@superjackfruitlabs/salaam 0.0.3 → 0.0.4

package/dist/src/service.js

@@ -1,5 +1,6 @@
 import { createServer } from 'node:http';
-import { mkdirSync, chmodSync, existsSync, unlinkSync, realpathSync, statSync } from 'node:fs';
+import { loadPersona } from './persona.js';
+import { mkdirSync, chmodSync, chownSync, existsSync, unlinkSync, realpathSync, statSync, } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { providerRoute } from './provider-config.js';
 import { TaskContext } from './task-context.js';
@@ -8,6 +9,8 @@ import { SLASH_COMMANDS } from './tui-commands.js';
 import { TaskWork } from './task-work.js';
 import { TaskBudget } from './task-budget.js';
 import { AgentPodWorkDecisions } from './agentpod-work-decisions.js';
+import { RunGrants } from './run-grants.js';
+import { TaskCritic } from './task-critic.js';
 import { AgentPodWork } from './agentpod-work.js';
 import { agentpodWorkAdmission } from './agentpod-work-protocol.js';
 import { TaskVerification } from './task-verification.js';
@@ -39,6 +42,7 @@ import { DockerHarnessBackend } from './harness-backend.js';
 import { A2AInbound } from './a2a-inbound.js';
 import { AgentPodAuthority, readAgentPodPins } from './agentpod-authority.js';
 import { ToolkitResources } from './toolkit-resources.js';
+import { OperatorMcp } from './operator-mcp.js';
 import { cancelToolkitCalls, recoverToolkitCalls } from './toolkit-calls.js';
 import { ToolkitOwners } from './toolkit-owners.js';
 import { ToolkitResolutions, resolvedToolkitCallSql } from './toolkit-resolutions.js';
@@ -49,13 +53,16 @@ import { McpAdmission } from './mcp-admission.js';
 import { McpWork } from './mcp-work.js';
 import { ToolkitWork } from './toolkit-work.js';
 import { permissionPolicy, configurePermissions } from './autonomy.js';
+import { chooseLocalSandbox } from './command-sandbox.js';
 import { LocalCoding } from './local-coding.js';
 import { localDiff } from './local-diff.js';
 import { reviewUndo, applyUndo, reconcileUndo } from './local-undo.js';
 import { forkPiSession } from './pi-sessions.js';
 import { StationWork } from './station-work.js';
 import { readToolkitConfig } from './toolkit-config.js';
+import { probeToolsUser, serviceToolIdentity } from './tool-identity.js';
 export class SalaamService {
+    operatorMcpPath;
     agentpod;
     agentpodWork;
     toolkitResources;
@@ -92,6 +99,7 @@ export class SalaamService {
     workspaces;
     coding;
     localCoding;
+    toolIdentity;
     codingSocket;
     closed;
     resolveClosed;
@@ -104,12 +112,18 @@ export class SalaamService {
     revocationStops = new Set();
     authorityTimer;
     hostManifestDigest;
+    hostReceipt;
+    operatorAccess;
     agentpodWorkProgression;
     constructor(options) {
         this.agentpodWorkProgression = options.agentpodWorkProgression === true;
         if (this.agentpodWorkProgression && (!options.stationConfig || !options.agentpodConfig))
             throw Error('Strict work requires reviewed AgentPod protected station configuration');
         this.hostManifestDigest = options.hostManifestDigest ?? null;
+        this.hostReceipt = options.hostManifestDigest ? (options.hostReceipt ?? null) : null;
+        if (options.operatorAccess && !this.agentpodWorkProgression)
+            throw Error('Operator group access is only for the strict work launcher profile');
+        this.operatorAccess = options.operatorAccess ?? null;
         if (process.platform === 'win32')
             throw new Error('Windows transport is not implemented');
         this.stateDir = resolve(options.stateDir);
@@ -134,6 +148,9 @@ export class SalaamService {
         this.codingSocket = options.codingSocket ? resolve(options.codingSocket) : null;
         mkdirSync(this.stateDir, { recursive: true, mode: 0o700 });
         this.stateDir = realpathSync(this.stateDir);
+        this.toolIdentity = options.toolsUser
+            ? probeToolsUser(options.toolsUser, this.stateDir, options.toolsLauncher)
+            : serviceToolIdentity();
         const mcpAdmission = options.managedMcp
             ? new McpAdmission(options.managedMcp.config, readAgentPodPins(resolve(options.agentpodConfig), this.stateDir), options.managedMcp.profile_digest)
             : undefined;
@@ -144,6 +161,11 @@ export class SalaamService {
         this.release = acquireStateLock(this.stateDir);
         try {
             this.store = new Store(join(this.stateDir, 'journal.sqlite'));
+            this.store.toolExecution = {
+                mode: this.toolIdentity.mode,
+                user: this.toolIdentity.user,
+                uid: this.toolIdentity.uid,
+            };
             try {
                 this.artifacts = new Artifacts(join(this.stateDir, 'artifacts'), this.store);
                 this.tasks = new TaskContext(this.store, this.artifacts);
@@ -183,6 +205,16 @@ export class SalaamService {
                     ]);
                 this.coding = new CodingWork(this.store, this.workspaces, this.artifacts, executor, (id, error) => this.supervisor.failControl(id, error));
                 this.taskVerification = new TaskVerification(this.store, this.taskWork, this.taskBudget, this.workspaces, this.coding, this.artifacts);
+                // Item 8: the completion critic. Its reviewer grant is the narrow built-in one, admitted
+                // only while the task's admitted plan still declares a critic.
+                this.taskVerification.critic = new TaskCritic(this.store, this.artifacts, {
+                    admit: (task, request) => this.agents.admitCritic(task.session_id, request, () => {
+                        if (!this.taskWork.get(task.id).completion_gate?.critic)
+                            throw new ServiceError('authority_denied', 'The admitted plan declares no critic');
+                    }),
+                    spawn: (task, parentAttempt, step, prompt, budget, grant, snapshot) => this.children.spawnCritic(task.session_id, parentAttempt, step, prompt, budget, grant, snapshot),
+                    workerId: (childId) => this.store.workerBoundary.view(childId).binding.worker_id,
+                });
                 this.taskCheckpoints = new TaskCheckpoints(this.store, this.taskWork, this.taskVerification, this.workspaces, this.artifacts);
                 this.supervisor = new Supervisor(this.store, {
                     ...options,
@@ -191,6 +223,16 @@ export class SalaamService {
                     effectsEnabled: !!options.effectConnector,
                 });
                 this.supervisor.tasks = this.tasks;
+                if (options.personaConfig) {
+                    const persona = loadPersona(options.personaConfig.config);
+                    if (persona.digest !== options.personaConfig.digest)
+                        throw Error('Host persona changed; run host plan again');
+                    this.supervisor.persona = persona;
+                }
+                if (options.operatorMcpConfig) {
+                    this.operatorMcpPath = options.operatorMcpConfig;
+                    this.supervisor.operatorMcp = OperatorMcp.load(options.operatorMcpConfig, options.operatorMcpEnvironment ?? process.env);
+                }
                 this.taskWork.providerCheck = (limits, session) => this.supervisor.assertTaskProviderSupported(limits, session ? this.store.localOutputCap(session) : undefined);
                 this.supervisor.coding = this.coding;
                 this.managed = new ManagedWork(this.store, {
@@ -205,7 +247,14 @@ export class SalaamService {
                         : this.supervisor.failControl(id, error),
                 });
                 this.supervisor.managed = this.managed;
-                this.localCoding = new LocalCoding(this.store, this.managed, (id, epoch, attempt) => this.supervisor.assertActive(id, epoch, attempt));
+                // Item 10: Linux runs local commands under bubblewrap and macOS under Seatbelt when
+                // usable; a host with neither refuses them unless the operator allowed them unsandboxed.
+                const localSandbox = {
+                    ...chooseLocalSandbox(options.localSandbox ?? 'workspace-write'),
+                    allowUnsandboxed: options.unsandboxedCommands === 'allow',
+                    ...(options.commandNetwork ? { network: { socket: options.commandNetwork.socket } } : {}),
+                };
+                this.localCoding = new LocalCoding(this.store, this.managed, (id, epoch, attempt) => this.supervisor.assertActive(id, epoch, attempt), this.toolIdentity, localSandbox);
                 this.supervisor.localCoding = this.localCoding;
                 this.agents = new AgentProfiles(this.store, this.supervisor.route, async (route, session) => {
                     const prepared = await this.supervisor.prepareProviderRoute(route);
@@ -293,6 +342,17 @@ export class SalaamService {
                         failed: (session, error) => this.supervisor.failControl(session, error),
                     });
                     this.supervisor.station = this.station;
+                    // "Approve for this run": one grant store for decisions and the station.
+                    this.station.grants = this.runGrants();
+                    this.station.grantScope = (session) => {
+                        const row = this.store.db
+                            .prepare('SELECT task_id FROM agentpod_work WHERE session_id=?')
+                            .get(session);
+                        if (!row?.task_id)
+                            return null;
+                        const task = this.taskWork.get(row.task_id);
+                        return { task_id: task.id, plan_revision: task.plan_revision, task_state: task.state };
+                    };
                     this.taskVerification.installStation(this.station);
                     this.agentpodWork = new AgentPodWork(this.store, this.agentpod, this.taskWork, this.taskVerification);
                     const cancelOwned = this.store.cancelChildren;
@@ -429,6 +489,7 @@ export class SalaamService {
             }
             await service.listen(service.bridgeServer, service.bridgeSocket);
             await service.listen(service.operator, service.socket);
+            service.shareOperatorSocket();
             service.taskDriver.start();
             service.jobs.start();
             service.recurring.start();
@@ -490,6 +551,17 @@ export class SalaamService {
         }
         await Promise.allSettled(jobs);
     }
+    /** The launcher profile's only widening: group traverse on state and rw on operator.sock.
+     * The bridge socket, journal, keys and every file below state stay owner-only. */
+    shareOperatorSocket() {
+        if (!this.operatorAccess)
+            return;
+        const { gid } = this.operatorAccess;
+        chownSync(this.socket, process.getuid(), gid);
+        chmodSync(this.socket, 0o660);
+        chownSync(this.stateDir, process.getuid(), gid);
+        chmodSync(this.stateDir, 0o710);
+    }
     async listen(server, path) {
         // The exclusive state lock is held before removing a stale socket.
         if (existsSync(path))
@@ -503,6 +575,11 @@ export class SalaamService {
             });
         });
     }
+    grantStore;
+    /** One "Approve for this run" grant store, shared by decisions and the station. */
+    runGrants() {
+        return (this.grantStore ??= new RunGrants(this.store));
+    }
     send(res, status, value) {
         res.writeHead(status, { 'content-type': 'application/json' });
         res.end(JSON.stringify(value));
@@ -602,6 +679,31 @@ export class SalaamService {
                     });
                     return;
                 }
+                // Item 11b: restore a checkpoint's files, exactly as approved, for an ended run.
+                if (parts[2] === 'work-restore') {
+                    if (!this.agentpodWork)
+                        throw new ServiceError('work_disabled', 'Strict work is not enabled');
+                    if (Object.keys(body).sort().join(',') !==
+                        'approved_by,binding,checkpoint_id,request_id,restore_digest')
+                        throw new ServiceError('invalid_work_payload', 'Closed restore request required');
+                    const restoreDigest = string(body.restore_digest, 'restore_digest', 64);
+                    if (!/^[a-f0-9]{64}$/.test(restoreDigest))
+                        throw new ServiceError('invalid_work_payload', 'A restore names its exact digest');
+                    this.send(res, 200, await this.agentpodWork.restore(body.binding, string(body.request_id, 'request_id', 128), string(body.checkpoint_id, 'checkpoint_id', 128), restoreDigest, string(body.approved_by, 'approved_by', 128)));
+                    return;
+                }
+                // Item 11: read-only checkpoints of the bound run and one checkpoint's diff.
+                if (parts[2] === 'work-checkpoints' || parts[2] === 'work-checkpoint-diff') {
+                    if (!this.agentpodWork)
+                        throw new ServiceError('work_disabled', 'Strict work is not enabled');
+                    const keys = parts[2] === 'work-checkpoints' ? 'binding' : 'binding,checkpoint_id';
+                    if (Object.keys(body).sort().join(',') !== keys)
+                        throw new ServiceError('invalid_work_payload', 'Closed checkpoint request required');
+                    this.send(res, 200, parts[2] === 'work-checkpoints'
+                        ? this.agentpodWork.checkpoints(body.binding)
+                        : await this.agentpodWork.checkpointDiff(body.binding, string(body.checkpoint_id, 'checkpoint_id', 128)));
+                    return;
+                }
                 if (parts[2] === 'work-status' || parts[2] === 'work-progress') {
                     if (!this.agentpodWork || !this.agentpodWorkProgression)
                         throw new ServiceError('work_disabled', 'Strict progression is not enabled');
@@ -690,13 +792,21 @@ export class SalaamService {
                     this.send(res, 200, await this.agentpodWork.completion(body.binding));
                     return;
                 }
+                if (parts[2] === 'work-read') {
+                    if (!this.agentpodWork)
+                        throw new ServiceError('work_disabled', 'Strict progression is not enabled');
+                    if (Object.keys(body).sort().join(',') !== 'answer,binding')
+                        throw new ServiceError('invalid_board_read', 'Closed board read answer required');
+                    this.send(res, 200, this.agentpodWork.answerBoardRead(body.binding, body.answer));
+                    return;
+                }
                 if (parts[2] === 'work-decisions' || parts[2] === 'work-decision') {
                     if (!this.agentpodWork)
                         throw new ServiceError('verification_unavailable', 'Reviewed protected station backend required');
                     const answering = parts[2] === 'work-decision';
                     if (Object.keys(body).sort().join(',') !== (answering ? 'answer,binding' : 'binding'))
                         throw new ServiceError('invalid_work_decision', 'Closed decision payload required');
-                    const decisions = new AgentPodWorkDecisions(this.agentpodWork, this.managed);
+                    const decisions = new AgentPodWorkDecisions(this.agentpodWork, this.managed, this.runGrants());
                     this.send(res, 200, answering ? decisions.answer(body.binding, body.answer) : decisions.list(body.binding));
                     return;
                 }
@@ -747,11 +857,13 @@ export class SalaamService {
                 }
                 const request = string(body.request_id, 'request_id', 128);
                 if (parts[2] === 'admit') {
-                    this.send(res, 200, this.agentpod.admit(body.binding, request));
+                    this.send(res, 200, this.agentpod.admit(body.binding, request, body.continue_from === undefined
+                        ? undefined
+                        : string(body.continue_from, 'continue_from', 128), body.approval_rules));
                     return;
                 }
                 if (parts[2] === 'renew') {
-                    this.send(res, 200, this.agentpod.renew(body.binding, request, integer(body.lease_sequence, 'lease_sequence')));
+                    this.send(res, 200, this.agentpod.renew(body.binding, request, integer(body.lease_sequence, 'lease_sequence'), body.approval_rules));
                     return;
                 }
                 if (parts[2] === 'revoke') {
@@ -1070,11 +1182,22 @@ export class SalaamService {
                     pid: process.pid,
                     host_manifest_digest: this.hostManifestDigest,
                     host_supervisor_connected: this.hostManifestDigest ? process.connected === true : null,
+                    host_receipt: this.hostReceipt,
                     runtime_node: realpathSync(process.execPath),
                     service_version: VERSION,
                     context_admission: { version: 1, automatic_discovery: false, child_inheritance: false },
                     agentpod_config: this.agentpod?.configPath ?? null,
                     agentpod_pins_digest: this.agentpod ? digest(this.agentpod.pins) : null,
+                    persona: this.supervisor.persona
+                        ? { digest: this.supervisor.persona.digest, text: this.supervisor.persona.text }
+                        : null,
+                    operator_mcp: this.operatorMcpPath
+                        ? {
+                            config: this.operatorMcpPath,
+                            digest: this.supervisor.operatorMcp.digest,
+                            servers: this.supervisor.operatorMcp.provenance(),
+                        }
+                        : null,
                     managed_mcp: this.mcp
                         ? { profile_digest: this.mcp.options.admission.profileDigest }
                         : null,
@@ -1086,6 +1209,12 @@ export class SalaamService {
                         ? { configuration_digest: this.station.configurationDigest }
                         : null,
                     service: 'healthy',
+                    tool_execution: {
+                        mode: this.toolIdentity.mode,
+                        user: this.toolIdentity.user,
+                        uid: this.toolIdentity.uid,
+                        warning: this.toolIdentity.warning,
+                    },
                     a2a: {
                         inbound_enabled: !!this.a2aInbound,
                         listener: this.a2aInbound?.server.address() ?? null,
@@ -1143,9 +1272,11 @@ export class SalaamService {
                             backend: this.coding.executor?.evidence ?? null,
                         }
                         : EXECUTION_STATUS,
+                    last_activity_at: new Date(this.store.lastActivityAny()).toISOString(),
                     sessions: sessions.map((x) => ({
                         id: x.id,
                         state: x.state,
+                        last_activity_at: iso(this.store.lastActivity(x.id)),
                         error: x.error,
                         capabilities: x.capabilities,
                         pending_approvals: this.store
@@ -1315,7 +1446,7 @@ export class SalaamService {
                                 .prepare("SELECT 1 FROM attempts WHERE session_id=? AND state IN ('accepted','dispatching','running')")
                                 .get(id))
                                 throw new ServiceError('session_busy', 'Wait for queued work before undo');
-                        }));
+                        }, this.toolIdentity));
                         return;
                     }
                 }
@@ -1886,6 +2017,7 @@ export class SalaamService {
         await attempt(() => this.toolkitResolutions.close());
         await attempt(() => this.children.close());
         await attempt(() => this.supervisor.close());
+        await attempt(() => this.supervisor.operatorMcp?.close());
         await attempt(() => this.dispatcher.drain());
         await attempt(() => this.managed.close());
         await attempt(() => Promise.all([this.operator, this.bridgeServer].map((server) => new Promise((resolve, reject) => {
@@ -1909,3 +2041,6 @@ export class SalaamService {
             throw this.shutdownFailure;
     }
 }
+function iso(ms) {
+    return ms === null ? null : new Date(ms).toISOString();
+}

package/dist/src/station-checkpoints.js

@@ -0,0 +1,139 @@
+import { digest, ServiceError } from './protocol.js';
+export class StationCheckpoints {
+    store;
+    constructor(store) {
+        this.store = store;
+    }
+    patches(session) {
+        return this.store.db
+            .prepare("SELECT rowid,args_json,result_json,attempt_id FROM station_calls WHERE session_id=? AND kind='patch' AND state='returned' ORDER BY rowid")
+            .all(session)
+            .map((r) => {
+            const args = JSON.parse(String(r.args_json)), result = JSON.parse(String(r.result_json));
+            return {
+                rowid: Number(r.rowid),
+                path: String(args.path),
+                content: typeof args.content === 'string' ? args.content : null,
+                expected_hash: typeof args.expected_hash === 'string' ? args.expected_hash : null,
+                before_tree: String(result.before_tree_digest),
+                tree: String(result.tree_digest),
+                sha256: typeof result.sha256 === 'string' ? result.sha256 : null,
+                attempt: String(r.attempt_id),
+            };
+        });
+    }
+    list(task) {
+        const patches = this.patches(task.session_id);
+        const attemptsOf = (step) => new Set(this.store.db
+            .prepare('SELECT attempt_id FROM task_step_attempts WHERE step_id=?')
+            .all(step)
+            .map((r) => String(r.attempt_id)));
+        const out = [];
+        let at = 0, tree = patches[0]?.before_tree ?? '';
+        for (const step of task.steps.filter((s) => s.state === 'completed')) {
+            const mine = patches.filter((p) => attemptsOf(step.id).has(p.attempt));
+            if (mine.length) {
+                at = Math.max(at, ...mine.map((p) => p.rowid));
+                tree = patches.find((p) => p.rowid === at).tree;
+            }
+            out.push({
+                id: digest({ task: task.id, plan_revision: task.plan_revision, step: step.id, at, tree }),
+                step_id: step.id,
+                step_key: step.key,
+                tree_digest: tree,
+                at,
+                files_changed: [...new Set(mine.map((p) => p.path))].sort(),
+            });
+        }
+        return out;
+    }
+    get(task, id) {
+        const found = this.list(task).find((c) => c.id === id);
+        if (!found)
+            throw new ServiceError('not_found', 'No such checkpoint for this task', 404);
+        return found;
+    }
+    /** A path's content at a checkpoint, from the run's own patches only. */
+    fileAt(task, at, path) {
+        const patches = this.patches(task.session_id).filter((p) => p.path === path);
+        const before = patches.filter((p) => p.rowid <= at).at(-1);
+        if (before)
+            return before.content === null
+                ? { state: 'absent' }
+                : { state: 'content', content: before.content };
+        const first = patches.find((p) => p.rowid > at);
+        return first && first.expected_hash === null ? { state: 'absent' } : { state: 'unknown' };
+    }
+    /**
+     * What restoring this checkpoint would do, against the LIVE workspace (never the run's own
+     * receipts alone): every path this run wrote is read as it is now, so a change made outside the
+     * run since (an edit, a deletion, a file put back) shows as what the restore would undo. The
+     * restore digest binds the live tree, so a restore refuses a workspace that moved after review.
+     * Files this run never wrote are left as they are; `drift` says when the tree moved outside it.
+     */
+    async diff(task, id, live) {
+        const checkpoint = this.get(task, id);
+        const patches = this.patches(task.session_id);
+        const recorded = patches.at(-1)?.tree ?? checkpoint.tree_digest;
+        const paths = [...new Set(patches.map((p) => p.path))].sort();
+        const files = [];
+        for (const path of paths) {
+            const now = await live.file(path);
+            const then = this.fileAt(task, checkpoint.at, path);
+            const change = now.state === 'unreadable' || then.state === 'unknown'
+                ? 'not_restorable'
+                : then.state === 'absent'
+                    ? now.state === 'absent'
+                        ? 'unchanged'
+                        : 'delete'
+                    : now.state === 'absent'
+                        ? 'bring_back'
+                        : now.content === then.content
+                            ? 'unchanged'
+                            : 'revert';
+            files.push({
+                path,
+                current: now.state === 'content' ? now.content : null,
+                current_state: now.state,
+                at_checkpoint: then,
+                change,
+                expected_hash: now.state === 'content' ? now.sha256 : null,
+            });
+        }
+        const shown = files.filter((f) => f.change !== 'unchanged');
+        const restore_digest = digest({
+            task: task.id,
+            plan_revision: task.plan_revision,
+            checkpoint: checkpoint.id,
+            checkpoint_tree: checkpoint.tree_digest,
+            recorded_tree: recorded,
+            current_tree: live.tree,
+            files: shown.map((f) => ({
+                path: f.path,
+                change: f.change,
+                target: f.at_checkpoint,
+                expected: f.expected_hash,
+            })),
+        });
+        return {
+            checkpoint,
+            current_tree: live.tree,
+            recorded_tree: recorded,
+            drift: live.tree !== recorded,
+            restore_digest,
+            files: shown.map(({ expected_hash: _, ...f }) => f),
+            writes: shown
+                .filter((f) => ['revert', 'delete', 'bring_back'].includes(f.change))
+                .map((f) => ({
+                path: f.path,
+                content: f.at_checkpoint.state === 'content' ? f.at_checkpoint.content : null,
+                expected_hash: f.expected_hash,
+            })),
+        };
+    }
+    /** Item 11b: exactly what a restore of this checkpoint writes, and the digest that binds it. */
+    async restorePlan(task, id, live) {
+        const { restore_digest, current_tree, writes, checkpoint } = await this.diff(task, id, live);
+        return { restore_digest, current_tree, writes, checkpoint };
+    }
+}

package/dist/src/station-config.js

@@ -106,8 +106,14 @@ export function stationRuntimeFingerprint(root) {
 export function readStationConfig(path, workspace, expected) {
     try {
         const v = object(JSON.parse(stationPrivateFile(path, 16384).toString('utf8')));
-        if (Object.keys(v).sort().join(',') !==
+        const keys = Object.keys(v)
+            .filter((k) => k !== 'tools_user')
+            .sort()
+            .join(',');
+        if (keys !==
             'files,kind,runtime_fingerprint,runtime_image_digest,runtime_root,systemctl,systemd_run,version,workspace,workspace_identity' ||
+            (Object.hasOwn(v, 'tools_user') &&
+                (typeof v.tools_user !== 'string' || !/^[a-z_][a-z0-9_-]{0,31}$/.test(v.tools_user))) ||
             v.version !== 1 ||
             v.kind !== 'linux-systemd-station-v1' ||
             v.workspace !== workspace ||
@@ -129,6 +135,7 @@ export function readStationConfig(path, workspace, expected) {
             runtime_root: v.runtime_root,
             runtime_fingerprint: v.runtime_fingerprint,
             runtime_image_digest: v.runtime_image_digest,
+            ...(Object.hasOwn(v, 'tools_user') ? { tools_user: v.tools_user } : {}),
         };
         if (workspace
             .split(sep)

package/dist/src/station-files.js

@@ -18,8 +18,12 @@ export function stationFileResult(request, value) {
     const fields = keys[String(request.action)];
     if (!fields)
         bad();
+    // A new file's missing parent directories, created beneath the root, are part of its effect.
+    const extra = request.action === 'patch' && 'created_directories' in v ? ['created_directories'] : [];
     if (Object.keys(v).sort().join(',') !==
-        ['version', 'ok', 'tree_digest', 'files', 'root_identity', ...fields].sort().join(',') ||
+        ['version', 'ok', 'tree_digest', 'files', 'root_identity', ...fields, ...extra]
+            .sort()
+            .join(',') ||
         v.version !== 1 ||
         v.ok !== true ||
         v.root_identity !== request.root_identity ||
@@ -39,6 +43,8 @@ export function stationFileResult(request, value) {
             v.sha256 !== stationHash(Buffer.from(v.content)))
             bad();
     }
+    if (extra.length && !createdParents(String(request.path), v.created_directories, request.content))
+        bad();
     if (request.action === 'patch') {
         if (v.path !== request.path ||
             v.before_tree_digest !== request.expected_tree ||
@@ -82,3 +88,16 @@ export function stationFileResult(request, value) {
     }
     return v;
 }
+/** The created directories must be a non-empty, in-order run of the path's own
+ * ancestors ending at its parent: each one beneath the last, nothing else. Only a
+ * new file creates them. */
+function createdParents(path, dirs, content) {
+    if (typeof content !== 'string' || !Array.isArray(dirs) || dirs.length === 0)
+        return false;
+    const parts = path.split('/');
+    if (parts.length < 2 || parts.some((p) => p === '' || p === '.' || p === '..'))
+        return false;
+    const ancestors = parts.slice(0, -1).map((_, i) => parts.slice(0, i + 1).join('/'));
+    const tail = ancestors.slice(ancestors.length - dirs.length);
+    return dirs.length <= ancestors.length && dirs.every((d, i) => d === tail[i]);
+}

package/dist/src/station-task-verification.js

@@ -1,3 +1,4 @@
+import { requiredChecks } from './task-policy.js';
 import { canonical, digest, ServiceError } from './protocol.js';
 /** Protected station backend for the existing task_checks/completion controller.
  * It never changes task success. The controller must await withFresh and commit
@@ -122,7 +123,7 @@ export class StationTaskVerification {
     }
     async dispatchOwned(id) {
         const receipt = this.verification.get(id), task = this.tasks.get(receipt.task_id);
-        const configured = task.acceptance.find((c) => c.key === receipt.check_key);
+        const configured = requiredChecks(task).find((c) => c.key === receipt.check_key);
         if (!configured || configured.cwd !== '.')
             this.fail();
         const binding = this.station.ready(task.session_id);
@@ -212,6 +213,7 @@ export class StationTaskVerification {
             objective: task.objective,
             constraints: task.constraints,
             acceptance: task.acceptance,
+            ...(task.completion_gate ? { completion_gate: task.completion_gate } : {}),
             deliverables: task.deliverables,
             limits: task.limits,
             steps: task.steps.map(({ key, title, instruction, depends_on, checks }) => ({
@@ -247,7 +249,7 @@ export class StationTaskVerification {
         });
     }
     matches(check, task, call) {
-        const configured = task.acceptance.find((c) => c.key === check.check_key);
+        const configured = requiredChecks(task).find((c) => c.key === check.check_key);
         const args = JSON.parse(call.args_json);
         if (check.task_id !== task.id ||
             check.plan_revision !== task.plan_revision ||
@@ -432,7 +434,8 @@ export class StationTaskVerification {
                 result.tree_digest !== tree ||
                 result.root_identity !== this.station.config.workspace_identity)
                 this.fail();
-            deliverables.push({ path, sha256: result.sha256 });
+            // The verified bytes travel with the digest; completion keeps them as an artifact.
+            deliverables.push({ path, sha256: result.sha256, content: result.content });
         }
         const final = await this.observe(evidence[0].call_id, this.tasks.get(prepared[0].bound.task_id).session_id, validate);
         return this.store.transaction(() => {