@tangle-network/agent-runtime 0.337.2 → 0.339.0

package/dist/{prepare-CER-ZkPp.js → prepare-bXkvPMJA.js}

@@ -1,14 +1,1185 @@
-import { A as verifyMaterializedWorkspace, B as omitTopLevelDigest, E as readVerifiedArtifact, F as canonicalCandidateDigest$1, I as canonicalCandidateDocument, L as deepFreezeCandidate, O as verifyBytes, P as canonicalCandidateBytes$1, R as embeddedCandidateArtifact, S as artifactCacheKey, T as readMaterializedWorkspaceFiles, V as sha256Bytes$1, Y as errorMessage, _ as verifyTaskCheckout, b as isWellFormedUnicode, g as verifyCandidateCode, h as readCandidateGitHubResource, j as verifyWorkspaceSnapshotArtifacts, k as verifyMaterializedProfileWorkspace, m as persistCandidateOutputArtifact, v as verifyTaskOutcomePatch, y as assertExactObjectKeys, z as immutableCandidateValue } from "./sandbox-profile-compat-QTkLe1Z6.js";
+import { A as verifyMaterializedWorkspace, B as omitTopLevelDigest, E as readVerifiedArtifact, F as canonicalCandidateDigest$1, I as canonicalCandidateDocument, L as deepFreezeCandidate, O as verifyBytes, P as canonicalCandidateBytes$1, R as embeddedCandidateArtifact, S as artifactCacheKey, T as readMaterializedWorkspaceFiles, U as hasControlCharacter, V as sha256Bytes$1, Z as errorMessage, b as isWellFormedUnicode, d as readCandidateGitHubResource, f as verifyCandidateCode, j as verifyWorkspaceSnapshotArtifacts, k as verifyMaterializedProfileWorkspace, m as verifyTaskOutcomePatch, p as verifyTaskCheckout, v as persistCandidateOutputArtifact, y as assertExactObjectKeys, z as immutableCandidateValue } from "./sandbox-profile-compat-BzVBFqrz.js";
+import { _ as parseAgentCandidateProfileActivation, c as buildLaunch, f as exactProfileExecutorFiles, h as modelRoutes, l as candidateEntrypointReceipt, m as materializeAgentCandidateProfilePlan, n as PI_CANDIDATE_SESSION_DIR_ENV, r as absoluteExecutionCwd, s as assertCandidateProfileExecutionSupport, t as PI_CANDIDATE_AGENT_DIR_ENV, u as candidateProfileAgentPaths, x as requirePublicCandidateConfigValue } from "./profile-Dpei_Sq0.js";
 import { i as redactProtectedValue, n as createProtectedRecordRedactor, r as redactProtectedReason, t as assertNoProtectedBytes } from "./protected-redaction-DFCeo4vg.js";
-import { f as parseAgentCandidateProfileActivation, g as requirePublicCandidateConfigValue, n as PI_CANDIDATE_SESSION_DIR_ENV, o as assertCandidateProfileExecutionSupport, s as candidateProfileAgentPaths, t as PI_CANDIDATE_AGENT_DIR_ENV, u as materializeAgentCandidateProfilePlan } from "./profile-gNUsHNIJ.js";
 import { agentCandidateArtifactRefSchema, agentCandidateBenchmarkResultEvidenceSchema, agentCandidateBenchmarkSuiteSchema, agentCandidateBenchmarkTaskSchema, agentCandidateBundleSchema, agentCandidateContainerSchema, agentCandidateExecutionLimitsSchema, agentCandidateExecutionPlanEvidenceSchema, agentCandidateExecutionPlanMaterialSchema, agentCandidateMaterializationReceiptSchema, agentCandidateModelAccessNetworkSchema, agentCandidateModelSettlementEvidenceSchema, agentCandidateProfilePlanEvidenceSchema, agentCandidateResolvedModelSchema, agentCandidateRunCellSchema, agentCandidateRunReceiptSchema, agentCandidateTaskOutcomeEvidenceSchema, agentCandidateTaskOutcomeSpecSchema, agentCandidateTerminationSchema, agentCandidateWorkspaceManifestMaterialSchema, agentCandidateWorkspaceSnapshotEvidenceSchema, sha256DigestSchema } from "@tangle-network/agent-interface";
 import { REDACTION_VERSION, isLlmSpan } from "@tangle-network/agent-eval";
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { isAbsolute, join, posix, relative, resolve } from "node:path";
 import { lstat, mkdtemp, readFile, readdir, rm } from "node:fs/promises";
 import { applyAgentCandidateWorkspacePlan } from "@tangle-network/agent-profile-materialize";
+import { isDeepStrictEqual } from "node:util";
 import { tmpdir } from "node:os";
 import { hashKnowledgeBase } from "@tangle-network/agent-knowledge";
+//#region src/candidate-execution/execution-roots.ts
+/** Validate the canonical identity and isolation boundary for execution roots. */
+function assertAgentCandidateExecutionRoots(roots) {
+	const entries = [
+		["task", roots.taskRoot],
+		["candidate", roots.candidateRoot],
+		["profile", roots.profileRoot]
+	];
+	for (const [name, root] of entries) {
+		if (root === void 0) continue;
+		if (!posix.isAbsolute(root) || posix.normalize(root) !== root) throw new Error(`execution ${name} root must be a canonical absolute path`);
+	}
+	for (let left = 0; left < entries.length; left++) {
+		const entry = entries[left];
+		if (!entry) continue;
+		const [leftName, leftRoot] = entry;
+		if (leftRoot === void 0) continue;
+		for (let right = left + 1; right < entries.length; right++) {
+			const rightEntry = entries[right];
+			if (!rightEntry) continue;
+			const [rightName, rightRoot] = rightEntry;
+			if (rightRoot !== void 0 && executionPathsOverlap(leftRoot, rightRoot)) throw new Error(`execution ${leftName} and ${rightName} roots must be distinct and non-overlapping`);
+		}
+	}
+}
+function executionPathsOverlap(left, right) {
+	const a = posix.normalize(left);
+	const b = posix.normalize(right);
+	return a === b || b.startsWith(a === "/" ? "/" : `${a}/`) || a.startsWith(b === "/" ? "/" : `${b}/`);
+}
+//#endregion
+//#region src/candidate-execution/types.ts
+const verifiedCandidateBrand = Symbol("verifiedAgentCandidate");
+const preparedCandidateBrand = Symbol("preparedAgentCandidate");
+const verifiedTaskOutcomeBrand = Symbol("verifiedTaskOutcome");
+/** Protected trace tags that bind a run to one prepared candidate execution. */
+const CANDIDATE_TRACE_TAGS = {
+	executionId: "tangle.candidate.execution_id",
+	bundleDigest: "tangle.candidate.bundle_digest",
+	executionPlanDigest: "tangle.candidate.execution_plan_digest",
+	materializationReceiptDigest: "tangle.candidate.materialization_receipt_digest"
+};
+/** Environment keys used to propagate immutable candidate trace identity. */
+const CANDIDATE_TRACE_ENV = {
+	executionId: "TANGLE_CANDIDATE_EXECUTION_ID",
+	bundleDigest: "TANGLE_CANDIDATE_BUNDLE_DIGEST",
+	executionPlanDigest: "TANGLE_CANDIDATE_EXECUTION_PLAN_DIGEST",
+	materializationReceiptDigest: "TANGLE_CANDIDATE_MATERIALIZATION_RECEIPT_DIGEST",
+	traceRunId: "TANGLE_TRACE_RUN_ID"
+};
+//#endregion
+//#region src/candidate-execution/verify.ts
+const verifiedCandidateState = /* @__PURE__ */ new WeakMap();
+/** Surfaces admitted by Runtime's verifier before an environment adapter is selected. */
+const AGENT_CANDIDATE_EXECUTION_SUPPORT = Object.freeze({
+	outcomes: Object.freeze(["workspace", "output"]),
+	code: Object.freeze([
+		"disabled",
+		"no-op",
+		"git-patch"
+	]),
+	memory: Object.freeze(["disabled", "isolated"]),
+	knowledge: true,
+	profile: Object.freeze({
+		mcpTransports: Object.freeze(["stdio"]),
+		remoteMcp: false,
+		tools: false,
+		permissions: false,
+		modes: false,
+		confidential: false
+	})
+});
+/** Verifies every digest, resource, workspace, and Git object in a candidate bundle. */
+async function verifyAgentCandidateBundle(input, ports) {
+	const parsed = agentCandidateBundleSchema.parse(input);
+	const withoutDigest = omitTopLevelDigest(parsed);
+	const actualDigest = canonicalCandidateDigest$1(withoutDigest);
+	if (actualDigest !== parsed.digest) throw new Error(`candidate bundle digest ${parsed.digest} does not match ${actualDigest}`);
+	const canonicalBytes = canonicalCandidateBytes$1(withoutDigest);
+	verifyBytes(canonicalBytes, parsed.digest, canonicalBytes.byteLength, "candidate bundle");
+	assertCandidateProfileExecutionSupport(parsed.profile);
+	const artifactBytes = /* @__PURE__ */ new Map();
+	const readArtifact = async (artifact) => {
+		const key = artifactCacheKey(artifact);
+		const existing = artifactBytes.get(key);
+		if (existing) return Uint8Array.from(existing);
+		const bytes = await readVerifiedArtifact(artifact, ports.artifacts);
+		artifactBytes.set(key, Uint8Array.from(bytes));
+		return bytes;
+	};
+	let patchBytes;
+	if (parsed.code.kind === "git-patch") patchBytes = await readArtifact(parsed.code.patch.artifact);
+	const materializedTree = await verifyCandidateCode(parsed.code, ports.repositories, patchBytes);
+	const resourceBytes = /* @__PURE__ */ new Map();
+	for (const resource of candidateResources(parsed)) {
+		const bytes = resource.kind === "inline" ? Buffer.from(resource.content, "utf8") : await readCandidateGitHubResource(resource, ports.repositories);
+		verifyBytes(bytes, resource.sha256, resource.byteLength, `candidate resource ${resource.name ?? (resource.kind === "github" ? resource.path : "<unnamed>")}`);
+		resourceBytes.set(resourceKey(resource), Uint8Array.from(bytes));
+		resourceBytes.set(resource.sha256, Uint8Array.from(bytes));
+	}
+	if (parsed.execution.workspace) {
+		const workspace = await verifyWorkspaceSnapshotArtifacts(parsed.execution.workspace, ports.artifacts);
+		artifactBytes.set(artifactCacheKey(parsed.execution.workspace.manifest), workspace.manifest);
+		artifactBytes.set(artifactCacheKey(parsed.execution.workspace.archive), workspace.archive);
+	}
+	if (parsed.knowledge) {
+		const knowledge = await verifyWorkspaceSnapshotArtifacts(parsed.knowledge.snapshot, ports.artifacts);
+		artifactBytes.set(artifactCacheKey(parsed.knowledge.snapshot.manifest), knowledge.manifest);
+		artifactBytes.set(artifactCacheKey(parsed.knowledge.snapshot.archive), knowledge.archive);
+		if (parsed.knowledge.retrievalConfig) await readArtifact(parsed.knowledge.retrievalConfig);
+		await readArtifact(parsed.knowledge.evaluation);
+	}
+	if (parsed.memory.mode === "isolated" && parsed.memory.seed) await readArtifact(parsed.memory.seed);
+	deepFreezeCandidate(parsed);
+	const verified = Object.freeze({
+		bundle: parsed,
+		...materializedTree === void 0 ? {} : { materializedTree },
+		[verifiedCandidateBrand]: true
+	});
+	verifiedCandidateState.set(verified, {
+		ports,
+		artifactBytes,
+		resourceBytes
+	});
+	return verified;
+}
+function getVerifiedCandidateState(candidate) {
+	const state = verifiedCandidateState.get(candidate);
+	if (!state || candidate[verifiedCandidateBrand] !== true) throw new Error("candidate must come from verifyAgentCandidateBundle");
+	return state;
+}
+async function verifiedArtifactBytes(candidate, artifact) {
+	const state = getVerifiedCandidateState(candidate);
+	const key = artifactCacheKey(artifact);
+	const existing = state.artifactBytes.get(key);
+	if (existing) return Uint8Array.from(existing);
+	const bytes = await readVerifiedArtifact(artifact, state.ports.artifacts);
+	state.artifactBytes.set(key, Uint8Array.from(bytes));
+	return bytes;
+}
+function verifiedResourceTextByDigest(candidate) {
+	const output = /* @__PURE__ */ new Map();
+	for (const resource of candidateResources(candidate.bundle)) {
+		const bytes = getVerifiedCandidateState(candidate).resourceBytes.get(resource.sha256);
+		if (!bytes) throw new Error(`candidate resource digest was not verified: ${resource.sha256}`);
+		output.set(resource.sha256, new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+	}
+	return output;
+}
+function candidateResources(bundle) {
+	const resources = bundle.profile.resources;
+	if (!resources) return [];
+	const output = [];
+	for (const mount of resources.files ?? []) output.push(mount.resource);
+	output.push(...resources.tools ?? []);
+	output.push(...resources.skills ?? []);
+	output.push(...resources.agents ?? []);
+	output.push(...resources.commands ?? []);
+	if (typeof resources.instructions === "object") output.push(resources.instructions);
+	return output;
+}
+function resourceKey(resource) {
+	return canonicalCandidateDigest$1(resource);
+}
+//#endregion
+//#region src/candidate-execution/knowledge.ts
+/** Environment variable containing the materialized candidate knowledge root. */
+const CANDIDATE_KNOWLEDGE_ROOT_ENV = "TANGLE_CANDIDATE_KNOWLEDGE_ROOT";
+/** Environment variable containing the materialized retrieval configuration path. */
+const CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV = "TANGLE_CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG";
+/** Deterministic, signed locations used by every candidate executor. */
+function candidateKnowledgeExecutionPaths(taskRoot, hasRetrievalConfig) {
+	if (!posix.isAbsolute(taskRoot) || posix.normalize(taskRoot) !== taskRoot) throw new Error("candidate knowledge requires a normalized absolute task root");
+	const parent = posix.join(taskRoot, ".tangle");
+	return {
+		root: posix.join(parent, "knowledge"),
+		...hasRetrievalConfig ? { retrievalConfig: posix.join(parent, "knowledge-retrieval-config.json") } : {}
+	};
+}
+/** Verify and detach the exact file-backed knowledge admitted by the bundle. */
+async function prepareAgentCandidateKnowledge(candidate, ports, arm) {
+	const knowledge = candidate.bundle.knowledge;
+	if (!knowledge) return void 0;
+	const archive = await verifiedArtifactBytes(candidate, knowledge.snapshot.archive);
+	const retrievalConfig = knowledge.retrievalConfig ? await verifiedArtifactBytes(candidate, knowledge.retrievalConfig) : void 0;
+	const root = await mkdtemp(join(tmpdir(), "agent-candidate-knowledge-"));
+	try {
+		await ports.workspaces.materialize({
+			role: "knowledge",
+			snapshot: knowledge.snapshot,
+			archive,
+			destination: root
+		});
+		const expectedHash = arm === "baseline" ? knowledge.candidate.baseHash : knowledge.candidate.candidateHash;
+		const actualHash = `sha256:${await hashKnowledgeBase(root, knowledge.stateScope)}`;
+		if (actualHash !== expectedHash) throw new Error(`materialized ${arm} knowledge does not match its measured content: expected ${expectedHash}, got ${actualHash}`);
+		const files = await readMaterializedWorkspaceFiles(root, knowledge.snapshot.material);
+		return Object.freeze({
+			candidate: knowledge.candidate,
+			...knowledge.stateScope ? { stateScope: Object.freeze({ ...knowledge.stateScope }) } : {},
+			snapshot: knowledge.snapshot,
+			files: Object.freeze(files.map((file) => Object.freeze({
+				path: file.path,
+				mode: file.mode,
+				bytes: Uint8Array.from(file.bytes)
+			}))),
+			...retrievalConfig ? { retrievalConfig: Uint8Array.from(retrievalConfig) } : {}
+		});
+	} finally {
+		await rm(root, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+//#endregion
+//#region src/candidate-execution/exact-process-executor.ts
+const DEFAULT_PROVISION_TIMEOUT_MS = 12e4;
+const DEFAULT_RECOVERY_RETENTION_MS = 15 * 6e4;
+/** Adapt one neutral exact-process provider to Runtime's trusted candidate boundary. */
+function exactProcessProviderAsCandidateExecutor(options) {
+	return new ExactProcessAgentCandidateExecutor(options);
+}
+var ExactProcessAgentCandidateExecutor = class {
+	options;
+	states = /* @__PURE__ */ new Map();
+	exactProcess;
+	resources;
+	provisionTimeoutMs;
+	recoveryRetentionMs;
+	providerOptions;
+	capabilitiesPromise;
+	constructor(options) {
+		this.options = options;
+		if (!options.provider.exactProcess) throw new Error(`agent environment provider "${options.provider.name}" does not implement exact processes`);
+		this.exactProcess = options.provider.exactProcess;
+		this.resources = exactResources(options.resources);
+		this.provisionTimeoutMs = positiveInteger(options.provisionTimeoutMs ?? DEFAULT_PROVISION_TIMEOUT_MS, "exact process provision timeout");
+		this.recoveryRetentionMs = positiveInteger(options.recoveryRetentionMs ?? DEFAULT_RECOVERY_RETENTION_MS, "exact process recovery retention");
+		this.providerOptions = options.providerOptions ? immutableCandidateValue(options.providerOptions) : void 0;
+	}
+	async execute(request, context) {
+		assertSupportedRequest(request);
+		const outcome = request.benchmark.task.outcome;
+		if (outcome.kind !== "output") throw new Error("exact process executor requires an output task");
+		const network = request.executionPlan.value.material.model.access.network;
+		const egress = network.mode === "disabled" ? { mode: "blocked" } : {
+			mode: "strict",
+			allowDomains: [...network.domains]
+		};
+		await this.assertCapability(egress.mode);
+		context.signal.throwIfAborted();
+		const key = executionKey(request.executionId, request.executionPlan.value.digest);
+		if (this.states.has(key)) throw new Error("candidate execution environment is already active");
+		const image = exactImage(request.executionPlan.value.material.container.image, request.executionPlan.value.material.container.manifestDigest);
+		const maxLifetimeMs = environmentLifetimeMs(request.hardLimits.timeoutMs, this.recoveryRetentionMs);
+		const createInputDigest = canonicalCandidateDigest$1(immutableCandidateValue({
+			kind: "agent-candidate-exact-process-create",
+			provider: this.options.provider.name,
+			executionId: request.executionId,
+			executionPlanDigest: request.executionPlan.value.digest,
+			image,
+			egress,
+			maxLifetimeMs,
+			provisionTimeoutMs: this.provisionTimeoutMs,
+			resources: this.resources,
+			output: {
+				mediaType: outcome.mediaType,
+				maxBytes: outcome.maxBytes
+			},
+			...this.providerOptions ? { providerOptions: this.providerOptions } : {}
+		}));
+		const metadata = immutableCandidateValue({
+			kind: "agent-candidate-execution",
+			provider: this.options.provider.name,
+			executionId: request.executionId,
+			executionPlanDigest: request.executionPlan.value.digest,
+			createInputDigest,
+			outputMediaType: outcome.mediaType,
+			outputMaxBytes: outcome.maxBytes
+		});
+		const environment = await this.exactProcess.create({
+			image,
+			egress,
+			maxLifetimeMs,
+			provisionTimeoutMs: this.provisionTimeoutMs,
+			resources: this.resources,
+			metadata,
+			idempotencyKey: executionIdempotencyKey(request.executionId, request.executionPlan.value.digest),
+			signal: context.signal,
+			...this.providerOptions ? { providerOptions: this.providerOptions } : {}
+		});
+		try {
+			assertExecutionEnvironment(environment, metadata, this.options.provider.name);
+		} catch (error) {
+			try {
+				await environment.destroy();
+			} catch (cleanupError) {
+				throw new AggregateError([error, cleanupError], "exact process validation and cleanup both failed");
+			}
+			throw error;
+		}
+		const state = { environment };
+		this.states.set(key, state);
+		if ((await environment.process.list()).length !== 0) throw new Error("fresh candidate environment already contains a process");
+		await materializeRequest(environment, request, context.signal);
+		const launch = exactLaunch(request);
+		const startedAt = Date.now();
+		state.trace = {
+			runId: request.trace.runId,
+			scenarioId: request.benchmark.task.scenario.id,
+			startedAt,
+			deadlineAtMs: context.deadlineAtMs,
+			timeoutMs: request.hardLimits.timeoutMs,
+			tags: {
+				...request.trace.tags,
+				environmentId: environment.id,
+				environmentProvider: environment.provider
+			},
+			written: false
+		};
+		const process = await environment.process.spawn(launch, { signal: context.signal });
+		const outputPromise = collectOutput(process, outcome.maxBytes);
+		outputPromise.catch(() => void 0);
+		let cancellation;
+		let processExited = false;
+		const cancel = () => {
+			if (!processExited) cancellation ??= stopProcess(process);
+		};
+		context.signal.addEventListener("abort", cancel, { once: true });
+		if (context.signal.aborted) cancel();
+		try {
+			const termination = await process.wait();
+			processExited = true;
+			context.signal.removeEventListener("abort", cancel);
+			if (cancellation) await cancellation;
+			const status = await process.status();
+			assertTerminalStatus(status, termination);
+			state.output = await awaitOutput(outputPromise, context.signal, context.deadlineAtMs);
+			state.termination = termination;
+			await appendExactProcessTrace(state, context.traceStore, status);
+			return {
+				executionId: request.executionId,
+				termination
+			};
+		} finally {
+			context.signal.removeEventListener("abort", cancel);
+		}
+	}
+	async stop(request, context) {
+		await this.assertCapability();
+		context.signal.throwIfAborted();
+		const environment = await this.resolve(request, true);
+		if (!environment) return { stopped: true };
+		let statuses = await environment.process.list();
+		if (statuses.length > 1) throw new Error("candidate exact process environment contains more than one process");
+		const status = statuses[0];
+		if (status?.running) {
+			const process = await environment.process.get(status.pid);
+			if (!process) throw new Error("candidate environment lost its running process handle");
+			await stopProcess(process);
+		}
+		context.signal.throwIfAborted();
+		statuses = await environment.process.list();
+		if (statuses.some((entry) => entry.running)) throw new Error("candidate exact process termination is not proven");
+		const finalStatus = statuses[0];
+		if (finalStatus) assertTerminalStatus(finalStatus);
+		const state = this.states.get(executionKey(request.executionId, request.executionPlanDigest));
+		if (state) {
+			state.termination = finalStatus?.termination ?? state.termination;
+			if (context.reason === "timeout" && state.trace) state.runtimeTermination = {
+				kind: "timeout",
+				timeoutMs: state.trace.timeoutMs
+			};
+			await appendExactProcessTrace(state, context.traceStore, finalStatus);
+		}
+		return { stopped: true };
+	}
+	async capture(request, context) {
+		await this.assertCapability();
+		context.signal.throwIfAborted();
+		const environment = await this.resolve(request, false);
+		const statuses = await environment.process.list();
+		const status = statuses[0];
+		if (statuses.length !== 1 || !status || status.running) throw new Error("candidate environment must contain one stopped process before capture");
+		assertTerminalStatus(status);
+		const process = await environment.process.get(status.pid);
+		if (!process) throw new Error("candidate environment lost its captured process handle");
+		assertTerminalStatus(await process.status(), status.termination);
+		const state = this.states.get(executionKey(request.executionId, request.executionPlanDigest));
+		const output = state?.output ?? await awaitOutput(collectOutput(process, outputSpec(environment).maxBytes), context.signal, Date.now() + this.provisionTimeoutMs);
+		context.signal.throwIfAborted();
+		const evidence = canonicalCandidateBytes$1({
+			kind: "agent-candidate-exact-process-capture",
+			provider: environment.provider,
+			environmentId: environment.id,
+			executionId: request.executionId,
+			executionPlanDigest: request.executionPlanDigest,
+			createInputDigest: environment.metadata?.createInputDigest,
+			process: {
+				pid: status.pid,
+				exitCode: status.exitCode,
+				...status.exitSignal ? { exitSignal: status.exitSignal } : {},
+				termination: status.termination
+			},
+			...state?.runtimeTermination ? { runtimeTermination: state.runtimeTermination } : {},
+			output: {
+				sha256: sha256Bytes$1(output),
+				byteLength: output.byteLength
+			}
+		});
+		return {
+			taskOutcome: {
+				kind: "output",
+				bytes: output
+			},
+			evidence
+		};
+	}
+	async dispose(request, context) {
+		await this.assertCapability();
+		context.signal.throwIfAborted();
+		const environment = await this.resolve(request, true);
+		if (!environment) return { disposed: true };
+		let destroyError;
+		try {
+			await environment.destroy();
+		} catch (error) {
+			destroyError = error;
+		}
+		if (await this.exactProcess.get(environment.id)) throw new Error("exact process environment disposal is not proven", { cause: destroyError });
+		context.signal.throwIfAborted();
+		this.states.delete(executionKey(request.executionId, request.executionPlanDigest));
+		return { disposed: true };
+	}
+	async assertCapability(mode) {
+		const pending = this.capabilitiesPromise ?? Promise.resolve(this.options.provider.capabilities());
+		this.capabilitiesPromise = pending;
+		let capabilities;
+		try {
+			capabilities = await pending;
+		} catch (error) {
+			if (this.capabilitiesPromise === pending) this.capabilitiesPromise = void 0;
+			throw error;
+		}
+		const exact = capabilities.exactProcess;
+		if (!exact) throw new Error(`agent environment provider "${this.options.provider.name}" does not declare exact process support`);
+		if (mode && !exact.egress.includes(mode)) throw new Error(`agent environment provider "${this.options.provider.name}" does not declare ${mode} exact egress`);
+	}
+	async resolve(request, missingIsDeleted) {
+		const key = executionKey(request.executionId, request.executionPlanDigest);
+		const active = this.states.get(key)?.environment;
+		if (active) return active;
+		const metadata = {
+			kind: "agent-candidate-execution",
+			provider: this.options.provider.name,
+			executionId: request.executionId,
+			executionPlanDigest: request.executionPlanDigest
+		};
+		const matches = (await this.exactProcess.list({
+			metadata,
+			...this.providerOptions ? { providerOptions: this.providerOptions } : {}
+		})).filter((environment) => environment.provider === this.options.provider.name && Object.entries(metadata).every(([name, value]) => isDeepStrictEqual(environment.metadata?.[name], value)));
+		if (matches.length > 1) throw new Error("multiple exact process environments match one candidate execution");
+		const environment = matches[0];
+		if (!environment) {
+			if (missingIsDeleted) return void 0;
+			throw new Error("candidate exact process evidence is unavailable");
+		}
+		if (!isSha256Digest$1(environment.metadata?.createInputDigest)) throw new Error("candidate exact process create-input digest is unavailable");
+		this.states.set(key, { environment });
+		return environment;
+	}
+};
+async function appendExactProcessTrace(state, traceStore, status) {
+	const trace = state.trace;
+	if (!trace || trace.written) return;
+	const endedAt = Math.max(trace.startedAt, Math.min(Date.now(), trace.deadlineAtMs));
+	const termination = state.runtimeTermination ?? state.termination ?? status?.termination;
+	await traceStore.appendRun({
+		runId: trace.runId,
+		scenarioId: trace.scenarioId,
+		startedAt: trace.startedAt,
+		endedAt,
+		status: termination?.kind === "exit" && termination.exitCode === 0 ? "completed" : "failed",
+		tags: trace.tags
+	});
+	trace.written = true;
+}
+function assertSupportedRequest(request) {
+	if (request.benchmark.task.outcome.kind !== "output") throw new Error("exact process candidate executor does not support workspace outcomes; use Pier");
+	if (request.executionPlan.value.material.codeKind !== "disabled" || request.inputs.candidate) throw new Error("exact process candidate executor does not support code workspaces; use Pier");
+	if (request.memory.mode !== "disabled") throw new Error("exact process candidate executor does not support isolated memory");
+	const mediaType = request.benchmark.task.outcome.mediaType.toLowerCase();
+	if (!(mediaType.startsWith("text/") || mediaType === "application/json" || mediaType.endsWith("+json"))) throw new Error("exact process candidate executor supports only UTF-8 text and JSON outputs");
+	if (!posix.isAbsolute(request.launch.executable) && !request.launch.env.PATH?.trim()) throw new Error("exact process candidate executable must be absolute or declare a signed PATH");
+	if (!request.roots) throw new Error("candidate execution roots are missing");
+	assertAgentCandidateExecutionRoots(request.roots);
+}
+async function materializeRequest(environment, request, signal) {
+	assertAgentCandidateExecutionRoots(request.roots);
+	const knowledgePaths = assertKnowledgeExecutionBinding(request);
+	for (const file of request.inputs.task.files) await environment.writeFile(beneath(request.roots.taskRoot, file.path), file.bytes, {
+		mode: file.mode,
+		signal
+	});
+	for (const file of request.inputs.profile.files) await environment.writeFile(profileFileExecutionPath(request, file), file.bytes, {
+		mode: file.mode,
+		signal
+	});
+	if (request.knowledge && knowledgePaths) {
+		for (const file of request.knowledge.files) await environment.writeFile(beneath(knowledgePaths.root, file.path), file.bytes, {
+			mode: file.mode,
+			signal
+		});
+		if (request.knowledge.retrievalConfig && knowledgePaths.retrievalConfig) await environment.writeFile(knowledgePaths.retrievalConfig, request.knowledge.retrievalConfig, {
+			mode: 420,
+			signal
+		});
+	}
+	if (request.instruction.delivery.kind === "utf8-file") await environment.writeFile(request.instruction.delivery.path, request.instruction.bytes, {
+		mode: 420,
+		signal
+	});
+}
+function assertKnowledgeExecutionBinding(request) {
+	const knowledge = request.knowledge;
+	if (!knowledge) {
+		if (request.launch.env["TANGLE_CANDIDATE_KNOWLEDGE_ROOT"] !== void 0 || request.launch.env["TANGLE_CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG"] !== void 0) throw new Error("candidate launch declares knowledge paths without verified knowledge");
+		return;
+	}
+	const paths = candidateKnowledgeExecutionPaths(request.roots.taskRoot, knowledge.retrievalConfig !== void 0);
+	if (request.launch.env["TANGLE_CANDIDATE_KNOWLEDGE_ROOT"] !== paths.root || request.launch.env["TANGLE_CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG"] !== paths.retrievalConfig) throw new Error("candidate knowledge paths do not match the signed launch environment");
+	const reserved = [paths.root, paths.retrievalConfig].filter((value) => value !== void 0);
+	if ([
+		...request.inputs.task.files.map((file) => beneath(request.roots.taskRoot, file.path)),
+		...request.inputs.profile.files.map((file) => profileFileExecutionPath(request, file)),
+		...request.instruction.delivery.kind === "utf8-file" ? [request.instruction.delivery.path] : []
+	].some((path) => reserved.some((reservedPath) => path === reservedPath || path.startsWith(`${reservedPath}/`) || reservedPath.startsWith(`${path}/`)))) throw new Error("candidate knowledge paths overlap other execution inputs");
+	return paths;
+}
+function profileFileExecutionPath(request, file) {
+	const workspaceRoot = request.executionPlan.value.material.profile.targetWorkspace === "task" ? request.roots.taskRoot : request.roots.candidateRoot;
+	if (!workspaceRoot) throw new Error("candidate profile targets a missing workspace");
+	if (file.root !== "agent") return beneath(workspaceRoot, file.path);
+	return beneath(profileAgentDirectory(request), file.path);
+}
+function profileAgentDirectory(request) {
+	const paths = candidateProfileAgentPaths(request.profilePlan.value.material, request.roots.profileRoot);
+	if (!paths) throw new Error("candidate profile agent-root file is missing its private root");
+	if (request.launch.env["PI_CODING_AGENT_DIR"] !== paths.agentDir || request.launch.env["PI_CODING_AGENT_SESSION_DIR"] !== paths.sessionDir) throw new Error("candidate Pi agent-root files do not match the signed launch environment");
+	return paths.agentDir;
+}
+function exactLaunch(request) {
+	const instruction = new TextDecoder("utf-8", { fatal: true }).decode(request.instruction.bytes);
+	const base = {
+		executable: request.launch.executable,
+		args: request.launch.args,
+		cwd: request.launch.cwd,
+		env: request.launch.env,
+		timeoutMs: 0
+	};
+	switch (request.instruction.delivery.kind) {
+		case "argv-append": return {
+			...base,
+			args: [...base.args, instruction]
+		};
+		case "stdin-utf8": return {
+			...base,
+			stdin: instruction
+		};
+		case "utf8-file": return base;
+	}
+}
+async function collectOutput(process, maxBytes) {
+	const chunks = [];
+	let byteLength = 0;
+	for await (const chunk of process.stdout()) {
+		const bytes = Buffer.from(chunk, "utf8");
+		byteLength += bytes.byteLength;
+		if (byteLength > maxBytes) {
+			let stopError;
+			try {
+				await stopProcess(process);
+			} catch (error) {
+				stopError = error;
+			}
+			throw new Error(`candidate output exceeds its ${maxBytes}-byte maximum`, { cause: stopError });
+		}
+		chunks.push(bytes);
+	}
+	return Uint8Array.from(Buffer.concat(chunks, byteLength));
+}
+async function awaitOutput(output, signal, deadlineAtMs) {
+	signal.throwIfAborted();
+	const remainingMs = deadlineAtMs - Date.now();
+	if (remainingMs <= 0) throw new Error("candidate output deadline expired");
+	let timer;
+	let onAbort;
+	try {
+		return await Promise.race([output, new Promise((_resolve, reject) => {
+			onAbort = () => reject(signal.reason ?? /* @__PURE__ */ new Error("candidate output cancelled"));
+			signal.addEventListener("abort", onAbort, { once: true });
+			timer = setTimeout(() => reject(/* @__PURE__ */ new Error("candidate output deadline expired")), remainingMs);
+		})]);
+	} finally {
+		if (onAbort) signal.removeEventListener("abort", onAbort);
+		if (timer) clearTimeout(timer);
+	}
+}
+async function stopProcess(process) {
+	if (!(await process.status()).running) return;
+	try {
+		await process.kill();
+	} catch (error) {
+		if ((await process.status()).running) throw error;
+	}
+	const termination = await process.wait();
+	assertTerminalStatus(await process.status(), termination);
+}
+function assertTerminalStatus(status, expected) {
+	if (status.running || !status.termination) throw new Error("exact process returned no terminal reason after exit");
+	if (expected && !isDeepStrictEqual(status.termination, expected)) throw new Error("exact process wait and status returned different terminal reasons");
+}
+function assertExecutionEnvironment(environment, metadata, providerName) {
+	if (!environment.id || environment.provider !== providerName) throw new Error("exact process provider returned the wrong environment identity");
+	if (!Object.entries(metadata).every(([name, value]) => isDeepStrictEqual(environment.metadata?.[name], value))) throw new Error("exact process provider did not persist candidate execution metadata");
+}
+function outputSpec(environment) {
+	const maxBytes = environment.metadata?.outputMaxBytes;
+	if (!Number.isSafeInteger(maxBytes) || Number(maxBytes) < 1) throw new Error("candidate exact process output bound is unavailable");
+	return { maxBytes: Number(maxBytes) };
+}
+function executionKey(executionId, executionPlanDigest) {
+	return `${executionId}\0${executionPlanDigest}`;
+}
+function executionIdempotencyKey(executionId, executionPlanDigest) {
+	return `candidate-${canonicalCandidateDigest$1({
+		kind: "agent-candidate-execution-identity",
+		executionId,
+		executionPlanDigest
+	}).slice(7)}`;
+}
+function exactImage(image, manifestDigest) {
+	if (isSha256Digest$1(image)) {
+		if (image !== manifestDigest) throw new Error("candidate container image conflicts with its resolved manifest");
+		return image;
+	}
+	const marker = image.lastIndexOf("@");
+	if (marker < 0) return `${image}@${manifestDigest}`;
+	if (image.slice(marker + 1) !== manifestDigest) throw new Error("candidate container image conflicts with its resolved manifest");
+	return image;
+}
+function environmentLifetimeMs(timeoutMs, retentionMs) {
+	const total = positiveInteger(timeoutMs, "candidate execution timeout") + retentionMs;
+	if (!Number.isSafeInteger(total)) throw new Error("candidate environment lifetime is too large");
+	return Math.ceil(total / 1e3) * 1e3;
+}
+function exactResources(resources) {
+	if (!Number.isFinite(resources.cpu) || resources.cpu <= 0) throw new Error("exact process CPU must be positive and finite");
+	return Object.freeze({
+		cpu: resources.cpu,
+		memoryMb: positiveInteger(resources.memoryMb, "exact process memory"),
+		diskMb: positiveInteger(resources.diskMb, "exact process disk")
+	});
+}
+function positiveInteger(value, label) {
+	if (!Number.isSafeInteger(value) || value < 1) throw new Error(`${label} must be a positive integer`);
+	return value;
+}
+function beneath(root, relativePath) {
+	if (posix.isAbsolute(relativePath)) throw new Error("candidate input path must be relative");
+	const path = posix.normalize(relativePath);
+	if (path === ".." || path.startsWith("../")) throw new Error("candidate input path escapes its execution root");
+	return posix.join(root, path);
+}
+function isSha256Digest$1(value) {
+	return typeof value === "string" && /^sha256:[a-f0-9]{64}$/.test(value);
+}
+//#endregion
+//#region src/candidate-execution/model-settlement.ts
+const USD_NANOS = 1e9;
+/** Validate and detach the evaluator gateway's terminal, revoked call ledger. */
+function sealAgentCandidateModelSettlement(settlement, expected) {
+	assertExactObjectKeys(settlement, [
+		"preparationId",
+		"grantDigest",
+		"closed",
+		"usageWithinLimits",
+		"calls"
+	], "model settlement");
+	if (settlement.closed !== true) throw new Error("protected model grant is not closed");
+	if (settlement.usageWithinLimits !== true) throw new Error("protected model settlement reports usage outside frozen limits");
+	if (settlement.grantDigest !== expected.grantDigest) throw new Error("protected model settlement grant digest does not match the reservation");
+	if (settlement.preparationId !== expected.preparationId) throw new Error("protected model settlement preparation does not match the reservation");
+	if (!Array.isArray(settlement.calls)) throw new Error("protected model settlement calls must be an array");
+	const callIds = /* @__PURE__ */ new Set();
+	const spanIds = /* @__PURE__ */ new Set();
+	let accountedInputTokens = 0;
+	let outputTokens = 0;
+	let cachedInputTokens = 0;
+	let reasoningTokens = 0;
+	let costUsdNanos = 0;
+	let costProvenance = "observed";
+	const calls = settlement.calls.map((source, index) => {
+		assertExactObjectKeys(source, [
+			"callId",
+			"generationId",
+			"traceSpanId",
+			"status",
+			"model",
+			"startedAtMs",
+			"endedAtMs",
+			"inputTokens",
+			"accountedInputTokens",
+			"outputTokens",
+			"cachedInputTokens",
+			"reasoningTokens",
+			"costUsdNanos",
+			"costProvenance"
+		], `model settlement call ${index}`);
+		assertIdentifier(source.callId, `model settlement call ${index} callId`);
+		assertIdentifier(source.generationId, `model settlement call ${index} generationId`);
+		assertIdentifier(source.traceSpanId, `model settlement call ${index} traceSpanId`);
+		if (source.traceSpanId !== source.generationId) throw new Error(`model settlement call ${index} traceSpanId is not its router generationId`);
+		if (source.status !== "succeeded" && source.status !== "failed") throw new Error(`model settlement call ${index} has an invalid status`);
+		if (callIds.has(source.callId)) throw new Error("protected model settlement has duplicate call ids");
+		if (spanIds.has(source.traceSpanId)) throw new Error("protected model settlement has duplicate trace span ids");
+		callIds.add(source.callId);
+		spanIds.add(source.traceSpanId);
+		if (source.model !== expected.model) throw new Error(`protected model settlement call ${index} has an unexpected model`);
+		assertTimestamp(source.startedAtMs, `model settlement call ${index} startedAtMs`);
+		assertTimestamp(source.endedAtMs, `model settlement call ${index} endedAtMs`);
+		if (source.endedAtMs < source.startedAtMs) throw new Error(`model settlement call ${index} ended before it started`);
+		assertCount$1(source.inputTokens, `model settlement call ${index} inputTokens`);
+		assertCount$1(source.accountedInputTokens, `model settlement call ${index} accountedInputTokens`);
+		if (source.accountedInputTokens < source.inputTokens) throw new Error(`model settlement call ${index} accountedInputTokens cannot be less than inputTokens`);
+		assertCount$1(source.outputTokens, `model settlement call ${index} outputTokens`);
+		assertCount$1(source.cachedInputTokens, `model settlement call ${index} cachedInputTokens`);
+		cachedInputTokens = safeAdd(cachedInputTokens, source.cachedInputTokens, "cached input token total");
+		assertCount$1(source.reasoningTokens, `model settlement call ${index} reasoningTokens`);
+		reasoningTokens = safeAdd(reasoningTokens, source.reasoningTokens, "reasoning token total");
+		assertCount$1(source.costUsdNanos, `model settlement call ${index} costUsdNanos`);
+		if (source.costProvenance !== "observed" && source.costProvenance !== "estimated") throw new Error(`model settlement call ${index} has an invalid cost provenance`);
+		if (source.costProvenance === "estimated") costProvenance = "estimated";
+		accountedInputTokens = safeAdd(accountedInputTokens, source.accountedInputTokens, "accounted input token total");
+		outputTokens = safeAdd(outputTokens, source.outputTokens, "output token total");
+		costUsdNanos = safeAdd(costUsdNanos, source.costUsdNanos, "cost total");
+		return Object.freeze({ ...source });
+	});
+	const usage = Object.freeze({
+		costUsdNanos,
+		inputTokens: accountedInputTokens,
+		outputTokens,
+		cachedInputTokens,
+		reasoningTokens,
+		modelCalls: calls.length,
+		costProvenance
+	});
+	return Object.freeze({
+		value: Object.freeze({
+			preparationId: settlement.preparationId,
+			grantDigest: settlement.grantDigest,
+			closed: true,
+			usageWithinLimits: true,
+			calls: Object.freeze(calls)
+		}),
+		usage
+	});
+}
+/**
+* Append the only accepted LLM spans from the router's closed ledger.
+* Candidate and executor code may write tool/process spans, but never model usage.
+*/
+async function appendAuthoritativeModelSettlementSpans(traceStore, runId, settlement) {
+	const run = await traceStore.getRun(runId);
+	if (!run) throw new Error(`protected trace run is missing before model settlement: ${runId}`);
+	if (run.status === "running" || run.endedAt === void 0) throw new Error("protected trace run must be terminal before model spans are appended");
+	const existing = await traceStore.spans({ runId });
+	if (existing.some(isLlmSpan)) throw new Error("protected trace contains a model span not authored from the closed router ledger");
+	const occupiedIds = new Set(existing.map((span) => span.spanId));
+	for (const call of settlement.value.calls) {
+		if (occupiedIds.has(call.traceSpanId)) throw new Error(`protected trace span identity collides with router generation ${call.generationId}`);
+		await traceStore.appendSpan({
+			runId,
+			spanId: call.traceSpanId,
+			kind: "llm",
+			name: "protected model call",
+			model: call.model,
+			messages: [],
+			startedAt: call.startedAtMs,
+			endedAt: call.endedAtMs,
+			status: call.status === "succeeded" ? "ok" : "error",
+			inputTokens: call.inputTokens,
+			outputTokens: call.outputTokens,
+			cachedTokens: call.cachedInputTokens,
+			reasoningTokens: call.reasoningTokens,
+			costUsd: call.costUsdNanos / USD_NANOS,
+			attributes: {
+				"tangle.protected_model.source": "router-settlement",
+				"tangle.router.call_id": call.callId,
+				"tangle.router.generation_id": call.generationId
+			}
+		});
+	}
+}
+/** Match every protected trace span one-for-one against gateway call evidence. */
+function assertTraceMatchesModelSettlement(spans, settlement) {
+	if (spans.length !== settlement.value.calls.length) throw new Error(`protected trace model calls ${spans.length} do not match model ledger ${settlement.value.calls.length}`);
+	const byId = new Map(spans.map((span) => [span.spanId, span]));
+	if (byId.size !== spans.length) throw new Error("protected trace has duplicate model span ids");
+	for (const call of settlement.value.calls) {
+		const span = byId.get(call.traceSpanId);
+		if (!span) throw new Error(`protected trace is missing model ledger span ${call.traceSpanId}`);
+		assertTraceCall(span, call);
+	}
+}
+function usdToNanos(value, label) {
+	if (!Number.isFinite(value) || value < 0) throw new Error(`${label} must be nonnegative`);
+	const nanos = Math.round(value * USD_NANOS);
+	if (!Number.isSafeInteger(nanos)) throw new Error(`${label} exceeds fixed-point range`);
+	return nanos;
+}
+function assertTraceCall(span, call) {
+	if (span.model !== call.model) throw new Error(`protected trace span ${span.spanId} model does not match model ledger`);
+	if (span.startedAt !== call.startedAtMs || span.endedAt !== call.endedAtMs || span.status !== (call.status === "succeeded" ? "ok" : "error")) throw new Error(`protected trace span ${span.spanId} timing or status does not match model ledger`);
+	if (span.attributes?.["tangle.protected_model.source"] !== "router-settlement" || span.attributes?.["tangle.router.call_id"] !== call.callId || span.attributes?.["tangle.router.generation_id"] !== call.generationId) throw new Error(`protected trace span ${span.spanId} lacks router settlement provenance`);
+	for (const [name, traced, settled] of [
+		[
+			"inputTokens",
+			span.inputTokens,
+			call.inputTokens
+		],
+		[
+			"outputTokens",
+			span.outputTokens,
+			call.outputTokens
+		],
+		[
+			"cachedInputTokens",
+			span.cachedTokens ?? 0,
+			call.cachedInputTokens
+		],
+		[
+			"reasoningTokens",
+			span.reasoningTokens ?? 0,
+			call.reasoningTokens
+		]
+	]) if (traced === void 0 || traced !== settled) throw new Error(`protected trace span ${span.spanId} ${name} ${traced} does not match model ledger ${settled}`);
+	if (span.costUsd === void 0) throw new Error(`protected trace span ${span.spanId} is missing costUsd`);
+	const tracedCost = usdToNanos(span.costUsd, `protected trace span ${span.spanId} costUsd`);
+	if (tracedCost !== call.costUsdNanos) throw new Error(`protected trace span ${span.spanId} costUsdNanos ${tracedCost} does not match model ledger ${call.costUsdNanos}`);
+}
+function assertIdentifier(value, label) {
+	if (typeof value !== "string" || value.length === 0 || value.length > 256) throw new Error(`${label} must be a non-empty bounded string`);
+}
+function assertCount$1(value, label) {
+	if (!Number.isSafeInteger(value) || value < 0) throw new Error(`${label} must be a nonnegative safe integer`);
+}
+function assertTimestamp(value, label) {
+	if (!Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive safe integer`);
+}
+function safeAdd(left, right, label) {
+	const total = left + right;
+	if (!Number.isSafeInteger(total)) throw new Error(`${label} exceeds safe integer range`);
+	return total;
+}
+//#endregion
+//#region src/candidate-execution/protected-model-port.ts
+const MAX_RECENT_SETTLEMENTS = 4096;
+const RECOVERED_SETTLEMENT_RETENTION_MS = 900 * 1e3;
+/**
+* Bind a protected model-grant service to the immutable candidate runtime.
+*
+* The service remains the authority for expiry, admission, revocation, and
+* metering. This adapter independently checks every response before allowing
+* it to cross into candidate execution or durable receipt finalization.
+*/
+function createProtectedAgentCandidateModelPort(options) {
+	const gatewayDomain = assertGatewayDomain(options.gatewayDomain);
+	const activationEnvNames = exactEnvironmentNames(options.activationEnvNames);
+	const reservations = /* @__PURE__ */ new Map();
+	const expiredReservations = /* @__PURE__ */ new Map();
+	const recentSettlements = /* @__PURE__ */ new Map();
+	return {
+		resolve: async (input) => {
+			const request = immutableCandidateValue(input);
+			return immutableCandidateValue(validateResolvedModel(await options.resolveModel(request), request));
+		},
+		reserveGrant: async (input) => {
+			pruneExpiredState(reservations, expiredReservations, recentSettlements, Date.now());
+			const request = immutableCandidateValue(input);
+			validateReserveInput(request);
+			const requestDigest = canonicalCandidateDigest$1(request);
+			const key = reservationKey(request.executionId, request.preparationId);
+			if (recentSettlements.has(key)) throw new Error("protected model reservation is already settled");
+			if (expiredReservations.get(key)) throw new Error("protected model reservation has expired");
+			const previous = reservations.get(key);
+			if (previous && previous.requestDigest !== requestDigest) throw new Error("protected model reservation retry changed immutable input");
+			const reservation = validateReservation(await options.client.reserve(request), request, gatewayDomain);
+			const responseDigest = canonicalCandidateDigest$1(reservation);
+			if (recentSettlements.has(key)) throw new Error("protected model reservation completed after the grant was settled");
+			const recorded = previous ?? reservations.get(key);
+			if (recorded && recorded.requestDigest !== requestDigest) throw new Error("protected model reservation retry changed immutable input");
+			if (recorded && recorded.responseDigest !== responseDigest) throw new Error("protected model reservation retry returned different evidence");
+			if (!recorded) reservations.set(key, {
+				requestDigest,
+				responseDigest,
+				executionId: request.executionId,
+				preparationId: request.preparationId,
+				grantDigest: reservation.digest,
+				expiresAtMs: request.expiresAtMs,
+				resolved: immutableCandidateValue(request.resolved),
+				limits: immutableCandidateValue(request.limits),
+				maxCostUsdNanos: usdToNanos(request.limits.maxCostUsd, "reserved maxCostUsd"),
+				activation: "reserved"
+			});
+			return reservation;
+		},
+		activateGrant: async (input) => {
+			pruneExpiredState(reservations, expiredReservations, recentSettlements, Date.now());
+			const request = immutableCandidateValue(input);
+			const key = reservationKey(request.executionId, request.preparationId);
+			if (recentSettlements.has(key)) throw new Error("protected model grant is already settled");
+			const state = reservations.get(key);
+			if (!state && expiredReservations.has(key)) throw new Error("protected model grant reservation has expired");
+			if (!state) throw new Error("protected model grant was not reserved by this port");
+			assertGrantIdentity(state, request);
+			if (state.settlementDigest) throw new Error("protected model grant is already settled");
+			if (state.activation !== "reserved") throw new Error("protected model grant activation is single-use");
+			if (!Number.isSafeInteger(request.deadlineAtMs) || request.deadlineAtMs <= 0) throw new Error("protected model activation deadline must be a positive safe integer");
+			if (request.deadlineAtMs <= Date.now()) throw new Error("protected model activation deadline must be in the future");
+			if (request.deadlineAtMs > state.expiresAtMs) throw new Error("protected model activation deadline exceeds the reserved expiry");
+			state.activation = "activating";
+			try {
+				const activation = validateActivation(await options.client.activate(request), state.limits.maxModelCalls === 0 ? [] : activationEnvNames);
+				if (recentSettlements.has(key) || reservations.get(key) !== state) throw new Error("protected model grant settled while activation was in flight");
+				state.activation = "activated";
+				return activation;
+			} catch (error) {
+				state.activation = "reserved";
+				throw error;
+			}
+		},
+		settleGrant: async (input) => {
+			const now = Date.now();
+			pruneExpiredState(reservations, expiredReservations, recentSettlements, now);
+			const request = immutableCandidateValue(input);
+			const key = reservationKey(request.executionId, request.preparationId);
+			const state = reservations.get(key) ?? expiredReservations.get(key)?.state;
+			if (state) assertGrantIdentity(state, request);
+			const remembered = state ?? recentSettlements.get(key);
+			if (remembered?.settlementReason && remembered.settlementReason !== request.reason) throw new Error("protected model settlement retry changed the termination reason");
+			const sealed = sealAgentCandidateModelSettlement(await options.client.settle(request), {
+				preparationId: request.preparationId,
+				grantDigest: request.grantDigest,
+				model: request.resolved.model
+			});
+			if (state) assertWithinReservedLimits(sealed.usage, state);
+			const settlementDigest = canonicalCandidateDigest$1(sealed.value);
+			if (remembered?.settlementDigest && remembered.settlementDigest !== settlementDigest) throw new Error("protected model settlement retry returned a different final ledger");
+			if (remembered?.settlementReason && remembered.settlementReason !== request.reason) throw new Error("protected model settlement retry changed the termination reason");
+			const expiresAtMs = state?.expiresAtMs ?? now + RECOVERED_SETTLEMENT_RETENTION_MS;
+			if (state) {
+				state.settlementDigest = settlementDigest;
+				state.settlementReason = request.reason;
+			}
+			reservations.delete(key);
+			expiredReservations.delete(key);
+			rememberSettlement(recentSettlements, key, {
+				settlementDigest,
+				settlementReason: request.reason,
+				expiresAtMs
+			});
+			return sealed.value;
+		}
+	};
+}
+function validateReserveInput(input) {
+	if (!Number.isSafeInteger(input.expiresAtMs) || input.expiresAtMs <= 0) throw new Error("protected model reservation expiry must be a positive safe integer");
+	if (input.expiresAtMs <= Date.now()) throw new Error("protected model reservation expiry must be in the future");
+	for (const [name, value] of [
+		["maxModelCalls", input.limits.maxModelCalls],
+		["maxInputTokens", input.limits.maxInputTokens],
+		["maxOutputTokens", input.limits.maxOutputTokens],
+		["maxTotalTokens", input.limits.maxTotalTokens]
+	]) {
+		if (value === void 0) continue;
+		if (!Number.isSafeInteger(value) || value < 0) throw new Error(`protected model reservation ${name} must be a nonnegative safe integer`);
+	}
+	usdToNanos(input.limits.maxCostUsd, "reserved maxCostUsd");
+}
+function validateReservation(value, expected, gatewayDomain) {
+	const source = exactRecord(value, [
+		"preparationId",
+		"digest",
+		"expiresAtMs",
+		"enforcedLimits",
+		"network"
+	], "protected model reservation response");
+	if (source.preparationId !== expected.preparationId) throw new Error("protected model reservation response changed preparation identity");
+	if (!isSha256Digest(source.digest)) throw new Error("protected model reservation response has an invalid digest");
+	if (source.expiresAtMs !== expected.expiresAtMs) throw new Error("protected model reservation response changed expiry");
+	exactRecord(source.enforcedLimits, modelLimitKeys(expected.limits), "protected model reservation enforced limits");
+	if (canonicalCandidateDigest$1(source.enforcedLimits) !== canonicalCandidateDigest$1(expected.limits)) throw new Error("protected model reservation response changed enforced limits");
+	const network = validateReservationNetwork(source.network, expected.limits.maxModelCalls, gatewayDomain);
+	return immutableCandidateValue({
+		preparationId: source.preparationId,
+		digest: source.digest,
+		expiresAtMs: source.expiresAtMs,
+		enforcedLimits: source.enforcedLimits,
+		network
+	});
+}
+function validateReservationNetwork(value, maxModelCalls, gatewayDomain) {
+	if (maxModelCalls === 0) {
+		if (exactRecord(value, ["mode"], "protected model reservation network").mode !== "disabled") throw new Error("zero-call protected model reservation must disable gateway access");
+		return { mode: "disabled" };
+	}
+	const source = exactRecord(value, ["mode", "domains"], "protected model reservation network");
+	if (source.mode !== "gateway-only") throw new Error("protected model reservation must allow only its model gateway");
+	if (!Array.isArray(source.domains) || source.domains.length !== 1 || source.domains[0] !== gatewayDomain) throw new Error("protected model reservation returned an unexpected gateway domain");
+	return {
+		mode: "gateway-only",
+		domains: [gatewayDomain]
+	};
+}
+function validateActivation(value, expectedNames) {
+	const env = record(exactRecord(value, ["env"], "protected model activation response").env, "protected model activation environment");
+	const actualNames = Object.keys(env).sort();
+	if (actualNames.length !== expectedNames.length || actualNames.some((name, index) => name !== expectedNames[index])) throw new Error("protected model activation returned unexpected environment names");
+	const detached = Object.create(null);
+	for (const name of expectedNames) {
+		const value = env[name];
+		if (typeof value !== "string" || value.length < 8 || value.length > 65536) throw new Error(`protected model activation ${name} must be a non-empty protected value`);
+		detached[name] = value;
+	}
+	return Object.freeze({ env: Object.freeze(detached) });
+}
+function validateResolvedModel(value, expected) {
+	const source = exactRecord(value, [
+		"requested",
+		"provider",
+		"model",
+		"snapshot",
+		"reasoningEffort"
+	], "resolved candidate model");
+	if (source.requested !== expected.requested) throw new Error("model resolver changed the evaluator-owned request");
+	if (source.reasoningEffort !== expected.reasoningEffort) throw new Error("model resolver changed the evaluator-owned reasoning effort");
+	for (const name of [
+		"requested",
+		"provider",
+		"model",
+		"snapshot"
+	]) if (typeof source[name] !== "string" || source[name].length === 0) throw new Error(`resolved candidate model ${name} must be non-empty`);
+	return source;
+}
+function assertGrantIdentity(expected, actual) {
+	if (actual.executionId !== expected.executionId || actual.preparationId !== expected.preparationId || actual.grantDigest !== expected.grantDigest || canonicalCandidateDigest$1(actual.resolved) !== canonicalCandidateDigest$1(expected.resolved)) throw new Error("protected model grant input does not match its immutable reservation");
+}
+function assertWithinReservedLimits(usage, reservation) {
+	for (const [name, actual, limit] of [
+		[
+			"model calls",
+			usage.modelCalls,
+			reservation.limits.maxModelCalls
+		],
+		[
+			"input tokens",
+			usage.inputTokens,
+			reservation.limits.maxInputTokens
+		],
+		[
+			"output tokens",
+			usage.outputTokens,
+			reservation.limits.maxOutputTokens
+		],
+		[
+			"cost USD nanos",
+			usage.costUsdNanos,
+			reservation.maxCostUsdNanos
+		]
+	]) if (actual > limit) throw new Error(`protected model settlement ${name} ${actual} exceeds reserved ${limit}`);
+	const maxTotalTokens = reservation.limits.maxTotalTokens;
+	if (maxTotalTokens !== void 0) {
+		const totalTokens = usage.inputTokens + usage.outputTokens;
+		if (!Number.isSafeInteger(totalTokens)) throw new Error("protected model settlement total token usage is incomplete");
+		if (totalTokens > maxTotalTokens) throw new Error(`protected model settlement total tokens ${totalTokens} exceeds reserved ${maxTotalTokens}`);
+	}
+}
+function modelLimitKeys(limits) {
+	return limits.maxTotalTokens === void 0 ? [
+		"maxModelCalls",
+		"maxInputTokens",
+		"maxOutputTokens",
+		"maxCostUsd"
+	] : [
+		"maxModelCalls",
+		"maxInputTokens",
+		"maxOutputTokens",
+		"maxTotalTokens",
+		"maxCostUsd"
+	];
+}
+function exactEnvironmentNames(values) {
+	if (values.length === 0) throw new Error("protected model activation environment names must not be empty");
+	const names = [...values].sort();
+	if (new Set(names).size !== names.length) throw new Error("protected model activation environment names must be unique");
+	for (const name of names) if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name) || [
+		"__proto__",
+		"constructor",
+		"prototype"
+	].includes(name)) throw new Error(`protected model activation environment name is invalid: ${name}`);
+	return Object.freeze(names);
+}
+function assertGatewayDomain(value) {
+	if (value.length > 253 || value !== value.toLowerCase() || value.endsWith(".") || value.includes(":") || value === "localhost" || value.endsWith(".localhost") || value === "metadata.google" || value === "metadata.google.internal") throw new Error("protected model gateway must be an exact lowercase public DNS name");
+	const labels = value.split(".");
+	if (labels.length < 2 || !labels.every((label) => label.length >= 1 && label.length <= 63 && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(label)) || !/[a-z]/.test(labels.at(-1) ?? "")) throw new Error("protected model gateway must be an exact lowercase public DNS name");
+	return value;
+}
+function reservationKey(executionId, preparationId) {
+	return canonicalCandidateDigest$1({
+		executionId,
+		preparationId
+	});
+}
+function pruneExpiredState(reservations, expiredReservations, settlements, now) {
+	for (const [key, value] of reservations) if (value.expiresAtMs <= now) {
+		reservations.delete(key);
+		expiredReservations.set(key, {
+			state: value,
+			retainedUntilMs: now + RECOVERED_SETTLEMENT_RETENTION_MS
+		});
+	}
+	for (const [key, value] of expiredReservations) if (value.retainedUntilMs <= now) expiredReservations.delete(key);
+	for (const [key, value] of settlements) if (value.expiresAtMs <= now) settlements.delete(key);
+}
+function rememberSettlement(settlements, key, value) {
+	settlements.delete(key);
+	settlements.set(key, value);
+	while (settlements.size > MAX_RECENT_SETTLEMENTS) {
+		const oldest = settlements.keys().next().value;
+		if (oldest === void 0) return;
+		settlements.delete(oldest);
+	}
+}
+function isSha256Digest(value) {
+	return typeof value === "string" && /^sha256:[a-f0-9]{64}$/.test(value);
+}
+function exactRecord(value, keys, label) {
+	const source = record(value, label);
+	assertExactObjectKeys(source, keys, label);
+	return source;
+}
+function record(value, label) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
+	const prototype = Object.getPrototypeOf(value);
+	if (prototype !== Object.prototype && prototype !== null) throw new Error(`${label} must be a plain object`);
+	return value;
+}
+function modelLimits(limits) {
+	return {
+		maxModelCalls: limits.maxModelCalls,
+		maxInputTokens: limits.maxInputTokens,
+		maxOutputTokens: limits.maxOutputTokens,
+		maxCostUsd: limits.maxCostUsd
+	};
+}
+//#endregion
 //#region src/candidate-execution/claim-file-formats.ts
 function sealCandidatePreparationEvidence(value, executionPlanDigest) {
 	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error("candidate execution preparation evidence must be an object");
@@ -249,7 +1420,7 @@ function sealUsage(usage) {
 		"cachedInputTokens",
 		"reasoningTokens",
 		"modelCalls"
-	]) assertCount$1(usage[field], `terminal usage ${field}`);
+	]) assertCount(usage[field], `terminal usage ${field}`);
 	if (usage.costProvenance !== "observed" && usage.costProvenance !== "estimated") throw new Error("terminal usage costProvenance must be observed or estimated");
 	return Object.freeze({
 		costUsdNanos: usage.costUsdNanos,
@@ -302,11 +1473,14 @@ function assertExecutionId$1(value) {
 function assertSha256Digest$1(value, field) {
 	if (!SHA256_PATTERN$1.test(value)) throw new Error(`candidate execution claim ${field} must be a lowercase sha256 digest`);
 }
-function assertCount$1(value, label) {
+function assertCount(value, label) {
 	if (!Number.isSafeInteger(value) || value < 0) throw new Error(`candidate execution ${label} must be a non-negative safe integer`);
 }
+//#endregion
+//#region src/candidate-execution/cleanup.ts
+const DEFAULT_CANDIDATE_CLEANUP_TIMEOUT_MS = 3e4;
 function candidateCleanupTimeout(timeoutMs) {
-	const effective = timeoutMs ?? 3e4;
+	const effective = timeoutMs ?? DEFAULT_CANDIDATE_CLEANUP_TIMEOUT_MS;
 	if (!Number.isSafeInteger(effective) || effective <= 0 || effective > 2147483647) throw new Error("candidate cleanup timeout is outside the supported timer range");
 	return effective;
 }
@@ -374,107 +1548,8 @@ function attemptRecord(claim, phase, staged, terminal) {
 		phase,
 		...staged ? { staged } : {},
 		...terminal ? { terminal } : {}
-	});
-}
-/** Single-process lifecycle implementation. */
-var InMemoryAgentCandidateExecutionClaimStore = class {
-	claims = /* @__PURE__ */ new Map();
-	now;
-	constructor(options = {}) {
-		this.now = options.now ?? Date.now;
-	}
-	async tryClaim(requested) {
-		const claim = sealClaim(requested);
-		const slot = claimSlot(claim);
-		const existing = this.claims.get(slot);
-		if (existing) return rejectedExistingClaim(existing.claim, claim);
-		assertUnexpiredLease(claim.leaseExpiresAtMs, this.now());
-		const retryRejection = retryRejectionFromMemory(this.claims, claim);
-		if (retryRejection) return rejectedRetry(claim, retryRejection);
-		const lease = newLease(claim);
-		this.claims.set(slot, {
-			claim,
-			leaseDigest: leaseDigest(lease),
-			phase: "claimed"
-		});
-		return Object.freeze({
-			acquired: true,
-			claim,
-			lease
-		});
-	}
-	async getAttempt(requestedAttempt) {
-		const attempt = sealAttemptRef(requestedAttempt);
-		const stored = this.claims.get(claimSlot(attempt));
-		return stored ? attemptRecord(stored.claim, stored.phase, stored.staged, stored.terminal) : void 0;
-	}
-	async markCandidateMayRun(requestedLease) {
-		const lease = sealLease(requestedLease);
-		const stored = this.requireClaim(lease);
-		assertLease(stored.leaseDigest, stored.claim.leaseExpiresAtMs, lease);
-		if (stored.phase === "candidate-may-run") return Object.freeze({
-			marked: false,
-			phase: "candidate-may-run"
-		});
-		if (stored.staged || stored.terminal) throw new Error("candidate execution terminal was staged before candidate-may-run phase");
-		assertUnexpiredLease(stored.claim.leaseExpiresAtMs, this.now());
-		stored.phase = "candidate-may-run";
-		return Object.freeze({
-			marked: true,
-			phase: "candidate-may-run"
-		});
-	}
-	async stageTerminal(requestedLease, result) {
-		const lease = sealLease(requestedLease);
-		const stored = this.requireClaim(lease);
-		assertLease(stored.leaseDigest, stored.claim.leaseExpiresAtMs, lease);
-		const terminal = terminalRecord(stored.claim, result);
-		if (stored.staged) return rejectedStage(stored.staged, terminal);
-		assertTerminalAllowedInPhase(stored.phase, terminal);
-		assertUnexpiredLease(stored.claim.leaseExpiresAtMs, this.now());
-		stored.staged = terminal;
-		return Object.freeze({
-			staged: true,
-			terminal
-		});
-	}
-	async finish(requestedLease, requestedTerminalDigest) {
-		const lease = sealLease(requestedLease);
-		const terminalDigest = sealTerminalDigest(requestedTerminalDigest);
-		const stored = this.requireClaim(lease);
-		assertLease(stored.leaseDigest, stored.claim.leaseExpiresAtMs, lease);
-		const staged = requireStagedTerminal(stored.staged, terminalDigest);
-		if (stored.terminal) return rejectedFinish(stored.terminal, terminalDigest);
-		assertUnexpiredLease(stored.claim.leaseExpiresAtMs, this.now());
-		stored.terminal = staged;
-		return Object.freeze({
-			finished: true,
-			terminal: staged
-		});
-	}
-	async recoverExpired(requestedAttempt, evidence) {
-		const attempt = sealAttemptRef(requestedAttempt);
-		const stored = this.requireClaim(attempt, "candidate execution recovery");
-		const recovered = recoveredTerminalRecord(stored.claim, stored.phase, evidence);
-		if (stored.staged) assertRecoveryMatchesStaged(stored.staged, recovered);
-		const requestedDigest = stored.staged?.terminalDigest ?? recovered.terminalDigest;
-		if (stored.terminal) return rejectedFinish(stored.terminal, requestedDigest);
-		assertExpiredLease(stored.claim.leaseExpiresAtMs, this.now());
-		const terminal = stored.staged ?? recovered;
-		assertRecoveryMatchesStaged(terminal, recovered);
-		stored.staged ??= terminal;
-		stored.terminal = terminal;
-		return Object.freeze({
-			finished: true,
-			terminal
-		});
-	}
-	requireClaim(attempt, operation = "candidate execution lease") {
-		const stored = this.claims.get(claimSlot(attempt));
-		if (!stored) throw new Error(`${operation} does not name an acquired attempt`);
-		return stored;
-	}
-};
+	});
+}
 const SHA256_PATTERN = /^sha256:[a-f0-9]{64}$/;
 const LEASE_TOKEN_PATTERN = /^candidate-execution-lease\.[A-Za-z0-9_-]{43}$/;
 const PREPARATION_ID_PATTERN = /^candidate-preparation\.[A-Za-z0-9_-]{43}$/;
@@ -603,13 +1678,6 @@ function assertLease(expectedDigest, expectedExpiresAtMs, lease) {
 function claimSlot(claim) {
 	return createHash("sha256").update(JSON.stringify([claim.executionId, claim.attempt]), "utf8").digest("hex");
 }
-function retryRejectionFromMemory(claims, claim) {
-	if (claim.attempt === 1) return void 0;
-	return retryRejection(claim, claims.get(claimSlot({
-		executionId: claim.executionId,
-		attempt: claim.attempt - 1
-	})));
-}
 function retryRejection(claim, prior) {
 	if (!prior) return "prior-attempt-missing";
 	if (claim.retryPolicy !== "pre-model-infrastructure-only" || prior.claim.retryPolicy !== claim.retryPolicy || prior.claim.maxAttempts !== claim.maxAttempts || prior.claim.bundleDigest !== claim.bundleDigest || prior.claim.retryLineageDigest !== claim.retryLineageDigest) return "retry-lineage-mismatch";
@@ -767,13 +1835,6 @@ function assertExecutionId(value) {
 function assertBoundedIdentifier(value, label, maxLength) {
 	if (typeof value !== "string" || value.length === 0 || value.length > maxLength || hasControlCharacter(value)) throw new Error(`candidate execution ${label} is invalid`);
 }
-function hasControlCharacter(value) {
-	for (let index = 0; index < value.length; index++) {
-		const code = value.charCodeAt(index);
-		if (code < 32 || code === 127) return true;
-	}
-	return false;
-}
 function assertPositiveTimestamp(value, label) {
 	if (!Number.isSafeInteger(value) || value <= 0) throw new Error(`candidate execution ${label} must be a positive safe timestamp`);
 }
@@ -841,57 +1902,6 @@ function candidateTerminalWindowMs(cleanupTimeoutMs) {
 	return windowMs;
 }
 //#endregion
-//#region src/candidate-execution/execution-roots.ts
-/** Validate the canonical identity and isolation boundary for execution roots. */
-function assertAgentCandidateExecutionRoots(roots) {
-	const entries = [
-		["task", roots.taskRoot],
-		["candidate", roots.candidateRoot],
-		["profile", roots.profileRoot]
-	];
-	for (const [name, root] of entries) {
-		if (root === void 0) continue;
-		if (!posix.isAbsolute(root) || posix.normalize(root) !== root) throw new Error(`execution ${name} root must be a canonical absolute path`);
-	}
-	for (let left = 0; left < entries.length; left++) {
-		const entry = entries[left];
-		if (!entry) continue;
-		const [leftName, leftRoot] = entry;
-		if (leftRoot === void 0) continue;
-		for (let right = left + 1; right < entries.length; right++) {
-			const rightEntry = entries[right];
-			if (!rightEntry) continue;
-			const [rightName, rightRoot] = rightEntry;
-			if (rightRoot !== void 0 && executionPathsOverlap(leftRoot, rightRoot)) throw new Error(`execution ${leftName} and ${rightName} roots must be distinct and non-overlapping`);
-		}
-	}
-}
-function executionPathsOverlap(left, right) {
-	const a = posix.normalize(left);
-	const b = posix.normalize(right);
-	return a === b || b.startsWith(a === "/" ? "/" : `${a}/`) || a.startsWith(b === "/" ? "/" : `${b}/`);
-}
-//#endregion
-//#region src/candidate-execution/types.ts
-const verifiedCandidateBrand = Symbol("verifiedAgentCandidate");
-const preparedCandidateBrand = Symbol("preparedAgentCandidate");
-const verifiedTaskOutcomeBrand = Symbol("verifiedTaskOutcome");
-/** Protected trace tags that bind a run to one prepared candidate execution. */
-const CANDIDATE_TRACE_TAGS = {
-	executionId: "tangle.candidate.execution_id",
-	bundleDigest: "tangle.candidate.bundle_digest",
-	executionPlanDigest: "tangle.candidate.execution_plan_digest",
-	materializationReceiptDigest: "tangle.candidate.materialization_receipt_digest"
-};
-/** Environment keys used to propagate immutable candidate trace identity. */
-const CANDIDATE_TRACE_ENV = {
-	executionId: "TANGLE_CANDIDATE_EXECUTION_ID",
-	bundleDigest: "TANGLE_CANDIDATE_BUNDLE_DIGEST",
-	executionPlanDigest: "TANGLE_CANDIDATE_EXECUTION_PLAN_DIGEST",
-	materializationReceiptDigest: "TANGLE_CANDIDATE_MATERIALIZATION_RECEIPT_DIGEST",
-	traceRunId: "TANGLE_TRACE_RUN_ID"
-};
-//#endregion
 //#region src/candidate-execution/prepared-state.ts
 const stateByExecution = /* @__PURE__ */ new WeakMap();
 const lifecycleByExecution = /* @__PURE__ */ new WeakMap();
@@ -1088,7 +2098,7 @@ function assertPrivateCandidateIntegrity(state) {
 	assertSignedBenchmarkInput(state);
 	const instruction = Buffer.from(state.benchmarkTask.instruction, "utf8");
 	if (!Buffer.from(state.instruction.bytes).equals(instruction) || JSON.stringify(state.instruction.delivery) !== JSON.stringify(state.executionPlan.value.material.instructionDelivery)) throw new Error("prepared instruction no longer matches the signed execution plan");
-	if (!/^candidate-preparation\.[A-Za-z0-9_-]{43}$/.test(state.preparationId) || !Number.isSafeInteger(state.reservationExpiresAtMs) || state.reservationExpiresAtMs <= 0 || !Number.isSafeInteger(state.cleanupTimeoutMs) || state.cleanupTimeoutMs <= 0 || !Number.isSafeInteger(state.resultTimeoutMs) || state.resultTimeoutMs <= 0 || JSON.stringify(state.resolvedModel) !== JSON.stringify(state.executionPlan.value.material.model.resolved) || state.modelReservation.digest !== state.executionPlan.value.material.model.access.grantDigest || state.modelReservation.preparationId !== state.preparationId || state.modelReservation.expiresAtMs !== state.reservationExpiresAtMs || canonicalCandidateDigest$1(state.modelReservation.network) !== canonicalCandidateDigest$1(state.executionPlan.value.material.model.access.network) || canonicalCandidateDigest$1(state.modelReservation.enforcedLimits) !== canonicalCandidateDigest$1(modelLimits$1(state.executionPlan.value.material.limits))) throw new Error("prepared model access no longer matches the signed execution plan");
+	if (!/^candidate-preparation\.[A-Za-z0-9_-]{43}$/.test(state.preparationId) || !Number.isSafeInteger(state.reservationExpiresAtMs) || state.reservationExpiresAtMs <= 0 || !Number.isSafeInteger(state.cleanupTimeoutMs) || state.cleanupTimeoutMs <= 0 || !Number.isSafeInteger(state.resultTimeoutMs) || state.resultTimeoutMs <= 0 || JSON.stringify(state.resolvedModel) !== JSON.stringify(state.executionPlan.value.material.model.resolved) || state.modelReservation.digest !== state.executionPlan.value.material.model.access.grantDigest || state.modelReservation.preparationId !== state.preparationId || state.modelReservation.expiresAtMs !== state.reservationExpiresAtMs || canonicalCandidateDigest$1(state.modelReservation.network) !== canonicalCandidateDigest$1(state.executionPlan.value.material.model.access.network) || canonicalCandidateDigest$1(state.modelReservation.enforcedLimits) !== canonicalCandidateDigest$1(modelLimits(state.executionPlan.value.material.limits))) throw new Error("prepared model access no longer matches the signed execution plan");
 	assertExecutorInputs(state);
 	assertPreparedKnowledge(state);
 	if (state.memory.mode === "isolated" && !state.memoryReservation || state.memory.mode === "disabled" && state.memoryReservation) throw new Error("prepared memory reservation does not match the signed execution plan");
@@ -1225,14 +2235,6 @@ function immutableExecutorFiles(files) {
 		bytes: Uint8Array.from(file.bytes)
 	})));
 }
-function modelLimits$1(limits) {
-	return {
-		maxModelCalls: limits.maxModelCalls,
-		maxInputTokens: limits.maxInputTokens,
-		maxOutputTokens: limits.maxOutputTokens,
-		maxCostUsd: limits.maxCostUsd
-	};
-}
 function transitionLifecycle(prepared, expected, next) {
 	const lifecycle = lifecycleByExecution.get(prepared);
 	if (!lifecycle || !expected.includes(lifecycle.status)) throw new Error(`prepared candidate execution is already ${lifecycle?.status ?? "unknown"}`);
@@ -1399,208 +2401,20 @@ function sealTaskOutcomeCapture(value, expected) {
 	], "candidate task capture");
 	if (capture.kind !== "workspace") throw new Error("candidate task capture has an invalid outcome kind");
 	if (expected.kind !== "workspace") throw new Error("candidate workspace capture does not match the signed outcome kind");
-	if (typeof capture.resultTree !== "string" || !/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(capture.resultTree)) throw new Error("candidate task capture resultTree is not a Git object id");
-	if (!(capture.archive instanceof Uint8Array) || !(capture.gitDiff instanceof Uint8Array)) throw new Error("candidate task capture archive and gitDiff must be byte arrays");
-	const afterState = agentCandidateWorkspaceManifestMaterialSchema.parse(capture.afterState);
-	return Object.freeze({
-		kind: "workspace",
-		resultTree: capture.resultTree,
-		afterState: Object.freeze(afterState),
-		archive: Uint8Array.from(capture.archive),
-		gitDiff: Uint8Array.from(capture.gitDiff)
-	});
-}
-function requireRecord(value, label) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
-	return value;
-}
-//#endregion
-//#region src/candidate-execution/model-settlement.ts
-const USD_NANOS = 1e9;
-/** Validate and detach the evaluator gateway's terminal, revoked call ledger. */
-function sealAgentCandidateModelSettlement(settlement, expected) {
-	assertExactObjectKeys(settlement, [
-		"preparationId",
-		"grantDigest",
-		"closed",
-		"usageWithinLimits",
-		"calls"
-	], "model settlement");
-	if (settlement.closed !== true) throw new Error("protected model grant is not closed");
-	if (settlement.usageWithinLimits !== true) throw new Error("protected model settlement reports usage outside frozen limits");
-	if (settlement.grantDigest !== expected.grantDigest) throw new Error("protected model settlement grant digest does not match the reservation");
-	if (settlement.preparationId !== expected.preparationId) throw new Error("protected model settlement preparation does not match the reservation");
-	if (!Array.isArray(settlement.calls)) throw new Error("protected model settlement calls must be an array");
-	const callIds = /* @__PURE__ */ new Set();
-	const spanIds = /* @__PURE__ */ new Set();
-	let accountedInputTokens = 0;
-	let outputTokens = 0;
-	let cachedInputTokens = 0;
-	let reasoningTokens = 0;
-	let costUsdNanos = 0;
-	let costProvenance = "observed";
-	const calls = settlement.calls.map((source, index) => {
-		assertExactObjectKeys(source, [
-			"callId",
-			"generationId",
-			"traceSpanId",
-			"status",
-			"model",
-			"startedAtMs",
-			"endedAtMs",
-			"inputTokens",
-			"accountedInputTokens",
-			"outputTokens",
-			"cachedInputTokens",
-			"reasoningTokens",
-			"costUsdNanos",
-			"costProvenance"
-		], `model settlement call ${index}`);
-		assertIdentifier(source.callId, `model settlement call ${index} callId`);
-		assertIdentifier(source.generationId, `model settlement call ${index} generationId`);
-		assertIdentifier(source.traceSpanId, `model settlement call ${index} traceSpanId`);
-		if (source.traceSpanId !== source.generationId) throw new Error(`model settlement call ${index} traceSpanId is not its router generationId`);
-		if (source.status !== "succeeded" && source.status !== "failed") throw new Error(`model settlement call ${index} has an invalid status`);
-		if (callIds.has(source.callId)) throw new Error("protected model settlement has duplicate call ids");
-		if (spanIds.has(source.traceSpanId)) throw new Error("protected model settlement has duplicate trace span ids");
-		callIds.add(source.callId);
-		spanIds.add(source.traceSpanId);
-		if (source.model !== expected.model) throw new Error(`protected model settlement call ${index} has an unexpected model`);
-		assertTimestamp(source.startedAtMs, `model settlement call ${index} startedAtMs`);
-		assertTimestamp(source.endedAtMs, `model settlement call ${index} endedAtMs`);
-		if (source.endedAtMs < source.startedAtMs) throw new Error(`model settlement call ${index} ended before it started`);
-		assertCount(source.inputTokens, `model settlement call ${index} inputTokens`);
-		assertCount(source.accountedInputTokens, `model settlement call ${index} accountedInputTokens`);
-		if (source.accountedInputTokens < source.inputTokens) throw new Error(`model settlement call ${index} accountedInputTokens cannot be less than inputTokens`);
-		assertCount(source.outputTokens, `model settlement call ${index} outputTokens`);
-		assertCount(source.cachedInputTokens, `model settlement call ${index} cachedInputTokens`);
-		cachedInputTokens = safeAdd(cachedInputTokens, source.cachedInputTokens, "cached input token total");
-		assertCount(source.reasoningTokens, `model settlement call ${index} reasoningTokens`);
-		reasoningTokens = safeAdd(reasoningTokens, source.reasoningTokens, "reasoning token total");
-		assertCount(source.costUsdNanos, `model settlement call ${index} costUsdNanos`);
-		if (source.costProvenance !== "observed" && source.costProvenance !== "estimated") throw new Error(`model settlement call ${index} has an invalid cost provenance`);
-		if (source.costProvenance === "estimated") costProvenance = "estimated";
-		accountedInputTokens = safeAdd(accountedInputTokens, source.accountedInputTokens, "accounted input token total");
-		outputTokens = safeAdd(outputTokens, source.outputTokens, "output token total");
-		costUsdNanos = safeAdd(costUsdNanos, source.costUsdNanos, "cost total");
-		return Object.freeze({ ...source });
-	});
-	const usage = Object.freeze({
-		costUsdNanos,
-		inputTokens: accountedInputTokens,
-		outputTokens,
-		cachedInputTokens,
-		reasoningTokens,
-		modelCalls: calls.length,
-		costProvenance
-	});
-	return Object.freeze({
-		value: Object.freeze({
-			preparationId: settlement.preparationId,
-			grantDigest: settlement.grantDigest,
-			closed: true,
-			usageWithinLimits: true,
-			calls: Object.freeze(calls)
-		}),
-		usage
-	});
-}
-/**
-* Append the only accepted LLM spans from the router's closed ledger.
-* Candidate and executor code may write tool/process spans, but never model usage.
-*/
-async function appendAuthoritativeModelSettlementSpans(traceStore, runId, settlement) {
-	const run = await traceStore.getRun(runId);
-	if (!run) throw new Error(`protected trace run is missing before model settlement: ${runId}`);
-	if (run.status === "running" || run.endedAt === void 0) throw new Error("protected trace run must be terminal before model spans are appended");
-	const existing = await traceStore.spans({ runId });
-	if (existing.some(isLlmSpan)) throw new Error("protected trace contains a model span not authored from the closed router ledger");
-	const occupiedIds = new Set(existing.map((span) => span.spanId));
-	for (const call of settlement.value.calls) {
-		if (occupiedIds.has(call.traceSpanId)) throw new Error(`protected trace span identity collides with router generation ${call.generationId}`);
-		await traceStore.appendSpan({
-			runId,
-			spanId: call.traceSpanId,
-			kind: "llm",
-			name: "protected model call",
-			model: call.model,
-			messages: [],
-			startedAt: call.startedAtMs,
-			endedAt: call.endedAtMs,
-			status: call.status === "succeeded" ? "ok" : "error",
-			inputTokens: call.inputTokens,
-			outputTokens: call.outputTokens,
-			cachedTokens: call.cachedInputTokens,
-			reasoningTokens: call.reasoningTokens,
-			costUsd: call.costUsdNanos / USD_NANOS,
-			attributes: {
-				"tangle.protected_model.source": "router-settlement",
-				"tangle.router.call_id": call.callId,
-				"tangle.router.generation_id": call.generationId
-			}
-		});
-	}
-}
-/** Match every protected trace span one-for-one against gateway call evidence. */
-function assertTraceMatchesModelSettlement(spans, settlement) {
-	if (spans.length !== settlement.value.calls.length) throw new Error(`protected trace model calls ${spans.length} do not match model ledger ${settlement.value.calls.length}`);
-	const byId = new Map(spans.map((span) => [span.spanId, span]));
-	if (byId.size !== spans.length) throw new Error("protected trace has duplicate model span ids");
-	for (const call of settlement.value.calls) {
-		const span = byId.get(call.traceSpanId);
-		if (!span) throw new Error(`protected trace is missing model ledger span ${call.traceSpanId}`);
-		assertTraceCall(span, call);
-	}
-}
-function usdToNanos(value, label) {
-	if (!Number.isFinite(value) || value < 0) throw new Error(`${label} must be nonnegative`);
-	const nanos = Math.round(value * USD_NANOS);
-	if (!Number.isSafeInteger(nanos)) throw new Error(`${label} exceeds fixed-point range`);
-	return nanos;
-}
-function assertTraceCall(span, call) {
-	if (span.model !== call.model) throw new Error(`protected trace span ${span.spanId} model does not match model ledger`);
-	if (span.startedAt !== call.startedAtMs || span.endedAt !== call.endedAtMs || span.status !== (call.status === "succeeded" ? "ok" : "error")) throw new Error(`protected trace span ${span.spanId} timing or status does not match model ledger`);
-	if (span.attributes?.["tangle.protected_model.source"] !== "router-settlement" || span.attributes?.["tangle.router.call_id"] !== call.callId || span.attributes?.["tangle.router.generation_id"] !== call.generationId) throw new Error(`protected trace span ${span.spanId} lacks router settlement provenance`);
-	for (const [name, traced, settled] of [
-		[
-			"inputTokens",
-			span.inputTokens,
-			call.inputTokens
-		],
-		[
-			"outputTokens",
-			span.outputTokens,
-			call.outputTokens
-		],
-		[
-			"cachedInputTokens",
-			span.cachedTokens ?? 0,
-			call.cachedInputTokens
-		],
-		[
-			"reasoningTokens",
-			span.reasoningTokens ?? 0,
-			call.reasoningTokens
-		]
-	]) if (traced === void 0 || traced !== settled) throw new Error(`protected trace span ${span.spanId} ${name} ${traced} does not match model ledger ${settled}`);
-	if (span.costUsd === void 0) throw new Error(`protected trace span ${span.spanId} is missing costUsd`);
-	const tracedCost = usdToNanos(span.costUsd, `protected trace span ${span.spanId} costUsd`);
-	if (tracedCost !== call.costUsdNanos) throw new Error(`protected trace span ${span.spanId} costUsdNanos ${tracedCost} does not match model ledger ${call.costUsdNanos}`);
-}
-function assertIdentifier(value, label) {
-	if (typeof value !== "string" || value.length === 0 || value.length > 256) throw new Error(`${label} must be a non-empty bounded string`);
-}
-function assertCount(value, label) {
-	if (!Number.isSafeInteger(value) || value < 0) throw new Error(`${label} must be a nonnegative safe integer`);
-}
-function assertTimestamp(value, label) {
-	if (!Number.isSafeInteger(value) || value <= 0) throw new Error(`${label} must be a positive safe integer`);
+	if (typeof capture.resultTree !== "string" || !/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(capture.resultTree)) throw new Error("candidate task capture resultTree is not a Git object id");
+	if (!(capture.archive instanceof Uint8Array) || !(capture.gitDiff instanceof Uint8Array)) throw new Error("candidate task capture archive and gitDiff must be byte arrays");
+	const afterState = agentCandidateWorkspaceManifestMaterialSchema.parse(capture.afterState);
+	return Object.freeze({
+		kind: "workspace",
+		resultTree: capture.resultTree,
+		afterState: Object.freeze(afterState),
+		archive: Uint8Array.from(capture.archive),
+		gitDiff: Uint8Array.from(capture.gitDiff)
+	});
 }
-function safeAdd(left, right, label) {
-	const total = left + right;
-	if (!Number.isSafeInteger(total)) throw new Error(`${label} exceeds safe integer range`);
-	return total;
+function requireRecord(value, label) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`${label} must be an object`);
+	return value;
 }
 //#endregion
 //#region src/candidate-execution/finalize.ts
@@ -2286,6 +3100,22 @@ function normalizeEvaluation(evaluation, termination) {
 function assertUnitScore(value, label) {
 	if (typeof value !== "number" || !Number.isFinite(value) || value < 0 || value > 1) throw new Error(`${label} must be finite and within [0, 1]`);
 }
+async function persistFailureEvidence(state, reason, failureClass, termination, outputArtifacts) {
+	const bytes = canonicalCandidateBytes$1({
+		kind: "agent-candidate-execution-failure",
+		executionId: state.executionId,
+		bundleDigest: state.bundle.digest,
+		executionPlanDigest: state.executionPlan.value.digest,
+		failureClass,
+		reason,
+		...termination ? { termination } : {}
+	});
+	return await persistCandidateOutputArtifact(outputArtifacts, {
+		executionId: state.executionId,
+		purpose: "failure-evidence",
+		bytes
+	});
+}
 //#endregion
 //#region src/candidate-execution/protected-trace-store.ts
 /** Keep the identity key in evaluator-owned closures and expose only the redacting store to code. */
@@ -2337,55 +3167,6 @@ function createProtectedAgentCandidateTraceAccess(inner, protectedValues) {
 		report: () => redactor.report()
 	});
 }
-/** Recovery can read existing trace state but must never accept new unredactable writes. */
-var RecoveryAgentCandidateTraceStore = class {
-	inner;
-	constructor(inner) {
-		this.inner = inner;
-	}
-	appendRun() {
-		return this.rejectWrite();
-	}
-	updateRun() {
-		return this.rejectWrite();
-	}
-	appendSpan() {
-		return this.rejectWrite();
-	}
-	updateSpan() {
-		return this.rejectWrite();
-	}
-	appendEvent() {
-		return this.rejectWrite();
-	}
-	appendArtifact() {
-		return this.rejectWrite();
-	}
-	appendBudgetEntry() {
-		return this.rejectWrite();
-	}
-	getRun(...args) {
-		return this.inner.getRun(...args);
-	}
-	listRuns(...args) {
-		return this.inner.listRuns(...args);
-	}
-	spans(...args) {
-		return this.inner.spans(...args);
-	}
-	events(...args) {
-		return this.inner.events(...args);
-	}
-	budget(...args) {
-		return this.inner.budget(...args);
-	}
-	artifacts(...args) {
-		return this.inner.artifacts(...args);
-	}
-	rejectWrite() {
-		return Promise.reject(/* @__PURE__ */ new Error("expired candidate recovery cannot append trace evidence"));
-	}
-};
 //#endregion
 //#region src/candidate-execution/execute.ts
 /** Executes and finalizes one durably claimed candidate without exposing an unproven result. */
@@ -2791,22 +3572,6 @@ async function finishClaim(store, lease, terminal, deadlineAtMs) {
 		return false;
 	}
 }
-async function persistFailureEvidence(state, reason, failureClass, termination, outputArtifacts) {
-	const bytes = canonicalCandidateBytes$1({
-		kind: "agent-candidate-execution-failure",
-		executionId: state.executionId,
-		bundleDigest: state.bundle.digest,
-		executionPlanDigest: state.executionPlan.value.digest,
-		failureClass,
-		reason,
-		...termination ? { termination } : {}
-	});
-	return await persistCandidateOutputArtifact(outputArtifacts, {
-		executionId: state.executionId,
-		purpose: "failure-evidence",
-		bytes
-	});
-}
 function protectedEnvironmentValues(activation, memoryActivation) {
 	return [...Object.values(activation?.env ?? {}), ...Object.values(memoryActivation?.env ?? {})];
 }
@@ -2820,171 +3585,6 @@ var CandidateExecutionDeadlineError = class extends Error {
 	}
 };
 //#endregion
-//#region src/candidate-execution/verify.ts
-const verifiedCandidateState = /* @__PURE__ */ new WeakMap();
-/** Surfaces admitted by Runtime's verifier before an environment adapter is selected. */
-const AGENT_CANDIDATE_EXECUTION_SUPPORT = Object.freeze({
-	outcomes: Object.freeze(["workspace", "output"]),
-	code: Object.freeze([
-		"disabled",
-		"no-op",
-		"git-patch"
-	]),
-	memory: Object.freeze(["disabled", "isolated"]),
-	knowledge: true,
-	profile: Object.freeze({
-		mcpTransports: Object.freeze(["stdio"]),
-		remoteMcp: false,
-		tools: false,
-		permissions: false,
-		modes: false,
-		confidential: false
-	})
-});
-/** Verifies every digest, resource, workspace, and Git object in a candidate bundle. */
-async function verifyAgentCandidateBundle(input, ports) {
-	const parsed = agentCandidateBundleSchema.parse(input);
-	const withoutDigest = omitTopLevelDigest(parsed);
-	const actualDigest = canonicalCandidateDigest$1(withoutDigest);
-	if (actualDigest !== parsed.digest) throw new Error(`candidate bundle digest ${parsed.digest} does not match ${actualDigest}`);
-	const canonicalBytes = canonicalCandidateBytes$1(withoutDigest);
-	verifyBytes(canonicalBytes, parsed.digest, canonicalBytes.byteLength, "candidate bundle");
-	assertCandidateProfileExecutionSupport(parsed.profile);
-	const artifactBytes = /* @__PURE__ */ new Map();
-	const readArtifact = async (artifact) => {
-		const key = artifactCacheKey(artifact);
-		const existing = artifactBytes.get(key);
-		if (existing) return Uint8Array.from(existing);
-		const bytes = await readVerifiedArtifact(artifact, ports.artifacts);
-		artifactBytes.set(key, Uint8Array.from(bytes));
-		return bytes;
-	};
-	let patchBytes;
-	if (parsed.code.kind === "git-patch") patchBytes = await readArtifact(parsed.code.patch.artifact);
-	const materializedTree = await verifyCandidateCode(parsed.code, ports.repositories, patchBytes);
-	const resourceBytes = /* @__PURE__ */ new Map();
-	for (const resource of candidateResources(parsed)) {
-		const bytes = resource.kind === "inline" ? Buffer.from(resource.content, "utf8") : await readCandidateGitHubResource(resource, ports.repositories);
-		verifyBytes(bytes, resource.sha256, resource.byteLength, `candidate resource ${resource.name ?? (resource.kind === "github" ? resource.path : "<unnamed>")}`);
-		resourceBytes.set(resourceKey(resource), Uint8Array.from(bytes));
-		resourceBytes.set(resource.sha256, Uint8Array.from(bytes));
-	}
-	if (parsed.execution.workspace) {
-		const workspace = await verifyWorkspaceSnapshotArtifacts(parsed.execution.workspace, ports.artifacts);
-		artifactBytes.set(artifactCacheKey(parsed.execution.workspace.manifest), workspace.manifest);
-		artifactBytes.set(artifactCacheKey(parsed.execution.workspace.archive), workspace.archive);
-	}
-	if (parsed.knowledge) {
-		const knowledge = await verifyWorkspaceSnapshotArtifacts(parsed.knowledge.snapshot, ports.artifacts);
-		artifactBytes.set(artifactCacheKey(parsed.knowledge.snapshot.manifest), knowledge.manifest);
-		artifactBytes.set(artifactCacheKey(parsed.knowledge.snapshot.archive), knowledge.archive);
-		if (parsed.knowledge.retrievalConfig) await readArtifact(parsed.knowledge.retrievalConfig);
-		await readArtifact(parsed.knowledge.evaluation);
-	}
-	if (parsed.memory.mode === "isolated" && parsed.memory.seed) await readArtifact(parsed.memory.seed);
-	deepFreezeCandidate(parsed);
-	const verified = Object.freeze({
-		bundle: parsed,
-		...materializedTree === void 0 ? {} : { materializedTree },
-		[verifiedCandidateBrand]: true
-	});
-	verifiedCandidateState.set(verified, {
-		ports,
-		artifactBytes,
-		resourceBytes
-	});
-	return verified;
-}
-function getVerifiedCandidateState(candidate) {
-	const state = verifiedCandidateState.get(candidate);
-	if (!state || candidate[verifiedCandidateBrand] !== true) throw new Error("candidate must come from verifyAgentCandidateBundle");
-	return state;
-}
-async function verifiedArtifactBytes(candidate, artifact) {
-	const state = getVerifiedCandidateState(candidate);
-	const key = artifactCacheKey(artifact);
-	const existing = state.artifactBytes.get(key);
-	if (existing) return Uint8Array.from(existing);
-	const bytes = await readVerifiedArtifact(artifact, state.ports.artifacts);
-	state.artifactBytes.set(key, Uint8Array.from(bytes));
-	return bytes;
-}
-function verifiedResourceTextByDigest(candidate) {
-	const output = /* @__PURE__ */ new Map();
-	for (const resource of candidateResources(candidate.bundle)) {
-		const bytes = getVerifiedCandidateState(candidate).resourceBytes.get(resource.sha256);
-		if (!bytes) throw new Error(`candidate resource digest was not verified: ${resource.sha256}`);
-		output.set(resource.sha256, new TextDecoder("utf-8", { fatal: true }).decode(bytes));
-	}
-	return output;
-}
-function candidateResources(bundle) {
-	const resources = bundle.profile.resources;
-	if (!resources) return [];
-	const output = [];
-	for (const mount of resources.files ?? []) output.push(mount.resource);
-	output.push(...resources.tools ?? []);
-	output.push(...resources.skills ?? []);
-	output.push(...resources.agents ?? []);
-	output.push(...resources.commands ?? []);
-	if (typeof resources.instructions === "object") output.push(resources.instructions);
-	return output;
-}
-function resourceKey(resource) {
-	return canonicalCandidateDigest$1(resource);
-}
-//#endregion
-//#region src/candidate-execution/knowledge.ts
-/** Environment variable containing the materialized candidate knowledge root. */
-const CANDIDATE_KNOWLEDGE_ROOT_ENV = "TANGLE_CANDIDATE_KNOWLEDGE_ROOT";
-/** Environment variable containing the materialized retrieval configuration path. */
-const CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV = "TANGLE_CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG";
-/** Deterministic, signed locations used by every candidate executor. */
-function candidateKnowledgeExecutionPaths(taskRoot, hasRetrievalConfig) {
-	if (!posix.isAbsolute(taskRoot) || posix.normalize(taskRoot) !== taskRoot) throw new Error("candidate knowledge requires a normalized absolute task root");
-	const parent = posix.join(taskRoot, ".tangle");
-	return {
-		root: posix.join(parent, "knowledge"),
-		...hasRetrievalConfig ? { retrievalConfig: posix.join(parent, "knowledge-retrieval-config.json") } : {}
-	};
-}
-/** Verify and detach the exact file-backed knowledge admitted by the bundle. */
-async function prepareAgentCandidateKnowledge(candidate, ports, arm) {
-	const knowledge = candidate.bundle.knowledge;
-	if (!knowledge) return void 0;
-	const archive = await verifiedArtifactBytes(candidate, knowledge.snapshot.archive);
-	const retrievalConfig = knowledge.retrievalConfig ? await verifiedArtifactBytes(candidate, knowledge.retrievalConfig) : void 0;
-	const root = await mkdtemp(join(tmpdir(), "agent-candidate-knowledge-"));
-	try {
-		await ports.workspaces.materialize({
-			role: "knowledge",
-			snapshot: knowledge.snapshot,
-			archive,
-			destination: root
-		});
-		const expectedHash = arm === "baseline" ? knowledge.candidate.baseHash : knowledge.candidate.candidateHash;
-		const actualHash = `sha256:${await hashKnowledgeBase(root, knowledge.stateScope)}`;
-		if (actualHash !== expectedHash) throw new Error(`materialized ${arm} knowledge does not match its measured content: expected ${expectedHash}, got ${actualHash}`);
-		const files = await readMaterializedWorkspaceFiles(root, knowledge.snapshot.material);
-		return Object.freeze({
-			candidate: knowledge.candidate,
-			...knowledge.stateScope ? { stateScope: Object.freeze({ ...knowledge.stateScope }) } : {},
-			snapshot: knowledge.snapshot,
-			files: Object.freeze(files.map((file) => Object.freeze({
-				path: file.path,
-				mode: file.mode,
-				bytes: Uint8Array.from(file.bytes)
-			}))),
-			...retrievalConfig ? { retrievalConfig: Uint8Array.from(retrievalConfig) } : {}
-		});
-	} finally {
-		await rm(root, {
-			recursive: true,
-			force: true
-		});
-	}
-}
-//#endregion
 //#region src/candidate-execution/prepare.ts
 const MIN_RESERVATION_TTL_MS = 15 * 6e4;
 const PREPARED_HOLD_MARGIN_MS = 5 * 6e4;
@@ -3454,32 +4054,6 @@ async function prepareMemory(candidate, task, ports, preparationId, expiresAtMs,
 		throw error;
 	}
 }
-function buildLaunch(candidate, task, profileFlags) {
-	const launch = candidate.bundle.execution.launch;
-	if (launch.kind === "container-command") return {
-		executable: launch.executable,
-		args: [...launch.args ?? [], ...profileFlags]
-	};
-	const candidateRoot = task.executionRoots.candidateRoot;
-	if (!candidateRoot) throw new Error("candidate entrypoint requires a container candidate root");
-	const entrypoint = posix.join(candidateRoot, launch.entrypoint);
-	const candidateArgs = launch.args ?? [];
-	if (launch.interpreter) return {
-		executable: launch.interpreter,
-		args: [
-			{
-				kind: "public",
-				value: entrypoint
-			},
-			...candidateArgs,
-			...profileFlags
-		]
-	};
-	return {
-		executable: entrypoint,
-		args: [...candidateArgs, ...profileFlags]
-	};
-}
 function mergePublicEnvironment(...records) {
 	const output = {};
 	for (const record of records) for (const [name, value] of Object.entries(record)) {
@@ -3493,50 +4067,6 @@ function mergePublicEnvironment(...records) {
 function unwrapPublicEnvironment(values) {
 	return Object.fromEntries(Object.entries(values).map(([name, value]) => [name, requirePublicCandidateConfigValue(value, `env.${name}`)]));
 }
-function modelRoutes(profile, requested) {
-	const routes = [{
-		kind: "primary",
-		requested
-	}];
-	if (profile.model?.small) routes.push({
-		kind: "small",
-		requested
-	});
-	for (const name of Object.keys(profile.modes ?? {}).sort()) if (profile.modes?.[name]?.model) routes.push({
-		kind: "mode",
-		name,
-		requested
-	});
-	for (const name of Object.keys(profile.subagents ?? {}).sort()) if (profile.subagents?.[name]?.model) routes.push({
-		kind: "subagent",
-		name,
-		requested
-	});
-	return routes;
-}
-function candidateEntrypointReceipt(candidate) {
-	const launch = candidate.bundle.execution.launch;
-	const workspace = candidate.bundle.execution.workspace;
-	if (launch.kind !== "candidate-entrypoint" || !workspace) return void 0;
-	const file = workspace.material.files.find((entry) => entry.path === launch.entrypoint);
-	if (!file) throw new Error("candidate entrypoint is absent from the verified workspace");
-	return {
-		path: file.path,
-		sha256: file.sha256,
-		byteLength: file.byteLength
-	};
-}
-function absoluteExecutionCwd(cwd, roots) {
-	const root = workspaceExecutionRoot(cwd.workspace, roots);
-	const absolute = cwd.path === "." ? root : posix.join(root, cwd.path);
-	if (absolute !== root && !absolute.startsWith(`${root}/`)) throw new Error("candidate cwd escapes its execution workspace");
-	return absolute;
-}
-function workspaceExecutionRoot(workspace, roots) {
-	const root = workspace === "task" ? roots.taskRoot : roots.candidateRoot;
-	if (!root) throw new Error(`candidate ${workspace} workspace root is missing`);
-	return root;
-}
 function validateProtectedModelReservation(reservation, expectedLimits, preparationId, expiresAtMs) {
 	if (!/^sha256:[a-f0-9]{64}$/.test(reservation.digest)) throw new Error("protected model reservation has an invalid identity digest");
 	if (reservation.preparationId !== preparationId || reservation.expiresAtMs !== expiresAtMs) throw new Error("protected model reservation is not scoped to this preparation");
@@ -3552,34 +4082,7 @@ function assertEnvironmentDisjoint(publicEnv, traceEnv) {
 		seen.add(name);
 	}
 }
-function modelLimits(limits) {
-	return {
-		maxModelCalls: limits.maxModelCalls,
-		maxInputTokens: limits.maxInputTokens,
-		maxOutputTokens: limits.maxOutputTokens,
-		maxCostUsd: limits.maxCostUsd
-	};
-}
-function exactProfileExecutorFiles(sourceFiles, expectedFiles) {
-	const byIdentity = new Map(sourceFiles.map((file) => [profileFileIdentity(file.root, file.relPath), file]));
-	if (byIdentity.size !== sourceFiles.length || sourceFiles.length !== expectedFiles.length) throw new Error("profile source files do not match the signed profile plan");
-	return expectedFiles.map((expected) => {
-		const source = byIdentity.get(profileFileIdentity(expected.root, expected.relPath));
-		const mode = source?.mode ?? 420;
-		const bytes = Buffer.from(source?.content ?? "", "utf8");
-		if (!source || !Number.isInteger(mode) || mode < 0 || mode > 511 || mode !== expected.mode || sha256Bytes$1(bytes) !== expected.contentSha256) throw new Error("profile source files do not match the signed profile plan");
-		return {
-			path: expected.relPath,
-			mode,
-			...expected.root === "agent" ? { root: "agent" } : {},
-			bytes: Uint8Array.from(bytes)
-		};
-	});
-}
-function profileFileIdentity(root, relPath) {
-	return `${root ?? "workspace"}\0${relPath}`;
-}
 //#endregion
-export { recoveredTerminalRecord as A, candidateCleanupDeadline as C, assertTerminalAllowedInPhase as D, assertRecoveryMatchesStaged as E, terminalRecord as F, rejectedStage as M, requireStagedTerminal as N, assertTerminalMatchesClaim as O, sealTerminalDigest as P, candidateClaimFileInternals as S, withinCandidateCleanupDeadline as T, consumePreparedCandidateExecution as _, AGENT_CANDIDATE_EXECUTION_SUPPORT as a, assertAgentCandidateExecutionRoots as b, executePreparedAgentCandidate as c, sealAgentCandidateModelSettlement as d, usdToNanos as f, beginPreparedCandidateDisposal as g, assertPreparedCandidateIntegrity as h, candidateKnowledgeExecutionPaths as i, rejectedFinish as j, assertTerminalMatchesStaged as k, RecoveryAgentCandidateTraceStore as l, candidateExecutionClaim as m, CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV as n, verifiedResourceTextByDigest as o, sealAgentCandidateExecutorStopAcknowledgement as p, CANDIDATE_KNOWLEDGE_ROOT_ENV as r, verifyAgentCandidateBundle as s, prepareAgentCandidateExecution as t, persistCandidateModelSettlementEvidence as u, CANDIDATE_TRACE_ENV as v, candidateCleanupTimeout as w, InMemoryAgentCandidateExecutionClaimStore as x, CANDIDATE_TRACE_TAGS as y };
+export { verifiedResourceTextByDigest as C, AGENT_CANDIDATE_EXECUTION_SUPPORT as S, sealTerminalDigest as _, consumePreparedCandidateExecution as a, sealAgentCandidateModelSettlement as b, withinCandidateCleanupDeadline as c, assertTerminalMatchesClaim as d, assertTerminalMatchesStaged as f, requireStagedTerminal as g, rejectedStage as h, beginPreparedCandidateDisposal as i, assertRecoveryMatchesStaged as l, rejectedFinish as m, executePreparedAgentCandidate as n, candidateClaimFileInternals as o, recoveredTerminalRecord as p, assertPreparedCandidateIntegrity as r, candidateCleanupDeadline as s, prepareAgentCandidateExecution as t, assertTerminalAllowedInPhase as u, terminalRecord as v, verifyAgentCandidateBundle as w, exactProcessProviderAsCandidateExecutor as x, createProtectedAgentCandidateModelPort as y };
 
-//# sourceMappingURL=prepare-CER-ZkPp.js.map
+//# sourceMappingURL=prepare-bXkvPMJA.js.map