      const transcript = createDeepAgentTranscript(input, sink, engine, workspace);
+      transcript = createDeepAgentTranscript(input, sink, engine, workspace);
       return consumeDeepAgentStream({ input, sink, engine, graphInput, transcript });
     },
   };
@@ -245,7 +252,7 @@ describe("consumeDeepAgentStream — what each event becomes", () => {
 
   it("publishes a file-modifying tool's target as an artifact on the status when the call finishes", async () => {
     const h = harness({ files: { "src/main.ts": "console.log('hi');" } });
-    const result = await h.run(
+    await h.run(
       scriptedRun([
         ...textTurn("run-1", "Writing."),
         makeToolStarted("toolu_w", "write_file", { file_path: "src/main.ts", content: "console.log('hi');" }),
@@ -253,8 +260,9 @@ describe("consumeDeepAgentStream — what each event becomes", () => {
       ]),
     );
 
-    expect(result.pendingPublishPromises, "one publish fired mid-turn, for the settle to drain").toHaveLength(1);
-    await Promise.all(result.pendingPublishPromises);
+    const { sideEffects } = h.transcript();
+    expect(sideEffects.pendingPublishPromises, "one publish fired mid-turn, held by the transcript for the drain").toHaveLength(1);
+    await sideEffects.drainPublishes();
     expect(h.sink.status.artifacts.map((a) => a.sandboxPath)).toEqual(["src/main.ts"]);
     expect([...h.blobs.keys()], "the bytes were uploaded under the execution's artifact key").toEqual(["artifacts/aex_fixture_0001/main.ts"]);
   });

package/src/activities/execute-deep-agent/inline-publisher.ts

@@ -8,6 +8,15 @@
  * Designed as a fire-and-forget callback: exceptions are logged and
  * swallowed so the streaming loop is never interrupted.
  *
+ * A file is uploaded only when its bytes differ from the row the execution's
+ * status already lists for its path. The status is the one home of that fact:
+ * the builder writes every row into it, and a reinvocation's seed carries the
+ * earlier turns' rows onto it before this publisher exists. So a completed
+ * turn after a gate, whose safety net walks the seeded history again, re-reads
+ * each earlier file but uploads none that did not change (stigmer/stigmer#1448).
+ * The re-read is kept on purpose: a shell command may have rewritten an earlier
+ * turn's file, and only its bytes can say so.
+ *
  * DD-7: No skill-aware directory publishing. Individual files only.
  */
 
@@ -35,6 +44,16 @@ export interface ArtifactSink {
   addArtifact(artifact: ExecutionArtifact): void;
 }
 
+/**
+ * The execution status's artifact rows, read at every publish: the status the
+ * {@link ArtifactSink} builds into (`TurnSink.status` in production), so a row
+ * registered here or seeded by a reinvocation is visible on the next check.
+ * Read, never copied, because the builder keeps writing it.
+ */
+export interface ArtifactRecord {
+  readonly artifacts: readonly ExecutionArtifact[];
+}
+
 export class InlinePublisher {
   private readonly workspaceBackend: WorkspaceBackend;
   /**
@@ -45,33 +64,46 @@ export class InlinePublisher {
    */
   private readonly artifactStorage: ArtifactStorage | undefined;
   private readonly artifacts: ArtifactSink;
+  private readonly record: ArtifactRecord;
   private readonly executionId: string;
 
-  /** Tracks (sandboxPath -> contentHash) for deduplication. */
-  private readonly published = new Map<string, string>();
+  /**
+   * Paths this publisher brought up to date in this turn, uploaded or found
+   * unchanged, so the post-stream safety net does not read them again. Per
+   * turn by design: an earlier turn's path is absent until this turn checks
+   * it, so a file rewritten outside a write tool is still caught.
+   */
+  private readonly published = new Set<string>();
 
   constructor(opts: {
     workspaceBackend: WorkspaceBackend;
     artifactStorage: ArtifactStorage | undefined;
     artifacts: ArtifactSink;
+    record: ArtifactRecord;
     executionId: string;
   }) {
     this.workspaceBackend = opts.workspaceBackend;
     this.artifactStorage = opts.artifactStorage;
     this.artifacts = opts.artifacts;
+    this.record = opts.record;
     this.executionId = opts.executionId;
   }
 
-  /** Set of sandbox paths that have been published (for auto-publish dedup). */
+  /** Set of sandbox paths brought up to date this turn (for auto-publish dedup). */
   get publishedPaths(): ReadonlySet<string> {
-    return new Set(this.published.keys());
+    return new Set(this.published);
   }
 
   /**
    * Upload the file at `path` to artifact storage and register it on the
    * status builder. Fire-and-forget: errors are logged and swallowed.
+   *
+   * The artifact's `createdAt` is read here, before the first await: the
+   * stream asks for the publish in the step that folds the write's finish, so
+   * the stamp is the write's, never the moment a slow upload returned.
    */
   async publish(path: string): Promise<void> {
+    const createdAt = utcTimestamp();
     // No artifact store (proxy misconfig): nothing to upload to. Skip silently —
     // this is a best-effort UI publisher and the operator was warned at setup.
     if (!this.artifactStorage) return;
@@ -97,7 +129,8 @@ export class InlinePublisher {
       const contentBuffer = Buffer.from(content, "utf-8");
       const contentHash = sha256(contentBuffer);
 
-      if (this.published.get(sandboxPath) === contentHash) {
+      if (this.isRecorded(sandboxPath, contentHash)) {
+        this.published.add(sandboxPath);
         return;
       }
 
@@ -112,12 +145,12 @@ export class InlinePublisher {
         kind: ExecutionArtifactKind.FILE,
         sizeBytes: BigInt(contentBuffer.length),
         storageKey,
-        createdAt: utcTimestamp(),
+        createdAt,
         contentHash,
       });
 
       this.artifacts.addArtifact(artifact);
-      this.published.set(sandboxPath, contentHash);
+      this.published.add(sandboxPath);
 
       console.log(
         `[InlinePublisher] execution=${this.executionId} — published '${sandboxPath}' ` +
@@ -130,6 +163,13 @@ export class InlinePublisher {
       );
     }
   }
+
+  /** Whether the status already lists these exact bytes at this path. */
+  private isRecorded(sandboxPath: string, contentHash: string): boolean {
+    return this.record.artifacts.some(
+      (a) => a.sandboxPath === sandboxPath && a.contentHash === contentHash,
+    );
+  }
 }
 
 function normalizePath(path: string): string {