@tangle-network/agent-runtime 0.90.1 → 0.92.0

package/dist/chunk-A62TP7SK.js

@@ -0,0 +1,4784 @@
+import {
+  contentAddress
+} from "./chunk-3D2RHC4K.js";
+
+// src/candidate-execution/types.ts
+var verifiedCandidateBrand = /* @__PURE__ */ Symbol("verifiedAgentCandidate");
+var preparedCandidateBrand = /* @__PURE__ */ Symbol("preparedAgentCandidate");
+var verifiedTaskOutcomeBrand = /* @__PURE__ */ Symbol("verifiedTaskOutcome");
+var CANDIDATE_TRACE_TAGS = {
+  executionId: "tangle.candidate.execution_id",
+  bundleDigest: "tangle.candidate.bundle_digest",
+  executionPlanDigest: "tangle.candidate.execution_plan_digest",
+  materializationReceiptDigest: "tangle.candidate.materialization_receipt_digest"
+};
+var CANDIDATE_TRACE_ENV = {
+  executionId: "TANGLE_CANDIDATE_EXECUTION_ID",
+  bundleDigest: "TANGLE_CANDIDATE_BUNDLE_DIGEST",
+  executionPlanDigest: "TANGLE_CANDIDATE_EXECUTION_PLAN_DIGEST",
+  materializationReceiptDigest: "TANGLE_CANDIDATE_MATERIALIZATION_RECEIPT_DIGEST",
+  traceRunId: "TANGLE_TRACE_RUN_ID"
+};
+
+// src/candidate-execution/claim.ts
+import { createHash as createHash2, randomBytes, timingSafeEqual } from "crypto";
+import { readFile } from "fs/promises";
+import {
+  agentCandidateResolvedModelSchema
+} from "@tangle-network/agent-interface";
+
+// src/candidate-execution/claim-file-formats.ts
+var CLAIM_FORMAT_VERSION = 7;
+var PENDING_FORMAT_VERSION = 1;
+var TERMINAL_FORMAT_VERSION = 3;
+var PHASE_FORMAT_VERSION = 1;
+
+// src/candidate-execution/claim-terminal.ts
+import { agentCandidateArtifactRefSchema } from "@tangle-network/agent-interface";
+
+// src/candidate-execution/digest.ts
+import { createHash } from "crypto";
+import { canonicalJson } from "@tangle-network/agent-eval";
+function sha256Bytes(bytes) {
+  return `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+}
+function canonicalCandidateBytes(value) {
+  return Buffer.from(canonicalJson(value), "utf8");
+}
+function canonicalCandidateDigest(value) {
+  return contentAddress(value);
+}
+function immutableCandidateValue(value) {
+  return deepFreezeCandidate(
+    JSON.parse(Buffer.from(canonicalCandidateBytes(value)).toString("utf8"))
+  );
+}
+function canonicalCandidateDocument(valueWithoutDigest) {
+  const bytes = canonicalCandidateBytes(valueWithoutDigest);
+  const digest = canonicalCandidateDigest(valueWithoutDigest);
+  if (sha256Bytes(bytes) !== digest) {
+    throw new Error("canonical candidate serializers disagree on document digest");
+  }
+  const storedBytes = Uint8Array.from(bytes);
+  const value = immutableCandidateValue({ ...valueWithoutDigest, digest });
+  return Object.freeze({
+    value,
+    get bytes() {
+      return Uint8Array.from(storedBytes);
+    },
+    digest
+  });
+}
+function embeddedCandidateArtifact(bytes) {
+  return {
+    encoding: "base64",
+    content: Buffer.from(bytes).toString("base64"),
+    sha256: sha256Bytes(bytes),
+    byteLength: bytes.byteLength
+  };
+}
+function omitTopLevelDigest(value) {
+  const { digest: _digest, ...rest } = value;
+  return rest;
+}
+function deepFreezeCandidate(value, seen = /* @__PURE__ */ new Set()) {
+  if (value === null || typeof value !== "object" || ArrayBuffer.isView(value) || seen.has(value)) {
+    return value;
+  }
+  seen.add(value);
+  for (const child of Object.values(value)) {
+    deepFreezeCandidate(child, seen);
+  }
+  return Object.freeze(value);
+}
+
+// src/candidate-execution/exact-object.ts
+function assertExactObjectKeys(value, required, label, optional = []) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${label} must be an object`);
+  }
+  const allowed = /* @__PURE__ */ new Set([...required, ...optional]);
+  if (allowed.size !== required.length + optional.length) {
+    throw new Error(`${label} exact-key contract contains duplicate fields`);
+  }
+  for (const key of Object.keys(value)) {
+    if (!allowed.has(key)) throw new Error(`${label} contains unknown field ${key}`);
+  }
+  for (const key of required) {
+    if (!(key in value)) throw new Error(`${label} is missing field ${key}`);
+  }
+}
+
+// src/candidate-execution/claim-terminal.ts
+var SHA256_PATTERN = /^sha256:[a-f0-9]{64}$/;
+function terminalRecord(claim, result) {
+  const terminal = sealTerminalResult(result);
+  const value = {
+    executionId: claim.executionId,
+    attempt: claim.attempt,
+    bundleDigest: claim.bundleDigest,
+    executionPlanDigest: claim.executionPlanDigest,
+    ...terminal
+  };
+  return immutableCandidateValue({
+    ...value,
+    terminalDigest: canonicalCandidateDigest(value)
+  });
+}
+function recoveredTerminalRecord(claim, phase, evidence) {
+  const recovered = sealRecoveryEvidence(evidence, claim);
+  return terminalRecord(claim, {
+    schemaVersion: 1,
+    status: "failed",
+    failureClass: recovered.failureClass === "pre-model-infrastructure" && phase !== "claimed" ? "unknown" : recovered.failureClass,
+    usage: recovered.usage,
+    modelSettlement: recovered.modelSettlement,
+    ...recovered.failureEvidence ? { failureEvidence: recovered.failureEvidence } : {}
+  });
+}
+function assertTerminalAllowedInPhase(phase, terminal) {
+  if (phase === "candidate-may-run" && terminal.status === "failed" && terminal.failureClass === "pre-model-infrastructure") {
+    throw new Error("candidate execution crossed candidate-may-run before pre-model failure");
+  }
+  if (phase === "claimed" && (terminal.status === "succeeded" || terminal.status === "failed" && (terminal.failureClass === "execution" || terminal.failureClass === "post-model-infrastructure"))) {
+    throw new Error("candidate execution terminal requires candidate-may-run phase");
+  }
+}
+function rejectedFinish(existing, requestedTerminalDigest) {
+  return Object.freeze({
+    finished: false,
+    terminal: existing,
+    exactReplay: existing.terminalDigest === requestedTerminalDigest
+  });
+}
+function rejectedStage(existing, requested) {
+  return Object.freeze({
+    staged: false,
+    terminal: existing,
+    exactReplay: existing.terminalDigest === requested.terminalDigest
+  });
+}
+function requireStagedTerminal(staged, terminalDigest) {
+  if (!staged) throw new Error("candidate execution terminal has not been staged");
+  if (staged.terminalDigest !== terminalDigest) {
+    throw new Error("candidate execution terminal digest does not match staged outbox");
+  }
+  return staged;
+}
+function sealTerminalDigest(value) {
+  assertSha256Digest(value, "terminalDigest");
+  return value;
+}
+function assertRecoveryMatchesStaged(staged, recovered) {
+  if (canonicalCandidateDigest(staged.usage) !== canonicalCandidateDigest(recovered.usage) || canonicalCandidateDigest(staged.modelSettlement) !== canonicalCandidateDigest(recovered.modelSettlement)) {
+    throw new Error("candidate execution recovery evidence does not match staged model evidence");
+  }
+}
+function sealTerminalRecordValue(value, label) {
+  const status = requireTerminalStatus(value.status, label);
+  assertExactObjectKeys(
+    value,
+    status === "succeeded" ? [
+      "executionId",
+      "attempt",
+      "bundleDigest",
+      "executionPlanDigest",
+      "terminalDigest",
+      "schemaVersion",
+      "status",
+      "usage",
+      "modelSettlement",
+      "taskOutcome",
+      "benchmarkResult",
+      "runReceipt"
+    ] : [
+      "executionId",
+      "attempt",
+      "bundleDigest",
+      "executionPlanDigest",
+      "terminalDigest",
+      "schemaVersion",
+      "status",
+      "failureClass",
+      "usage",
+      "modelSettlement",
+      ...value.failureEvidence ? ["failureEvidence"] : []
+    ],
+    label
+  );
+  const identity = {
+    executionId: requireString(value.executionId, label, "executionId"),
+    attempt: requireNumber(value.attempt, label, "attempt"),
+    bundleDigest: requireString(value.bundleDigest, label, "bundleDigest"),
+    executionPlanDigest: requireString(
+      value.executionPlanDigest,
+      label,
+      "executionPlanDigest"
+    )
+  };
+  assertExecutionId(identity.executionId);
+  if (!Number.isSafeInteger(identity.attempt) || identity.attempt < 1) {
+    throw new Error(`${label} has invalid attempt`);
+  }
+  assertSha256Digest(identity.bundleDigest, "bundleDigest");
+  assertSha256Digest(identity.executionPlanDigest, "executionPlanDigest");
+  const result = sealTerminalResult(
+    status === "succeeded" ? {
+      schemaVersion: requireNumber(value.schemaVersion, label, "schemaVersion"),
+      status,
+      usage: requireObject(
+        value.usage,
+        label,
+        "usage"
+      ),
+      modelSettlement: requireArtifactRef(value.modelSettlement, label, "modelSettlement"),
+      taskOutcome: requireArtifactRef(value.taskOutcome, label, "taskOutcome"),
+      benchmarkResult: requireArtifactRef(value.benchmarkResult, label, "benchmarkResult"),
+      runReceipt: requireArtifactRef(value.runReceipt, label, "runReceipt")
+    } : {
+      schemaVersion: requireNumber(value.schemaVersion, label, "schemaVersion"),
+      status,
+      failureClass: requireFailureClass(value.failureClass, label),
+      usage: requireObject(
+        value.usage,
+        label,
+        "usage"
+      ),
+      modelSettlement: requireArtifactRef(value.modelSettlement, label, "modelSettlement"),
+      ...value.failureEvidence ? {
+        failureEvidence: requireArtifactRef(
+          value.failureEvidence,
+          label,
+          "failureEvidence"
+        )
+      } : {}
+    }
+  );
+  const material = { ...identity, ...result };
+  const terminalDigest = requireString(
+    value.terminalDigest,
+    label,
+    "terminalDigest"
+  );
+  assertSha256Digest(terminalDigest, "terminalDigest");
+  if (terminalDigest !== canonicalCandidateDigest(material)) {
+    throw new Error(`${label} has invalid terminalDigest`);
+  }
+  return immutableCandidateValue({
+    ...material,
+    terminalDigest
+  });
+}
+function assertTerminalMatchesClaim(terminal, claim, path) {
+  if (terminal.executionId !== claim.executionId || terminal.attempt !== claim.attempt || terminal.bundleDigest !== claim.bundleDigest || terminal.executionPlanDigest !== claim.executionPlanDigest) {
+    throw new Error(`candidate execution terminal record at ${path} does not match its claim`);
+  }
+}
+function assertTerminalMatchesStaged(terminal, staged, path) {
+  if (terminal.terminalDigest !== staged.terminalDigest || canonicalCandidateDigest(terminal) !== canonicalCandidateDigest(staged)) {
+    throw new Error(`candidate execution terminal record at ${path} differs from staged outbox`);
+  }
+}
+function sealRecoveryEvidence(evidence, claim) {
+  assertExactObjectKeys(
+    evidence,
+    [
+      "failureClass",
+      "usage",
+      "modelSettlement",
+      "process",
+      "model",
+      ...evidence.failureEvidence ? ["failureEvidence"] : [],
+      ...evidence.memory ? ["memory"] : []
+    ],
+    "candidate execution recovery evidence"
+  );
+  assertFailureClass(evidence.failureClass);
+  const usage = sealUsage(evidence.usage);
+  if (evidence.failureClass === "pre-model-infrastructure" && usage.modelCalls !== 0) {
+    throw new Error("pre-model infrastructure failure cannot contain model calls");
+  }
+  const modelSettlement = sealArtifactRef(evidence.modelSettlement, "modelSettlement");
+  const failureEvidence = evidence.failureEvidence ? sealArtifactRef(evidence.failureEvidence, "failureEvidence") : void 0;
+  assertExactObjectKeys(
+    evidence.process,
+    ["stopped", "executionPlanDigest"],
+    "candidate execution process closure evidence"
+  );
+  if (evidence.process.stopped !== true || evidence.process.executionPlanDigest !== claim.executionPlanDigest) {
+    throw new Error("candidate execution recovery does not prove the claimed process stopped");
+  }
+  assertExactObjectKeys(
+    evidence.model,
+    ["closed", "preparationId", "grantDigest"],
+    "candidate execution model closure evidence"
+  );
+  if (evidence.model.closed !== true || evidence.model.preparationId !== claim.cleanup.preparationId || evidence.model.grantDigest !== claim.cleanup.modelGrantDigest) {
+    throw new Error("candidate execution recovery does not prove the claimed model grant closed");
+  }
+  if (claim.cleanup.memory) {
+    if (!evidence.memory) {
+      throw new Error("candidate execution recovery is missing memory closure evidence");
+    }
+    assertExactObjectKeys(
+      evidence.memory,
+      ["closed", "preparationId", "accessDigest", "effectiveNamespace"],
+      "candidate execution memory closure evidence"
+    );
+    if (evidence.memory.closed !== true || evidence.memory.preparationId !== claim.cleanup.preparationId || evidence.memory.accessDigest !== claim.cleanup.memory.accessDigest || evidence.memory.effectiveNamespace !== claim.cleanup.memory.effectiveNamespace) {
+      throw new Error(
+        "candidate execution recovery does not prove the claimed memory access closed"
+      );
+    }
+  } else if (evidence.memory !== void 0) {
+    throw new Error("candidate execution recovery has unexpected memory closure evidence");
+  }
+  return Object.freeze({
+    failureClass: evidence.failureClass,
+    usage,
+    modelSettlement,
+    ...failureEvidence ? { failureEvidence } : {},
+    process: Object.freeze({ ...evidence.process }),
+    model: Object.freeze({ ...evidence.model }),
+    ...evidence.memory ? { memory: Object.freeze({ ...evidence.memory }) } : {}
+  });
+}
+function sealTerminalResult(result) {
+  if (result.status !== "succeeded" && result.status !== "failed") {
+    throw new Error("candidate execution terminal status is invalid");
+  }
+  assertExactObjectKeys(
+    result,
+    result.status === "succeeded" ? [
+      "schemaVersion",
+      "status",
+      "usage",
+      "modelSettlement",
+      "taskOutcome",
+      "benchmarkResult",
+      "runReceipt"
+    ] : [
+      "schemaVersion",
+      "status",
+      "failureClass",
+      "usage",
+      "modelSettlement",
+      ...result.failureEvidence ? ["failureEvidence"] : []
+    ],
+    "candidate execution terminal result"
+  );
+  if (result.schemaVersion !== 1) {
+    throw new Error("candidate execution terminal schemaVersion must be 1");
+  }
+  const usage = sealUsage(result.usage);
+  const modelSettlement = sealArtifactRef(result.modelSettlement, "modelSettlement");
+  if (result.status === "succeeded") {
+    return Object.freeze({
+      schemaVersion: 1,
+      status: "succeeded",
+      usage,
+      modelSettlement,
+      taskOutcome: sealArtifactRef(result.taskOutcome, "taskOutcome"),
+      benchmarkResult: sealArtifactRef(result.benchmarkResult, "benchmarkResult"),
+      runReceipt: sealArtifactRef(result.runReceipt, "runReceipt")
+    });
+  }
+  assertFailureClass(result.failureClass);
+  if (result.failureClass === "pre-model-infrastructure" && usage.modelCalls !== 0) {
+    throw new Error("pre-model infrastructure failure cannot contain model calls");
+  }
+  return Object.freeze({
+    schemaVersion: 1,
+    status: "failed",
+    failureClass: result.failureClass,
+    usage,
+    modelSettlement,
+    ...result.failureEvidence ? { failureEvidence: sealArtifactRef(result.failureEvidence, "failureEvidence") } : {}
+  });
+}
+function sealUsage(usage) {
+  assertExactObjectKeys(
+    usage,
+    [
+      "costUsdNanos",
+      "inputTokens",
+      "outputTokens",
+      "cachedInputTokens",
+      "reasoningTokens",
+      "modelCalls"
+    ],
+    "candidate execution terminal usage"
+  );
+  for (const [field, value] of Object.entries(usage)) {
+    assertCount(value, `terminal usage ${field}`);
+  }
+  return Object.freeze({
+    costUsdNanos: usage.costUsdNanos,
+    inputTokens: usage.inputTokens,
+    outputTokens: usage.outputTokens,
+    cachedInputTokens: usage.cachedInputTokens,
+    reasoningTokens: usage.reasoningTokens,
+    modelCalls: usage.modelCalls
+  });
+}
+function sealArtifactRef(ref, label) {
+  const parsed = agentCandidateArtifactRefSchema.parse(ref);
+  if (!Number.isSafeInteger(parsed.byteLength)) {
+    throw new Error(`candidate execution terminal ${label} byteLength exceeds safe integer range`);
+  }
+  return immutableCandidateValue(parsed);
+}
+function requireArtifactRef(value, path, field) {
+  return requireObject(value, path, field);
+}
+function requireString(value, path, field) {
+  if (typeof value !== "string") {
+    throw new Error(`candidate execution record at ${path} has invalid ${field}`);
+  }
+  return value;
+}
+function requireNumber(value, path, field) {
+  if (typeof value !== "number") {
+    throw new Error(`candidate execution record at ${path} has invalid ${field}`);
+  }
+  return value;
+}
+function requireObject(value, path, field) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`candidate execution record at ${path} has invalid ${field}`);
+  }
+  return value;
+}
+function requireTerminalStatus(value, path) {
+  if (value !== "succeeded" && value !== "failed") {
+    throw new Error(`candidate execution terminal record at ${path} has invalid status`);
+  }
+  return value;
+}
+function requireFailureClass(value, path) {
+  try {
+    assertFailureClass(value);
+    return value;
+  } catch (error) {
+    throw new Error(`candidate execution terminal record at ${path} has invalid failureClass`, {
+      cause: error
+    });
+  }
+}
+function assertFailureClass(value) {
+  if (value !== "pre-model-infrastructure" && value !== "execution" && value !== "post-model-infrastructure" && value !== "unknown") {
+    throw new Error("candidate execution failureClass is invalid");
+  }
+}
+function assertExecutionId(value) {
+  if (typeof value !== "string" || !/^[A-Za-z0-9._:-]{1,200}$/.test(value)) {
+    throw new Error("candidate execution claim executionId is invalid");
+  }
+}
+function assertSha256Digest(value, field) {
+  if (!SHA256_PATTERN.test(value)) {
+    throw new Error(`candidate execution claim ${field} must be a lowercase sha256 digest`);
+  }
+}
+function assertCount(value, label) {
+  if (!Number.isSafeInteger(value) || value < 0) {
+    throw new Error(`candidate execution ${label} must be a non-negative safe integer`);
+  }
+}
+
+// src/candidate-execution/cleanup.ts
+var DEFAULT_CANDIDATE_CLEANUP_TIMEOUT_MS = 3e4;
+var MAX_CANDIDATE_TIMER_INTERVAL_MS = 2147483647;
+function candidateCleanupTimeout(timeoutMs) {
+  const effective = timeoutMs ?? DEFAULT_CANDIDATE_CLEANUP_TIMEOUT_MS;
+  if (!Number.isSafeInteger(effective) || effective <= 0 || effective > MAX_CANDIDATE_TIMER_INTERVAL_MS) {
+    throw new Error("candidate cleanup timeout is outside the supported timer range");
+  }
+  return effective;
+}
+function candidateCleanupDeadline(timeoutMs) {
+  return Date.now() + candidateCleanupTimeout(timeoutMs);
+}
+function candidateResultTimeout(timeoutMs, taskTimeoutMs) {
+  const effective = timeoutMs ?? taskTimeoutMs;
+  if (!Number.isSafeInteger(effective) || effective <= 0 || effective > MAX_CANDIDATE_TIMER_INTERVAL_MS) {
+    throw new Error("candidate result timeout is outside the supported timer range");
+  }
+  return effective;
+}
+async function withinCandidateCleanupDeadline(operation, deadlineAtMs, label) {
+  const remainingMs = deadlineAtMs - Date.now();
+  if (remainingMs <= 0) throw new CandidateCleanupTimeoutError(label);
+  const pending = Promise.resolve().then(operation);
+  void pending.catch(() => void 0);
+  let timer;
+  try {
+    const result = await Promise.race([
+      pending,
+      new Promise((_resolve, reject) => {
+        timer = setTimeout(() => reject(new CandidateCleanupTimeoutError(label)), remainingMs);
+      })
+    ]);
+    if (Date.now() >= deadlineAtMs) throw new CandidateCleanupTimeoutError(label);
+    return result;
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+async function withinCandidateResultDeadline(operation, deadlineAtMs, label) {
+  const remainingMs = deadlineAtMs - Date.now();
+  if (remainingMs <= 0) throw new CandidateResultTimeoutError(label);
+  const controller = new AbortController();
+  const timeoutError = new CandidateResultTimeoutError(label);
+  const pending = Promise.resolve().then(() => operation(controller.signal));
+  void pending.catch(() => void 0);
+  let timer;
+  try {
+    const result = await Promise.race([
+      pending,
+      new Promise((_resolve, reject) => {
+        timer = setTimeout(() => {
+          controller.abort(timeoutError);
+          reject(timeoutError);
+        }, remainingMs);
+      })
+    ]);
+    if (Date.now() >= deadlineAtMs) {
+      controller.abort(timeoutError);
+      throw timeoutError;
+    }
+    return result;
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+var CandidateCleanupTimeoutError = class extends Error {
+  constructor(label) {
+    super(`${label} did not complete before the evaluator cleanup deadline`);
+    this.name = "CandidateCleanupTimeoutError";
+  }
+};
+var CandidateResultTimeoutError = class extends Error {
+  constructor(label) {
+    super(`${label} did not complete before the evaluator result deadline`);
+    this.name = "CandidateResultTimeoutError";
+  }
+};
+
+// src/candidate-execution/claim.ts
+function attemptRecord(claim, phase, staged, terminal) {
+  return Object.freeze({
+    claim,
+    phase,
+    ...staged ? { staged } : {},
+    ...terminal ? { terminal } : {}
+  });
+}
+var InMemoryAgentCandidateExecutionClaimStore = class {
+  claims = /* @__PURE__ */ new Map();
+  now;
+  constructor(options = {}) {
+    this.now = options.now ?? Date.now;
+  }
+  async tryClaim(requested) {
+    const claim = sealClaim(requested);
+    const slot = claimSlot(claim);
+    const existing = this.claims.get(slot);
+    if (existing) return rejectedExistingClaim(existing.claim, claim);
+    assertUnexpiredLease(claim.leaseExpiresAtMs, this.now());
+    const retryRejection2 = retryRejectionFromMemory(this.claims, claim);
+    if (retryRejection2) return rejectedRetry(claim, retryRejection2);
+    const lease = newLease(claim);
+    this.claims.set(slot, {
+      claim,
+      leaseDigest: leaseDigest(lease),
+      phase: "claimed"
+    });
+    return Object.freeze({ acquired: true, claim, lease });
+  }
+  async getAttempt(requestedAttempt) {
+    const attempt = sealAttemptRef(requestedAttempt);
+    const stored = this.claims.get(claimSlot(attempt));
+    return stored ? attemptRecord(stored.claim, stored.phase, stored.staged, stored.terminal) : void 0;
+  }
+  async markCandidateMayRun(requestedLease) {
+    const lease = sealLease(requestedLease);
+    const stored = this.requireClaim(lease);
+    assertLease(stored.leaseDigest, stored.claim.leaseExpiresAtMs, lease);
+    if (stored.phase === "candidate-may-run") {
+      return Object.freeze({ marked: false, phase: "candidate-may-run" });
+    }
+    if (stored.staged || stored.terminal) {
+      throw new Error("candidate execution terminal was staged before candidate-may-run phase");
+    }
+    assertUnexpiredLease(stored.claim.leaseExpiresAtMs, this.now());
+    stored.phase = "candidate-may-run";
+    return Object.freeze({ marked: true, phase: "candidate-may-run" });
+  }
+  async stageTerminal(requestedLease, result) {
+    const lease = sealLease(requestedLease);
+    const stored = this.requireClaim(lease);
+    assertLease(stored.leaseDigest, stored.claim.leaseExpiresAtMs, lease);
+    const terminal = terminalRecord(stored.claim, result);
+    if (stored.staged) return rejectedStage(stored.staged, terminal);
+    assertTerminalAllowedInPhase(stored.phase, terminal);
+    assertUnexpiredLease(stored.claim.leaseExpiresAtMs, this.now());
+    stored.staged = terminal;
+    return Object.freeze({ staged: true, terminal });
+  }
+  async finish(requestedLease, requestedTerminalDigest) {
+    const lease = sealLease(requestedLease);
+    const terminalDigest = sealTerminalDigest(requestedTerminalDigest);
+    const stored = this.requireClaim(lease);
+    assertLease(stored.leaseDigest, stored.claim.leaseExpiresAtMs, lease);
+    const staged = requireStagedTerminal(stored.staged, terminalDigest);
+    if (stored.terminal) return rejectedFinish(stored.terminal, terminalDigest);
+    assertUnexpiredLease(stored.claim.leaseExpiresAtMs, this.now());
+    stored.terminal = staged;
+    return Object.freeze({ finished: true, terminal: staged });
+  }
+  async recoverExpired(requestedAttempt, evidence) {
+    const attempt = sealAttemptRef(requestedAttempt);
+    const stored = this.requireClaim(attempt, "candidate execution recovery");
+    const recovered = recoveredTerminalRecord(stored.claim, stored.phase, evidence);
+    if (stored.staged) assertRecoveryMatchesStaged(stored.staged, recovered);
+    const requestedDigest = stored.staged?.terminalDigest ?? recovered.terminalDigest;
+    if (stored.terminal) return rejectedFinish(stored.terminal, requestedDigest);
+    assertExpiredLease(stored.claim.leaseExpiresAtMs, this.now());
+    const terminal = stored.staged ?? recovered;
+    assertRecoveryMatchesStaged(terminal, recovered);
+    stored.staged ??= terminal;
+    stored.terminal = terminal;
+    return Object.freeze({ finished: true, terminal });
+  }
+  requireClaim(attempt, operation = "candidate execution lease") {
+    const stored = this.claims.get(claimSlot(attempt));
+    if (!stored) throw new Error(`${operation} does not name an acquired attempt`);
+    return stored;
+  }
+};
+var SHA256_PATTERN2 = /^sha256:[a-f0-9]{64}$/;
+var LEASE_TOKEN_PATTERN = /^candidate-execution-lease-v1\.[A-Za-z0-9_-]{43}$/;
+var PREPARATION_ID_PATTERN = /^candidate-preparation-v1\.[A-Za-z0-9_-]{43}$/;
+function sealClaim(claim) {
+  assertExactObjectKeys(
+    claim,
+    [
+      "executionId",
+      "attempt",
+      "maxAttempts",
+      "retryPolicy",
+      "bundleDigest",
+      "executionPlanDigest",
+      "retryLineageDigest",
+      "leaseExpiresAtMs",
+      "resultTimeoutMs",
+      "cleanup"
+    ],
+    "candidate execution claim"
+  );
+  assertExecutionId2(claim.executionId);
+  if (!Number.isSafeInteger(claim.attempt) || claim.attempt < 1) {
+    throw new Error("candidate execution claim attempt must be a positive safe integer");
+  }
+  if (!Number.isSafeInteger(claim.maxAttempts) || claim.maxAttempts < 1) {
+    throw new Error("candidate execution claim maxAttempts must be a positive safe integer");
+  }
+  if (claim.attempt > claim.maxAttempts) {
+    throw new Error("candidate execution claim attempt exceeds maxAttempts");
+  }
+  if (!["none", "pre-model-infrastructure-only"].includes(claim.retryPolicy)) {
+    throw new Error("candidate execution claim retryPolicy is invalid");
+  }
+  if (claim.retryPolicy === "none" && claim.maxAttempts !== 1) {
+    throw new Error("candidate execution claim retryPolicy none requires maxAttempts 1");
+  }
+  assertSha256Digest2(claim.bundleDigest, "bundleDigest");
+  assertSha256Digest2(claim.executionPlanDigest, "executionPlanDigest");
+  assertSha256Digest2(claim.retryLineageDigest, "retryLineageDigest");
+  assertPositiveTimestamp(claim.leaseExpiresAtMs, "leaseExpiresAtMs");
+  candidateResultTimeout(claim.resultTimeoutMs, claim.resultTimeoutMs);
+  const cleanup = sealCleanupHandles(claim.cleanup);
+  return Object.freeze({
+    executionId: claim.executionId,
+    attempt: claim.attempt,
+    maxAttempts: claim.maxAttempts,
+    retryPolicy: claim.retryPolicy,
+    bundleDigest: claim.bundleDigest,
+    executionPlanDigest: claim.executionPlanDigest,
+    retryLineageDigest: claim.retryLineageDigest,
+    leaseExpiresAtMs: claim.leaseExpiresAtMs,
+    resultTimeoutMs: claim.resultTimeoutMs,
+    cleanup
+  });
+}
+function sealCleanupHandles(cleanup) {
+  assertExactObjectKeys(
+    cleanup,
+    cleanup.memory ? [
+      "preparationId",
+      "modelGrantDigest",
+      "resolvedModel",
+      "traceRunId",
+      "cleanupTimeoutMs",
+      "memory"
+    ] : ["preparationId", "modelGrantDigest", "resolvedModel", "traceRunId", "cleanupTimeoutMs"],
+    "candidate execution cleanup handles"
+  );
+  if (!PREPARATION_ID_PATTERN.test(cleanup.preparationId)) {
+    throw new Error("candidate execution cleanup preparationId is invalid");
+  }
+  assertSha256Digest2(cleanup.modelGrantDigest, "cleanup modelGrantDigest");
+  const resolvedModel = immutableCandidateValue(
+    agentCandidateResolvedModelSchema.parse(cleanup.resolvedModel)
+  );
+  assertBoundedIdentifier(cleanup.traceRunId, "cleanup traceRunId", 512);
+  const cleanupTimeoutMs = candidateCleanupTimeout(cleanup.cleanupTimeoutMs);
+  const memory = cleanup.memory ? sealMemoryCleanupHandle(cleanup.memory) : void 0;
+  return Object.freeze({
+    preparationId: cleanup.preparationId,
+    modelGrantDigest: cleanup.modelGrantDigest,
+    resolvedModel,
+    traceRunId: cleanup.traceRunId,
+    cleanupTimeoutMs,
+    ...memory ? { memory } : {}
+  });
+}
+function sealMemoryCleanupHandle(memory) {
+  assertExactObjectKeys(
+    memory,
+    ["accessDigest", "effectiveNamespace"],
+    "candidate execution memory cleanup handle"
+  );
+  assertSha256Digest2(memory.accessDigest, "memory accessDigest");
+  assertBoundedIdentifier(memory.effectiveNamespace, "memory effectiveNamespace", 1024);
+  return Object.freeze({
+    accessDigest: memory.accessDigest,
+    effectiveNamespace: memory.effectiveNamespace
+  });
+}
+function sealAttemptRef(attempt) {
+  assertExactObjectKeys(attempt, ["executionId", "attempt"], "candidate execution attempt reference");
+  assertExecutionId2(attempt.executionId);
+  if (!Number.isSafeInteger(attempt.attempt) || attempt.attempt < 1) {
+    throw new Error("candidate execution attempt reference must have a positive safe attempt");
+  }
+  return Object.freeze({ executionId: attempt.executionId, attempt: attempt.attempt });
+}
+function sealLease(lease) {
+  assertExactObjectKeys(
+    lease,
+    ["executionId", "attempt", "token", "expiresAtMs"],
+    "candidate execution lease"
+  );
+  if (lease.executionId.length === 0 || !Number.isSafeInteger(lease.attempt) || lease.attempt < 1) {
+    throw new Error("candidate execution lease identity is invalid");
+  }
+  if (!LEASE_TOKEN_PATTERN.test(lease.token)) {
+    throw new Error("candidate execution lease token is invalid");
+  }
+  assertPositiveTimestamp(lease.expiresAtMs, "lease expiresAtMs");
+  return Object.freeze({
+    executionId: lease.executionId,
+    attempt: lease.attempt,
+    token: lease.token,
+    expiresAtMs: lease.expiresAtMs
+  });
+}
+function newLease(claim) {
+  return Object.freeze({
+    executionId: claim.executionId,
+    attempt: claim.attempt,
+    token: `candidate-execution-lease-v1.${randomBytes(32).toString("base64url")}`,
+    expiresAtMs: claim.leaseExpiresAtMs
+  });
+}
+function leaseDigest(lease) {
+  return sha256(lease.token);
+}
+function assertLease(expectedDigest, expectedExpiresAtMs, lease) {
+  const expected = Buffer.from(expectedDigest);
+  const actual = Buffer.from(leaseDigest(lease));
+  if (expected.length !== actual.length || !timingSafeEqual(expected, actual) || lease.expiresAtMs !== expectedExpiresAtMs) {
+    throw new Error("candidate execution lease is invalid");
+  }
+}
+function claimSlot(claim) {
+  return createHash2("sha256").update(JSON.stringify([claim.executionId, claim.attempt]), "utf8").digest("hex");
+}
+function retryRejectionFromMemory(claims, claim) {
+  if (claim.attempt === 1) return void 0;
+  const prior = claims.get(
+    claimSlot({ executionId: claim.executionId, attempt: claim.attempt - 1 })
+  );
+  return retryRejection(claim, prior);
+}
+function retryRejection(claim, prior) {
+  if (!prior) return "prior-attempt-missing";
+  if (claim.retryPolicy !== "pre-model-infrastructure-only" || prior.claim.retryPolicy !== claim.retryPolicy || prior.claim.maxAttempts !== claim.maxAttempts || prior.claim.bundleDigest !== claim.bundleDigest || prior.claim.retryLineageDigest !== claim.retryLineageDigest) {
+    return "retry-lineage-mismatch";
+  }
+  if (!prior.terminal) return "prior-attempt-running";
+  if (prior.terminal.status === "succeeded") return "prior-attempt-succeeded";
+  if (prior.terminal.usage.modelCalls !== 0) return "prior-attempt-spent-model-calls";
+  if (prior.terminal.failureClass !== "pre-model-infrastructure") {
+    return "prior-attempt-not-pre-model-infrastructure";
+  }
+  return void 0;
+}
+function rejectedExistingClaim(existing, requested) {
+  return Object.freeze({
+    acquired: false,
+    reason: "already-claimed",
+    claim: existing,
+    exactReplay: canonicalCandidateDigest(existing) === canonicalCandidateDigest(requested)
+  });
+}
+function rejectedRetry(claim, detail) {
+  return Object.freeze({ acquired: false, reason: "retry-not-eligible", claim, detail });
+}
+async function readClaim(path) {
+  const parsed = await readJsonObject(path, "claim");
+  const record = parsed;
+  if (record.version !== CLAIM_FORMAT_VERSION) {
+    throw new Error(`candidate execution claim at ${path} has unsupported version`);
+  }
+  assertExactObjectKeys(
+    parsed,
+    [
+      "version",
+      "executionId",
+      "attempt",
+      "maxAttempts",
+      "retryPolicy",
+      "bundleDigest",
+      "executionPlanDigest",
+      "retryLineageDigest",
+      "leaseExpiresAtMs",
+      "resultTimeoutMs",
+      "cleanup",
+      "phase",
+      "leaseDigest"
+    ],
+    `candidate execution claim at ${path}`
+  );
+  const claim = sealClaim({
+    executionId: requireString2(record.executionId, path, "executionId"),
+    attempt: requireNumber2(record.attempt, path, "attempt"),
+    maxAttempts: requireNumber2(record.maxAttempts, path, "maxAttempts"),
+    retryPolicy: requireRetryPolicy(record.retryPolicy, path),
+    bundleDigest: requireString2(record.bundleDigest, path, "bundleDigest"),
+    executionPlanDigest: requireString2(
+      record.executionPlanDigest,
+      path,
+      "executionPlanDigest"
+    ),
+    retryLineageDigest: requireString2(
+      record.retryLineageDigest,
+      path,
+      "retryLineageDigest"
+    ),
+    leaseExpiresAtMs: requireNumber2(record.leaseExpiresAtMs, path, "leaseExpiresAtMs"),
+    resultTimeoutMs: requireNumber2(record.resultTimeoutMs, path, "resultTimeoutMs"),
+    cleanup: requireObject2(
+      record.cleanup,
+      path,
+      "cleanup"
+    )
+  });
+  const persistedLeaseDigest = requireString2(
+    record.leaseDigest,
+    path,
+    "leaseDigest"
+  );
+  assertSha256Digest2(persistedLeaseDigest, "leaseDigest");
+  if (record.phase !== "claimed") {
+    throw new Error(`candidate execution claim at ${path} has invalid initial phase`);
+  }
+  return { claim, leaseDigest: persistedLeaseDigest, phase: "claimed" };
+}
+async function readClaimIfPresent(path) {
+  try {
+    return await readClaim(path);
+  } catch (error) {
+    if (isMissingError(error)) return void 0;
+    throw error;
+  }
+}
+async function readTerminal(path) {
+  const parsed = await readJsonObject(path, "terminal record");
+  const record = parsed;
+  if (record.version !== TERMINAL_FORMAT_VERSION) {
+    throw new Error(`candidate execution terminal record at ${path} has unsupported version`);
+  }
+  assertExactObjectKeys(parsed, ["version", "terminal"], `candidate execution terminal record at ${path}`);
+  return sealTerminalRecordValue(
+    requireObject2(record.terminal, path, "terminal"),
+    `candidate execution terminal record at ${path}`
+  );
+}
+async function readTerminalIfPresent(path) {
+  try {
+    return await readTerminal(path);
+  } catch (error) {
+    if (isMissingError(error)) return void 0;
+    throw error;
+  }
+}
+async function readTransitionIfPresent(path, claim) {
+  let parsed;
+  try {
+    parsed = await readJsonObject(path, "transition record");
+  } catch (error) {
+    if (isMissingError(error)) return void 0;
+    throw error;
+  }
+  if (parsed.kind === "candidate-execution-phase") {
+    const record = parsed;
+    if (record.version !== PHASE_FORMAT_VERSION) {
+      throw new Error(`candidate execution phase record at ${path} has unsupported version`);
+    }
+    assertExactObjectKeys(
+      parsed,
+      ["version", "kind", "executionId", "attempt", "executionPlanDigest", "phase"],
+      `candidate execution phase record at ${path}`
+    );
+    if (record.executionId !== claim.executionId || record.attempt !== claim.attempt || record.executionPlanDigest !== claim.executionPlanDigest || record.phase !== "candidate-may-run") {
+      throw new Error(`candidate execution phase record at ${path} does not match its claim`);
+    }
+    return { kind: "phase" };
+  }
+  if (parsed.kind === "candidate-execution-pending-terminal") {
+    const record = parsed;
+    if (record.version !== PENDING_FORMAT_VERSION) {
+      throw new Error(`candidate execution pending record at ${path} has unsupported version`);
+    }
+    assertExactObjectKeys(
+      parsed,
+      ["version", "kind", "terminal"],
+      `candidate execution pending record at ${path}`
+    );
+    const terminal = sealTerminalRecordValue(
+      requireObject2(record.terminal, path, "terminal"),
+      `candidate execution pending record at ${path}`
+    );
+    assertTerminalMatchesClaim(terminal, claim, path);
+    return { kind: "pending", terminal };
+  }
+  throw new Error(`candidate execution transition record at ${path} has invalid kind`);
+}
+async function readJsonObject(path, kind) {
+  let parsed;
+  try {
+    parsed = JSON.parse(await readFile(path, "utf8"));
+  } catch (error) {
+    if (isMissingError(error)) throw error;
+    throw new Error(`candidate execution ${kind} at ${path} is unreadable`, { cause: error });
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(`candidate execution ${kind} at ${path} is not an object`);
+  }
+  return parsed;
+}
+function assertSameSlot(existing, requested, path) {
+  if (existing.executionId !== requested.executionId || existing.attempt !== requested.attempt) {
+    throw new Error(`candidate execution record at ${path} does not match its claim slot`);
+  }
+}
+function assertSha256Digest2(value, field) {
+  if (!SHA256_PATTERN2.test(value)) {
+    throw new Error(`candidate execution claim ${field} must be a lowercase sha256 digest`);
+  }
+}
+function requireString2(value, path, field) {
+  if (typeof value !== "string") {
+    throw new Error(`candidate execution record at ${path} has invalid ${field}`);
+  }
+  return value;
+}
+function requireNumber2(value, path, field) {
+  if (typeof value !== "number") {
+    throw new Error(`candidate execution record at ${path} has invalid ${field}`);
+  }
+  return value;
+}
+function requireObject2(value, path, field) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`candidate execution record at ${path} has invalid ${field}`);
+  }
+  return value;
+}
+function requireRetryPolicy(value, path) {
+  if (value !== "none" && value !== "pre-model-infrastructure-only") {
+    throw new Error(`candidate execution record at ${path} has invalid retryPolicy`);
+  }
+  return value;
+}
+function assertExecutionId2(value) {
+  if (typeof value !== "string" || !/^[A-Za-z0-9._:-]{1,200}$/.test(value)) {
+    throw new Error("candidate execution claim executionId is invalid");
+  }
+}
+function assertBoundedIdentifier(value, label, maxLength) {
+  if (typeof value !== "string" || value.length === 0 || value.length > maxLength || hasControlCharacter(value)) {
+    throw new Error(`candidate execution ${label} is invalid`);
+  }
+}
+function hasControlCharacter(value) {
+  for (let index = 0; index < value.length; index++) {
+    const code = value.charCodeAt(index);
+    if (code < 32 || code === 127) return true;
+  }
+  return false;
+}
+function assertPositiveTimestamp(value, label) {
+  if (!Number.isSafeInteger(value) || value <= 0) {
+    throw new Error(`candidate execution ${label} must be a positive safe timestamp`);
+  }
+}
+function assertClock(value) {
+  if (!Number.isSafeInteger(value) || value < 0) {
+    throw new Error("candidate execution claim-store clock returned an invalid timestamp");
+  }
+}
+function assertUnexpiredLease(expiresAtMs, nowMs) {
+  assertClock(nowMs);
+  if (nowMs >= expiresAtMs) throw new Error("candidate execution lease has expired");
+}
+function assertExpiredLease(expiresAtMs, nowMs) {
+  assertClock(nowMs);
+  if (nowMs < expiresAtMs) throw new Error("candidate execution lease has not expired");
+}
+function sha256(value) {
+  return `sha256:${createHash2("sha256").update(value, "utf8").digest("hex")}`;
+}
+function isMissingError(error) {
+  return isNodeError(error, "ENOENT");
+}
+function isNodeError(error, code) {
+  return error !== null && typeof error === "object" && "code" in error && error.code === code;
+}
+var candidateClaimFileInternals = Object.freeze({
+  assertExpiredLease,
+  assertLease,
+  assertSameSlot,
+  assertUnexpiredLease,
+  attemptRecord,
+  claimSlot,
+  leaseDigest,
+  newLease,
+  readClaim,
+  readClaimIfPresent,
+  readTerminal,
+  readTerminalIfPresent,
+  readTransitionIfPresent,
+  rejectedExistingClaim,
+  rejectedRetry,
+  retryRejection,
+  sealAttemptRef,
+  sealClaim,
+  sealLease
+});
+
+// src/candidate-execution/execution-window.ts
+var CANDIDATE_TERMINAL_PERSISTENCE_MARGIN_MS = 1e4;
+var CANDIDATE_POST_RUN_CLEANUP_PHASES = 4;
+function candidatePostRunWindowMs(cleanupTimeoutMs, resultTimeoutMs) {
+  const windowMs = cleanupTimeoutMs * CANDIDATE_POST_RUN_CLEANUP_PHASES + resultTimeoutMs + CANDIDATE_TERMINAL_PERSISTENCE_MARGIN_MS;
+  if (!Number.isSafeInteger(windowMs) || windowMs > MAX_CANDIDATE_TIMER_INTERVAL_MS) {
+    throw new Error("candidate post-run window exceeds the supported timer range");
+  }
+  return windowMs;
+}
+function candidateExecutionOwnerWindowMs(timeoutMs, cleanupTimeoutMs, resultTimeoutMs) {
+  const windowMs = timeoutMs + candidatePostRunWindowMs(cleanupTimeoutMs, resultTimeoutMs);
+  if (!Number.isSafeInteger(windowMs) || windowMs > MAX_CANDIDATE_TIMER_INTERVAL_MS) {
+    throw new Error("candidate execution and cleanup window exceeds the supported timer range");
+  }
+  return windowMs;
+}
+function candidateTerminalWindowMs(cleanupTimeoutMs) {
+  const windowMs = cleanupTimeoutMs + CANDIDATE_TERMINAL_PERSISTENCE_MARGIN_MS;
+  if (!Number.isSafeInteger(windowMs) || windowMs > MAX_CANDIDATE_TIMER_INTERVAL_MS) {
+    throw new Error("candidate terminal window exceeds the supported timer range");
+  }
+  return windowMs;
+}
+
+// src/candidate-execution/prepared-state.ts
+import {
+  agentCandidateExecutionPlanEvidenceSchema,
+  agentCandidateMaterializationReceiptSchema,
+  agentCandidateProfilePlanEvidenceSchema
+} from "@tangle-network/agent-interface";
+
+// src/candidate-execution/artifacts.ts
+import { constants as fsConstants } from "fs";
+import { lstat, open, readdir, realpath } from "fs/promises";
+import { relative, resolve, sep } from "path";
+function artifactCacheKey(artifact) {
+  return `${artifact.sha256}:${artifact.byteLength}`;
+}
+async function readVerifiedArtifact(artifact, port) {
+  const bytes = "content" in artifact ? Buffer.from(artifact.content, "base64") : await port.read(artifact);
+  verifyBytes(bytes, artifact.sha256, artifact.byteLength, "candidate artifact");
+  return Uint8Array.from(bytes);
+}
+function verifyBytes(bytes, digest, byteLength, label) {
+  if (bytes.byteLength !== byteLength) {
+    throw new Error(`${label} byte length ${bytes.byteLength} does not match ${byteLength}`);
+  }
+  const actual = sha256Bytes(bytes);
+  if (actual !== digest) {
+    throw new Error(`${label} digest ${actual} does not match ${digest}`);
+  }
+}
+async function verifyWorkspaceSnapshotArtifacts(snapshot, port) {
+  const [manifest, archive] = await Promise.all([
+    readVerifiedArtifact(snapshot.manifest, port),
+    readVerifiedArtifact(snapshot.archive, port)
+  ]);
+  const canonicalManifest = canonicalCandidateBytes(snapshot.material);
+  if (!Buffer.from(manifest).equals(Buffer.from(canonicalManifest))) {
+    throw new Error("workspace manifest artifact is not the exact canonical manifest material");
+  }
+  if (sha256Bytes(canonicalManifest) !== snapshot.digest) {
+    throw new Error("workspace snapshot digest does not match its canonical manifest material");
+  }
+  return { manifest, archive };
+}
+async function verifyMaterializedWorkspace(root, expected, options = {}) {
+  const observed = await scanWorkspace(root, new Set(options.ignoredProtectedRootEntries ?? []));
+  assertWorkspaceManifest(observed.manifest, expected);
+}
+async function readMaterializedWorkspaceFiles(root, expected, options = {}) {
+  const observed = await scanWorkspace(root, new Set(options.ignoredProtectedRootEntries ?? []));
+  assertWorkspaceManifest(observed.manifest, expected);
+  return observed.files.map(
+    (file) => Object.freeze({ path: file.path, mode: file.mode, bytes: Uint8Array.from(file.bytes) })
+  );
+}
+function assertWorkspaceManifest(observed, expected) {
+  if (!Buffer.from(canonicalCandidateBytes(observed)).equals(canonicalCandidateBytes(expected))) {
+    throw new Error(
+      "materialized workspace files, modes, or bytes do not match the signed manifest"
+    );
+  }
+}
+async function verifyMaterializedProfileWorkspace(root, expected) {
+  const observed = await scanWorkspace(root, /* @__PURE__ */ new Set());
+  const observedProfile = observed.manifest.files.map(({ path, mode, sha256: sha2562 }) => ({
+    relPath: path,
+    mode,
+    contentSha256: sha2562
+  }));
+  if (!Buffer.from(canonicalCandidateBytes(observedProfile)).equals(
+    canonicalCandidateBytes(expected.files)
+  )) {
+    throw new Error("profile staging files, modes, or bytes do not match the signed profile plan");
+  }
+}
+async function scanWorkspace(root, ignoredProtectedRootEntries) {
+  const absoluteRoot = resolve(root);
+  const rootStats = await lstat(absoluteRoot);
+  if (!rootStats.isDirectory() || rootStats.isSymbolicLink()) {
+    throw new Error("workspace root must be a real directory");
+  }
+  if (await realpath(absoluteRoot) !== absoluteRoot) {
+    throw new Error("workspace root has a symlinked path component");
+  }
+  const files = [];
+  const capturedFiles = [];
+  async function visit(directory) {
+    const entries = await readdir(directory, { withFileTypes: true });
+    entries.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+    for (const entry of entries) {
+      if (directory === absoluteRoot && ignoredProtectedRootEntries.has(entry.name)) {
+        continue;
+      }
+      const absolute = resolve(directory, entry.name);
+      const relPath = relative(absoluteRoot, absolute).split(sep).join("/");
+      if (!relPath || relPath.startsWith("../") || relPath.includes("/../")) {
+        throw new Error(`workspace entry escapes root: ${relPath}`);
+      }
+      const stats = await lstat(absolute);
+      if (stats.isSymbolicLink()) {
+        throw new Error(`workspace contains a symlink: ${relPath}`);
+      }
+      if (stats.isDirectory()) {
+        await visit(absolute);
+        continue;
+      }
+      if (!stats.isFile()) {
+        throw new Error(`workspace contains a non-regular entry: ${relPath}`);
+      }
+      const descriptor = await open(
+        absolute,
+        fsConstants.O_RDONLY | (typeof fsConstants.O_NOFOLLOW === "number" ? fsConstants.O_NOFOLLOW : 0)
+      );
+      try {
+        const openedStats = await descriptor.stat();
+        if (!openedStats.isFile()) {
+          throw new Error(`workspace contains a non-regular entry: ${relPath}`);
+        }
+        if (openedStats.nlink !== 1) {
+          throw new Error(`workspace contains a hard-linked file: ${relPath}`);
+        }
+        const mode = openedStats.mode & 511;
+        if (mode !== 420 && mode !== 493) {
+          throw new Error(`workspace file has unsupported mode ${mode.toString(8)}: ${relPath}`);
+        }
+        const bytes = await descriptor.readFile();
+        const supportedMode = mode;
+        files.push({
+          path: relPath,
+          mode: supportedMode,
+          sha256: sha256Bytes(bytes),
+          byteLength: bytes.byteLength
+        });
+        capturedFiles.push({ path: relPath, mode: supportedMode, bytes: Uint8Array.from(bytes) });
+      } finally {
+        await descriptor.close();
+      }
+    }
+  }
+  await visit(absoluteRoot);
+  files.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+  capturedFiles.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+  return {
+    manifest: {
+      schemaVersion: 1,
+      kind: "agent-candidate-workspace-manifest",
+      files
+    },
+    files: capturedFiles
+  };
+}
+
+// src/candidate-execution/git-materialize.ts
+import { spawn } from "child_process";
+import { mkdir, mkdtemp, readFile as readFile2, realpath as realpath2, rm, stat } from "fs/promises";
+import { tmpdir } from "os";
+import { join, resolve as resolve2 } from "path";
+async function verifyCandidateCode(code, repositories, patchBytes) {
+  if (code.kind === "disabled") return void 0;
+  const repositoryRoot = await verifiedRepositoryRoot(code.repository, repositories);
+  await assertCommitAndBaseTree(repositoryRoot, code.baseCommit, code.baseTree);
+  if (code.kind === "no-op") {
+    await assertSafeTree(repositoryRoot, code.baseTree);
+    return code.baseTree;
+  }
+  if (!patchBytes) throw new Error("git-patch candidate is missing verified patch bytes");
+  const temporary = await mkdtemp(join(tmpdir(), "agent-candidate-git-"));
+  try {
+    const indexFile = join(temporary, "index");
+    await git(repositoryRoot, ["read-tree", code.baseTree], void 0, {
+      GIT_INDEX_FILE: indexFile
+    });
+    await git(
+      repositoryRoot,
+      ["apply", "--cached", "--binary", "--whitespace=nowarn", "-"],
+      patchBytes,
+      { GIT_INDEX_FILE: indexFile }
+    );
+    const candidateTree = (await git(repositoryRoot, ["write-tree"], void 0, { GIT_INDEX_FILE: indexFile })).stdout.toString("utf8").trim();
+    if (candidateTree !== code.candidateTree) {
+      throw new Error(
+        `git patch materialized tree ${candidateTree} does not match ${code.candidateTree}`
+      );
+    }
+    await assertSafeTree(repositoryRoot, candidateTree);
+    return candidateTree;
+  } finally {
+    await rm(temporary, { recursive: true, force: true });
+  }
+}
+async function readCandidateGitHubResource(resource, repositories) {
+  const repositoryRoot = await verifiedRepositoryRoot(resource.repository, repositories);
+  const commitType = (await git(repositoryRoot, ["cat-file", "-t", resource.commit])).stdout.toString("utf8").trim();
+  if (commitType !== "commit") {
+    throw new Error(`GitHub resource commit is not a commit object: ${resource.commit}`);
+  }
+  const listing = (await git(repositoryRoot, ["ls-tree", "-z", resource.commit, "--", resource.path])).stdout;
+  const entries = parseTreeEntries(listing);
+  if (entries.length !== 1 || entries[0]?.path !== resource.path) {
+    throw new Error(`GitHub resource path is not one exact file: ${resource.path}`);
+  }
+  const entry = entries[0];
+  if (!entry || entry.type !== "blob" || entry.mode !== "100644" && entry.mode !== "100755") {
+    throw new Error(`GitHub resource path is not a regular Git blob: ${resource.path}`);
+  }
+  const bytes = (await git(repositoryRoot, ["cat-file", "blob", entry.object])).stdout;
+  verifyBytes(bytes, resource.sha256, resource.byteLength, `GitHub resource ${resource.path}`);
+  return Uint8Array.from(bytes);
+}
+async function verifyTaskCheckout(taskRoot, expected) {
+  const root = resolve2(taskRoot);
+  const head = (await git(root, ["rev-parse", "HEAD"])).stdout.toString("utf8").trim();
+  if (head !== expected.baseCommit) {
+    throw new Error(`task checkout HEAD ${head} does not match ${expected.baseCommit}`);
+  }
+  const tree = (await git(root, ["rev-parse", "HEAD^{tree}"])).stdout.toString("utf8").trim();
+  if (tree !== expected.baseTree) {
+    throw new Error(`task checkout base tree ${tree} does not match ${expected.baseTree}`);
+  }
+}
+async function verifyTaskOutcomePatch(input) {
+  const repositoryRoot = resolve2(input.repositoryRoot);
+  await verifyTaskCheckout(repositoryRoot, input);
+  const gitDir = resolve2(
+    (await git(repositoryRoot, ["rev-parse", "--absolute-git-dir"])).stdout.toString("utf8").trim()
+  );
+  if (await realpath2(gitDir) !== gitDir || gitDir.includes(":")) {
+    throw new Error("task Git object store has an unsupported path");
+  }
+  await assertNoGitIndirection(repositoryRoot, gitDir, "task repository");
+  const temporary = await mkdtemp(join(tmpdir(), "agent-candidate-task-outcome-"));
+  try {
+    const objectDirectory = join(temporary, "objects");
+    const indexFile = join(temporary, "index");
+    await mkdir(objectDirectory);
+    const gitEnvironment = {
+      GIT_INDEX_FILE: indexFile,
+      GIT_OBJECT_DIRECTORY: objectDirectory,
+      GIT_ALTERNATE_OBJECT_DIRECTORIES: join(gitDir, "objects")
+    };
+    await git(repositoryRoot, ["read-tree", input.baseTree], void 0, gitEnvironment);
+    if (input.patch.byteLength > 0) {
+      await git(
+        repositoryRoot,
+        ["apply", "--cached", "--binary", "--whitespace=nowarn", "-"],
+        input.patch,
+        gitEnvironment
+      );
+    }
+    const resultTree = (await git(repositoryRoot, ["write-tree"], void 0, gitEnvironment)).stdout.toString("utf8").trim();
+    if (resultTree !== input.resultTree) {
+      throw new Error(
+        `task outcome patch materialized tree ${resultTree} does not match ${input.resultTree}`
+      );
+    }
+    await assertSafeTree(repositoryRoot, resultTree, gitEnvironment);
+    const observed = await workspaceManifestFromGitTree(repositoryRoot, resultTree, gitEnvironment);
+    if (!Buffer.from(canonicalCandidateBytes(observed)).equals(
+      Buffer.from(canonicalCandidateBytes(input.afterState))
+    )) {
+      throw new Error("task outcome after-state does not match the materialized result tree");
+    }
+    const resultCommit = (await git(
+      repositoryRoot,
+      ["commit-tree", resultTree, "-p", input.baseCommit],
+      Buffer.from("candidate task outcome\n", "utf8"),
+      {
+        ...gitEnvironment,
+        GIT_AUTHOR_NAME: "Tangle Evaluator",
+        GIT_AUTHOR_EMAIL: "evaluator@tangle.tools",
+        GIT_AUTHOR_DATE: "2000-01-01T00:00:00Z",
+        GIT_COMMITTER_NAME: "Tangle Evaluator",
+        GIT_COMMITTER_EMAIL: "evaluator@tangle.tools",
+        GIT_COMMITTER_DATE: "2000-01-01T00:00:00Z"
+      }
+    )).stdout.toString("utf8").trim();
+    const committedTree = (await git(repositoryRoot, ["rev-parse", `${resultCommit}^{tree}`], void 0, gitEnvironment)).stdout.toString("utf8").trim();
+    if (committedTree !== resultTree) {
+      throw new Error("task outcome evaluator commit does not bind the verified result tree");
+    }
+    return { resultTree, resultCommit };
+  } finally {
+    await rm(temporary, { recursive: true, force: true });
+  }
+}
+async function verifiedRepositoryRoot(repository, repositories) {
+  const repositoryRoot = resolve2(await repositories.resolve(repository));
+  const rootStats = await stat(repositoryRoot);
+  if (!rootStats.isDirectory()) throw new Error("candidate repository path is not a directory");
+  const origin = (await git(repositoryRoot, ["remote", "get-url", "origin"])).stdout.toString("utf8").trim();
+  const actual = parseGitHubRemote(origin);
+  if (!actual || actual.owner !== repository.owner || actual.repo !== repository.repo) {
+    throw new Error(
+      `local repository origin ${origin || "<missing>"} does not match github.com/${repository.owner}/${repository.repo}`
+    );
+  }
+  const gitDirText = (await git(repositoryRoot, ["rev-parse", "--absolute-git-dir"])).stdout.toString("utf8").trim();
+  const gitDir = resolve2(gitDirText);
+  await assertNoGitIndirection(repositoryRoot, gitDir, "candidate repository");
+  return repositoryRoot;
+}
+async function assertNoGitIndirection(repositoryRoot, gitDir, label) {
+  const replacements = (await git(repositoryRoot, ["for-each-ref", "--format=%(refname)", "refs/replace"])).stdout.toString("utf8").trim();
+  if (replacements) throw new Error(`${label} contains Git replace refs`);
+  for (const name of ["alternates", "http-alternates"]) {
+    const path = join(gitDir, "objects", "info", name);
+    try {
+      const contents = await readFile2(path, "utf8");
+      if (contents.trim()) throw new Error(`${label} uses forbidden Git ${name}`);
+    } catch (error) {
+      if (!isNoEntry(error)) throw error;
+    }
+  }
+}
+async function assertCommitAndBaseTree(repositoryRoot, commit, expectedTree) {
+  const type = (await git(repositoryRoot, ["cat-file", "-t", commit])).stdout.toString("utf8").trim();
+  if (type !== "commit") throw new Error(`candidate base object is not a commit: ${commit}`);
+  const actualTree = (await git(repositoryRoot, ["rev-parse", `${commit}^{tree}`])).stdout.toString("utf8").trim();
+  if (actualTree !== expectedTree) {
+    throw new Error(`candidate base commit tree ${actualTree} does not match ${expectedTree}`);
+  }
+}
+async function assertSafeTree(repositoryRoot, tree, environment = {}) {
+  const listing = (await git(repositoryRoot, ["ls-tree", "-rz", "--full-tree", tree], void 0, environment)).stdout;
+  const entries = parseTreeEntries(listing);
+  if (entries.length === 0) throw new Error("candidate Git tree cannot be empty");
+  for (const entry of entries) {
+    if (entry.type !== "blob" || entry.mode !== "100644" && entry.mode !== "100755") {
+      throw new Error(
+        `candidate Git tree contains a symlink, submodule, or non-blob: ${entry.path}`
+      );
+    }
+    assertSafeGitPath(entry.path);
+  }
+}
+async function workspaceManifestFromGitTree(repositoryRoot, tree, environment) {
+  const listing = (await git(repositoryRoot, ["ls-tree", "-rz", "--full-tree", tree], void 0, environment)).stdout;
+  const entries = parseTreeEntries(listing);
+  const files = await Promise.all(
+    entries.map(async (entry) => {
+      if (entry.type !== "blob" || entry.mode !== "100644" && entry.mode !== "100755") {
+        throw new Error(`task outcome tree contains a non-regular file: ${entry.path}`);
+      }
+      const bytes = (await git(repositoryRoot, ["cat-file", "blob", entry.object], void 0, environment)).stdout;
+      return {
+        path: entry.path,
+        mode: entry.mode === "100755" ? 493 : 420,
+        sha256: sha256Bytes(bytes),
+        byteLength: bytes.byteLength
+      };
+    })
+  );
+  files.sort((left, right) => left.path.localeCompare(right.path));
+  return {
+    schemaVersion: 1,
+    kind: "agent-candidate-workspace-manifest",
+    files
+  };
+}
+function parseTreeEntries(bytes) {
+  const raw = Buffer.from(bytes);
+  const decoded = raw.toString("utf8");
+  if (!Buffer.from(decoded, "utf8").equals(raw)) {
+    throw new Error("candidate Git tree contains a non-UTF-8 path");
+  }
+  const rows = decoded.split("\0").filter(Boolean);
+  return rows.map((row) => {
+    const tab = row.indexOf("	");
+    const header = row.slice(0, tab).split(" ");
+    const path = row.slice(tab + 1);
+    const [mode, type, object] = header;
+    if (tab < 1 || !mode || !type || !object || !path) {
+      throw new Error("malformed Git tree entry");
+    }
+    return { mode, type, object, path };
+  });
+}
+function assertSafeGitPath(path) {
+  if (!path || path.startsWith("/") || path.includes("\\") || path.includes("\0") || hasControlCharacter2(path) || path.split("/").some((part) => !part || part === "." || part === "..") || path.split("/")[0]?.toLowerCase() === ".git") {
+    throw new Error(`candidate Git tree contains an unsafe path: ${path}`);
+  }
+}
+function hasControlCharacter2(value) {
+  for (let index = 0; index < value.length; index++) {
+    const code = value.charCodeAt(index);
+    if (code < 32 || code === 127) return true;
+  }
+  return false;
+}
+function parseGitHubRemote(value) {
+  const match = value.match(
+    /^(?:https?:\/\/github\.com\/|ssh:\/\/git@github\.com\/|git@github\.com:)([^/]+)\/([^/]+?)(?:\.git)?$/
+  );
+  if (!match?.[1] || !match[2]) return void 0;
+  return { owner: match[1], repo: match[2] };
+}
+async function git(repositoryRoot, args, input, extraEnv = {}) {
+  const env = Object.fromEntries(
+    Object.entries(process.env).filter(([name]) => !name.startsWith("GIT_"))
+  );
+  Object.assign(env, {
+    GIT_CONFIG_NOSYSTEM: "1",
+    GIT_CONFIG_GLOBAL: "/dev/null",
+    GIT_CONFIG_SYSTEM: "/dev/null",
+    GIT_TERMINAL_PROMPT: "0",
+    GIT_NO_REPLACE_OBJECTS: "1",
+    LC_ALL: "C",
+    ...extraEnv
+  });
+  const fullArgs = [
+    "-c",
+    "core.hooksPath=/dev/null",
+    "-c",
+    "protocol.file.allow=never",
+    "-C",
+    repositoryRoot,
+    ...args
+  ];
+  return await new Promise((resolveResult, reject) => {
+    const child = spawn("git", fullArgs, { env, stdio: ["pipe", "pipe", "pipe"] });
+    const stdout = [];
+    const stderr = [];
+    child.stdout.on("data", (chunk) => stdout.push(chunk));
+    child.stderr.on("data", (chunk) => stderr.push(chunk));
+    child.on("error", reject);
+    child.on("close", (code, signal) => {
+      const out = Buffer.concat(stdout);
+      const err = Buffer.concat(stderr);
+      if (code !== 0) {
+        reject(
+          new Error(
+            `git ${args[0] ?? "<command>"} failed (${signal ?? code}): ${err.toString("utf8").trim()}`
+          )
+        );
+        return;
+      }
+      resolveResult({ stdout: out, stderr: err });
+    });
+    if (input) child.stdin.end(input);
+    else child.stdin.end();
+  });
+}
+function isNoEntry(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+
+// src/candidate-execution/prepared-state.ts
+var stateByExecution = /* @__PURE__ */ new WeakMap();
+var lifecycleByExecution = /* @__PURE__ */ new WeakMap();
+function createPreparedCandidateExecution(input) {
+  const state = detachPreparedCandidateState(input);
+  assertPrivateCandidateIntegrity(state);
+  const prepared = Object.freeze({
+    bundle: state.bundle,
+    executionId: state.executionId,
+    roots: state.roots,
+    profilePlan: evidenceView(state.profilePlan),
+    executionPlan: evidenceView(state.executionPlan),
+    materializationReceipt: state.materializationReceipt,
+    launch: state.launch,
+    instruction: bytesView(state.instruction, "bytes"),
+    resolvedModel: state.resolvedModel,
+    ...state.knowledge ? { knowledge: knowledgeView(state.knowledge) } : {},
+    trace: state.trace,
+    memory: state.memory,
+    [preparedCandidateBrand]: true
+  });
+  stateByExecution.set(prepared, state);
+  lifecycleByExecution.set(prepared, { status: "prepared" });
+  return prepared;
+}
+function getPreparedCandidateState(prepared) {
+  const state = stateByExecution.get(prepared);
+  if (!state || prepared[preparedCandidateBrand] !== true) {
+    throw new Error("execution must come from prepareAgentCandidateExecution");
+  }
+  return state;
+}
+function assertPreparedCandidateIntegrity(prepared) {
+  const state = getPreparedCandidateState(prepared);
+  assertPrivateCandidateIntegrity(state);
+  return state;
+}
+function beginPreparedCandidateClaim(prepared) {
+  const state = assertPreparedCandidateIntegrity(prepared);
+  transitionLifecycle(prepared, ["prepared"], "claiming");
+  return state;
+}
+function beginPreparedCandidateDisposal(prepared) {
+  const state = assertPreparedCandidateIntegrity(prepared);
+  transitionLifecycle(prepared, ["prepared", "disposal-failed", "cleanup-failed"], "disposing");
+  return state;
+}
+function markPreparedCandidateClaimed(prepared) {
+  transitionLifecycle(prepared, ["claiming"], "claimed");
+}
+function beginPreparedCandidateRun(prepared, modelAccess, memoryAccess) {
+  const state = assertPreparedCandidateIntegrity(prepared);
+  assertProtectedEnvironment(state, modelAccess.env, memoryAccess?.env);
+  transitionLifecycle(prepared, ["claimed"], "running");
+  const completeEnvironment = immutableCandidateValue({
+    ...state.launch.env,
+    ...modelAccess.env,
+    ...memoryAccess?.env ?? {},
+    ...state.trace.env
+  });
+  const material = state.executionPlan.value.material;
+  const request = Object.freeze({
+    executionId: state.executionId,
+    inputs: Object.freeze({
+      task: workspaceInputView(material.task.workspace, state.executorInputs.taskFiles),
+      ...material.candidateWorkspace && state.executorInputs.candidateFiles ? {
+        candidate: workspaceInputView(
+          material.candidateWorkspace,
+          state.executorInputs.candidateFiles
+        )
+      } : {},
+      profile: Object.freeze({
+        files: Object.freeze(
+          state.executorInputs.profileFiles.map((file) => profileFileView(file))
+        )
+      })
+    }),
+    roots: state.roots.execution,
+    profilePlan: evidenceView(state.profilePlan),
+    executionPlan: evidenceView(state.executionPlan),
+    materializationReceipt: state.materializationReceipt,
+    launch: immutableCandidateValue({ ...state.launch, env: completeEnvironment }),
+    instruction: bytesView(state.instruction, "bytes"),
+    resolvedModel: state.resolvedModel,
+    hardLimits: Object.freeze({ timeoutMs: state.executionPlan.value.material.limits.timeoutMs }),
+    observedLimits: Object.freeze({ maxSteps: state.executionPlan.value.material.limits.maxSteps }),
+    ...state.knowledge ? { knowledge: knowledgeView(state.knowledge) } : {},
+    trace: state.trace,
+    memory: state.memory
+  });
+  return { state, request };
+}
+function consumePreparedCandidateExecution(prepared, outcome) {
+  transitionLifecycle(
+    prepared,
+    outcome === "disposed" || outcome === "disposal-failed" ? ["disposing"] : ["settling"],
+    outcome
+  );
+}
+function beginPreparedCandidateSettlement(prepared) {
+  transitionLifecycle(prepared, ["claiming", "claimed", "running"], "settling");
+}
+async function assertPreparedCandidateWorkspaces(state) {
+  const plan = state.executionPlan.value.material;
+  await verifyMaterializedWorkspace(state.roots.staging.taskRoot, plan.task.workspace.material, {
+    ignoredProtectedRootEntries: [".git", ".sidecar"]
+  });
+  await verifyTaskCheckout(state.roots.staging.taskRoot, plan.task.repository);
+  await verifyMaterializedProfileWorkspace(
+    state.roots.staging.profileRoot,
+    state.profilePlan.value.material
+  );
+  if (plan.candidateWorkspace) {
+    const candidateRoot = state.roots.staging.candidateRoot;
+    if (!candidateRoot) throw new Error("prepared candidate staging root is missing");
+    await verifyMaterializedWorkspace(candidateRoot, plan.candidateWorkspace.material);
+  } else if (state.roots.staging.candidateRoot !== void 0) {
+    throw new Error("disabled candidate unexpectedly has a staging root");
+  }
+}
+function detachPreparedCandidateState(input) {
+  const profilePlan = immutableCandidateValue(
+    agentCandidateProfilePlanEvidenceSchema.parse(input.profilePlan.value)
+  );
+  const executionPlan = immutableCandidateValue(
+    agentCandidateExecutionPlanEvidenceSchema.parse(input.executionPlan.value)
+  );
+  const receiptValue = immutableCandidateValue(
+    agentCandidateMaterializationReceiptSchema.parse(input.materializationReceipt.value)
+  );
+  const materializationReceipt = canonicalCandidateDocument(
+    omitTopLevelDigest(receiptValue)
+  );
+  if (materializationReceipt.digest !== input.materializationReceipt.digest) {
+    throw new Error("materialization receipt digest changed while sealing prepared execution");
+  }
+  return Object.freeze({
+    ports: input.ports,
+    bundle: input.bundle,
+    executionId: input.executionId,
+    roots: immutableCandidateValue(input.roots),
+    profilePlan: Object.freeze({
+      value: profilePlan,
+      bytes: Uint8Array.from(input.profilePlan.bytes),
+      written: Object.freeze([...input.profilePlan.written])
+    }),
+    executionPlan: Object.freeze({
+      value: executionPlan,
+      bytes: Uint8Array.from(input.executionPlan.bytes)
+    }),
+    materializationReceipt,
+    launch: immutableCandidateValue(input.launch),
+    instruction: Object.freeze({
+      bytes: Uint8Array.from(input.instruction.bytes),
+      delivery: immutableCandidateValue(input.instruction.delivery)
+    }),
+    resolvedModel: immutableCandidateValue(input.resolvedModel),
+    preparationId: input.preparationId,
+    reservationExpiresAtMs: input.reservationExpiresAtMs,
+    cleanupTimeoutMs: input.cleanupTimeoutMs,
+    resultTimeoutMs: input.resultTimeoutMs,
+    modelReservation: immutableCandidateValue(input.modelReservation),
+    executorInputs: Object.freeze({
+      taskFiles: immutableExecutorFiles(input.executorInputs.taskFiles),
+      ...input.executorInputs.candidateFiles ? { candidateFiles: immutableExecutorFiles(input.executorInputs.candidateFiles) } : {},
+      profileFiles: Object.freeze(
+        input.executorInputs.profileFiles.map(
+          (file) => Object.freeze({ ...file, bytes: Uint8Array.from(file.bytes) })
+        )
+      )
+    }),
+    ...input.memoryReservation ? { memoryReservation: immutableCandidateValue(input.memoryReservation) } : {},
+    ...input.knowledge ? {
+      knowledge: Object.freeze({
+        snapshotId: input.knowledge.snapshotId,
+        manifestDigest: input.knowledge.manifestDigest,
+        manifest: Uint8Array.from(input.knowledge.manifest)
+      })
+    } : {},
+    trace: immutableCandidateValue(input.trace),
+    memory: immutableCandidateValue(input.memory)
+  });
+}
+function assertPrivateCandidateIntegrity(state) {
+  const bundleMaterial = omitTopLevelDigest(state.bundle);
+  if (canonicalCandidateDigest(bundleMaterial) !== state.bundle.digest) {
+    throw new Error("prepared candidate bundle no longer matches its digest");
+  }
+  assertPlanEvidence(state.profilePlan.value, state.profilePlan.bytes, "profile plan");
+  assertPlanEvidence(state.executionPlan.value, state.executionPlan.bytes, "execution plan");
+  agentCandidateExecutionPlanEvidenceSchema.parse(state.executionPlan.value);
+  const receipt = agentCandidateMaterializationReceiptSchema.parse(
+    state.materializationReceipt.value
+  );
+  const receiptBytes = canonicalCandidateBytes(omitTopLevelDigest(receipt));
+  if (canonicalCandidateDigest(omitTopLevelDigest(receipt)) !== state.materializationReceipt.digest || !Buffer.from(receiptBytes).equals(Buffer.from(state.materializationReceipt.bytes))) {
+    throw new Error("prepared materialization receipt no longer matches its canonical bytes");
+  }
+  const instruction = state.executionPlan.value.material.task.instruction;
+  if (sha256Bytes(state.instruction.bytes) !== instruction.sha256 || state.instruction.bytes.byteLength !== instruction.byteLength || JSON.stringify(state.instruction.delivery) !== JSON.stringify(instruction.delivery)) {
+    throw new Error("prepared instruction no longer matches the signed execution plan");
+  }
+  if (!/^candidate-preparation-v1\.[A-Za-z0-9_-]{43}$/.test(state.preparationId) || !Number.isSafeInteger(state.reservationExpiresAtMs) || state.reservationExpiresAtMs <= 0 || !Number.isSafeInteger(state.cleanupTimeoutMs) || state.cleanupTimeoutMs <= 0 || !Number.isSafeInteger(state.resultTimeoutMs) || state.resultTimeoutMs <= 0 || JSON.stringify(state.resolvedModel) !== JSON.stringify(state.executionPlan.value.material.model.resolved) || state.modelReservation.digest !== state.executionPlan.value.material.model.access.grantDigest || state.modelReservation.preparationId !== state.preparationId || state.modelReservation.expiresAtMs !== state.reservationExpiresAtMs || canonicalCandidateDigest(state.modelReservation.network) !== canonicalCandidateDigest(state.executionPlan.value.material.model.access.network) || canonicalCandidateDigest(state.modelReservation.enforcedLimits) !== canonicalCandidateDigest(modelLimits(state.executionPlan.value.material.limits))) {
+    throw new Error("prepared model access no longer matches the signed execution plan");
+  }
+  assertExecutorInputs(state);
+  if (state.memory.mode === "isolated" && !state.memoryReservation || state.memory.mode === "disabled" && state.memoryReservation) {
+    throw new Error("prepared memory reservation does not match the signed execution plan");
+  }
+  if (state.memory.mode === "isolated" && state.memoryReservation && (state.memoryReservation.preparationId !== state.preparationId || state.memoryReservation.expiresAtMs !== state.reservationExpiresAtMs || state.memoryReservation.effectiveNamespace !== state.memory.effectiveNamespace)) {
+    throw new Error("prepared memory reservation identity no longer matches the execution");
+  }
+  if (JSON.stringify(state.memory) !== JSON.stringify(state.executionPlan.value.material.memory)) {
+    throw new Error("prepared memory no longer matches the signed execution plan");
+  }
+  const expectedTags = {
+    [CANDIDATE_TRACE_TAGS.executionId]: state.executionId,
+    [CANDIDATE_TRACE_TAGS.bundleDigest]: state.bundle.digest,
+    [CANDIDATE_TRACE_TAGS.executionPlanDigest]: state.executionPlan.value.digest,
+    [CANDIDATE_TRACE_TAGS.materializationReceiptDigest]: state.materializationReceipt.digest
+  };
+  const expectedTraceEnvironment = {
+    [CANDIDATE_TRACE_ENV.executionId]: state.executionId,
+    [CANDIDATE_TRACE_ENV.bundleDigest]: state.bundle.digest,
+    [CANDIDATE_TRACE_ENV.executionPlanDigest]: state.executionPlan.value.digest,
+    [CANDIDATE_TRACE_ENV.materializationReceiptDigest]: state.materializationReceipt.digest,
+    [CANDIDATE_TRACE_ENV.traceRunId]: state.trace.runId
+  };
+  if (!state.trace.runId.startsWith(
+    `${state.executionId}:attempt-${state.executionPlan.value.material.attempt.number}:`
+  ) || canonicalCandidateDigest(state.trace.tags) !== canonicalCandidateDigest(expectedTags) || canonicalCandidateDigest(state.trace.env) !== canonicalCandidateDigest(expectedTraceEnvironment)) {
+    throw new Error("prepared trace identity no longer matches the signed execution");
+  }
+}
+function assertPlanEvidence(evidence, bytes, label) {
+  const expected = canonicalCandidateBytes(evidence.material);
+  if (sha256Bytes(expected) !== evidence.digest || !Buffer.from(expected).equals(Buffer.from(bytes)) || evidence.artifact.sha256 !== evidence.digest || evidence.artifact.byteLength !== bytes.byteLength || !("content" in evidence.artifact) || !Buffer.from(evidence.artifact.content, "base64").equals(Buffer.from(bytes))) {
+    throw new Error(`prepared ${label} no longer matches its canonical bytes`);
+  }
+}
+function evidenceView(evidence) {
+  const bytes = Uint8Array.from(evidence.bytes);
+  return Object.freeze({
+    ...evidence,
+    get bytes() {
+      return Uint8Array.from(bytes);
+    }
+  });
+}
+function bytesView(value, key) {
+  const bytes = Uint8Array.from(value.bytes);
+  return Object.freeze({
+    ...value,
+    get [key]() {
+      return Uint8Array.from(bytes);
+    }
+  });
+}
+function knowledgeView(knowledge) {
+  const manifest = Uint8Array.from(knowledge.manifest);
+  return Object.freeze({
+    snapshotId: knowledge.snapshotId,
+    manifestDigest: knowledge.manifestDigest,
+    get manifest() {
+      return Uint8Array.from(manifest);
+    }
+  });
+}
+function workspaceInputView(snapshot, sourceFiles) {
+  return Object.freeze({
+    snapshot,
+    files: Object.freeze(sourceFiles.map((file) => profileFileView(file)))
+  });
+}
+function profileFileView(source) {
+  const bytes = Uint8Array.from(source.bytes);
+  return Object.freeze({
+    path: source.path,
+    mode: source.mode,
+    get bytes() {
+      return Uint8Array.from(bytes);
+    }
+  });
+}
+function assertExecutorInputs(state) {
+  const material = state.executionPlan.value.material;
+  assertWorkspaceExecutorFiles(state.executorInputs.taskFiles, material.task.workspace.material);
+  if (material.candidateWorkspace) {
+    if (!state.executorInputs.candidateFiles) {
+      throw new Error("prepared candidate executor files are missing");
+    }
+    assertWorkspaceExecutorFiles(
+      state.executorInputs.candidateFiles,
+      material.candidateWorkspace.material
+    );
+  } else if (state.executorInputs.candidateFiles) {
+    throw new Error("disabled candidate has executor files");
+  }
+  const expectedFiles = state.profilePlan.value.material.files;
+  if (state.executorInputs.profileFiles.length !== expectedFiles.length) {
+    throw new Error("prepared profile executor files do not match the signed profile plan");
+  }
+  for (let index = 0; index < expectedFiles.length; index++) {
+    const expected = expectedFiles[index];
+    const actual = state.executorInputs.profileFiles[index];
+    if (!expected || !actual || actual.path !== expected.relPath || actual.mode !== expected.mode || sha256Bytes(actual.bytes) !== expected.contentSha256) {
+      throw new Error("prepared profile executor files do not match the signed profile plan");
+    }
+  }
+}
+function assertWorkspaceExecutorFiles(actualFiles, expected) {
+  if (actualFiles.length !== expected.files.length) {
+    throw new Error("prepared workspace executor files do not match the signed manifest");
+  }
+  for (let index = 0; index < expected.files.length; index++) {
+    const actual = actualFiles[index];
+    const planned = expected.files[index];
+    if (!actual || !planned || actual.path !== planned.path || actual.mode !== planned.mode || actual.bytes.byteLength !== planned.byteLength || sha256Bytes(actual.bytes) !== planned.sha256) {
+      throw new Error("prepared workspace executor files do not match the signed manifest");
+    }
+  }
+}
+function immutableExecutorFiles(files) {
+  return Object.freeze(
+    files.map((file) => Object.freeze({ ...file, bytes: Uint8Array.from(file.bytes) }))
+  );
+}
+function modelLimits(limits) {
+  return {
+    maxModelCalls: limits.maxModelCalls,
+    maxInputTokens: limits.maxInputTokens,
+    maxOutputTokens: limits.maxOutputTokens,
+    maxCostUsd: limits.maxCostUsd
+  };
+}
+function transitionLifecycle(prepared, expected, next) {
+  const lifecycle = lifecycleByExecution.get(prepared);
+  if (!lifecycle || !expected.includes(lifecycle.status)) {
+    throw new Error(`prepared candidate execution is already ${lifecycle?.status ?? "unknown"}`);
+  }
+  lifecycle.status = next;
+}
+function assertProtectedEnvironment(state, modelEnvironment, memoryEnvironment) {
+  const seen = /* @__PURE__ */ new Set([...Object.keys(state.launch.env), ...Object.keys(state.trace.env)]);
+  for (const [name, value] of [
+    ...Object.entries(modelEnvironment),
+    ...Object.entries(memoryEnvironment ?? {})
+  ]) {
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name) || typeof value !== "string" || value.length < 8) {
+      throw new Error("protected model activation contains an invalid environment binding");
+    }
+    if (seen.has(name)) {
+      throw new Error(`protected model activation collides with environment binding ${name}`);
+    }
+    seen.add(name);
+  }
+}
+
+// src/candidate-execution/claim-plan.ts
+function candidateExecutionClaim(prepared) {
+  const state = assertPreparedCandidateIntegrity(prepared);
+  const material = prepared.executionPlan.value.material;
+  const attempt = material.attempt;
+  const nowMs = Date.now();
+  if (!Number.isSafeInteger(nowMs) || nowMs < 0) {
+    throw new Error("candidate execution claim-store clock returned an invalid timestamp");
+  }
+  const leaseExpiresAtMs = nowMs + candidateExecutionOwnerWindowMs(
+    material.limits.timeoutMs,
+    state.cleanupTimeoutMs,
+    state.resultTimeoutMs
+  );
+  if (!Number.isSafeInteger(leaseExpiresAtMs) || leaseExpiresAtMs <= 0) {
+    throw new Error("candidate execution leaseExpiresAtMs must be a positive safe timestamp");
+  }
+  if (leaseExpiresAtMs > state.reservationExpiresAtMs) {
+    throw new Error(
+      "candidate preparation expires before its full execution and cleanup owner window"
+    );
+  }
+  return candidateClaimFileInternals.sealClaim({
+    executionId: prepared.executionId,
+    attempt: attempt.number,
+    maxAttempts: attempt.maxAttempts,
+    retryPolicy: attempt.retryPolicy,
+    bundleDigest: prepared.bundle.digest,
+    executionPlanDigest: prepared.executionPlan.value.digest,
+    retryLineageDigest: retryLineageDigest(prepared, state.resultTimeoutMs),
+    leaseExpiresAtMs,
+    resultTimeoutMs: state.resultTimeoutMs,
+    cleanup: {
+      preparationId: state.preparationId,
+      modelGrantDigest: state.modelReservation.digest,
+      resolvedModel: state.resolvedModel,
+      traceRunId: state.trace.runId,
+      cleanupTimeoutMs: state.cleanupTimeoutMs,
+      ...state.memoryReservation ? {
+        memory: {
+          accessDigest: state.memoryReservation.accessDigest,
+          effectiveNamespace: state.memoryReservation.effectiveNamespace
+        }
+      } : {}
+    }
+  });
+}
+function retryLineageDigest(prepared, resultTimeoutMs) {
+  const material = prepared.executionPlan.value.material;
+  return canonicalCandidateDigest({
+    resultTimeoutMs,
+    executionPlan: {
+      ...material,
+      attempt: { ...material.attempt, number: 0 },
+      model: {
+        ...material.model,
+        access: {
+          ...material.model.access,
+          grantDigest: `sha256:${"0".repeat(64)}`
+        }
+      },
+      memory: material.memory.mode === "disabled" ? material.memory : {
+        mode: "isolated",
+        scope: "task",
+        effectiveNamespace: "candidate/retry-lineage-normalized",
+        reset: {
+          kind: "fresh",
+          emptyStateDigest: material.memory.reset.emptyStateDigest
+        },
+        beforeState: {
+          digest: material.memory.beforeState.digest,
+          material: material.memory.beforeState.material,
+          manifest: {
+            sha256: material.memory.beforeState.manifest.sha256,
+            byteLength: material.memory.beforeState.manifest.byteLength
+          },
+          archive: {
+            sha256: material.memory.beforeState.archive.sha256,
+            byteLength: material.memory.beforeState.archive.byteLength
+          }
+        },
+        ...material.memory.seedDigest ? { seedDigest: material.memory.seedDigest } : {}
+      }
+    }
+  });
+}
+
+// src/candidate-execution/output-artifacts.ts
+import {
+  agentCandidateArtifactRefSchema as agentCandidateArtifactRefSchema2
+} from "@tangle-network/agent-interface";
+async function persistCandidateOutputArtifact(port, input) {
+  input.signal?.throwIfAborted();
+  const bytes = Uint8Array.from(input.bytes);
+  const expectedDigest = sha256Bytes(bytes);
+  const ref = agentCandidateArtifactRefSchema2.parse(
+    await port.put({
+      executionId: input.executionId,
+      purpose: input.purpose,
+      bytes: Uint8Array.from(bytes),
+      ...input.signal ? { signal: input.signal } : {}
+    })
+  );
+  input.signal?.throwIfAborted();
+  if (ref.sha256 !== expectedDigest || ref.byteLength !== bytes.byteLength) {
+    throw new Error("candidate output locator does not identify the submitted bytes");
+  }
+  const stored = await port.read(ref);
+  input.signal?.throwIfAborted();
+  verifyBytes(stored, expectedDigest, bytes.byteLength, "persisted candidate output");
+  return immutableCandidateValue(ref);
+}
+
+// src/candidate-execution/executor-capture.ts
+import {
+  agentCandidateTerminationSchema,
+  agentCandidateWorkspaceManifestMaterialSchema
+} from "@tangle-network/agent-interface";
+function sealAgentCandidateProtectedRunCapture(value) {
+  const capture = requireRecord(value, "candidate execution capture");
+  assertExactObjectKeys(capture, ["executionId", "termination"], "candidate execution capture");
+  if (typeof capture.executionId !== "string" || capture.executionId.length === 0) {
+    throw new Error("candidate execution capture has an invalid executionId");
+  }
+  return Object.freeze({
+    executionId: capture.executionId,
+    termination: Object.freeze(agentCandidateTerminationSchema.parse(capture.termination))
+  });
+}
+function sealAgentCandidateExecutorFinalCapture(value) {
+  const capture = requireRecord(value, "candidate final capture");
+  assertExactObjectKeys(capture, ["stopped"], "candidate final capture", ["taskOutcome", "memoryAfter"]);
+  if (capture.stopped !== true) {
+    throw new Error("candidate final capture does not prove process death");
+  }
+  const taskOutcome = capture.taskOutcome ? sealTaskOutcomeCapture(capture.taskOutcome) : void 0;
+  const memoryAfter = capture.memoryAfter ? sealMemoryCapture(capture.memoryAfter) : void 0;
+  return Object.freeze({
+    stopped: true,
+    ...taskOutcome ? { taskOutcome } : {},
+    ...memoryAfter ? { memoryAfter: Object.freeze(memoryAfter) } : {}
+  });
+}
+function sealMemoryCapture(value) {
+  const capture = requireRecord(value, "candidate memory capture");
+  assertExactObjectKeys(capture, ["afterState", "archive"], "candidate memory capture");
+  if (!(capture.archive instanceof Uint8Array)) {
+    throw new Error("candidate memory capture archive must be a byte array");
+  }
+  return Object.freeze({
+    afterState: Object.freeze(
+      agentCandidateWorkspaceManifestMaterialSchema.parse(capture.afterState)
+    ),
+    archive: Uint8Array.from(capture.archive)
+  });
+}
+function sealTaskOutcomeCapture(value) {
+  const capture = requireRecord(value, "candidate task capture");
+  assertExactObjectKeys(
+    capture,
+    ["resultTree", "afterState", "archive", "gitDiff"],
+    "candidate task capture"
+  );
+  if (typeof capture.resultTree !== "string" || !/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(capture.resultTree)) {
+    throw new Error("candidate task capture resultTree is not a Git object id");
+  }
+  if (!(capture.archive instanceof Uint8Array) || !(capture.gitDiff instanceof Uint8Array)) {
+    throw new Error("candidate task capture archive and gitDiff must be byte arrays");
+  }
+  const afterState = agentCandidateWorkspaceManifestMaterialSchema.parse(capture.afterState);
+  return Object.freeze({
+    resultTree: capture.resultTree,
+    afterState: Object.freeze(afterState),
+    archive: Uint8Array.from(capture.archive),
+    gitDiff: Uint8Array.from(capture.gitDiff)
+  });
+}
+function requireRecord(value, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${label} must be an object`);
+  }
+  return value;
+}
+
+// src/candidate-execution/finalize.ts
+import { mkdtemp as mkdtemp2, rm as rm2 } from "fs/promises";
+import { tmpdir as tmpdir2 } from "os";
+import { join as join2 } from "path";
+import { isLlmSpan as isLlmSpan2, REDACTION_VERSION as REDACTION_VERSION2 } from "@tangle-network/agent-eval";
+import {
+  agentCandidateRunReceiptV2Schema,
+  agentCandidateWorkspaceSnapshotEvidenceSchema
+} from "@tangle-network/agent-interface";
+
+// src/candidate-execution/model-settlement.ts
+import { isLlmSpan } from "@tangle-network/agent-eval";
+var USD_NANOS = 1e9;
+function sealAgentCandidateModelSettlement(settlement, expected) {
+  assertExactObjectKeys(
+    settlement,
+    ["preparationId", "grantDigest", "closed", "calls"],
+    "model settlement"
+  );
+  if (settlement.closed !== true) throw new Error("protected model grant is not closed");
+  if (settlement.grantDigest !== expected.grantDigest) {
+    throw new Error("protected model settlement grant digest does not match the reservation");
+  }
+  if (settlement.preparationId !== expected.preparationId) {
+    throw new Error("protected model settlement preparation does not match the reservation");
+  }
+  if (!Array.isArray(settlement.calls)) {
+    throw new Error("protected model settlement calls must be an array");
+  }
+  const callIds = /* @__PURE__ */ new Set();
+  const spanIds = /* @__PURE__ */ new Set();
+  let inputTokens = 0;
+  let outputTokens = 0;
+  let cachedInputTokens = 0;
+  let reasoningTokens = 0;
+  let hasCachedInput = false;
+  let costUsdNanos = 0;
+  const calls = settlement.calls.map((source, index) => {
+    assertExactObjectKeys(
+      source,
+      [
+        "callId",
+        "generationId",
+        "traceSpanId",
+        "status",
+        "model",
+        "startedAtMs",
+        "endedAtMs",
+        "inputTokens",
+        "outputTokens",
+        "cachedInputTokens",
+        "reasoningTokens",
+        "costUsdNanos"
+      ],
+      `model settlement call ${index}`
+    );
+    assertIdentifier(source.callId, `model settlement call ${index} callId`);
+    assertIdentifier(source.generationId, `model settlement call ${index} generationId`);
+    assertIdentifier(source.traceSpanId, `model settlement call ${index} traceSpanId`);
+    if (source.traceSpanId !== source.generationId) {
+      throw new Error(`model settlement call ${index} traceSpanId is not its router generationId`);
+    }
+    if (source.status !== "succeeded" && source.status !== "failed") {
+      throw new Error(`model settlement call ${index} has an invalid status`);
+    }
+    if (callIds.has(source.callId))
+      throw new Error("protected model settlement has duplicate call ids");
+    if (spanIds.has(source.traceSpanId)) {
+      throw new Error("protected model settlement has duplicate trace span ids");
+    }
+    callIds.add(source.callId);
+    spanIds.add(source.traceSpanId);
+    if (source.model !== expected.model) {
+      throw new Error(`protected model settlement call ${index} has an unexpected model`);
+    }
+    assertTimestamp(source.startedAtMs, `model settlement call ${index} startedAtMs`);
+    assertTimestamp(source.endedAtMs, `model settlement call ${index} endedAtMs`);
+    if (source.endedAtMs < source.startedAtMs) {
+      throw new Error(`model settlement call ${index} ended before it started`);
+    }
+    assertCount2(source.inputTokens, `model settlement call ${index} inputTokens`);
+    assertCount2(source.outputTokens, `model settlement call ${index} outputTokens`);
+    assertCount2(source.cachedInputTokens, `model settlement call ${index} cachedInputTokens`);
+    cachedInputTokens = safeAdd(
+      cachedInputTokens,
+      source.cachedInputTokens,
+      "cached input token total"
+    );
+    hasCachedInput = true;
+    assertCount2(source.reasoningTokens, `model settlement call ${index} reasoningTokens`);
+    reasoningTokens = safeAdd(reasoningTokens, source.reasoningTokens, "reasoning token total");
+    assertCount2(source.costUsdNanos, `model settlement call ${index} costUsdNanos`);
+    inputTokens = safeAdd(inputTokens, source.inputTokens, "input token total");
+    outputTokens = safeAdd(outputTokens, source.outputTokens, "output token total");
+    costUsdNanos = safeAdd(costUsdNanos, source.costUsdNanos, "cost total");
+    return Object.freeze({ ...source });
+  });
+  const usage = Object.freeze({
+    costUsd: costUsdNanos / USD_NANOS,
+    inputTokens,
+    outputTokens,
+    ...hasCachedInput ? { cachedInputTokens } : {},
+    modelCalls: calls.length
+  });
+  const fixedUsage = Object.freeze({
+    costUsdNanos,
+    inputTokens,
+    outputTokens,
+    cachedInputTokens,
+    reasoningTokens,
+    modelCalls: calls.length
+  });
+  return Object.freeze({
+    value: Object.freeze({
+      preparationId: settlement.preparationId,
+      grantDigest: settlement.grantDigest,
+      closed: true,
+      calls: Object.freeze(calls)
+    }),
+    usage,
+    fixedUsage,
+    costUsdNanos
+  });
+}
+async function appendAuthoritativeModelSettlementSpans(traceStore, runId, settlement) {
+  const run = await traceStore.getRun(runId);
+  if (!run) throw new Error(`protected trace run is missing before model settlement: ${runId}`);
+  if (run.status === "running" || run.endedAt === void 0) {
+    throw new Error("protected trace run must be terminal before model spans are appended");
+  }
+  const existing = await traceStore.spans({ runId });
+  if (existing.some(isLlmSpan)) {
+    throw new Error(
+      "protected trace contains a model span not authored from the closed router ledger"
+    );
+  }
+  const occupiedIds = new Set(existing.map((span) => span.spanId));
+  for (const call of settlement.value.calls) {
+    if (occupiedIds.has(call.traceSpanId)) {
+      throw new Error(
+        `protected trace span identity collides with router generation ${call.generationId}`
+      );
+    }
+    await traceStore.appendSpan({
+      runId,
+      spanId: call.traceSpanId,
+      kind: "llm",
+      name: "protected model call",
+      model: call.model,
+      messages: [],
+      startedAt: call.startedAtMs,
+      endedAt: call.endedAtMs,
+      status: call.status === "succeeded" ? "ok" : "error",
+      inputTokens: call.inputTokens,
+      outputTokens: call.outputTokens,
+      cachedTokens: call.cachedInputTokens,
+      reasoningTokens: call.reasoningTokens,
+      costUsd: call.costUsdNanos / USD_NANOS,
+      attributes: {
+        "tangle.protected_model.source": "router-settlement",
+        "tangle.router.call_id": call.callId,
+        "tangle.router.generation_id": call.generationId
+      }
+    });
+  }
+}
+function assertTraceMatchesModelSettlement(spans, settlement) {
+  if (spans.length !== settlement.value.calls.length) {
+    throw new Error(
+      `protected trace model calls ${spans.length} do not match model ledger ${settlement.value.calls.length}`
+    );
+  }
+  const byId = new Map(spans.map((span) => [span.spanId, span]));
+  if (byId.size !== spans.length) throw new Error("protected trace has duplicate model span ids");
+  for (const call of settlement.value.calls) {
+    const span = byId.get(call.traceSpanId);
+    if (!span) {
+      throw new Error(`protected trace is missing model ledger span ${call.traceSpanId}`);
+    }
+    assertTraceCall(span, call);
+  }
+}
+function usdToNanos(value, label) {
+  if (!Number.isFinite(value) || value < 0) throw new Error(`${label} must be nonnegative`);
+  const nanos = Math.round(value * USD_NANOS);
+  if (!Number.isSafeInteger(nanos)) throw new Error(`${label} exceeds fixed-point range`);
+  return nanos;
+}
+function assertTraceCall(span, call) {
+  if (span.model !== call.model) {
+    throw new Error(`protected trace span ${span.spanId} model does not match model ledger`);
+  }
+  if (span.startedAt !== call.startedAtMs || span.endedAt !== call.endedAtMs || span.status !== (call.status === "succeeded" ? "ok" : "error")) {
+    throw new Error(
+      `protected trace span ${span.spanId} timing or status does not match model ledger`
+    );
+  }
+  if (span.attributes?.["tangle.protected_model.source"] !== "router-settlement" || span.attributes?.["tangle.router.call_id"] !== call.callId || span.attributes?.["tangle.router.generation_id"] !== call.generationId) {
+    throw new Error(`protected trace span ${span.spanId} lacks router settlement provenance`);
+  }
+  for (const [name, traced, settled] of [
+    ["inputTokens", span.inputTokens, call.inputTokens],
+    ["outputTokens", span.outputTokens, call.outputTokens],
+    ["cachedInputTokens", span.cachedTokens ?? 0, call.cachedInputTokens],
+    ["reasoningTokens", span.reasoningTokens ?? 0, call.reasoningTokens]
+  ]) {
+    if (traced === void 0 || traced !== settled) {
+      throw new Error(
+        `protected trace span ${span.spanId} ${name} ${traced} does not match model ledger ${settled}`
+      );
+    }
+  }
+  if (span.costUsd === void 0) {
+    throw new Error(`protected trace span ${span.spanId} is missing costUsd`);
+  }
+  const tracedCost = usdToNanos(span.costUsd, `protected trace span ${span.spanId} costUsd`);
+  if (tracedCost !== call.costUsdNanos) {
+    throw new Error(
+      `protected trace span ${span.spanId} costUsdNanos ${tracedCost} does not match model ledger ${call.costUsdNanos}`
+    );
+  }
+}
+function assertIdentifier(value, label) {
+  if (typeof value !== "string" || value.length === 0 || value.length > 256) {
+    throw new Error(`${label} must be a non-empty bounded string`);
+  }
+}
+function assertCount2(value, label) {
+  if (!Number.isSafeInteger(value) || value < 0) {
+    throw new Error(`${label} must be a nonnegative safe integer`);
+  }
+}
+function assertTimestamp(value, label) {
+  if (!Number.isSafeInteger(value) || value <= 0) {
+    throw new Error(`${label} must be a positive safe integer`);
+  }
+}
+function safeAdd(left, right, label) {
+  const total = left + right;
+  if (!Number.isSafeInteger(total)) throw new Error(`${label} exceeds safe integer range`);
+  return total;
+}
+
+// src/candidate-execution/protected-redaction.ts
+import {
+  DEFAULT_REDACTION_RULES,
+  REDACTION_VERSION,
+  redactString
+} from "@tangle-network/agent-eval";
+function redactProtectedValue(value, protectedValues) {
+  const report = {
+    version: REDACTION_VERSION,
+    redactionCount: 0,
+    byRule: {}
+  };
+  const rules = protectedRedactionRules(protectedValues);
+  const redacted = redactNode(value, protectedValues, rules, report);
+  assertNoProtectedEvidence(redacted, protectedValues);
+  return { value: redacted, report };
+}
+function redactProtectedReason(reason, protectedValues) {
+  try {
+    return redactProtectedValue(reason, protectedValues).value;
+  } catch {
+    return "candidate execution failed with a protected error";
+  }
+}
+function assertNoProtectedEvidence(value, protectedValues) {
+  if (value instanceof Uint8Array) {
+    assertNoProtectedBytes(value, protectedValues);
+    return;
+  }
+  if (typeof value === "string") {
+    for (const protectedValue of protectedValueVariants(protectedValues)) {
+      if (value.includes(protectedValue)) {
+        throw new Error("protected value survived candidate evidence redaction");
+      }
+    }
+    if (decodedBase64ContainsProtectedValue(value, protectedValues)) {
+      throw new Error("base64 protected value survived candidate evidence redaction");
+    }
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const entry of value) assertNoProtectedEvidence(entry, protectedValues);
+    return;
+  }
+  if (value && typeof value === "object") {
+    for (const [key, entry] of Object.entries(value)) {
+      assertNoProtectedEvidence(key, protectedValues);
+      assertNoProtectedEvidence(entry, protectedValues);
+    }
+  }
+}
+function assertNoProtectedBytes(bytes, protectedValues) {
+  if (containsProtectedBytes(bytes, protectedValues)) {
+    throw new Error("protected value survived candidate evidence byte redaction");
+  }
+}
+function redactNode(value, protectedValues, rules, report) {
+  if (value instanceof Uint8Array) {
+    if (containsProtectedBytes(value, protectedValues)) {
+      recordRedaction(report, "candidate-access-binary", 1);
+      return Uint8Array.from(Buffer.from("[redacted:candidate-access-binary]", "utf8"));
+    }
+    return Uint8Array.from(value);
+  }
+  if (typeof value === "string") {
+    if (decodedBase64ContainsProtectedValue(value, protectedValues)) {
+      recordRedaction(report, "candidate-access-binary", 1);
+      return "[redacted:candidate-access-binary]";
+    }
+    const redacted = redactString(value, [...rules]);
+    for (const [rule, count] of Object.entries(redacted.report.byRule)) {
+      recordRedaction(report, rule, count);
+    }
+    return redacted.output;
+  }
+  if (Array.isArray(value)) {
+    return value.map((entry) => redactNode(entry, protectedValues, rules, report));
+  }
+  if (value && typeof value === "object") {
+    const entries = [];
+    const seenKeys = /* @__PURE__ */ new Set();
+    for (const [key, entry] of Object.entries(value)) {
+      const redactedKey = redactNode(key, protectedValues, rules, report);
+      if (typeof redactedKey !== "string" || seenKeys.has(redactedKey)) {
+        throw new Error("protected evidence redaction produced an ambiguous object key");
+      }
+      seenKeys.add(redactedKey);
+      entries.push([redactedKey, redactNode(entry, protectedValues, rules, report)]);
+    }
+    return Object.fromEntries(entries);
+  }
+  return value;
+}
+function protectedRedactionRules(protectedValues) {
+  const exactRules = protectedValueVariants(protectedValues).sort((left, right) => right.length - left.length || left.localeCompare(right)).map((value, index) => ({
+    id: `candidate-access-${index}`,
+    pattern: new RegExp(escapeRegularExpression(value), "g"),
+    replacement: "[redacted:candidate-access]"
+  }));
+  return [...exactRules, ...DEFAULT_REDACTION_RULES];
+}
+function recordRedaction(report, rule, count) {
+  if (count <= 0) return;
+  report.redactionCount += count;
+  report.byRule[rule] = (report.byRule[rule] ?? 0) + count;
+}
+function containsProtectedBytes(bytes, protectedValues) {
+  const source = Buffer.from(bytes);
+  return protectedValueVariants(protectedValues).some(
+    (value) => source.includes(Buffer.from(value, "utf8"))
+  );
+}
+function decodedBase64ContainsProtectedValue(value, protectedValues) {
+  if (value.length < 4 || value.length % 4 !== 0 || !/^[A-Za-z0-9+/]*={0,2}$/.test(value)) {
+    return false;
+  }
+  try {
+    return containsProtectedBytes(Buffer.from(value, "base64"), protectedValues);
+  } catch {
+    return false;
+  }
+}
+function protectedValueVariants(protectedValues) {
+  const variants = /* @__PURE__ */ new Set();
+  for (const value of normalizedProtectedValues(protectedValues)) {
+    variants.add(value);
+    variants.add(Buffer.from(value, "utf8").toString("base64"));
+    variants.add(Buffer.from(value, "utf8").toString("base64url"));
+    variants.add(encodeURIComponent(value));
+  }
+  return [...variants];
+}
+function normalizedProtectedValues(values) {
+  return [...new Set(values.filter((value) => value.length > 0))];
+}
+function escapeRegularExpression(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+// src/candidate-execution/finalize.ts
+async function finalizeAgentCandidateRun(state, capture, traceStore, settlement, evidence, protectedValues, writeRedactionReport, signal) {
+  let termination;
+  try {
+    signal?.throwIfAborted();
+    const protectedCapture = sealAgentCandidateProtectedRunCapture(capture);
+    if (protectedCapture.executionId !== state.executionId) {
+      throw new Error("protected capture execution id does not match the prepared execution");
+    }
+    termination = protectedCapture.termination;
+    if (termination.kind === "timeout" && termination.timeoutMs !== state.executionPlan.value.material.limits.timeoutMs) {
+      throw new Error("timeout termination does not match the frozen execution limit");
+    }
+    const run = await traceStore.getRun(state.trace.runId);
+    if (!run) throw new Error(`protected trace run is missing: ${state.trace.runId}`);
+    if (run.status === "running" || run.endedAt === void 0) {
+      throw new Error("protected trace run is not terminal");
+    }
+    assertTraceBindings(run.tags, state);
+    const [spans, events, budget, artifacts] = await Promise.all([
+      traceStore.spans({ runId: run.runId }),
+      traceStore.events({ runId: run.runId }),
+      traceStore.budget(run.runId),
+      traceStore.artifacts(run.runId)
+    ]);
+    const orderedSpans = [...spans].sort(
+      (a, b) => a.startedAt - b.startedAt || compareStrings(a.spanId, b.spanId)
+    );
+    const orderedEvents = [...events].sort(
+      (a, b) => a.timestamp - b.timestamp || compareStrings(a.eventId, b.eventId)
+    );
+    const orderedBudget = [...budget].sort(
+      (a, b) => a.timestamp - b.timestamp || compareStrings(a.dimension, b.dimension)
+    );
+    const orderedArtifacts = [...artifacts].sort(
+      (a, b) => compareStrings(a.artifactId, b.artifactId)
+    );
+    const modelSpans = orderedSpans.filter(isLlmSpan2);
+    assertTraceMatchesModelSettlement(modelSpans, settlement);
+    const usage = settlement.usage;
+    enforceLimits(state, run.startedAt, run.endedAt, orderedSpans, settlement);
+    const finalCapture = sealAgentCandidateExecutorFinalCapture(evidence.finalCapture);
+    const memory = await memoryReceipt(
+      state,
+      finalCapture,
+      evidence.outputArtifacts,
+      protectedValues,
+      signal
+    );
+    const redacted = redactProtectedValue(
+      {
+        schemaVersion: 1,
+        run: { ...run, redactionVersion: REDACTION_VERSION2 },
+        spans: orderedSpans,
+        events: orderedEvents,
+        budget: orderedBudget,
+        artifacts: orderedArtifacts
+      },
+      protectedValues
+    );
+    const combinedByRule = { ...writeRedactionReport?.byRule ?? {} };
+    for (const [rule, count] of Object.entries(redacted.report.byRule)) {
+      combinedByRule[rule] = (combinedByRule[rule] ?? 0) + count;
+    }
+    const traceMaterial = {
+      ...redacted.value,
+      evaluatorLimits: { resultTimeoutMs: state.resultTimeoutMs },
+      redaction: {
+        version: REDACTION_VERSION2,
+        redactionCount: (writeRedactionReport?.redactionCount ?? 0) + redacted.report.redactionCount,
+        byRule: combinedByRule
+      }
+    };
+    const traceBytes = canonicalCandidateBytes(traceMaterial);
+    assertNoProtectedBytes(traceBytes, protectedValues);
+    const traceArtifact = await persistCandidateOutputArtifact(evidence.outputArtifacts, {
+      executionId: state.executionId,
+      purpose: "trace",
+      bytes: traceBytes,
+      signal
+    });
+    const trace = {
+      schemaVersion: 1,
+      artifact: traceArtifact,
+      eventCount: 1 + orderedSpans.length + orderedEvents.length + orderedBudget.length + orderedArtifacts.length,
+      modelCallCount: modelSpans.length
+    };
+    const document = canonicalCandidateDocument({
+      schemaVersion: 2,
+      kind: "agent-candidate-run",
+      digestAlgorithm: "rfc8785-sha256",
+      bundleDigest: state.bundle.digest,
+      materializationReceiptDigest: state.materializationReceipt.digest,
+      executionPlanDigest: state.executionPlan.value.digest,
+      memory,
+      usage,
+      modelUsage: { resolved: state.resolvedModel, usage },
+      trace,
+      termination,
+      fixedUsage: settlement.fixedUsage,
+      modelSettlement: evidence.modelSettlement,
+      taskOutcome: evidence.taskOutcome.evidence,
+      benchmarkResult: evidence.benchmarkResult
+    });
+    agentCandidateRunReceiptV2Schema.parse(document.value);
+    const runReceipt = await persistCandidateOutputArtifact(evidence.outputArtifacts, {
+      executionId: state.executionId,
+      purpose: "run-receipt",
+      bytes: document.bytes,
+      signal
+    });
+    return {
+      succeeded: true,
+      receipt: document,
+      artifacts: {
+        modelSettlement: evidence.modelSettlement.artifact,
+        taskOutcome: evidence.taskOutcome.evidence.artifact,
+        benchmarkResult: evidence.benchmarkResult.artifact,
+        runReceipt
+      }
+    };
+  } catch (error) {
+    return {
+      ...failedAgentCandidateRun(
+        state,
+        redactProtectedReason(
+          error instanceof Error ? error.message : String(error),
+          protectedValues
+        ),
+        termination,
+        settlement.usage
+      )
+    };
+  }
+}
+function assertTraceBindings(tags, state) {
+  const expected = state.trace.tags;
+  for (const name of Object.values(CANDIDATE_TRACE_TAGS)) {
+    if (tags?.[name] !== expected[name]) {
+      throw new Error(`protected trace is not bound to prepared execution tag ${name}`);
+    }
+  }
+}
+function enforceLimits(state, startedAt, endedAt, spans, settlement) {
+  const limits = state.executionPlan.value.material.limits;
+  const usage = settlement.usage;
+  const wallMs = endedAt - startedAt;
+  if (!Number.isFinite(wallMs) || wallMs < 0 || wallMs > limits.timeoutMs) {
+    throw new Error(`protected trace wall time ${wallMs} exceeds ${limits.timeoutMs}`);
+  }
+  const steps = spans.filter((span) => span.kind === "tool").length;
+  const checks = [
+    [steps, limits.maxSteps, "tool steps"],
+    [usage.modelCalls, limits.maxModelCalls, "model calls"],
+    [usage.inputTokens, limits.maxInputTokens, "input tokens"],
+    [usage.outputTokens, limits.maxOutputTokens, "output tokens"]
+  ];
+  for (const [actual, limit, label] of checks) {
+    if (actual > limit) throw new Error(`protected ${label} ${actual} exceeds ${limit}`);
+  }
+  if (settlement.costUsdNanos > usdToNanos(limits.maxCostUsd, "frozen maxCostUsd")) {
+    throw new Error(`protected cost USD ${usage.costUsd} exceeds ${limits.maxCostUsd}`);
+  }
+}
+async function memoryReceipt(state, capture, outputArtifacts, protectedValues, signal) {
+  signal?.throwIfAborted();
+  if (state.memory.mode === "disabled") {
+    if (capture.memoryAfter !== void 0) {
+      throw new Error("disabled memory cannot return an after-state");
+    }
+    return { mode: "disabled" };
+  }
+  if (!capture.memoryAfter) throw new Error("isolated memory is missing its protected after-state");
+  const afterState = capture.memoryAfter.afterState;
+  const archive = Uint8Array.from(capture.memoryAfter.archive);
+  if (archive.byteLength === 0) throw new Error("isolated memory archive cannot be empty");
+  const manifestBytes = canonicalCandidateBytes(afterState);
+  assertNoProtectedBytes(manifestBytes, protectedValues);
+  assertNoProtectedBytes(archive, protectedValues);
+  const provisionalSnapshot = agentCandidateWorkspaceSnapshotEvidenceSchema.parse({
+    schemaVersion: 1,
+    kind: "agent-candidate-workspace-snapshot",
+    digest: sha256Bytes(manifestBytes),
+    material: afterState,
+    manifest: embeddedCandidateArtifact(manifestBytes),
+    archive: embeddedCandidateArtifact(archive)
+  });
+  const root = await mkdtemp2(join2(tmpdir2(), "agent-candidate-memory-after-"));
+  try {
+    await state.ports.workspaces.materialize({
+      role: "memory",
+      snapshot: provisionalSnapshot,
+      archive: Uint8Array.from(archive),
+      destination: root
+    });
+    const files = await readMaterializedWorkspaceFiles(root, afterState);
+    for (const file of files) assertNoProtectedBytes(file.bytes, protectedValues);
+    signal?.throwIfAborted();
+  } finally {
+    await rm2(root, { recursive: true, force: true });
+  }
+  const [manifest, archiveRef] = await Promise.all([
+    persistCandidateOutputArtifact(outputArtifacts, {
+      executionId: state.executionId,
+      purpose: "memory-after-manifest",
+      bytes: manifestBytes,
+      signal
+    }),
+    persistCandidateOutputArtifact(outputArtifacts, {
+      executionId: state.executionId,
+      purpose: "memory-after-archive",
+      bytes: archive,
+      signal
+    })
+  ]);
+  const snapshot = agentCandidateWorkspaceSnapshotEvidenceSchema.parse({
+    schemaVersion: 1,
+    kind: "agent-candidate-workspace-snapshot",
+    digest: sha256Bytes(manifestBytes),
+    material: afterState,
+    manifest,
+    archive: archiveRef
+  });
+  return {
+    mode: "isolated",
+    scope: "task",
+    effectiveNamespace: state.memory.effectiveNamespace,
+    resetEvidenceDigest: state.memory.reset.evidence.sha256,
+    beforeStateDigest: state.memory.beforeState.digest,
+    afterState: snapshot
+  };
+}
+function failedAgentCandidateRun(state, reason, termination, usage = null) {
+  return {
+    succeeded: false,
+    reason,
+    partial: {
+      executionId: state.executionId,
+      bundleDigest: state.bundle.digest,
+      executionPlanDigest: state.executionPlan.value.digest,
+      materializationReceiptDigest: state.materializationReceipt.digest,
+      ...termination ? { termination } : {}
+    },
+    usage
+  };
+}
+function compareStrings(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+
+// src/candidate-execution/outcome-evidence.ts
+import { mkdtemp as mkdtemp3, rm as rm3 } from "fs/promises";
+import { tmpdir as tmpdir3 } from "os";
+import { join as join3 } from "path";
+import {
+  agentCandidateBenchmarkResultEvidenceSchema,
+  agentCandidateModelSettlementEvidenceSchema,
+  agentCandidateTaskOutcomeEvidenceSchema,
+  agentCandidateWorkspaceSnapshotEvidenceSchema as agentCandidateWorkspaceSnapshotEvidenceSchema2
+} from "@tangle-network/agent-interface";
+
+// src/candidate-execution/benchmark-grader.ts
+async function runBoundCandidateBenchmarkGrader(input) {
+  input.signal?.throwIfAborted();
+  const descriptor = snapshotGraderDescriptor(input.grader);
+  const implementationBytes = await readVerifiedArtifact(descriptor.artifact, input.artifacts);
+  if (implementationBytes.byteLength === 0) {
+    throw new Error("candidate benchmark grader implementation cannot be empty");
+  }
+  const expectedImplementationDigest = sha256Bytes(implementationBytes);
+  const termination = immutableCandidateValue(input.termination);
+  const run = input.grader.run;
+  const result = await run(
+    Object.freeze({
+      executionId: input.executionId,
+      termination,
+      outcome: input.outcome,
+      implementation: detachedImplementation(implementationBytes),
+      signal: input.signal ?? new AbortController().signal
+    })
+  );
+  input.signal?.throwIfAborted();
+  assertExactRunnerResult(result);
+  const evidence = Uint8Array.from(result.evidence);
+  const outputDigest = sha256Bytes(evidence);
+  if (result.binding.implementationDigest !== expectedImplementationDigest) {
+    throw new Error(
+      "candidate benchmark grader executed implementation digest does not match its verified artifact"
+    );
+  }
+  if (result.binding.taskOutcomeDigest !== input.outcome.evidence.digest) {
+    throw new Error(
+      "candidate benchmark grader task outcome digest does not match verified outcome"
+    );
+  }
+  if (result.binding.outputDigest !== outputDigest) {
+    throw new Error("candidate benchmark grader raw output digest does not match returned evidence");
+  }
+  return Object.freeze({
+    grader: descriptor,
+    evaluation: result.evaluation,
+    evidence
+  });
+}
+function snapshotGraderDescriptor(grader) {
+  if (!grader.name || !grader.version) {
+    throw new Error("candidate benchmark grader name and version must be non-empty");
+  }
+  return immutableCandidateValue({
+    name: grader.name,
+    version: grader.version,
+    artifact: grader.artifact
+  });
+}
+function detachedImplementation(bytes) {
+  const stored = Uint8Array.from(bytes);
+  return Object.freeze({
+    byteLength: stored.byteLength,
+    get bytes() {
+      return Uint8Array.from(stored);
+    }
+  });
+}
+function assertExactRunnerResult(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("candidate benchmark grader result must be an object");
+  }
+  const result = value;
+  const keys = Object.keys(result).sort();
+  if (keys.length !== 3 || keys[0] !== "binding" || keys[1] !== "evaluation" || keys[2] !== "evidence") {
+    throw new Error("candidate benchmark grader returned unknown or missing fields");
+  }
+  if (!(result.evidence instanceof Uint8Array)) {
+    throw new Error("candidate benchmark grader evidence must be bytes");
+  }
+  if (result.binding === null || typeof result.binding !== "object" || Array.isArray(result.binding)) {
+    throw new Error("candidate benchmark grader binding must be an object");
+  }
+  const bindingKeys = Object.keys(result.binding).sort();
+  if (bindingKeys.length !== 3 || bindingKeys[0] !== "implementationDigest" || bindingKeys[1] !== "outputDigest" || bindingKeys[2] !== "taskOutcomeDigest") {
+    throw new Error("candidate benchmark grader binding returned unknown or missing fields");
+  }
+}
+
+// src/candidate-execution/outcome-evidence.ts
+async function persistCandidateModelSettlement(state, settlement, outputArtifacts) {
+  return await persistCandidateModelSettlementEvidence(
+    {
+      executionId: state.executionId,
+      executionPlanDigest: state.executionPlan.value.digest,
+      resolvedModel: state.resolvedModel
+    },
+    settlement,
+    outputArtifacts
+  );
+}
+async function persistCandidateModelSettlementEvidence(identity, settlement, outputArtifacts) {
+  const material = {
+    schemaVersion: 2,
+    kind: "agent-candidate-model-settlement-material",
+    executionPlanDigest: identity.executionPlanDigest,
+    preparationId: settlement.value.preparationId,
+    grantDigest: settlement.value.grantDigest,
+    closed: true,
+    resolved: identity.resolvedModel,
+    calls: settlement.value.calls.map((call) => ({
+      callId: call.callId,
+      generationId: call.generationId,
+      traceSpanId: call.traceSpanId,
+      status: call.status,
+      model: call.model,
+      startedAtMs: call.startedAtMs,
+      endedAtMs: call.endedAtMs,
+      inputTokens: call.inputTokens,
+      outputTokens: call.outputTokens,
+      cachedInputTokens: call.cachedInputTokens ?? 0,
+      reasoningTokens: call.reasoningTokens ?? 0,
+      costUsdNanos: call.costUsdNanos
+    })),
+    usage: settlement.fixedUsage
+  };
+  const bytes = canonicalCandidateBytes(material);
+  const digest = sha256Bytes(bytes);
+  const artifact = await persistCandidateOutputArtifact(outputArtifacts, {
+    executionId: identity.executionId,
+    purpose: "model-settlement",
+    bytes
+  });
+  return immutableCandidateValue(
+    agentCandidateModelSettlementEvidenceSchema.parse({
+      schemaVersion: 1,
+      kind: "agent-candidate-model-settlement",
+      digest,
+      material,
+      artifact
+    })
+  );
+}
+async function persistVerifiedCandidateTaskOutcome(state, capture, outputArtifacts, protectedValues, signal) {
+  signal?.throwIfAborted();
+  const patch = Uint8Array.from(capture.gitDiff);
+  const archive = Uint8Array.from(capture.archive);
+  if (archive.byteLength === 0) throw new Error("candidate task archive cannot be empty");
+  assertNoProtectedBytes(patch, protectedValues);
+  assertNoProtectedBytes(archive, protectedValues);
+  const afterState = immutableCandidateValue(capture.afterState);
+  const repository = state.executionPlan.value.material.task.repository;
+  const verified = await verifyTaskOutcomePatch({
+    repositoryRoot: state.roots.staging.taskRoot,
+    baseCommit: repository.baseCommit,
+    baseTree: repository.baseTree,
+    resultTree: capture.resultTree,
+    patch,
+    afterState
+  });
+  signal?.throwIfAborted();
+  const manifestBytes = canonicalCandidateBytes(afterState);
+  assertNoProtectedBytes(manifestBytes, protectedValues);
+  const provisionalSnapshot = agentCandidateWorkspaceSnapshotEvidenceSchema2.parse({
+    schemaVersion: 1,
+    kind: "agent-candidate-workspace-snapshot",
+    digest: sha256Bytes(manifestBytes),
+    material: afterState,
+    manifest: embeddedCandidateArtifact(manifestBytes),
+    archive: embeddedCandidateArtifact(archive)
+  });
+  await verifyTaskOutcomeArchive(state, provisionalSnapshot, archive, protectedValues);
+  signal?.throwIfAborted();
+  const [manifest, archiveRef, gitDiff] = await Promise.all([
+    persistCandidateOutputArtifact(outputArtifacts, {
+      executionId: state.executionId,
+      purpose: "task-manifest",
+      bytes: manifestBytes,
+      signal
+    }),
+    persistCandidateOutputArtifact(outputArtifacts, {
+      executionId: state.executionId,
+      purpose: "task-archive",
+      bytes: archive,
+      signal
+    }),
+    persistCandidateOutputArtifact(outputArtifacts, {
+      executionId: state.executionId,
+      purpose: "task-patch",
+      bytes: patch,
+      signal
+    })
+  ]);
+  const snapshot = agentCandidateWorkspaceSnapshotEvidenceSchema2.parse({
+    schemaVersion: 1,
+    kind: "agent-candidate-workspace-snapshot",
+    digest: sha256Bytes(manifestBytes),
+    material: afterState,
+    manifest,
+    archive: archiveRef
+  });
+  const material = {
+    schemaVersion: 1,
+    kind: "agent-candidate-task-outcome-material",
+    executionPlanDigest: state.executionPlan.value.digest,
+    baseRepository: {
+      identity: repository.identity,
+      rootIdentity: repository.rootIdentity,
+      commit: repository.baseCommit,
+      tree: repository.baseTree
+    },
+    resultRepository: {
+      identity: repository.identity,
+      rootIdentity: repository.rootIdentity,
+      commit: verified.resultCommit,
+      tree: verified.resultTree
+    },
+    afterState: snapshot,
+    gitDiff: {
+      format: "git-diff-binary",
+      artifact: gitDiff
+    }
+  };
+  const bytes = canonicalCandidateBytes(material);
+  const digest = sha256Bytes(bytes);
+  const artifact = await persistCandidateOutputArtifact(outputArtifacts, {
+    executionId: state.executionId,
+    purpose: "task-outcome",
+    bytes,
+    signal
+  });
+  const evidence = immutableCandidateValue(
+    agentCandidateTaskOutcomeEvidenceSchema.parse({
+      schemaVersion: 1,
+      kind: "agent-candidate-task-outcome",
+      digest,
+      material,
+      artifact
+    })
+  );
+  const storedPatch = Uint8Array.from(patch);
+  return Object.freeze({
+    evidence,
+    get patch() {
+      return Uint8Array.from(storedPatch);
+    },
+    [verifiedTaskOutcomeBrand]: true
+  });
+}
+async function persistCandidateBenchmarkResult(state, termination, outcome, grader, outputArtifacts, protectedValues, signal) {
+  signal?.throwIfAborted();
+  const frozenTermination = immutableCandidateValue(termination);
+  const graded = await runBoundCandidateBenchmarkGrader({
+    executionId: state.executionId,
+    termination: frozenTermination,
+    outcome,
+    grader,
+    artifacts: outputArtifacts,
+    signal
+  });
+  signal?.throwIfAborted();
+  const evaluation = normalizeEvaluation(graded.evaluation, frozenTermination);
+  const rawEvidence = Uint8Array.from(graded.evidence);
+  if (rawEvidence.byteLength === 0) throw new Error("candidate benchmark evidence cannot be empty");
+  assertNoProtectedBytes(rawEvidence, protectedValues);
+  const evidenceRef = await persistCandidateOutputArtifact(outputArtifacts, {
+    executionId: state.executionId,
+    purpose: "grader-evidence",
+    bytes: rawEvidence,
+    signal
+  });
+  const task = state.executionPlan.value.material.task;
+  const material = {
+    schemaVersion: 1,
+    kind: "agent-candidate-benchmark-result-material",
+    executionPlanDigest: state.executionPlan.value.digest,
+    taskOutcomeDigest: outcome.evidence.digest,
+    benchmark: {
+      name: task.benchmark,
+      version: task.benchmarkVersion,
+      taskId: task.taskId,
+      splitDigest: task.splitDigest
+    },
+    grader: {
+      name: graded.grader.name,
+      version: graded.grader.version,
+      artifact: graded.grader.artifact
+    },
+    evidence: evidenceRef,
+    score: evaluation.score,
+    passed: evaluation.passed,
+    dimensions: evaluation.dimensions
+  };
+  const bytes = canonicalCandidateBytes(material);
+  const digest = sha256Bytes(bytes);
+  const artifact = await persistCandidateOutputArtifact(outputArtifacts, {
+    executionId: state.executionId,
+    purpose: "benchmark-result",
+    bytes,
+    signal
+  });
+  return immutableCandidateValue(
+    agentCandidateBenchmarkResultEvidenceSchema.parse({
+      schemaVersion: 1,
+      kind: "agent-candidate-benchmark-result",
+      digest,
+      material,
+      artifact
+    })
+  );
+}
+async function verifyTaskOutcomeArchive(state, snapshot, archive, protectedValues) {
+  const root = await mkdtemp3(join3(tmpdir3(), "agent-candidate-task-archive-"));
+  try {
+    await state.ports.workspaces.materialize({
+      role: "task",
+      snapshot,
+      archive: Uint8Array.from(archive),
+      destination: root
+    });
+    const files = await readMaterializedWorkspaceFiles(root, snapshot.material);
+    for (const file of files) assertNoProtectedBytes(file.bytes, protectedValues);
+  } finally {
+    await rm3(root, { recursive: true, force: true });
+  }
+}
+function normalizeEvaluation(evaluation, termination) {
+  if (!evaluation || typeof evaluation !== "object" || Array.isArray(evaluation)) {
+    throw new Error("candidate benchmark evaluation must be an object");
+  }
+  assertUnitScore(evaluation.score, "candidate benchmark score");
+  if (evaluation.passed !== void 0 && typeof evaluation.passed !== "boolean") {
+    throw new Error("candidate benchmark passed must be boolean");
+  }
+  const cleanExit = termination.kind === "exit" && termination.exitCode === 0;
+  const dimensions = Object.entries(evaluation.dimensions ?? {}).map(([name, score]) => {
+    if (!/^[a-z0-9]+(?:[._-][a-z0-9]+)*$/.test(name)) {
+      throw new Error(`candidate benchmark dimension is not normalized: ${name}`);
+    }
+    assertUnitScore(score, `candidate benchmark dimension ${name}`);
+    return { name, score: cleanExit ? score : 0 };
+  }).sort((left, right) => left.name.localeCompare(right.name));
+  return {
+    score: cleanExit ? evaluation.score : 0,
+    passed: cleanExit && (evaluation.passed ?? evaluation.score > 0),
+    dimensions
+  };
+}
+function assertUnitScore(value, label) {
+  if (typeof value !== "number" || !Number.isFinite(value) || value < 0 || value > 1) {
+    throw new Error(`${label} must be finite and within [0, 1]`);
+  }
+}
+
+// src/candidate-execution/protected-trace-store.ts
+import { REDACTION_VERSION as REDACTION_VERSION3 } from "@tangle-network/agent-eval";
+var ProtectedAgentCandidateTraceStore = class {
+  constructor(inner, protectedValues) {
+    this.inner = inner;
+    this.protectedValues = protectedValues;
+  }
+  inner;
+  protectedValues;
+  aggregate = {
+    version: REDACTION_VERSION3,
+    redactionCount: 0,
+    byRule: {}
+  };
+  report() {
+    return {
+      version: this.aggregate.version,
+      redactionCount: this.aggregate.redactionCount,
+      byRule: { ...this.aggregate.byRule }
+    };
+  }
+  async appendRun(run) {
+    await this.inner.appendRun(this.redact(run));
+  }
+  async updateRun(runId, patch) {
+    await this.inner.updateRun(this.redact(runId), this.redact(patch));
+  }
+  async appendSpan(span) {
+    if (span.kind === "llm") {
+      throw new Error("candidate executors cannot author protected model spans");
+    }
+    await this.inner.appendSpan(this.redact(span));
+  }
+  async updateSpan(spanId, patch) {
+    if (patch.kind === "llm") {
+      throw new Error("candidate executors cannot author protected model spans");
+    }
+    await this.inner.updateSpan(this.redact(spanId), this.redact(patch));
+  }
+  async appendEvent(event) {
+    await this.inner.appendEvent(this.redact(event));
+  }
+  async appendArtifact(artifact) {
+    await this.inner.appendArtifact(this.redact(artifact));
+  }
+  async appendBudgetEntry(entry) {
+    await this.inner.appendBudgetEntry(this.redact(entry));
+  }
+  getRun(...args) {
+    return this.inner.getRun(...args);
+  }
+  listRuns(...args) {
+    return this.inner.listRuns(...args);
+  }
+  spans(...args) {
+    return this.inner.spans(...args);
+  }
+  events(...args) {
+    return this.inner.events(...args);
+  }
+  budget(...args) {
+    return this.inner.budget(...args);
+  }
+  artifacts(...args) {
+    return this.inner.artifacts(...args);
+  }
+  redact(value) {
+    const redacted = redactProtectedValue(value, this.protectedValues);
+    this.aggregate.version = redacted.report.version;
+    this.aggregate.redactionCount += redacted.report.redactionCount;
+    for (const [rule, count] of Object.entries(redacted.report.byRule)) {
+      this.aggregate.byRule[rule] = (this.aggregate.byRule[rule] ?? 0) + count;
+    }
+    return redacted.value;
+  }
+};
+var RecoveryAgentCandidateTraceStore = class {
+  constructor(inner) {
+    this.inner = inner;
+  }
+  inner;
+  appendRun() {
+    return this.rejectWrite();
+  }
+  updateRun() {
+    return this.rejectWrite();
+  }
+  appendSpan() {
+    return this.rejectWrite();
+  }
+  updateSpan() {
+    return this.rejectWrite();
+  }
+  appendEvent() {
+    return this.rejectWrite();
+  }
+  appendArtifact() {
+    return this.rejectWrite();
+  }
+  appendBudgetEntry() {
+    return this.rejectWrite();
+  }
+  getRun(...args) {
+    return this.inner.getRun(...args);
+  }
+  listRuns(...args) {
+    return this.inner.listRuns(...args);
+  }
+  spans(...args) {
+    return this.inner.spans(...args);
+  }
+  events(...args) {
+    return this.inner.events(...args);
+  }
+  budget(...args) {
+    return this.inner.budget(...args);
+  }
+  artifacts(...args) {
+    return this.inner.artifacts(...args);
+  }
+  rejectWrite() {
+    return Promise.reject(new Error("expired candidate recovery cannot append trace evidence"));
+  }
+};
+
+// src/candidate-execution/execute.ts
+async function executePreparedAgentCandidate(prepared, options) {
+  const initialState = assertPreparedCandidateIntegrity(prepared);
+  const cleanupTimeoutMs = candidateCleanupTimeout(
+    options.cleanupTimeoutMs ?? initialState.cleanupTimeoutMs
+  );
+  if (cleanupTimeoutMs > initialState.cleanupTimeoutMs) {
+    throw new Error("execution cleanup timeout exceeds the frozen preparation bound");
+  }
+  const resultTimeoutMs = candidateResultTimeout(
+    options.resultTimeoutMs ?? initialState.resultTimeoutMs,
+    initialState.resultTimeoutMs
+  );
+  if (resultTimeoutMs > initialState.resultTimeoutMs) {
+    throw new Error("execution result timeout exceeds the frozen preparation bound");
+  }
+  let state;
+  try {
+    state = beginPreparedCandidateClaim(prepared);
+  } catch (error) {
+    return failedAgentCandidateRun(initialState, errorMessage(error));
+  }
+  try {
+    await assertPreparedCandidateWorkspaces(state);
+  } catch (error) {
+    return await failBeforeActivation(prepared, state, error, "failed", cleanupTimeoutMs);
+  }
+  let acquired;
+  try {
+    acquired = await options.claimStore.tryClaim(candidateExecutionClaim(prepared));
+  } catch (error) {
+    return await failBeforeActivation(prepared, state, error, "failed", cleanupTimeoutMs);
+  }
+  if (!acquired.acquired) {
+    return await failBeforeActivation(
+      prepared,
+      state,
+      new Error(
+        acquired.reason === "retry-not-eligible" ? `candidate execution retry is not eligible: ${acquired.detail}` : "candidate execution attempt is already claimed"
+      ),
+      "replayed",
+      cleanupTimeoutMs
+    );
+  }
+  markPreparedCandidateClaimed(prepared);
+  const postRunWindowMs = candidatePostRunWindowMs(cleanupTimeoutMs, resultTimeoutMs);
+  const deadlineAtMs = acquired.claim.leaseExpiresAtMs - candidatePostRunWindowMs(state.cleanupTimeoutMs, state.resultTimeoutMs);
+  const requiredLeaseExpiry = deadlineAtMs + postRunWindowMs;
+  if (Date.now() >= deadlineAtMs || deadlineAtMs > state.reservationExpiresAtMs || requiredLeaseExpiry > acquired.lease.expiresAtMs) {
+    return await failClaimedExecution(
+      prepared,
+      state,
+      acquired.lease,
+      options.claimStore,
+      options.outputArtifacts,
+      new Error("candidate claim no longer covers its full execution and cleanup window"),
+      "failed",
+      cleanupTimeoutMs,
+      "pre-model-infrastructure"
+    );
+  }
+  let activation;
+  try {
+    const activated = await withinCandidateCleanupDeadline(
+      () => state.ports.models.activateGrant({
+        executionId: state.executionId,
+        preparationId: state.preparationId,
+        grantDigest: state.modelReservation.digest,
+        resolved: state.resolvedModel,
+        deadlineAtMs
+      }),
+      Math.min(deadlineAtMs, candidateCleanupDeadline(cleanupTimeoutMs)),
+      "protected model activation"
+    );
+    activation = Object.freeze({ env: Object.freeze({ ...activated.env }) });
+  } catch (error) {
+    return await failClaimedExecution(
+      prepared,
+      state,
+      acquired.lease,
+      options.claimStore,
+      options.outputArtifacts,
+      new Error("protected model activation failed", { cause: error }),
+      "failed",
+      cleanupTimeoutMs,
+      "pre-model-infrastructure"
+    );
+  }
+  let memoryActivation;
+  if (state.memory.mode === "isolated") {
+    try {
+      const reservation = state.memoryReservation;
+      if (!reservation) throw new Error("isolated memory reservation is missing");
+      const activated = await withinCandidateCleanupDeadline(
+        () => state.ports.memory.activate({
+          executionId: state.executionId,
+          preparationId: reservation.preparationId,
+          accessDigest: reservation.accessDigest,
+          effectiveNamespace: reservation.effectiveNamespace,
+          deadlineAtMs
+        }),
+        Math.min(deadlineAtMs, candidateCleanupDeadline(cleanupTimeoutMs)),
+        "isolated memory activation"
+      );
+      memoryActivation = Object.freeze({ env: Object.freeze({ ...activated.env }) });
+    } catch (error) {
+      return await failClaimedExecution(
+        prepared,
+        state,
+        acquired.lease,
+        options.claimStore,
+        options.outputArtifacts,
+        new Error("isolated memory activation failed", { cause: error }),
+        "failed",
+        cleanupTimeoutMs,
+        "pre-model-infrastructure",
+        activation
+      );
+    }
+  }
+  let request;
+  try {
+    request = beginPreparedCandidateRun(prepared, activation, memoryActivation).request;
+  } catch (error) {
+    return await failClaimedExecution(
+      prepared,
+      state,
+      acquired.lease,
+      options.claimStore,
+      options.outputArtifacts,
+      error,
+      "failed",
+      cleanupTimeoutMs,
+      "pre-model-infrastructure",
+      activation,
+      memoryActivation
+    );
+  }
+  try {
+    const phase = await options.claimStore.markCandidateMayRun(acquired.lease);
+    if (phase.phase !== "candidate-may-run") {
+      throw new Error("candidate claim did not persist the candidate-may-run phase");
+    }
+  } catch (error) {
+    return await failClaimedExecution(
+      prepared,
+      state,
+      acquired.lease,
+      options.claimStore,
+      options.outputArtifacts,
+      new Error("candidate execution phase persistence failed", { cause: error }),
+      "failed",
+      cleanupTimeoutMs,
+      "pre-model-infrastructure",
+      activation,
+      memoryActivation
+    );
+  }
+  if (Date.now() >= deadlineAtMs) {
+    return await failClaimedExecution(
+      prepared,
+      state,
+      acquired.lease,
+      options.claimStore,
+      options.outputArtifacts,
+      new Error("candidate execution deadline elapsed while persisting its launch phase"),
+      "failed",
+      cleanupTimeoutMs,
+      "unknown",
+      activation,
+      memoryActivation
+    );
+  }
+  const protectedValues = protectedEnvironmentValues(activation, memoryActivation);
+  const protectedTraceStore = new ProtectedAgentCandidateTraceStore(
+    options.traceStore,
+    protectedValues
+  );
+  const execution = await runAndStopExecutor(
+    options.executor,
+    request,
+    protectedTraceStore,
+    deadlineAtMs,
+    cleanupTimeoutMs
+  );
+  beginPreparedCandidateSettlement(prepared);
+  const cleanupDeadlineAtMs = candidateCleanupDeadline(cleanupTimeoutMs);
+  const accessReason = execution.kind === "timeout" || execution.termination?.kind === "timeout" ? "timeout" : execution.kind === "capture" ? "completed" : "failed";
+  const [memoryClose, settlementResult] = await Promise.all([
+    closeMemoryAccess(state, accessReason, cleanupDeadlineAtMs),
+    settleModelGrant(state, accessReason, cleanupDeadlineAtMs)
+  ]);
+  if (!execution.processStopped || !settlementResult.settlement || !memoryClose.closed) {
+    consumePreparedCandidateExecution(prepared, "failed");
+    return failedAgentCandidateRun(
+      state,
+      redactProtectedReason(
+        joinErrors(
+          execution.error,
+          !execution.processStopped ? new Error("candidate process termination is not proven") : void 0,
+          memoryClose.error,
+          settlementResult.error ?? (!settlementResult.settlement ? new Error("model settlement failed") : void 0),
+          new Error("candidate claim remains recoverable until protected cleanup is proven")
+        ),
+        protectedValues
+      ),
+      execution.termination,
+      settlementResult.settlement?.usage ?? null
+    );
+  }
+  let modelSettlement;
+  try {
+    modelSettlement = await withinCandidateCleanupDeadline(
+      () => persistCandidateModelSettlement(
+        state,
+        settlementResult.settlement,
+        options.outputArtifacts
+      ),
+      candidateCleanupDeadline(cleanupTimeoutMs),
+      "candidate model settlement persistence"
+    );
+  } catch (error) {
+    consumePreparedCandidateExecution(prepared, "failed");
+    return failedAgentCandidateRun(
+      state,
+      redactProtectedReason(
+        joinErrors(
+          error,
+          new Error("candidate claim remains recoverable until settlement evidence is durable")
+        ),
+        protectedValues
+      ),
+      execution.termination,
+      settlementResult.settlement.usage
+    );
+  }
+  let result;
+  const failureClass = execution.kind === "error" ? "execution" : "post-model-infrastructure";
+  if (execution.kind === "error") {
+    result = failedAgentCandidateRun(
+      state,
+      redactProtectedReason(errorMessage(execution.error), protectedValues),
+      execution.termination,
+      settlementResult.settlement.usage
+    );
+  } else if (!execution.finalCapture.taskOutcome) {
+    result = failedAgentCandidateRun(
+      state,
+      "candidate executor stopped without a captured task outcome",
+      execution.termination,
+      settlementResult.settlement.usage
+    );
+  } else {
+    const capture = execution.kind === "capture" ? execution.capture : {
+      executionId: state.executionId,
+      termination: execution.termination
+    };
+    try {
+      const resultDeadlineAtMs = Math.min(
+        Date.now() + resultTimeoutMs,
+        acquired.lease.expiresAtMs - candidateTerminalWindowMs(cleanupTimeoutMs)
+      );
+      result = await withinCandidateResultDeadline(
+        async (signal) => {
+          await appendAuthoritativeModelSettlementSpans(
+            options.traceStore,
+            state.trace.runId,
+            settlementResult.settlement
+          );
+          const taskOutcome = await persistVerifiedCandidateTaskOutcome(
+            state,
+            execution.finalCapture.taskOutcome,
+            options.outputArtifacts,
+            protectedValues,
+            signal
+          );
+          const benchmarkResult = await persistCandidateBenchmarkResult(
+            state,
+            capture.termination,
+            taskOutcome,
+            options.grader,
+            options.outputArtifacts,
+            protectedValues,
+            signal
+          );
+          return await finalizeAgentCandidateRun(
+            state,
+            capture,
+            options.traceStore,
+            settlementResult.settlement,
+            {
+              finalCapture: execution.finalCapture,
+              modelSettlement,
+              taskOutcome,
+              benchmarkResult,
+              outputArtifacts: options.outputArtifacts
+            },
+            protectedValues,
+            protectedTraceStore.report(),
+            signal
+          );
+        },
+        resultDeadlineAtMs,
+        "candidate evidence finalization"
+      );
+    } catch (error) {
+      result = failedAgentCandidateRun(
+        state,
+        redactProtectedReason(errorMessage(error), protectedValues),
+        execution.termination,
+        settlementResult.settlement.usage
+      );
+    }
+  }
+  let terminal;
+  try {
+    terminal = result.succeeded ? {
+      schemaVersion: 1,
+      status: "succeeded",
+      usage: settlementResult.settlement.fixedUsage,
+      modelSettlement: result.artifacts.modelSettlement,
+      taskOutcome: result.artifacts.taskOutcome,
+      benchmarkResult: result.artifacts.benchmarkResult,
+      runReceipt: result.artifacts.runReceipt
+    } : {
+      schemaVersion: 1,
+      status: "failed",
+      failureClass,
+      usage: settlementResult.settlement.fixedUsage,
+      modelSettlement: modelSettlement.artifact,
+      failureEvidence: await withinCandidateCleanupDeadline(
+        () => persistFailureEvidence(
+          state,
+          result.reason,
+          failureClass,
+          execution.termination,
+          options.outputArtifacts
+        ),
+        acquired.lease.expiresAtMs,
+        "candidate failure-evidence persistence"
+      )
+    };
+  } catch (error) {
+    consumePreparedCandidateExecution(prepared, "failed");
+    return failedAgentCandidateRun(
+      state,
+      redactProtectedReason(
+        joinErrors(
+          error,
+          new Error("candidate claim remains recoverable until terminal evidence is durable")
+        ),
+        protectedValues
+      ),
+      execution.termination,
+      settlementResult.settlement.usage
+    );
+  }
+  const finished = await finishClaim(
+    options.claimStore,
+    acquired.lease,
+    terminal,
+    acquired.lease.expiresAtMs
+  );
+  if (finished) {
+    consumePreparedCandidateExecution(prepared, result.succeeded ? "succeeded" : "failed");
+    return result;
+  }
+  consumePreparedCandidateExecution(prepared, "failed");
+  return failedAgentCandidateRun(
+    state,
+    "candidate execution terminal record could not be persisted",
+    execution.termination,
+    settlementResult.settlement.usage
+  );
+}
+async function runAndStopExecutor(executor, request, traceStore, deadlineAtMs, cleanupTimeoutMs) {
+  const timeoutMs = request.hardLimits.timeoutMs;
+  const timeoutError = new CandidateExecutionDeadlineError(timeoutMs);
+  if (Date.now() >= deadlineAtMs) {
+    return {
+      kind: "error",
+      error: timeoutError,
+      termination: { kind: "timeout", timeoutMs },
+      processStopped: true
+    };
+  }
+  const controller = new AbortController();
+  let timer;
+  let timedOut = false;
+  let capture;
+  let executionError;
+  const executionPromise = Promise.resolve().then(
+    () => executor.execute(request, {
+      traceStore,
+      signal: controller.signal,
+      deadlineAtMs
+    })
+  );
+  void executionPromise.catch(() => void 0);
+  const deadlinePromise = new Promise((_resolve, reject) => {
+    timer = setTimeout(
+      () => {
+        timedOut = true;
+        controller.abort(timeoutError);
+        reject(timeoutError);
+      },
+      Math.max(0, deadlineAtMs - Date.now())
+    );
+  });
+  void deadlinePromise.catch(() => void 0);
+  try {
+    capture = sealAgentCandidateProtectedRunCapture(
+      await Promise.race([executionPromise, deadlinePromise])
+    );
+  } catch (error) {
+    executionError = error;
+  }
+  if (!timedOut && capture && capture.executionId !== request.executionId) {
+    executionError = new Error("candidate execution capture id does not match the request");
+    capture = void 0;
+  } else if (!timedOut && capture && Date.now() >= deadlineAtMs) {
+    timedOut = true;
+    executionError = timeoutError;
+    capture = void 0;
+  } else if (!timedOut && capture?.termination.kind === "timeout") {
+    executionError = new Error("candidate executor cannot declare the runtime-owned timeout");
+    capture = void 0;
+  }
+  if (!capture || timedOut) controller.abort(executionError);
+  const stopReason = timedOut ? "timeout" : capture ? "completed" : "failed";
+  let stopped;
+  try {
+    stopped = await withinCandidateCleanupDeadline(
+      () => executor.stopAndCapture(
+        {
+          executionId: request.executionId,
+          executionPlanDigest: request.executionPlan.value.digest
+        },
+        {
+          traceStore,
+          reason: stopReason,
+          signal: controller.signal,
+          deadlineAtMs
+        }
+      ),
+      Date.now() + cleanupTimeoutMs,
+      "candidate process termination"
+    );
+    if (!stopped || typeof stopped !== "object" || stopped.stopped !== true) {
+      throw new Error("candidate executor did not acknowledge exact process termination");
+    }
+  } catch (stopError) {
+    if (timer) clearTimeout(timer);
+    controller.abort(stopError);
+    return {
+      kind: "error",
+      error: new Error(joinErrors(executionError, stopError)),
+      ...timedOut ? { termination: { kind: "timeout", timeoutMs } } : {},
+      processStopped: false
+    };
+  }
+  let finalCapture;
+  try {
+    finalCapture = sealAgentCandidateExecutorFinalCapture(stopped);
+  } catch (captureError) {
+    if (timer) clearTimeout(timer);
+    controller.abort(captureError);
+    return {
+      kind: "error",
+      error: new Error(joinErrors(executionError, captureError)),
+      ...timedOut ? { termination: { kind: "timeout", timeoutMs } } : {},
+      processStopped: true
+    };
+  }
+  if (Date.now() >= deadlineAtMs) {
+    timedOut = true;
+    executionError = timeoutError;
+    capture = void 0;
+    controller.abort(timeoutError);
+  }
+  if (timer) clearTimeout(timer);
+  if (timedOut) {
+    return {
+      kind: "timeout",
+      termination: { kind: "timeout", timeoutMs },
+      finalCapture,
+      processStopped: true
+    };
+  }
+  if (executionError || !capture) {
+    return {
+      kind: "error",
+      error: executionError ?? new Error("candidate executor returned no capture"),
+      finalCapture,
+      processStopped: true
+    };
+  }
+  return {
+    kind: "capture",
+    capture,
+    termination: capture.termination,
+    finalCapture,
+    processStopped: true
+  };
+}
+async function failBeforeActivation(prepared, state, error, reason, cleanupTimeoutMs) {
+  beginPreparedCandidateSettlement(prepared);
+  const cleanupDeadlineAtMs = candidateCleanupDeadline(cleanupTimeoutMs);
+  const [memoryClose, settled] = await Promise.all([
+    closeMemoryAccess(state, reason, cleanupDeadlineAtMs),
+    settleModelGrant(state, reason, cleanupDeadlineAtMs)
+  ]);
+  const cleanupProven = memoryClose.closed && settled.settlement !== void 0;
+  consumePreparedCandidateExecution(prepared, cleanupProven ? "failed" : "cleanup-failed");
+  return failedAgentCandidateRun(
+    state,
+    redactProtectedReason(
+      joinErrors(
+        error,
+        memoryClose.error,
+        settled.error,
+        !cleanupProven ? new Error("prepared access cleanup remains incomplete and may be retried by disposal") : void 0
+      ),
+      []
+    ),
+    void 0,
+    settled.settlement?.usage ?? null
+  );
+}
+async function failClaimedExecution(prepared, state, lease, claimStore, outputArtifacts, error, reason, cleanupTimeoutMs, failureClass, activation, memoryActivation) {
+  beginPreparedCandidateSettlement(prepared);
+  const cleanupDeadlineAtMs = candidateCleanupDeadline(cleanupTimeoutMs);
+  const [memoryClose, settled] = await Promise.all([
+    closeMemoryAccess(state, reason, cleanupDeadlineAtMs),
+    settleModelGrant(state, reason, cleanupDeadlineAtMs)
+  ]);
+  const protectedValues = protectedEnvironmentValues(activation, memoryActivation);
+  const safeReason = redactProtectedReason(
+    joinErrors(error, memoryClose.error, settled.error),
+    protectedValues
+  );
+  let finishFailed = false;
+  let persistenceFailure;
+  if (settled.settlement && memoryClose.closed) {
+    try {
+      const modelSettlement = await withinCandidateCleanupDeadline(
+        () => persistCandidateModelSettlement(state, settled.settlement, outputArtifacts),
+        lease.expiresAtMs,
+        "candidate pre-run model-settlement persistence"
+      );
+      const failureEvidence = await withinCandidateCleanupDeadline(
+        () => persistFailureEvidence(state, safeReason, failureClass, void 0, outputArtifacts),
+        lease.expiresAtMs,
+        "candidate pre-run failure-evidence persistence"
+      );
+      finishFailed = !await finishClaim(
+        claimStore,
+        lease,
+        {
+          schemaVersion: 1,
+          status: "failed",
+          failureClass,
+          usage: settled.settlement.fixedUsage,
+          modelSettlement: modelSettlement.artifact,
+          failureEvidence
+        },
+        lease.expiresAtMs
+      );
+    } catch (persistenceError) {
+      finishFailed = true;
+      persistenceFailure = persistenceError;
+    }
+  }
+  consumePreparedCandidateExecution(prepared, "failed");
+  return failedAgentCandidateRun(
+    state,
+    redactProtectedReason(
+      joinErrors(
+        safeReason,
+        persistenceFailure,
+        memoryClose.error,
+        settled.error,
+        !memoryClose.closed || !settled.settlement ? new Error("candidate claim remains recoverable until protected cleanup is proven") : void 0,
+        finishFailed ? new Error("candidate execution terminal record could not be persisted") : void 0
+      ),
+      protectedValues
+    ),
+    void 0,
+    settled.settlement?.usage ?? null
+  );
+}
+async function closeMemoryAccess(state, reason, cleanupDeadlineAtMs) {
+  if (state.memory.mode === "disabled") return { closed: true };
+  try {
+    const reservation = state.memoryReservation;
+    if (!reservation) throw new Error("isolated memory reservation is missing");
+    const closed = await withinCandidateCleanupDeadline(
+      () => state.ports.memory.close({
+        executionId: state.executionId,
+        preparationId: reservation.preparationId,
+        accessDigest: reservation.accessDigest,
+        effectiveNamespace: reservation.effectiveNamespace,
+        reason
+      }),
+      cleanupDeadlineAtMs,
+      "isolated memory closure"
+    );
+    if (closed.closed !== true || Object.keys(closed).some((key) => key !== "closed")) {
+      throw new Error("isolated memory access did not acknowledge closure");
+    }
+    return { closed: true };
+  } catch (error) {
+    return { closed: false, error };
+  }
+}
+async function settleModelGrant(state, reason, cleanupDeadlineAtMs) {
+  try {
+    const value = await withinCandidateCleanupDeadline(
+      () => state.ports.models.settleGrant({
+        executionId: state.executionId,
+        preparationId: state.preparationId,
+        grantDigest: state.modelReservation.digest,
+        resolved: state.resolvedModel,
+        reason
+      }),
+      cleanupDeadlineAtMs,
+      "protected model settlement"
+    );
+    return {
+      settlement: sealAgentCandidateModelSettlement(value, {
+        preparationId: state.preparationId,
+        grantDigest: state.modelReservation.digest,
+        model: state.resolvedModel.model
+      })
+    };
+  } catch (error) {
+    return { error: new Error("protected model settlement failed", { cause: error }) };
+  }
+}
+async function finishClaim(store, lease, terminal, deadlineAtMs) {
+  try {
+    const staged = await withinCandidateCleanupDeadline(
+      () => store.stageTerminal(lease, terminal),
+      deadlineAtMs ?? lease.expiresAtMs,
+      "candidate terminal staging"
+    );
+    if (!staged.staged && !staged.exactReplay) return false;
+    const result = await withinCandidateCleanupDeadline(
+      () => store.finish(lease, staged.terminal.terminalDigest),
+      deadlineAtMs ?? lease.expiresAtMs,
+      "candidate terminal publication"
+    );
+    return result.finished || result.exactReplay;
+  } catch {
+    return false;
+  }
+}
+async function persistFailureEvidence(state, reason, failureClass, termination, outputArtifacts) {
+  const bytes = canonicalCandidateBytes({
+    schemaVersion: 1,
+    kind: "agent-candidate-execution-failure",
+    executionId: state.executionId,
+    bundleDigest: state.bundle.digest,
+    executionPlanDigest: state.executionPlan.value.digest,
+    failureClass,
+    reason,
+    ...termination ? { termination } : {}
+  });
+  return await persistCandidateOutputArtifact(outputArtifacts, {
+    executionId: state.executionId,
+    purpose: "failure-evidence",
+    bytes
+  });
+}
+function protectedEnvironmentValues(activation, memoryActivation) {
+  return [...Object.values(activation?.env ?? {}), ...Object.values(memoryActivation?.env ?? {})];
+}
+function joinErrors(...errors) {
+  return errors.filter((error) => error !== void 0).map(errorMessage).join("; ");
+}
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+var CandidateExecutionDeadlineError = class extends Error {
+  constructor(timeoutMs) {
+    super(`candidate execution reached its frozen ${timeoutMs}ms deadline`);
+    this.name = "CandidateExecutionDeadlineError";
+  }
+};
+
+// src/candidate-execution/verify.ts
+import { agentCandidateBundleSchema } from "@tangle-network/agent-interface";
+var verifiedCandidateState = /* @__PURE__ */ new WeakMap();
+async function verifyAgentCandidateBundle(input, ports) {
+  const parsed = agentCandidateBundleSchema.parse(input);
+  const withoutDigest = omitTopLevelDigest(parsed);
+  const actualDigest = canonicalCandidateDigest(withoutDigest);
+  if (actualDigest !== parsed.digest) {
+    throw new Error(`candidate bundle digest ${parsed.digest} does not match ${actualDigest}`);
+  }
+  const canonicalBytes = canonicalCandidateBytes(withoutDigest);
+  verifyBytes(canonicalBytes, parsed.digest, canonicalBytes.byteLength, "candidate bundle");
+  const artifactBytes = /* @__PURE__ */ new Map();
+  const readArtifact = async (artifact) => {
+    const key = artifactCacheKey(artifact);
+    const existing = artifactBytes.get(key);
+    if (existing) return Uint8Array.from(existing);
+    const bytes = await readVerifiedArtifact(artifact, ports.artifacts);
+    artifactBytes.set(key, Uint8Array.from(bytes));
+    return bytes;
+  };
+  let patchBytes;
+  if (parsed.code.kind === "git-patch") {
+    patchBytes = await readArtifact(parsed.code.patch.artifact);
+  }
+  const materializedTree = await verifyCandidateCode(parsed.code, ports.repositories, patchBytes);
+  const resourceBytes = /* @__PURE__ */ new Map();
+  for (const resource of candidateResources(parsed)) {
+    const bytes = resource.kind === "inline" ? Buffer.from(resource.content, "utf8") : await readCandidateGitHubResource(resource, ports.repositories);
+    verifyBytes(
+      bytes,
+      resource.sha256,
+      resource.byteLength,
+      `candidate resource ${resource.name ?? (resource.kind === "github" ? resource.path : "<unnamed>")}`
+    );
+    resourceBytes.set(resourceKey(resource), Uint8Array.from(bytes));
+    resourceBytes.set(resource.sha256, Uint8Array.from(bytes));
+  }
+  if (parsed.execution.workspace) {
+    const workspace = await verifyWorkspaceSnapshotArtifacts(
+      parsed.execution.workspace,
+      ports.artifacts
+    );
+    artifactBytes.set(artifactCacheKey(parsed.execution.workspace.manifest), workspace.manifest);
+    artifactBytes.set(artifactCacheKey(parsed.execution.workspace.archive), workspace.archive);
+  }
+  if (parsed.knowledge) await readArtifact(parsed.knowledge.manifest);
+  if (parsed.memory.mode === "isolated" && parsed.memory.seed)
+    await readArtifact(parsed.memory.seed);
+  deepFreezeCandidate(parsed);
+  const verified = Object.freeze({
+    bundle: parsed,
+    ...materializedTree === void 0 ? {} : { materializedTree },
+    [verifiedCandidateBrand]: true
+  });
+  verifiedCandidateState.set(verified, { ports, artifactBytes, resourceBytes });
+  return verified;
+}
+function getVerifiedCandidateState(candidate) {
+  const state = verifiedCandidateState.get(candidate);
+  if (!state || candidate[verifiedCandidateBrand] !== true) {
+    throw new Error("candidate must come from verifyAgentCandidateBundle");
+  }
+  return state;
+}
+async function verifiedArtifactBytes(candidate, artifact) {
+  const state = getVerifiedCandidateState(candidate);
+  const key = artifactCacheKey(artifact);
+  const existing = state.artifactBytes.get(key);
+  if (existing) return Uint8Array.from(existing);
+  const bytes = await readVerifiedArtifact(artifact, state.ports.artifacts);
+  state.artifactBytes.set(key, Uint8Array.from(bytes));
+  return bytes;
+}
+function verifiedResourceTextByDigest(candidate) {
+  const output = /* @__PURE__ */ new Map();
+  for (const resource of candidateResources(candidate.bundle)) {
+    const bytes = getVerifiedCandidateState(candidate).resourceBytes.get(resource.sha256);
+    if (!bytes) throw new Error(`candidate resource digest was not verified: ${resource.sha256}`);
+    output.set(resource.sha256, new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+  }
+  return output;
+}
+function candidateResources(bundle) {
+  const resources = bundle.profile.resources;
+  if (!resources) return [];
+  const output = [];
+  for (const mount of resources.files ?? []) output.push(mount.resource);
+  output.push(...resources.tools ?? []);
+  output.push(...resources.skills ?? []);
+  output.push(...resources.agents ?? []);
+  output.push(...resources.commands ?? []);
+  if (typeof resources.instructions === "object") output.push(resources.instructions);
+  return output;
+}
+function resourceKey(resource) {
+  return canonicalCandidateDigest(resource);
+}
+
+// src/candidate-execution/prepare.ts
+import { randomBytes as randomBytes2 } from "crypto";
+import { lstat as lstat2, readdir as readdir2 } from "fs/promises";
+import { isAbsolute, posix, relative as relative2, resolve as resolveHostPath } from "path";
+import {
+  agentCandidateContainerSchema,
+  agentCandidateExecutionLimitsSchema,
+  agentCandidateExecutionPlanEvidenceSchema as agentCandidateExecutionPlanEvidenceSchema2,
+  agentCandidateExecutionPlanMaterialSchema,
+  agentCandidateMaterializationReceiptSchema as agentCandidateMaterializationReceiptSchema2,
+  agentCandidateModelAccessNetworkSchema,
+  agentCandidateWorkspaceSnapshotEvidenceSchema as agentCandidateWorkspaceSnapshotEvidenceSchema3,
+  sha256DigestSchema
+} from "@tangle-network/agent-interface";
+import {
+  applyAgentCandidateWorkspacePlan,
+  materializeCandidateProfile
+} from "@tangle-network/agent-profile-materialize";
+var MATERIALIZER_HARNESSES = /* @__PURE__ */ new Set([
+  "claude-code",
+  "claude",
+  "claudish",
+  "nanoclaw",
+  "codex",
+  "opencode",
+  "kimi-code",
+  "kimi",
+  "pi",
+  "gemini",
+  "hermes",
+  "openclaw"
+]);
+var MIN_RESERVATION_TTL_MS = 15 * 6e4;
+var PREPARED_HOLD_MARGIN_MS = 5 * 6e4;
+async function prepareAgentCandidateExecution(candidate, task, ports, options = {}) {
+  const cleanupTimeoutMs = candidateCleanupTimeout(options.cleanupTimeoutMs);
+  const verifiedState = getVerifiedCandidateState(candidate);
+  assertSameVerificationPorts(verifiedState.ports, ports);
+  const bundle = candidate.bundle;
+  const harness = materializerHarness(bundle.execution.harness);
+  assertTaskInput(task, bundle.execution.instructionDelivery);
+  const resultTimeoutMs = candidateResultTimeout(options.resultTimeoutMs, task.limits.timeoutMs);
+  const ownerWindowMs = candidateExecutionOwnerWindowMs(
+    task.limits.timeoutMs,
+    cleanupTimeoutMs,
+    resultTimeoutMs
+  );
+  const reservationWindowMs = ownerWindowMs + PREPARED_HOLD_MARGIN_MS;
+  if (reservationWindowMs > MAX_CANDIDATE_TIMER_INTERVAL_MS) {
+    throw new Error("candidate reservation window exceeds the supported timer range");
+  }
+  assertDisjointHostStagingRoots(task);
+  const instructionBytes = Buffer.from(task.instruction, "utf8");
+  const instructionDigest = sha256Bytes(instructionBytes);
+  const taskArtifacts = await verifyWorkspaceSnapshotArtifacts(task.workspace, ports.artifacts);
+  await ports.workspaces.materialize({
+    role: "task",
+    snapshot: task.workspace,
+    archive: taskArtifacts.archive,
+    destination: task.stagingRoots.taskRoot
+  });
+  await verifyMaterializedWorkspace(task.stagingRoots.taskRoot, task.workspace.material, {
+    ignoredProtectedRootEntries: [".git", ".sidecar"]
+  });
+  await verifyTaskCheckout(task.stagingRoots.taskRoot, task.repository);
+  const taskExecutorFiles = await readMaterializedWorkspaceFiles(
+    task.stagingRoots.taskRoot,
+    task.workspace.material,
+    { ignoredProtectedRootEntries: [".git", ".sidecar"] }
+  );
+  let candidateArchive;
+  let candidateExecutorFiles;
+  if (bundle.execution.workspace) {
+    if (!task.stagingRoots.candidateRoot || !task.executionRoots.candidateRoot) {
+      throw new Error("active candidate execution requires host and container candidate roots");
+    }
+    candidateArchive = await verifiedArtifactBytes(candidate, bundle.execution.workspace.archive);
+    await ports.workspaces.materialize({
+      role: "candidate",
+      snapshot: bundle.execution.workspace,
+      archive: candidateArchive,
+      destination: task.stagingRoots.candidateRoot
+    });
+    await verifyMaterializedWorkspace(
+      task.stagingRoots.candidateRoot,
+      bundle.execution.workspace.material
+    );
+    candidateExecutorFiles = await readMaterializedWorkspaceFiles(
+      task.stagingRoots.candidateRoot,
+      bundle.execution.workspace.material
+    );
+  } else if (task.stagingRoots.candidateRoot || task.executionRoots.candidateRoot) {
+    throw new Error("disabled code cannot receive a candidate workspace root");
+  }
+  await assertEmptyDirectory(task.stagingRoots.profileRoot);
+  const profileWorkspacePlan = materializeCandidateProfile(bundle.profile, harness, {
+    resolvedResources: verifiedResourceTextByDigest(candidate)
+  });
+  const profileApplication = applyAgentCandidateWorkspacePlan(
+    profileWorkspacePlan,
+    task.stagingRoots.profileRoot,
+    bundle.execution.cwd.workspace
+  );
+  await verifyMaterializedProfileWorkspace(
+    task.stagingRoots.profileRoot,
+    profileApplication.profilePlan.material
+  );
+  const profilePlanBytes = await readVerifiedArtifact(
+    profileApplication.profilePlan.artifact,
+    ports.artifacts
+  );
+  if (!Buffer.from(profilePlanBytes).equals(
+    Buffer.from(canonicalCandidateBytes(profileApplication.profilePlan.material))
+  )) {
+    throw new Error("profile materializer did not capture exact canonical plan bytes");
+  }
+  const container = await resolveContainer(candidate, task, ports);
+  const resolvedModel = await resolveModel(candidate, task, ports);
+  const preparationId = `candidate-preparation-v1.${randomBytes2(32).toString("base64url")}`;
+  const reservationExpiresAtMs = Date.now() + Math.max(MIN_RESERVATION_TTL_MS, reservationWindowMs);
+  const modelReservation = await withinCandidateCleanupDeadline(
+    () => ports.models.reserveGrant({
+      executionId: task.executionId,
+      preparationId,
+      expiresAtMs: reservationExpiresAtMs,
+      attempt: task.attempt,
+      bundleDigest: bundle.digest,
+      resolved: resolvedModel,
+      limits: modelLimits2(task.limits)
+    }),
+    candidateCleanupDeadline(cleanupTimeoutMs),
+    "protected model reservation"
+  );
+  let preparedMemory;
+  try {
+    validateProtectedModelReservation(
+      modelReservation,
+      task.limits,
+      preparationId,
+      reservationExpiresAtMs
+    );
+    preparedMemory = await prepareMemory(
+      candidate,
+      task,
+      ports,
+      preparationId,
+      reservationExpiresAtMs,
+      cleanupTimeoutMs
+    );
+    const memory = preparedMemory.value;
+    const knowledge = bundle.knowledge ? {
+      snapshotId: bundle.knowledge.snapshotId,
+      manifestDigest: bundle.knowledge.manifest.sha256,
+      manifest: await verifiedArtifactBytes(candidate, bundle.knowledge.manifest)
+    } : void 0;
+    const baseLaunch = buildLaunch(candidate, task, profileApplication.flags);
+    const publicEnv = mergePublicEnvironment(
+      bundle.execution.env ?? {},
+      profileApplication.env,
+      bundle.execution.instructionDelivery.kind === "utf8-file" ? {
+        [bundle.execution.instructionDelivery.env]: {
+          kind: "public",
+          value: bundle.execution.instructionDelivery.path
+        }
+      } : {}
+    );
+    const routes = modelRoutes(bundle.profile, task.model.requested);
+    const executionMaterial = {
+      schemaVersion: 1,
+      kind: "agent-candidate-execution-plan-material",
+      bundleDigest: bundle.digest,
+      executionId: task.executionId,
+      attempt: task.attempt,
+      task: {
+        benchmark: task.benchmark,
+        benchmarkVersion: task.benchmarkVersion,
+        taskId: task.taskId,
+        splitDigest: task.splitDigest,
+        instruction: {
+          encoding: "utf8",
+          sha256: instructionDigest,
+          byteLength: instructionBytes.byteLength,
+          delivery: bundle.execution.instructionDelivery
+        },
+        repository: task.repository,
+        workspace: task.workspace
+      },
+      workspaces: {
+        taskRoot: task.executionRoots.taskRoot,
+        ...task.executionRoots.candidateRoot ? { candidateRoot: task.executionRoots.candidateRoot } : {}
+      },
+      codeKind: bundle.code.kind,
+      ...bundle.execution.workspace ? { candidateWorkspace: bundle.execution.workspace } : {},
+      profile: profileApplication.application,
+      harness: bundle.execution.harness,
+      harnessVersion: bundle.execution.harnessVersion,
+      container,
+      model: {
+        policy: "single",
+        resolved: resolvedModel,
+        access: {
+          kind: "evaluator-mediated",
+          grantDigest: modelReservation.digest,
+          network: modelReservation.network
+        },
+        routes
+      },
+      grader: task.grader,
+      launch: {
+        executable: baseLaunch.executable,
+        args: baseLaunch.args,
+        env: publicEnv,
+        cwd: bundle.execution.cwd
+      },
+      ...bundle.knowledge ? { knowledgeManifestDigest: bundle.knowledge.manifest.sha256 } : {},
+      memory,
+      limits: task.limits,
+      network: { mode: "disabled" }
+    };
+    agentCandidateExecutionPlanMaterialSchema.parse(executionMaterial);
+    const executionBytes = canonicalCandidateBytes(executionMaterial);
+    const executionDigest = canonicalCandidateDigest(executionMaterial);
+    if (sha256Bytes(executionBytes) !== executionDigest) {
+      throw new Error("execution plan canonical serializers disagree");
+    }
+    const executionPlan = agentCandidateExecutionPlanEvidenceSchema2.parse({
+      schemaVersion: 1,
+      kind: "agent-candidate-execution-plan",
+      digest: executionDigest,
+      material: executionMaterial,
+      artifact: embeddedCandidateArtifact(executionBytes)
+    });
+    const entrypoint = candidateEntrypointReceipt(candidate);
+    const materializationReceipt = canonicalCandidateDocument(
+      {
+        schemaVersion: 1,
+        kind: "agent-candidate-materialization",
+        digestAlgorithm: "rfc8785-sha256",
+        bundleDigest: bundle.digest,
+        profilePlan: profileApplication.profilePlan,
+        executionPlan,
+        ...bundle.execution.workspace ? { candidateWorkspace: bundle.execution.workspace } : {},
+        codeKind: bundle.code.kind,
+        ...candidate.materializedTree ? { materializedTree: candidate.materializedTree } : {},
+        harness: bundle.execution.harness,
+        harnessVersion: bundle.execution.harnessVersion,
+        container,
+        resolvedModel,
+        ...bundle.knowledge ? { knowledgeManifestDigest: bundle.knowledge.manifest.sha256 } : {},
+        ...entrypoint ? { entrypoint } : {}
+      }
+    );
+    agentCandidateMaterializationReceiptSchema2.parse(materializationReceipt.value);
+    const traceRunId = `${task.executionId}:attempt-${task.attempt.number}:${canonicalCandidateDigest({ preparationId }).slice(7, 23)}`;
+    const traceTags = {
+      [CANDIDATE_TRACE_TAGS.executionId]: task.executionId,
+      [CANDIDATE_TRACE_TAGS.bundleDigest]: bundle.digest,
+      [CANDIDATE_TRACE_TAGS.executionPlanDigest]: executionPlan.digest,
+      [CANDIDATE_TRACE_TAGS.materializationReceiptDigest]: materializationReceipt.digest
+    };
+    const traceEnv = {
+      [CANDIDATE_TRACE_ENV.executionId]: task.executionId,
+      [CANDIDATE_TRACE_ENV.bundleDigest]: bundle.digest,
+      [CANDIDATE_TRACE_ENV.executionPlanDigest]: executionPlan.digest,
+      [CANDIDATE_TRACE_ENV.materializationReceiptDigest]: materializationReceipt.digest,
+      [CANDIDATE_TRACE_ENV.traceRunId]: traceRunId
+    };
+    assertEnvironmentDisjoint(publicEnv, traceEnv);
+    return createPreparedCandidateExecution({
+      ports,
+      bundle,
+      executionId: task.executionId,
+      roots: {
+        execution: { ...task.executionRoots },
+        staging: { ...task.stagingRoots }
+      },
+      profilePlan: {
+        value: profileApplication.profilePlan,
+        bytes: profilePlanBytes,
+        written: [...profileApplication.application.mountPaths]
+      },
+      executionPlan: { value: executionPlan, bytes: executionBytes },
+      materializationReceipt,
+      launch: {
+        executable: baseLaunch.executable,
+        args: baseLaunch.args.map((value) => value.value),
+        env: unwrapPublicEnvironment(publicEnv),
+        flags: profileApplication.flags.map((value) => value.value),
+        cwd: absoluteExecutionCwd(bundle.execution.cwd, task.executionRoots)
+      },
+      instruction: {
+        bytes: Uint8Array.from(instructionBytes),
+        delivery: bundle.execution.instructionDelivery
+      },
+      resolvedModel,
+      preparationId,
+      reservationExpiresAtMs,
+      cleanupTimeoutMs,
+      resultTimeoutMs,
+      modelReservation: {
+        preparationId: modelReservation.preparationId,
+        digest: modelReservation.digest,
+        expiresAtMs: modelReservation.expiresAtMs,
+        enforcedLimits: modelReservation.enforcedLimits,
+        network: modelReservation.network
+      },
+      executorInputs: {
+        taskFiles: taskExecutorFiles,
+        ...candidateExecutorFiles ? { candidateFiles: candidateExecutorFiles } : {},
+        profileFiles: exactProfileExecutorFiles(
+          profileWorkspacePlan.files,
+          profileApplication.profilePlan.material.files
+        )
+      },
+      ...preparedMemory.accessDigest && preparedMemory.value.mode === "isolated" ? {
+        memoryReservation: {
+          preparationId,
+          accessDigest: preparedMemory.accessDigest,
+          expiresAtMs: reservationExpiresAtMs,
+          effectiveNamespace: preparedMemory.value.effectiveNamespace
+        }
+      } : {},
+      ...knowledge ? { knowledge } : {},
+      trace: { runId: traceRunId, tags: traceTags, env: traceEnv },
+      memory
+    });
+  } catch (error) {
+    const cleanupDeadlineAtMs = candidateCleanupDeadline(cleanupTimeoutMs);
+    const cleanup = [];
+    if (preparedMemory?.value.mode === "isolated") {
+      const accessDigest = preparedMemory.accessDigest;
+      const effectiveNamespace = preparedMemory.value.effectiveNamespace;
+      if (!accessDigest) throw new Error("isolated memory preparation is missing access identity");
+      cleanup.push(
+        withinCandidateCleanupDeadline(
+          async () => {
+            const closed = await ports.memory.close({
+              executionId: task.executionId,
+              preparationId,
+              accessDigest,
+              effectiveNamespace,
+              reason: "preparation-failed"
+            });
+            if (closed.closed !== true || Object.keys(closed).some((key) => key !== "closed")) {
+              throw new Error("failed preparation did not close isolated memory access");
+            }
+          },
+          cleanupDeadlineAtMs,
+          "failed preparation memory cleanup"
+        )
+      );
+    }
+    cleanup.push(
+      withinCandidateCleanupDeadline(
+        async () => {
+          const settlement = sealAgentCandidateModelSettlement(
+            await ports.models.settleGrant({
+              executionId: task.executionId,
+              preparationId,
+              grantDigest: modelReservation.digest,
+              resolved: resolvedModel,
+              reason: "preparation-failed"
+            }),
+            {
+              preparationId,
+              grantDigest: modelReservation.digest,
+              model: resolvedModel.model
+            }
+          );
+          if (settlement.usage.modelCalls !== 0) {
+            throw new Error("failed preparation unexpectedly contains model calls");
+          }
+        },
+        cleanupDeadlineAtMs,
+        "failed preparation model cleanup"
+      )
+    );
+    const cleanupResults = await Promise.allSettled(cleanup);
+    const cleanupErrors = cleanupResults.filter((result) => result.status === "rejected").map((result) => result.reason);
+    if (cleanupErrors.length > 0) {
+      throw new Error(
+        `candidate preparation failed and protected access cleanup failed: ${cleanupErrors.map(errorMessage2).join("; ")}`,
+        { cause: error }
+      );
+    }
+    throw error;
+  }
+}
+function assertSameVerificationPorts(verified, execution) {
+  if (verified.artifacts !== execution.artifacts || verified.repositories !== execution.repositories) {
+    throw new Error(
+      "prepare must use the same artifact and repository ports that verified the bundle"
+    );
+  }
+}
+function assertTaskInput(task, delivery) {
+  const requiredStrings = [
+    ["executionId", task.executionId],
+    ["benchmark", task.benchmark],
+    ["benchmarkVersion", task.benchmarkVersion],
+    ["taskId", task.taskId],
+    ["repository identity", task.repository.identity],
+    ["repository root identity", task.repository.rootIdentity]
+  ];
+  for (const [name, value] of requiredStrings) {
+    if (!value.trim()) throw new Error(`${name} must be non-empty`);
+  }
+  if (!/^[A-Za-z0-9._:-]{1,200}$/.test(task.executionId)) {
+    throw new Error("executionId must be a stable filesystem-neutral identifier");
+  }
+  if (!task.instruction || !isWellFormedUnicode(task.instruction)) {
+    throw new Error("task instruction must be non-empty well-formed Unicode");
+  }
+  sha256DigestSchema.parse(task.splitDigest);
+  agentCandidateWorkspaceSnapshotEvidenceSchema3.parse(task.workspace);
+  agentCandidateExecutionLimitsSchema.parse(task.limits);
+  if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(task.repository.baseCommit)) {
+    throw new Error("task repository base commit is not a full Git object id");
+  }
+  if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(task.repository.baseTree)) {
+    throw new Error("task repository base tree is not a full Git object id");
+  }
+  if (task.repository.baseCommit.length !== task.repository.baseTree.length) {
+    throw new Error("task repository Git object formats disagree");
+  }
+  for (const [name, root] of [
+    ["execution task root", task.executionRoots.taskRoot],
+    ["execution candidate root", task.executionRoots.candidateRoot],
+    ["staging task root", task.stagingRoots.taskRoot],
+    ["staging candidate root", task.stagingRoots.candidateRoot],
+    ["staging profile root", task.stagingRoots.profileRoot]
+  ]) {
+    if (root === void 0) continue;
+    const canonical = name.startsWith("execution") ? posix.isAbsolute(root) && posix.normalize(root) === root : isAbsolute(root) && resolveHostPath(root) === root;
+    if (!canonical) throw new Error(`${name} must be a canonical absolute path`);
+  }
+  if (!Number.isInteger(task.attempt.number) || !Number.isInteger(task.attempt.maxAttempts) || task.attempt.number < 1 || task.attempt.number > task.attempt.maxAttempts || task.attempt.retryPolicy === "none" && task.attempt.maxAttempts !== 1) {
+    throw new Error("task attempt policy is invalid");
+  }
+  const limits = task.limits;
+  if (!Number.isInteger(limits.timeoutMs) || limits.timeoutMs <= 0 || limits.timeoutMs > MAX_CANDIDATE_TIMER_INTERVAL_MS || !Number.isInteger(limits.maxSteps) || limits.maxSteps <= 0 || !Number.isInteger(limits.maxModelCalls) || limits.maxModelCalls < 0 || !Number.isInteger(limits.maxInputTokens) || limits.maxInputTokens < 0 || !Number.isInteger(limits.maxOutputTokens) || limits.maxOutputTokens < 0 || !Number.isFinite(limits.maxCostUsd) || limits.maxCostUsd < 0) {
+    throw new Error("task execution limits are invalid");
+  }
+  usdToNanos(limits.maxCostUsd, "task maxCostUsd");
+  if (!task.model.requested.trim()) throw new Error("evaluator model request must be non-empty");
+  if (!task.grader.name.trim() || !task.grader.version.trim()) {
+    throw new Error("evaluator benchmark grader identity must be non-empty");
+  }
+  if (!Number.isInteger(task.grader.artifact.byteLength) || task.grader.artifact.byteLength <= 0) {
+    throw new Error("evaluator benchmark grader artifact must be non-empty");
+  }
+  sha256DigestSchema.parse(task.grader.artifact.sha256);
+  if (task.evaluatorTaskContainer) {
+    if (task.evaluatorTaskContainer.source !== "evaluator-task-container" || !task.evaluatorTaskContainer.image.trim() || !task.evaluatorTaskContainer.platform.os.trim() || !task.evaluatorTaskContainer.platform.architecture.trim()) {
+      throw new Error("evaluator task container evidence is incomplete");
+    }
+    sha256DigestSchema.parse(task.evaluatorTaskContainer.indexDigest);
+    sha256DigestSchema.parse(task.evaluatorTaskContainer.manifestDigest);
+    agentCandidateContainerSchema.parse({
+      image: task.evaluatorTaskContainer.image,
+      indexDigest: task.evaluatorTaskContainer.indexDigest
+    });
+  }
+  if (delivery.kind === "utf8-file") {
+    if (executionPathsOverlap(task.executionRoots.taskRoot, delivery.path) || task.executionRoots.candidateRoot !== void 0 && executionPathsOverlap(task.executionRoots.candidateRoot, delivery.path)) {
+      throw new Error("task instruction file must remain outside execution workspaces");
+    }
+  }
+}
+function executionPathsOverlap(left, right) {
+  const a = posix.normalize(left);
+  const b = posix.normalize(right);
+  return a === b || b.startsWith(a === "/" ? "/" : `${a}/`) || a.startsWith(b === "/" ? "/" : `${b}/`);
+}
+function assertDisjointHostStagingRoots(task) {
+  const roots = [
+    task.stagingRoots.taskRoot,
+    task.stagingRoots.candidateRoot,
+    task.stagingRoots.profileRoot
+  ].filter((value) => value !== void 0).map((value) => resolveHostPath(value));
+  for (let left = 0; left < roots.length; left++) {
+    for (let right = left + 1; right < roots.length; right++) {
+      const a = roots[left];
+      const b = roots[right];
+      if (a && b && (a === b || isContainedPath(a, b) || isContainedPath(b, a))) {
+        throw new Error("host task, candidate, and profile staging roots must be disjoint");
+      }
+    }
+  }
+}
+function isContainedPath(parent, child) {
+  const path = relative2(parent, child);
+  return path !== "" && !path.startsWith("..") && !isAbsolute(path);
+}
+async function assertEmptyDirectory(path) {
+  const stats = await lstat2(path);
+  if (!stats.isDirectory() || stats.isSymbolicLink()) {
+    throw new Error("profile staging root must be a real directory");
+  }
+  if ((await readdir2(path)).length !== 0) {
+    throw new Error("profile staging root must be empty before materialization");
+  }
+}
+function materializerHarness(harness) {
+  if (!MATERIALIZER_HARNESSES.has(harness)) {
+    throw new Error(
+      `sealed candidate profile materialization is unsupported for harness ${harness}`
+    );
+  }
+  return harness;
+}
+async function resolveContainer(candidate, task, ports) {
+  const environment = candidate.bundle.execution.environment;
+  const pinned = environment.kind === "pinned-container" ? environment.container : void 0;
+  if (environment.kind === "evaluator-task-container" && !task.evaluatorTaskContainer) {
+    throw new Error("evaluator-task-container candidate requires an evaluator-owned task image");
+  }
+  if (environment.kind === "pinned-container" && task.evaluatorTaskContainer) {
+    throw new Error("pinned candidate containers cannot be replaced by a task image");
+  }
+  const resolved = await ports.containers.resolve({
+    candidate: pinned,
+    evaluatorTaskContainer: task.evaluatorTaskContainer
+  });
+  if (resolved.source !== environment.kind) throw new Error("resolved container source drifted");
+  if (pinned && (resolved.image !== pinned.image || resolved.indexDigest !== pinned.indexDigest)) {
+    throw new Error("resolved pinned container does not match the candidate image index");
+  }
+  if (task.evaluatorTaskContainer && JSON.stringify(resolved) !== JSON.stringify(task.evaluatorTaskContainer)) {
+    throw new Error("resolved task container does not match evaluator-owned image evidence");
+  }
+  return resolved;
+}
+async function resolveModel(candidate, task, ports) {
+  const hints = candidate.bundle.profile.model;
+  if (hints?.default !== void 0 && hints.default !== task.model.requested) {
+    throw new Error("candidate model preference conflicts with the evaluator-owned model");
+  }
+  if (hints?.reasoningEffort !== void 0 && hints.reasoningEffort !== task.model.reasoningEffort) {
+    throw new Error("candidate reasoning effort conflicts with the evaluator-owned effort");
+  }
+  const resolved = await ports.models.resolve({
+    requested: task.model.requested,
+    harness: candidate.bundle.execution.harness,
+    reasoningEffort: task.model.reasoningEffort
+  });
+  if (resolved.requested !== task.model.requested || resolved.reasoningEffort !== task.model.reasoningEffort) {
+    throw new Error("model resolver drifted from the evaluator-owned request");
+  }
+  return resolved;
+}
+async function prepareMemory(candidate, task, ports, preparationId, expiresAtMs, cleanupTimeoutMs) {
+  const policy = candidate.bundle.memory;
+  if (policy.mode === "disabled") return { value: { mode: "disabled" } };
+  const seed = policy.seed ? await verifiedArtifactBytes(candidate, policy.seed) : void 0;
+  const executionSegment = canonicalCandidateDigest({ executionId: task.executionId }).slice(7);
+  const taskSegment = canonicalCandidateDigest({ taskId: task.taskId }).slice(7);
+  const preparationSegment = canonicalCandidateDigest({ preparationId }).slice(7, 23);
+  const effectiveNamespace = `candidate/${candidate.bundle.digest.slice(7, 23)}/${executionSegment}/${taskSegment}/${preparationSegment}`;
+  const reset = await withinCandidateCleanupDeadline(
+    () => ports.memory.reset({
+      executionId: task.executionId,
+      preparationId,
+      expiresAtMs,
+      effectiveNamespace,
+      ...seed ? { seed } : {},
+      ...policy.seed ? { seedDigest: policy.seed.sha256 } : {}
+    }),
+    candidateCleanupDeadline(cleanupTimeoutMs),
+    "isolated memory reset"
+  );
+  try {
+    if (reset.preparationId !== preparationId || reset.expiresAtMs !== expiresAtMs || !/^sha256:[a-f0-9]{64}$/.test(reset.accessDigest)) {
+      throw new Error("isolated memory reservation is not scoped to this preparation");
+    }
+    await readVerifiedArtifact(reset.evidence, ports.artifacts);
+    await verifyWorkspaceSnapshotArtifacts(reset.beforeState, ports.artifacts);
+    return {
+      value: {
+        mode: "isolated",
+        scope: "task",
+        effectiveNamespace,
+        reset: {
+          kind: "fresh",
+          evidence: reset.evidence,
+          emptyStateDigest: reset.emptyStateDigest
+        },
+        beforeState: reset.beforeState,
+        ...policy.seed ? { seedDigest: policy.seed.sha256 } : {}
+      },
+      accessDigest: reset.accessDigest
+    };
+  } catch (error) {
+    try {
+      const closed = await withinCandidateCleanupDeadline(
+        () => ports.memory.close({
+          executionId: task.executionId,
+          preparationId,
+          accessDigest: reset.accessDigest,
+          effectiveNamespace,
+          reason: "preparation-failed"
+        }),
+        candidateCleanupDeadline(cleanupTimeoutMs),
+        "invalid isolated memory reset cleanup"
+      );
+      if (closed.closed !== true || Object.keys(closed).some((key) => key !== "closed")) {
+        throw new Error("invalid isolated memory reset did not acknowledge closure");
+      }
+    } catch (closeError) {
+      throw new Error("isolated memory preparation and cleanup both failed", {
+        cause: new AggregateError([error, closeError])
+      });
+    }
+    throw error;
+  }
+}
+function buildLaunch(candidate, task, profileFlags) {
+  const launch = candidate.bundle.execution.launch;
+  if (launch.kind === "container-command") {
+    return { executable: launch.executable, args: [...launch.args ?? [], ...profileFlags] };
+  }
+  const candidateRoot = task.executionRoots.candidateRoot;
+  if (!candidateRoot) throw new Error("candidate entrypoint requires a container candidate root");
+  const entrypoint = posix.join(candidateRoot, launch.entrypoint);
+  const candidateArgs = launch.args ?? [];
+  if (launch.interpreter) {
+    return {
+      executable: launch.interpreter,
+      args: [{ kind: "public", value: entrypoint }, ...candidateArgs, ...profileFlags]
+    };
+  }
+  return { executable: entrypoint, args: [...candidateArgs, ...profileFlags] };
+}
+function mergePublicEnvironment(...records) {
+  const output = {};
+  for (const record of records) {
+    for (const [name, value] of Object.entries(record)) {
+      const previous = output[name];
+      if (previous && previous.value !== value.value) {
+        throw new Error(`candidate and profile environment disagree on ${name}`);
+      }
+      output[name] = value;
+    }
+  }
+  return output;
+}
+function unwrapPublicEnvironment(values) {
+  return Object.fromEntries(Object.entries(values).map(([name, value]) => [name, value.value]));
+}
+function modelRoutes(profile, requested) {
+  const routes = [
+    { kind: "primary", requested }
+  ];
+  if (profile.model?.small) routes.push({ kind: "small", requested });
+  for (const name of Object.keys(profile.modes ?? {}).sort()) {
+    if (profile.modes?.[name]?.model) routes.push({ kind: "mode", name, requested });
+  }
+  for (const name of Object.keys(profile.subagents ?? {}).sort()) {
+    if (profile.subagents?.[name]?.model) routes.push({ kind: "subagent", name, requested });
+  }
+  return routes;
+}
+function candidateEntrypointReceipt(candidate) {
+  const launch = candidate.bundle.execution.launch;
+  const workspace = candidate.bundle.execution.workspace;
+  if (launch.kind !== "candidate-entrypoint" || !workspace) return void 0;
+  const file = workspace.material.files.find((entry) => entry.path === launch.entrypoint);
+  if (!file) throw new Error("candidate entrypoint is absent from the verified workspace");
+  return { path: file.path, sha256: file.sha256, byteLength: file.byteLength };
+}
+function absoluteExecutionCwd(cwd, roots) {
+  const root = cwd.workspace === "task" ? roots.taskRoot : roots.candidateRoot;
+  if (!root) throw new Error("candidate cwd is missing its execution workspace root");
+  const absolute = cwd.path === "." ? root : posix.join(root, cwd.path);
+  if (absolute !== root && !absolute.startsWith(`${root}/`)) {
+    throw new Error("candidate cwd escapes its execution workspace");
+  }
+  return absolute;
+}
+function validateProtectedModelReservation(reservation, expectedLimits, preparationId, expiresAtMs) {
+  if (!/^sha256:[a-f0-9]{64}$/.test(reservation.digest)) {
+    throw new Error("protected model reservation has an invalid identity digest");
+  }
+  if (reservation.preparationId !== preparationId || reservation.expiresAtMs !== expiresAtMs) {
+    throw new Error("protected model reservation is not scoped to this preparation");
+  }
+  const limits = modelLimits2(expectedLimits);
+  if (canonicalCandidateDigest(reservation.enforcedLimits) !== canonicalCandidateDigest(limits)) {
+    throw new Error("protected model reservation does not enforce the frozen model limits");
+  }
+  const expectedNetworkMode = limits.maxModelCalls === 0 ? "disabled" : "gateway-only";
+  const network = agentCandidateModelAccessNetworkSchema.parse(reservation.network);
+  if (network.mode !== expectedNetworkMode) {
+    throw new Error("protected model reservation has the wrong network policy for its call limit");
+  }
+}
+function assertEnvironmentDisjoint(publicEnv, traceEnv) {
+  const seen = new Set(Object.keys(publicEnv));
+  for (const name of Object.keys(traceEnv)) {
+    if (seen.has(name)) throw new Error(`evaluator environment binding collides with ${name}`);
+    seen.add(name);
+  }
+}
+function modelLimits2(limits) {
+  return {
+    maxModelCalls: limits.maxModelCalls,
+    maxInputTokens: limits.maxInputTokens,
+    maxOutputTokens: limits.maxOutputTokens,
+    maxCostUsd: limits.maxCostUsd
+  };
+}
+function exactProfileExecutorFiles(sourceFiles, expectedFiles) {
+  const byPath = new Map(sourceFiles.map((file) => [file.relPath, file]));
+  if (byPath.size !== sourceFiles.length || sourceFiles.length !== expectedFiles.length) {
+    throw new Error("profile source files do not match the signed profile plan");
+  }
+  return expectedFiles.map((expected) => {
+    const source = byPath.get(expected.relPath);
+    const mode = source?.mode ?? 420;
+    const bytes = Buffer.from(source?.content ?? "", "utf8");
+    if (!source || mode !== 420 && mode !== 493 || mode !== expected.mode || sha256Bytes(bytes) !== expected.contentSha256) {
+      throw new Error("profile source files do not match the signed profile plan");
+    }
+    return { path: expected.relPath, mode, bytes: Uint8Array.from(bytes) };
+  });
+}
+function isWellFormedUnicode(value) {
+  for (let index = 0; index < value.length; index++) {
+    const code = value.charCodeAt(index);
+    if (code >= 55296 && code <= 56319) {
+      const next = value.charCodeAt(index + 1);
+      if (!(next >= 56320 && next <= 57343)) return false;
+      index++;
+    } else if (code >= 56320 && code <= 57343) {
+      return false;
+    }
+  }
+  return true;
+}
+function errorMessage2(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+export {
+  CLAIM_FORMAT_VERSION,
+  PENDING_FORMAT_VERSION,
+  TERMINAL_FORMAT_VERSION,
+  PHASE_FORMAT_VERSION,
+  canonicalCandidateBytes,
+  canonicalCandidateDigest,
+  immutableCandidateValue,
+  canonicalCandidateDocument,
+  omitTopLevelDigest,
+  assertExactObjectKeys,
+  terminalRecord,
+  recoveredTerminalRecord,
+  assertTerminalAllowedInPhase,
+  rejectedFinish,
+  rejectedStage,
+  requireStagedTerminal,
+  sealTerminalDigest,
+  assertRecoveryMatchesStaged,
+  assertTerminalMatchesClaim,
+  assertTerminalMatchesStaged,
+  candidateCleanupTimeout,
+  candidateCleanupDeadline,
+  withinCandidateCleanupDeadline,
+  CANDIDATE_TRACE_TAGS,
+  CANDIDATE_TRACE_ENV,
+  assertPreparedCandidateIntegrity,
+  beginPreparedCandidateDisposal,
+  consumePreparedCandidateExecution,
+  candidateExecutionClaim,
+  InMemoryAgentCandidateExecutionClaimStore,
+  candidateClaimFileInternals,
+  sealAgentCandidateModelSettlement,
+  usdToNanos,
+  sealAgentCandidateExecutorFinalCapture,
+  persistCandidateOutputArtifact,
+  persistCandidateModelSettlementEvidence,
+  RecoveryAgentCandidateTraceStore,
+  executePreparedAgentCandidate,
+  verifyAgentCandidateBundle,
+  prepareAgentCandidateExecution
+};
+//# sourceMappingURL=chunk-A62TP7SK.js.map