@tangle-network/agent-runtime 0.94.13 → 0.96.1

package/dist/{chunk-CNH7DF7Z.js → chunk-YOLKCWRV.js}

@@ -1,9 +1,15 @@
 import {
   contentAddress
-} from "./chunk-WIPGQ4GT.js";
+} from "./chunk-IMSNJSXH.js";
 
-// src/candidate-execution/bundle.ts
-import { agentCandidateBundleSchema } from "@tangle-network/agent-interface";
+// src/candidate-execution/profile.ts
+import {
+  agentCandidateProfileActivationSchema,
+  agentCandidateProfileSchema,
+  agentProfileDiffSchema,
+  agentProfileSchema,
+  applyAgentProfileDiff
+} from "@tangle-network/agent-interface";
 
 // src/candidate-execution/digest.ts
 import { createHash } from "crypto";
@@ -38,6 +44,12 @@ function canonicalCandidateDocument(valueWithoutDigest) {
     digest
   });
 }
+function verifyCanonicalCandidateDocument(value, label) {
+  if (canonicalCandidateDigest(omitTopLevelDigest(value)) !== value.digest) {
+    throw new Error(`${label} digest does not match`);
+  }
+  return immutableCandidateValue(value);
+}
 function embeddedCandidateArtifact(bytes) {
   return {
     encoding: "base64",
@@ -61,24 +73,69 @@ function deepFreezeCandidate(value, seen = /* @__PURE__ */ new Set()) {
   return Object.freeze(value);
 }
 
-// src/candidate-execution/bundle.ts
-function sealAgentCandidateBundle(input) {
-  const digest = canonicalCandidateDigest(input);
-  const parsed = agentCandidateBundleSchema.parse({ ...input, digest });
-  const parsedDigest = canonicalCandidateDigest(omitTopLevelDigest(parsed));
-  if (parsedDigest !== digest) {
-    throw new Error("candidate bundle changed while validating its canonical wire shape");
+// src/candidate-execution/profile.ts
+var MATERIALIZER_HARNESSES = /* @__PURE__ */ new Set([
+  "claude-code",
+  "claude",
+  "claudish",
+  "nanoclaw",
+  "codex",
+  "opencode",
+  "kimi-code",
+  "kimi",
+  "pi",
+  "gemini",
+  "hermes",
+  "openclaw"
+]);
+function candidateMaterializerHarness(harness) {
+  if (!MATERIALIZER_HARNESSES.has(harness)) {
+    throw new Error(
+      `sealed candidate profile materialization is unsupported for harness ${harness}`
+    );
   }
-  return immutableCandidateValue(parsed);
+  return harness;
+}
+function createAgentCandidateProfileActivation(plan, profilePlan) {
+  const sourceByPath = new Map(plan.files.map((file) => [file.relPath, file]));
+  if (sourceByPath.size !== plan.files.length) {
+    throw new Error("candidate profile activation contains duplicate native file paths");
+  }
+  const files = profilePlan.material.files.map((expected) => {
+    const source = sourceByPath.get(expected.relPath);
+    if (!source) {
+      throw new Error(`candidate profile activation is missing ${expected.relPath}`);
+    }
+    const mode = source.mode ?? 420;
+    if (!Number.isSafeInteger(mode) || mode < 0 || mode > 511) {
+      throw new Error(`candidate profile activation has invalid mode for ${expected.relPath}`);
+    }
+    return { path: expected.relPath, mode, content: source.content };
+  });
+  if (files.length !== plan.files.length) {
+    throw new Error("candidate profile activation contains unplanned native files");
+  }
+  return parseAgentCandidateProfileActivation(
+    canonicalCandidateDocument({
+      kind: "agent-candidate-profile-activation",
+      profilePlan,
+      files
+    }).value,
+    profilePlan.digest
+  );
+}
+function parseAgentCandidateProfileActivation(input, expectedProfilePlanDigest) {
+  const activation = agentCandidateProfileActivationSchema.parse(input);
+  const planBytes = canonicalCandidateBytes(activation.profilePlan.material);
+  const profilePlanArtifact = activation.profilePlan.artifact;
+  if (sha256Bytes(planBytes) !== activation.profilePlan.digest || profilePlanArtifact.sha256 !== activation.profilePlan.digest || profilePlanArtifact.byteLength !== planBytes.byteLength || "content" in profilePlanArtifact && !Buffer.from(profilePlanArtifact.content, "base64").equals(Buffer.from(planBytes)) || expectedProfilePlanDigest !== void 0 && activation.profilePlan.digest !== expectedProfilePlanDigest) {
+    throw new Error("candidate profile activation has an invalid canonical profile plan");
+  }
+  if (canonicalCandidateDigest(omitTopLevelDigest(activation)) !== activation.digest) {
+    throw new Error("candidate profile activation digest does not match");
+  }
+  return immutableCandidateValue(activation);
 }
-
-// src/candidate-execution/profile.ts
-import {
-  agentCandidateProfileSchema,
-  agentProfileDiffSchema,
-  agentProfileSchema,
-  applyAgentProfileDiff
-} from "@tangle-network/agent-interface";
 var CANDIDATE_PROFILE_DIRECT_FIELDS = [
   "name",
   "description",
@@ -137,18 +194,28 @@ function assertCandidateProfileBinding(measuredInput, bundled) {
   if (measured.connections || measured.metadata || measured.extensions) {
     throw new Error("proposal candidate profile contains fields unsupported by sealed candidates");
   }
-  const normalized = candidateProfileAsAgentProfile(bundled);
+  const normalized = agentCandidateProfileAsAgentProfile(bundled);
   if (canonicalCandidateDigest(measured) !== canonicalCandidateDigest(normalized)) {
     throw new Error("proposal candidateProfile does not match candidateBundle.profile");
   }
 }
 function parseExactAgentProfile(input, label) {
-  const parsed = agentProfileSchema.parse(input);
+  let parsed;
+  try {
+    parsed = agentProfileSchema.parse(input);
+  } catch (cause) {
+    throw new Error(`${label} contains unsupported or non-canonical fields`, { cause });
+  }
   assertCanonicalParse(input, parsed, label);
   return parsed;
 }
 function parseExactAgentProfileDiff(input, label) {
-  const parsed = agentProfileDiffSchema.parse(input);
+  let parsed;
+  try {
+    parsed = agentProfileDiffSchema.parse(input);
+  } catch (cause) {
+    throw new Error(`${label} contains unsupported or non-canonical fields`, { cause });
+  }
   assertCanonicalParse(input, parsed, label);
   return parsed;
 }
@@ -172,7 +239,7 @@ function assertCandidateProfileExecutionSupport(profile) {
     );
   }
 }
-function candidateProfileAsAgentProfile(candidate) {
+function agentCandidateProfileAsAgentProfile(candidate) {
   const output = {};
   copyDirectProfileFields(output, candidate);
   if (candidate.model) output.model = { ...candidate.model };
@@ -375,13 +442,9 @@ import {
 } from "@tangle-network/agent-interface";
 
 // src/candidate-execution/claim-file-formats.ts
-var CLAIM_FORMAT_VERSION = 7;
-var PENDING_FORMAT_VERSION = 1;
-var TERMINAL_FORMAT_VERSION = 3;
-var PHASE_FORMAT_VERSION = 1;
-
-// src/candidate-execution/claim-terminal.ts
-import { agentCandidateArtifactRefSchema } from "@tangle-network/agent-interface";
+import {
+  agentCandidateArtifactRefSchema
+} from "@tangle-network/agent-interface";
 
 // src/candidate-execution/exact-object.ts
 function assertExactObjectKeys(value, required, label, optional = []) {
@@ -400,7 +463,31 @@ function assertExactObjectKeys(value, required, label, optional = []) {
   }
 }
 
+// src/candidate-execution/claim-file-formats.ts
+function sealCandidatePreparationEvidence(value, executionPlanDigest) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("candidate execution preparation evidence must be an object");
+  }
+  const record = value;
+  assertExactObjectKeys(
+    record,
+    ["executionPlan", "materializationReceipt"],
+    "candidate execution preparation evidence"
+  );
+  const executionPlan = immutableCandidateValue(
+    agentCandidateArtifactRefSchema.parse(record.executionPlan)
+  );
+  const materializationReceipt = immutableCandidateValue(
+    agentCandidateArtifactRefSchema.parse(record.materializationReceipt)
+  );
+  if (executionPlan.sha256 !== executionPlanDigest) {
+    throw new Error("candidate execution plan artifact digest does not match its claim");
+  }
+  return Object.freeze({ executionPlan, materializationReceipt });
+}
+
 // src/candidate-execution/claim-terminal.ts
+import { agentCandidateArtifactRefSchema as agentCandidateArtifactRefSchema2 } from "@tangle-network/agent-interface";
 var SHA256_PATTERN = /^sha256:[a-f0-9]{64}$/;
 function terminalRecord(claim, result) {
   const terminal = sealTerminalResult(result);
@@ -409,6 +496,7 @@ function terminalRecord(claim, result) {
     attempt: claim.attempt,
     bundleDigest: claim.bundleDigest,
     executionPlanDigest: claim.executionPlanDigest,
+    preparationEvidence: claim.preparationEvidence,
     ...terminal
   };
   return immutableCandidateValue({
@@ -419,7 +507,6 @@ function terminalRecord(claim, result) {
 function recoveredTerminalRecord(claim, phase, evidence) {
   const recovered = sealRecoveryEvidence(evidence, claim);
   return terminalRecord(claim, {
-    schemaVersion: 1,
     status: "failed",
     failureClass: recovered.failureClass === "pre-model-infrastructure" && phase !== "claimed" ? "unknown" : recovered.failureClass,
     usage: recovered.usage,
@@ -474,8 +561,8 @@ function sealTerminalRecordValue(value, label) {
       "attempt",
       "bundleDigest",
       "executionPlanDigest",
+      "preparationEvidence",
       "terminalDigest",
-      "schemaVersion",
       "status",
       "usage",
       "modelSettlement",
@@ -487,8 +574,8 @@ function sealTerminalRecordValue(value, label) {
       "attempt",
       "bundleDigest",
       "executionPlanDigest",
+      "preparationEvidence",
       "terminalDigest",
-      "schemaVersion",
       "status",
       "failureClass",
       "usage",
@@ -497,14 +584,19 @@ function sealTerminalRecordValue(value, label) {
     ],
     label
   );
+  const executionPlanDigest = requireString(
+    value.executionPlanDigest,
+    label,
+    "executionPlanDigest"
+  );
   const identity = {
     executionId: requireString(value.executionId, label, "executionId"),
     attempt: requireNumber(value.attempt, label, "attempt"),
     bundleDigest: requireString(value.bundleDigest, label, "bundleDigest"),
-    executionPlanDigest: requireString(
-      value.executionPlanDigest,
-      label,
-      "executionPlanDigest"
+    executionPlanDigest,
+    preparationEvidence: sealCandidatePreparationEvidence(
+      value.preparationEvidence,
+      executionPlanDigest
     )
   };
   assertExecutionId(identity.executionId);
@@ -513,28 +605,21 @@ function sealTerminalRecordValue(value, label) {
   }
   assertSha256Digest(identity.bundleDigest, "bundleDigest");
   assertSha256Digest(identity.executionPlanDigest, "executionPlanDigest");
+  if (identity.preparationEvidence.executionPlan.sha256 !== identity.executionPlanDigest) {
+    throw new Error(`${label} execution plan artifact does not match executionPlanDigest`);
+  }
   const result = sealTerminalResult(
     status === "succeeded" ? {
-      schemaVersion: requireNumber(value.schemaVersion, label, "schemaVersion"),
       status,
-      usage: requireObject(
-        value.usage,
-        label,
-        "usage"
-      ),
+      usage: requireObject(value.usage, label, "usage"),
       modelSettlement: requireArtifactRef(value.modelSettlement, label, "modelSettlement"),
       taskOutcome: requireArtifactRef(value.taskOutcome, label, "taskOutcome"),
       benchmarkResult: requireArtifactRef(value.benchmarkResult, label, "benchmarkResult"),
       runReceipt: requireArtifactRef(value.runReceipt, label, "runReceipt")
     } : {
-      schemaVersion: requireNumber(value.schemaVersion, label, "schemaVersion"),
       status,
       failureClass: requireFailureClass(value.failureClass, label),
-      usage: requireObject(
-        value.usage,
-        label,
-        "usage"
-      ),
+      usage: requireObject(value.usage, label, "usage"),
       modelSettlement: requireArtifactRef(value.modelSettlement, label, "modelSettlement"),
       ...value.failureEvidence ? {
         failureEvidence: requireArtifactRef(
@@ -561,7 +646,7 @@ function sealTerminalRecordValue(value, label) {
   });
 }
 function assertTerminalMatchesClaim(terminal, claim, path) {
-  if (terminal.executionId !== claim.executionId || terminal.attempt !== claim.attempt || terminal.bundleDigest !== claim.bundleDigest || terminal.executionPlanDigest !== claim.executionPlanDigest) {
+  if (terminal.executionId !== claim.executionId || terminal.attempt !== claim.attempt || terminal.bundleDigest !== claim.bundleDigest || terminal.executionPlanDigest !== claim.executionPlanDigest || canonicalCandidateDigest(terminal.preparationEvidence) !== canonicalCandidateDigest(claim.preparationEvidence)) {
     throw new Error(`candidate execution terminal record at ${path} does not match its claim`);
   }
 }
@@ -640,16 +725,7 @@ function sealTerminalResult(result) {
   }
   assertExactObjectKeys(
     result,
-    result.status === "succeeded" ? [
-      "schemaVersion",
-      "status",
-      "usage",
-      "modelSettlement",
-      "taskOutcome",
-      "benchmarkResult",
-      "runReceipt"
-    ] : [
-      "schemaVersion",
+    result.status === "succeeded" ? ["status", "usage", "modelSettlement", "taskOutcome", "benchmarkResult", "runReceipt"] : [
       "status",
       "failureClass",
       "usage",
@@ -658,14 +734,10 @@ function sealTerminalResult(result) {
     ],
     "candidate execution terminal result"
   );
-  if (result.schemaVersion !== 1) {
-    throw new Error("candidate execution terminal schemaVersion must be 1");
-  }
   const usage = sealUsage(result.usage);
   const modelSettlement = sealArtifactRef(result.modelSettlement, "modelSettlement");
   if (result.status === "succeeded") {
     return Object.freeze({
-      schemaVersion: 1,
       status: "succeeded",
       usage,
       modelSettlement,
@@ -679,7 +751,6 @@ function sealTerminalResult(result) {
     throw new Error("pre-model infrastructure failure cannot contain model calls");
   }
   return Object.freeze({
-    schemaVersion: 1,
     status: "failed",
     failureClass: result.failureClass,
     usage,
@@ -713,7 +784,7 @@ function sealUsage(usage) {
   });
 }
 function sealArtifactRef(ref, label) {
-  const parsed = agentCandidateArtifactRefSchema.parse(ref);
+  const parsed = agentCandidateArtifactRefSchema2.parse(ref);
   if (!Number.isSafeInteger(parsed.byteLength)) {
     throw new Error(`candidate execution terminal ${label} byteLength exceeds safe integer range`);
   }
@@ -798,29 +869,15 @@ function candidateResultTimeout(timeoutMs, taskTimeoutMs) {
   return effective;
 }
 async function withinCandidateCleanupDeadline(operation, deadlineAtMs, label) {
-  const remainingMs = deadlineAtMs - Date.now();
-  if (remainingMs <= 0) throw new CandidateCleanupTimeoutError(label);
-  const pending = Promise.resolve().then(operation);
-  void pending.catch(() => void 0);
-  let timer;
-  try {
-    const result = await Promise.race([
-      pending,
-      new Promise((_resolve, reject) => {
-        timer = setTimeout(() => reject(new CandidateCleanupTimeoutError(label)), remainingMs);
-      })
-    ]);
-    if (Date.now() >= deadlineAtMs) throw new CandidateCleanupTimeoutError(label);
-    return result;
-  } finally {
-    if (timer) clearTimeout(timer);
-  }
+  return withinCandidateDeadline(operation, deadlineAtMs, new CandidateCleanupTimeoutError(label));
 }
 async function withinCandidateResultDeadline(operation, deadlineAtMs, label) {
+  return withinCandidateDeadline(operation, deadlineAtMs, new CandidateResultTimeoutError(label));
+}
+async function withinCandidateDeadline(operation, deadlineAtMs, timeoutError) {
   const remainingMs = deadlineAtMs - Date.now();
-  if (remainingMs <= 0) throw new CandidateResultTimeoutError(label);
+  if (remainingMs <= 0) throw timeoutError;
   const controller = new AbortController();
-  const timeoutError = new CandidateResultTimeoutError(label);
   const pending = Promise.resolve().then(() => operation(controller.signal));
   void pending.catch(() => void 0);
   let timer;
@@ -949,8 +1006,8 @@ var InMemoryAgentCandidateExecutionClaimStore = class {
   }
 };
 var SHA256_PATTERN2 = /^sha256:[a-f0-9]{64}$/;
-var LEASE_TOKEN_PATTERN = /^candidate-execution-lease-v1\.[A-Za-z0-9_-]{43}$/;
-var PREPARATION_ID_PATTERN = /^candidate-preparation-v1\.[A-Za-z0-9_-]{43}$/;
+var LEASE_TOKEN_PATTERN = /^candidate-execution-lease\.[A-Za-z0-9_-]{43}$/;
+var PREPARATION_ID_PATTERN = /^candidate-preparation\.[A-Za-z0-9_-]{43}$/;
 function sealClaim(claim) {
   assertExactObjectKeys(
     claim,
@@ -961,6 +1018,7 @@ function sealClaim(claim) {
       "retryPolicy",
       "bundleDigest",
       "executionPlanDigest",
+      "preparationEvidence",
       "retryLineageDigest",
       "leaseExpiresAtMs",
       "resultTimeoutMs",
@@ -986,6 +1044,10 @@ function sealClaim(claim) {
   }
   assertSha256Digest2(claim.bundleDigest, "bundleDigest");
   assertSha256Digest2(claim.executionPlanDigest, "executionPlanDigest");
+  const preparationEvidence = sealCandidatePreparationEvidence(
+    claim.preparationEvidence,
+    claim.executionPlanDigest
+  );
   assertSha256Digest2(claim.retryLineageDigest, "retryLineageDigest");
   assertPositiveTimestamp(claim.leaseExpiresAtMs, "leaseExpiresAtMs");
   candidateResultTimeout(claim.resultTimeoutMs, claim.resultTimeoutMs);
@@ -997,6 +1059,7 @@ function sealClaim(claim) {
     retryPolicy: claim.retryPolicy,
     bundleDigest: claim.bundleDigest,
     executionPlanDigest: claim.executionPlanDigest,
+    preparationEvidence,
     retryLineageDigest: claim.retryLineageDigest,
     leaseExpiresAtMs: claim.leaseExpiresAtMs,
     resultTimeoutMs: claim.resultTimeoutMs,
@@ -1080,7 +1143,7 @@ function newLease(claim) {
   return Object.freeze({
     executionId: claim.executionId,
     attempt: claim.attempt,
-    token: `candidate-execution-lease-v1.${randomBytes(32).toString("base64url")}`,
+    token: `candidate-execution-lease.${randomBytes(32).toString("base64url")}`,
     expiresAtMs: claim.leaseExpiresAtMs
   });
 }
@@ -1131,19 +1194,16 @@ function rejectedRetry(claim, detail) {
 async function readClaim(path) {
   const parsed = await readJsonObject(path, "claim");
   const record = parsed;
-  if (record.version !== CLAIM_FORMAT_VERSION) {
-    throw new Error(`candidate execution claim at ${path} has unsupported version`);
-  }
   assertExactObjectKeys(
     parsed,
     [
-      "version",
       "executionId",
       "attempt",
       "maxAttempts",
       "retryPolicy",
       "bundleDigest",
       "executionPlanDigest",
+      "preparationEvidence",
       "retryLineageDigest",
       "leaseExpiresAtMs",
       "resultTimeoutMs",
@@ -1164,6 +1224,11 @@ async function readClaim(path) {
       path,
       "executionPlanDigest"
     ),
+    preparationEvidence: requireObject2(
+      record.preparationEvidence,
+      path,
+      "preparationEvidence"
+    ),
     retryLineageDigest: requireString2(
       record.retryLineageDigest,
       path,
@@ -1199,10 +1264,7 @@ async function readClaimIfPresent(path) {
 async function readTerminal(path) {
   const parsed = await readJsonObject(path, "terminal record");
   const record = parsed;
-  if (record.version !== TERMINAL_FORMAT_VERSION) {
-    throw new Error(`candidate execution terminal record at ${path} has unsupported version`);
-  }
-  assertExactObjectKeys(parsed, ["version", "terminal"], `candidate execution terminal record at ${path}`);
+  assertExactObjectKeys(parsed, ["terminal"], `candidate execution terminal record at ${path}`);
   return sealTerminalRecordValue(
     requireObject2(record.terminal, path, "terminal"),
     `candidate execution terminal record at ${path}`
@@ -1226,12 +1288,9 @@ async function readTransitionIfPresent(path, claim) {
   }
   if (parsed.kind === "candidate-execution-phase") {
     const record = parsed;
-    if (record.version !== PHASE_FORMAT_VERSION) {
-      throw new Error(`candidate execution phase record at ${path} has unsupported version`);
-    }
     assertExactObjectKeys(
       parsed,
-      ["version", "kind", "executionId", "attempt", "executionPlanDigest", "phase"],
+      ["kind", "executionId", "attempt", "executionPlanDigest", "phase"],
       `candidate execution phase record at ${path}`
     );
     if (record.executionId !== claim.executionId || record.attempt !== claim.attempt || record.executionPlanDigest !== claim.executionPlanDigest || record.phase !== "candidate-may-run") {
@@ -1241,14 +1300,7 @@ async function readTransitionIfPresent(path, claim) {
   }
   if (parsed.kind === "candidate-execution-pending-terminal") {
     const record = parsed;
-    if (record.version !== PENDING_FORMAT_VERSION) {
-      throw new Error(`candidate execution pending record at ${path} has unsupported version`);
-    }
-    assertExactObjectKeys(
-      parsed,
-      ["version", "kind", "terminal"],
-      `candidate execution pending record at ${path}`
-    );
+    assertExactObjectKeys(parsed, ["kind", "terminal"], `candidate execution pending record at ${path}`);
     const terminal = sealTerminalRecordValue(
       requireObject2(record.terminal, path, "terminal"),
       `candidate execution pending record at ${path}`
@@ -1398,6 +1450,8 @@ function candidateTerminalWindowMs(cleanupTimeoutMs) {
 
 // src/candidate-execution/prepared-state.ts
 import {
+  agentCandidateBenchmarkSuiteSchema,
+  agentCandidateBenchmarkTaskSchema,
   agentCandidateExecutionPlanEvidenceSchema,
   agentCandidateMaterializationReceiptSchema,
   agentCandidateProfilePlanEvidenceSchema
@@ -1466,7 +1520,6 @@ async function readMaterializedWorkspaceFiles(root, expected, options = {}) {
 }
 function candidateWorkspaceManifest(files) {
   return {
-    schemaVersion: 2,
     kind: "agent-candidate-workspace-manifest",
     files: files.map((file) => ({
       path: file.path,
@@ -1936,14 +1989,6 @@ function isNoEntry(error) {
   return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
 }
 
-// src/candidate-execution/workspace-task.ts
-function workspaceTaskRepository(task) {
-  if (task.outcome.kind !== "workspace" || !task.repository) {
-    throw new Error("candidate runtime requires a workspace outcome with repository provenance");
-  }
-  return task.repository;
-}
-
 // src/candidate-execution/prepared-state.ts
 var stateByExecution = /* @__PURE__ */ new WeakMap();
 var lifecycleByExecution = /* @__PURE__ */ new WeakMap();
@@ -1952,9 +1997,11 @@ function createPreparedCandidateExecution(input) {
   assertPrivateCandidateIntegrity(state);
   const prepared = Object.freeze({
     bundle: state.bundle,
+    benchmark: Object.freeze({ suite: state.benchmarkSuite, task: state.benchmarkTask }),
     executionId: state.executionId,
     roots: state.roots,
     profilePlan: evidenceView(state.profilePlan),
+    profileActivation: state.profileActivation,
     executionPlan: evidenceView(state.executionPlan),
     materializationReceipt: state.materializationReceipt,
     launch: state.launch,
@@ -2007,8 +2054,9 @@ function beginPreparedCandidateRun(prepared, modelAccess, memoryAccess) {
   const material = state.executionPlan.value.material;
   const request = Object.freeze({
     executionId: state.executionId,
+    benchmark: preparedBenchmark(state),
     inputs: Object.freeze({
-      task: workspaceInputView(material.task.workspace, state.executorInputs.taskFiles),
+      task: workspaceInputView(state.benchmarkTask.workspace, state.executorInputs.taskFiles),
       ...material.candidateWorkspace && state.executorInputs.candidateFiles ? {
         candidate: workspaceInputView(
           material.candidateWorkspace,
@@ -2023,6 +2071,7 @@ function beginPreparedCandidateRun(prepared, modelAccess, memoryAccess) {
     }),
     roots: state.roots.execution,
     profilePlan: evidenceView(state.profilePlan),
+    profileActivation: state.profileActivation,
     executionPlan: evidenceView(state.executionPlan),
     materializationReceipt: state.materializationReceipt,
     launch: immutableCandidateValue({ ...state.launch, env: completeEnvironment }),
@@ -2036,6 +2085,9 @@ function beginPreparedCandidateRun(prepared, modelAccess, memoryAccess) {
   });
   return { state, request };
 }
+function preparedBenchmark(state) {
+  return Object.freeze({ suite: state.benchmarkSuite, task: state.benchmarkTask });
+}
 function consumePreparedCandidateExecution(prepared, outcome) {
   transitionLifecycle(
     prepared,
@@ -2048,10 +2100,16 @@ function beginPreparedCandidateSettlement(prepared) {
 }
 async function assertPreparedCandidateWorkspaces(state) {
   const plan = state.executionPlan.value.material;
-  await verifyMaterializedWorkspace(state.roots.staging.taskRoot, plan.task.workspace.material, {
-    ignoredProtectedRootEntries: [".git", ".sidecar"]
-  });
-  await verifyTaskCheckout(state.roots.staging.taskRoot, workspaceTaskRepository(plan.task));
+  await verifyMaterializedWorkspace(
+    state.roots.staging.taskRoot,
+    state.benchmarkTask.workspace.material,
+    {
+      ignoredProtectedRootEntries: [".git", ".sidecar"]
+    }
+  );
+  if (state.benchmarkTask.repository) {
+    await verifyTaskCheckout(state.roots.staging.taskRoot, state.benchmarkTask.repository);
+  }
   await verifyMaterializedProfileWorkspace(
     state.roots.staging.profileRoot,
     state.profilePlan.value.material
@@ -2065,9 +2123,19 @@ async function assertPreparedCandidateWorkspaces(state) {
   }
 }
 function detachPreparedCandidateState(input) {
+  const benchmarkSuite = immutableCandidateValue(
+    agentCandidateBenchmarkSuiteSchema.parse(input.benchmarkSuite)
+  );
+  const benchmarkTask = immutableCandidateValue(
+    agentCandidateBenchmarkTaskSchema.parse(input.benchmarkTask)
+  );
   const profilePlan = immutableCandidateValue(
     agentCandidateProfilePlanEvidenceSchema.parse(input.profilePlan.value)
   );
+  const profileActivation = parseAgentCandidateProfileActivation(
+    input.profileActivation,
+    profilePlan.digest
+  );
   const executionPlan = immutableCandidateValue(
     agentCandidateExecutionPlanEvidenceSchema.parse(input.executionPlan.value)
   );
@@ -2083,6 +2151,8 @@ function detachPreparedCandidateState(input) {
   return Object.freeze({
     ports: input.ports,
     bundle: input.bundle,
+    benchmarkSuite,
+    benchmarkTask,
     executionId: input.executionId,
     roots: immutableCandidateValue(input.roots),
     profilePlan: Object.freeze({
@@ -2090,6 +2160,7 @@ function detachPreparedCandidateState(input) {
       bytes: Uint8Array.from(input.profilePlan.bytes),
       written: Object.freeze([...input.profilePlan.written])
     }),
+    profileActivation,
     executionPlan: Object.freeze({
       value: executionPlan,
       bytes: Uint8Array.from(input.executionPlan.bytes)
@@ -2109,11 +2180,7 @@ function detachPreparedCandidateState(input) {
     executorInputs: Object.freeze({
       taskFiles: immutableExecutorFiles(input.executorInputs.taskFiles),
       ...input.executorInputs.candidateFiles ? { candidateFiles: immutableExecutorFiles(input.executorInputs.candidateFiles) } : {},
-      profileFiles: Object.freeze(
-        input.executorInputs.profileFiles.map(
-          (file) => Object.freeze({ ...file, bytes: Uint8Array.from(file.bytes) })
-        )
-      )
+      profileFiles: immutableExecutorFiles(input.executorInputs.profileFiles)
     }),
     ...input.memoryReservation ? { memoryReservation: immutableCandidateValue(input.memoryReservation) } : {},
     ...input.knowledge ? {
@@ -2134,6 +2201,7 @@ function assertPrivateCandidateIntegrity(state) {
     throw new Error("prepared candidate bundle no longer matches its digest");
   }
   assertPlanEvidence(state.profilePlan.value, state.profilePlan.bytes, "profile plan");
+  parseAgentCandidateProfileActivation(state.profileActivation, state.profilePlan.value.digest);
   assertPlanEvidence(state.executionPlan.value, state.executionPlan.bytes, "execution plan");
   agentCandidateExecutionPlanEvidenceSchema.parse(state.executionPlan.value);
   const receipt = agentCandidateMaterializationReceiptSchema.parse(
@@ -2143,11 +2211,12 @@ function assertPrivateCandidateIntegrity(state) {
   if (canonicalCandidateDigest(omitTopLevelDigest(receipt)) !== state.materializationReceipt.digest || !Buffer.from(receiptBytes).equals(Buffer.from(state.materializationReceipt.bytes))) {
     throw new Error("prepared materialization receipt no longer matches its canonical bytes");
   }
-  const instruction = state.executionPlan.value.material.task.instruction;
-  if (sha256Bytes(state.instruction.bytes) !== instruction.sha256 || state.instruction.bytes.byteLength !== instruction.byteLength || JSON.stringify(state.instruction.delivery) !== JSON.stringify(instruction.delivery)) {
+  assertSignedBenchmarkInput(state);
+  const instruction = Buffer.from(state.benchmarkTask.instruction, "utf8");
+  if (!Buffer.from(state.instruction.bytes).equals(instruction) || JSON.stringify(state.instruction.delivery) !== JSON.stringify(state.executionPlan.value.material.instructionDelivery)) {
     throw new Error("prepared instruction no longer matches the signed execution plan");
   }
-  if (!/^candidate-preparation-v1\.[A-Za-z0-9_-]{43}$/.test(state.preparationId) || !Number.isSafeInteger(state.reservationExpiresAtMs) || state.reservationExpiresAtMs <= 0 || !Number.isSafeInteger(state.cleanupTimeoutMs) || state.cleanupTimeoutMs <= 0 || !Number.isSafeInteger(state.resultTimeoutMs) || state.resultTimeoutMs <= 0 || JSON.stringify(state.resolvedModel) !== JSON.stringify(state.executionPlan.value.material.model.resolved) || state.modelReservation.digest !== state.executionPlan.value.material.model.access.grantDigest || state.modelReservation.preparationId !== state.preparationId || state.modelReservation.expiresAtMs !== state.reservationExpiresAtMs || canonicalCandidateDigest(state.modelReservation.network) !== canonicalCandidateDigest(state.executionPlan.value.material.model.access.network) || canonicalCandidateDigest(state.modelReservation.enforcedLimits) !== canonicalCandidateDigest(modelLimits(state.executionPlan.value.material.limits))) {
+  if (!/^candidate-preparation\.[A-Za-z0-9_-]{43}$/.test(state.preparationId) || !Number.isSafeInteger(state.reservationExpiresAtMs) || state.reservationExpiresAtMs <= 0 || !Number.isSafeInteger(state.cleanupTimeoutMs) || state.cleanupTimeoutMs <= 0 || !Number.isSafeInteger(state.resultTimeoutMs) || state.resultTimeoutMs <= 0 || JSON.stringify(state.resolvedModel) !== JSON.stringify(state.executionPlan.value.material.model.resolved) || state.modelReservation.digest !== state.executionPlan.value.material.model.access.grantDigest || state.modelReservation.preparationId !== state.preparationId || state.modelReservation.expiresAtMs !== state.reservationExpiresAtMs || canonicalCandidateDigest(state.modelReservation.network) !== canonicalCandidateDigest(state.executionPlan.value.material.model.access.network) || canonicalCandidateDigest(state.modelReservation.enforcedLimits) !== canonicalCandidateDigest(modelLimits(state.executionPlan.value.material.limits))) {
     throw new Error("prepared model access no longer matches the signed execution plan");
   }
   assertExecutorInputs(state);
@@ -2175,7 +2244,7 @@ function assertPrivateCandidateIntegrity(state) {
     [CANDIDATE_TRACE_ENV.traceRunId]: state.trace.runId
   };
   if (!state.trace.runId.startsWith(
-    `${state.executionId}:attempt-${state.executionPlan.value.material.attempt.number}:`
+    `${state.executionId}:attempt-${state.executionPlan.value.material.runCell.attempt}:`
   ) || canonicalCandidateDigest(state.trace.tags) !== canonicalCandidateDigest(expectedTags) || canonicalCandidateDigest(state.trace.env) !== canonicalCandidateDigest(expectedTraceEnvironment)) {
     throw new Error("prepared trace identity no longer matches the signed execution");
   }
@@ -2220,7 +2289,7 @@ function knowledgeView(knowledge) {
 function workspaceInputView(snapshot, sourceFiles) {
   return Object.freeze({
     snapshot,
-    files: Object.freeze(sourceFiles.map((file) => profileFileView(file)))
+    files: Object.freeze(sourceFiles.map((file) => executorFileView(file)))
   });
 }
 function profileFileView(source) {
@@ -2233,9 +2302,22 @@ function profileFileView(source) {
     }
   });
 }
+function executorFileView(source) {
+  const bytes = Uint8Array.from(source.bytes);
+  return Object.freeze({
+    path: source.path,
+    mode: source.mode,
+    get bytes() {
+      return Uint8Array.from(bytes);
+    }
+  });
+}
 function assertExecutorInputs(state) {
   const material = state.executionPlan.value.material;
-  assertWorkspaceExecutorFiles(state.executorInputs.taskFiles, material.task.workspace.material);
+  assertWorkspaceExecutorFiles(
+    state.executorInputs.taskFiles,
+    state.benchmarkTask.workspace.material
+  );
   if (material.candidateWorkspace) {
     if (!state.executorInputs.candidateFiles) {
       throw new Error("prepared candidate executor files are missing");
@@ -2293,6 +2375,22 @@ function assertWorkspaceExecutorFiles(actualFiles, expected) {
     }
   }
 }
+function assertSignedBenchmarkInput(state) {
+  const plan = state.executionPlan.value.material;
+  const cell = plan.runCell;
+  const suite = state.benchmarkSuite;
+  const task = state.benchmarkTask;
+  const receipt = state.materializationReceipt.value;
+  const cellIndex = cell.taskIndex * suite.reps + cell.repetition;
+  if (canonicalCandidateDigest(omitTopLevelDigest(suite)) !== suite.digest || canonicalCandidateDigest(omitTopLevelDigest(task)) !== task.digest || canonicalCandidateDigest(omitTopLevelDigest(cell)) !== cell.digest || cell.bundleDigest !== state.bundle.digest || cell.suiteDigest !== suite.digest || cell.taskDigest !== task.digest || suite.taskDigests[cell.taskIndex] !== task.digest || suite.seeds[cellIndex] !== cell.seed || cell.repetition >= suite.reps || cell.attempt < 1 || cell.attempt > task.attempt.maxAttempts) {
+    throw new Error("prepared candidate no longer matches its signed experiment cell");
+  }
+  const suiteBytes = canonicalCandidateBytes(omitTopLevelDigest(suite));
+  const taskBytes = canonicalCandidateBytes(omitTopLevelDigest(task));
+  if (receipt.benchmark.suite.digest !== suite.digest || receipt.benchmark.suite.material.sha256 !== sha256Bytes(suiteBytes) || receipt.benchmark.suite.material.byteLength !== suiteBytes.byteLength || receipt.benchmark.task.digest !== task.digest || receipt.benchmark.task.material.sha256 !== sha256Bytes(taskBytes) || receipt.benchmark.task.material.byteLength !== taskBytes.byteLength) {
+    throw new Error("materialization receipt no longer matches its signed benchmark input");
+  }
+}
 function immutableExecutorFiles(files) {
   return Object.freeze(
     files.map((file) => Object.freeze({ ...file, bytes: Uint8Array.from(file.bytes) }))
@@ -2330,10 +2428,14 @@ function assertProtectedEnvironment(state, modelEnvironment, memoryEnvironment)
 }
 
 // src/candidate-execution/claim-plan.ts
-function candidateExecutionClaim(prepared) {
+function candidateExecutionClaim(prepared, preparationEvidence) {
   const state = assertPreparedCandidateIntegrity(prepared);
   const material = prepared.executionPlan.value.material;
-  const attempt = material.attempt;
+  const attempt = {
+    number: material.runCell.attempt,
+    maxAttempts: state.benchmarkTask.attempt.maxAttempts,
+    retryPolicy: state.benchmarkTask.attempt.retryPolicy
+  };
   const nowMs = Date.now();
   if (!Number.isSafeInteger(nowMs) || nowMs < 0) {
     throw new Error("candidate execution claim-store clock returned an invalid timestamp");
@@ -2351,6 +2453,14 @@ function candidateExecutionClaim(prepared) {
       "candidate preparation expires before its full execution and cleanup owner window"
     );
   }
+  if (preparationEvidence.executionPlan.sha256 !== prepared.executionPlan.value.digest || preparationEvidence.executionPlan.byteLength !== state.executionPlan.bytes.byteLength) {
+    throw new Error("persisted execution plan does not match its canonical preparation bytes");
+  }
+  if (preparationEvidence.materializationReceipt.sha256 !== state.materializationReceipt.digest || preparationEvidence.materializationReceipt.byteLength !== state.materializationReceipt.bytes.byteLength) {
+    throw new Error(
+      "persisted materialization receipt does not match its canonical preparation bytes"
+    );
+  }
   return candidateClaimFileInternals.sealClaim({
     executionId: prepared.executionId,
     attempt: attempt.number,
@@ -2358,6 +2468,7 @@ function candidateExecutionClaim(prepared) {
     retryPolicy: attempt.retryPolicy,
     bundleDigest: prepared.bundle.digest,
     executionPlanDigest: prepared.executionPlan.value.digest,
+    preparationEvidence,
     retryLineageDigest: retryLineageDigest(prepared, state.resultTimeoutMs),
     leaseExpiresAtMs,
     resultTimeoutMs: state.resultTimeoutMs,
@@ -2382,7 +2493,11 @@ function retryLineageDigest(prepared, resultTimeoutMs) {
     resultTimeoutMs,
     executionPlan: {
       ...material,
-      attempt: { ...material.attempt, number: 0 },
+      runCell: {
+        ...material.runCell,
+        attempt: 0,
+        digest: `sha256:${"0".repeat(64)}`
+      },
       model: {
         ...material.model,
         access: {
@@ -2418,13 +2533,13 @@ function retryLineageDigest(prepared, resultTimeoutMs) {
 
 // src/candidate-execution/output-artifacts.ts
 import {
-  agentCandidateArtifactRefSchema as agentCandidateArtifactRefSchema2
+  agentCandidateArtifactRefSchema as agentCandidateArtifactRefSchema3
 } from "@tangle-network/agent-interface";
 async function persistCandidateOutputArtifact(port, input) {
   input.signal?.throwIfAborted();
   const bytes = Uint8Array.from(input.bytes);
   const expectedDigest = sha256Bytes(bytes);
-  const ref = agentCandidateArtifactRefSchema2.parse(
+  const ref = agentCandidateArtifactRefSchema3.parse(
     await port.put({
       executionId: input.executionId,
       purpose: input.purpose,
@@ -2447,6 +2562,7 @@ import {
   agentCandidateTerminationSchema,
   agentCandidateWorkspaceManifestMaterialSchema
 } from "@tangle-network/agent-interface";
+var sealedFinalCaptureBrand = /* @__PURE__ */ Symbol("sealedAgentCandidateExecutorFinalCapture");
 function sealAgentCandidateProtectedRunCapture(value) {
   const capture = requireRecord(value, "candidate execution capture");
   assertExactObjectKeys(capture, ["executionId", "termination"], "candidate execution capture");
@@ -2458,31 +2574,32 @@ function sealAgentCandidateProtectedRunCapture(value) {
     termination: Object.freeze(agentCandidateTerminationSchema.parse(capture.termination))
   });
 }
-function sealAgentCandidateExecutorFinalCapture(value) {
+function sealAgentCandidateExecutorFinalCapture(value, expectedOutcome) {
   const capture = requireRecord(value, "candidate final capture");
-  assertExactObjectKeys(capture, ["stopped"], "candidate final capture", ["taskOutcome", "memoryAfter"]);
-  if (capture.stopped !== true) {
-    throw new Error("candidate final capture does not prove process death");
-  }
-  const taskOutcome = capture.taskOutcome ? sealTaskOutcomeCapture(capture.taskOutcome) : void 0;
+  assertExactObjectKeys(capture, [], "candidate final capture", [
+    "taskOutcome",
+    "memoryAfter",
+    "evidence"
+  ]);
+  const taskOutcome = capture.taskOutcome ? sealTaskOutcomeCapture(capture.taskOutcome, expectedOutcome) : void 0;
   const memoryAfter = capture.memoryAfter ? sealMemoryCapture(capture.memoryAfter) : void 0;
+  if (capture.evidence !== void 0 && !(capture.evidence instanceof Uint8Array)) {
+    throw new Error("candidate executor evidence must be a byte array");
+  }
+  const evidence = capture.evidence ? Uint8Array.from(capture.evidence) : void 0;
   return Object.freeze({
-    stopped: true,
     ...taskOutcome ? { taskOutcome } : {},
-    ...memoryAfter ? { memoryAfter: Object.freeze(memoryAfter) } : {}
+    ...memoryAfter ? { memoryAfter: Object.freeze(memoryAfter) } : {},
+    ...evidence ? { evidence } : {},
+    [sealedFinalCaptureBrand]: true
   });
 }
-function encodeAgentCandidateExecutorCapture(input) {
-  return canonicalCandidateBytes({
-    schemaVersion: 1,
-    kind: "agent-candidate-executor-capture",
-    executionId: input.executionId,
-    executionPlanDigest: input.executionPlanDigest,
-    termination: input.termination,
-    stopped: true,
-    taskOutcome: input.taskOutcome,
-    ...input.memoryAfter ? { memoryAfter: input.memoryAfter } : {}
-  });
+function sealAgentCandidateExecutorStopAcknowledgement(value) {
+  const capture = requireRecord(value, "candidate stop acknowledgement");
+  assertExactObjectKeys(capture, ["stopped"], "candidate stop acknowledgement");
+  if (capture.stopped !== true) {
+    throw new Error("candidate stop acknowledgement does not prove process death");
+  }
 }
 function sealMemoryCapture(value) {
   const capture = requireRecord(value, "candidate memory capture");
@@ -2497,13 +2614,32 @@ function sealMemoryCapture(value) {
     archive: Uint8Array.from(capture.archive)
   });
 }
-function sealTaskOutcomeCapture(value) {
+function sealTaskOutcomeCapture(value, expected) {
   const capture = requireRecord(value, "candidate task capture");
+  if (capture.kind === "output") {
+    assertExactObjectKeys(capture, ["kind", "bytes"], "candidate task output capture");
+    if (expected.kind !== "output") {
+      throw new Error("candidate task output capture does not match the signed outcome kind");
+    }
+    if (!(capture.bytes instanceof Uint8Array)) {
+      throw new Error("candidate task output capture must contain a byte array");
+    }
+    if (capture.bytes.byteLength > expected.maxBytes) {
+      throw new Error(`candidate task output exceeds the frozen ${expected.maxBytes}-byte maximum`);
+    }
+    return Object.freeze({ kind: "output", bytes: Uint8Array.from(capture.bytes) });
+  }
   assertExactObjectKeys(
     capture,
-    ["resultTree", "afterState", "archive", "gitDiff"],
+    ["kind", "resultTree", "afterState", "archive", "gitDiff"],
     "candidate task capture"
   );
+  if (capture.kind !== "workspace") {
+    throw new Error("candidate task capture has an invalid outcome kind");
+  }
+  if (expected.kind !== "workspace") {
+    throw new Error("candidate workspace capture does not match the signed outcome kind");
+  }
   if (typeof capture.resultTree !== "string" || !/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(capture.resultTree)) {
     throw new Error("candidate task capture resultTree is not a Git object id");
   }
@@ -2512,6 +2648,7 @@ function sealTaskOutcomeCapture(value) {
   }
   const afterState = agentCandidateWorkspaceManifestMaterialSchema.parse(capture.afterState);
   return Object.freeze({
+    kind: "workspace",
     resultTree: capture.resultTree,
     afterState: Object.freeze(afterState),
     archive: Uint8Array.from(capture.archive),
@@ -2526,11 +2663,11 @@ function requireRecord(value, label) {
 }
 
 // src/candidate-execution/finalize.ts
-import { mkdtemp as mkdtemp2, rm as rm2 } from "fs/promises";
-import { tmpdir as tmpdir2 } from "os";
-import { join as join2 } from "path";
 import { isLlmSpan as isLlmSpan2, REDACTION_VERSION as REDACTION_VERSION2 } from "@tangle-network/agent-eval";
-import { agentCandidateRunReceiptSchema } from "@tangle-network/agent-interface";
+import {
+  agentCandidateRunReceiptSchema,
+  agentCandidateWorkspaceSnapshotEvidenceSchema
+} from "@tangle-network/agent-interface";
 
 // src/candidate-execution/model-settlement.ts
 import { isLlmSpan } from "@tangle-network/agent-eval";
@@ -2557,7 +2694,6 @@ function sealAgentCandidateModelSettlement(settlement, expected) {
   let outputTokens = 0;
   let cachedInputTokens = 0;
   let reasoningTokens = 0;
-  let hasCachedInput = false;
   let costUsdNanos = 0;
   const calls = settlement.calls.map((source, index) => {
     assertExactObjectKeys(
@@ -2610,7 +2746,6 @@ function sealAgentCandidateModelSettlement(settlement, expected) {
       source.cachedInputTokens,
       "cached input token total"
     );
-    hasCachedInput = true;
     assertCount2(source.reasoningTokens, `model settlement call ${index} reasoningTokens`);
     reasoningTokens = safeAdd(reasoningTokens, source.reasoningTokens, "reasoning token total");
     assertCount2(source.costUsdNanos, `model settlement call ${index} costUsdNanos`);
@@ -2620,13 +2755,6 @@ function sealAgentCandidateModelSettlement(settlement, expected) {
     return Object.freeze({ ...source });
   });
   const usage = Object.freeze({
-    costUsd: costUsdNanos / USD_NANOS,
-    inputTokens,
-    outputTokens,
-    ...hasCachedInput ? { cachedInputTokens } : {},
-    modelCalls: calls.length
-  });
-  const fixedUsage = Object.freeze({
     costUsdNanos,
     inputTokens,
     outputTokens,
@@ -2641,9 +2769,7 @@ function sealAgentCandidateModelSettlement(settlement, expected) {
       closed: true,
       calls: Object.freeze(calls)
     }),
-    usage,
-    fixedUsage,
-    costUsdNanos
+    usage
   });
 }
 async function appendAuthoritativeModelSettlementSpans(traceStore, runId, settlement) {
@@ -2766,11 +2892,60 @@ function safeAdd(left, right, label) {
 }
 
 // src/candidate-execution/protected-redaction.ts
+import { createHmac, randomBytes as randomBytes2 } from "crypto";
 import {
   DEFAULT_REDACTION_RULES,
   REDACTION_VERSION,
   redactString
 } from "@tangle-network/agent-eval";
+function createProtectedRecordRedactor(protectedValues) {
+  const identityKey = randomBytes2(32);
+  const aggregate = {
+    version: REDACTION_VERSION,
+    redactionCount: 0,
+    byRule: {}
+  };
+  const mergeReport = (report) => {
+    aggregate.version = report.version;
+    aggregate.redactionCount += report.redactionCount;
+    for (const [rule, count] of Object.entries(report.byRule)) {
+      aggregate.byRule[rule] = (aggregate.byRule[rule] ?? 0) + count;
+    }
+  };
+  const redactScalar = (value, record) => {
+    const redacted = redactProtectedValue(value, protectedValues);
+    if (record) mergeReport(redacted.report);
+    return redacted.value;
+  };
+  const identifier = (value, record) => {
+    const redacted = redactScalar(value, record);
+    if (redacted === value) return value;
+    const digest = createHmac("sha256", identityKey).update(value).digest("hex");
+    return `${redacted}:hmac-sha256:${digest}`;
+  };
+  const transform = (value, record) => {
+    const transformed = transformProtectedRecord(
+      value,
+      void 0,
+      record,
+      redactScalar,
+      identifier
+    );
+    assertNoProtectedEvidence(transformed, protectedValues);
+    return transformed;
+  };
+  return Object.freeze({
+    record: (value) => transform(value, true),
+    query: (value) => transform(value, false),
+    identifier: (value) => identifier(value, false),
+    traceIdentity: (trace) => transform(trace, false),
+    report: () => ({
+      version: aggregate.version,
+      redactionCount: aggregate.redactionCount,
+      byRule: { ...aggregate.byRule }
+    })
+  });
+}
 function redactProtectedValue(value, protectedValues) {
   const report = {
     version: REDACTION_VERSION,
@@ -2858,6 +3033,65 @@ function redactNode(value, protectedValues, rules, report) {
   }
   return value;
 }
+function transformProtectedRecord(value, fieldName, record, redactScalar, redactIdentifier) {
+  if (value instanceof Uint8Array) return redactScalar(value, record);
+  if (typeof value === "string") {
+    return fieldName && isIdentifierFieldName(fieldName) ? redactIdentifier(value, record) : redactScalar(value, record);
+  }
+  if (Array.isArray(value)) {
+    return value.map(
+      (entry) => transformProtectedRecord(entry, fieldName, record, redactScalar, redactIdentifier)
+    );
+  }
+  if (!value || typeof value !== "object") return value;
+  if (fieldName === "tags") {
+    return transformTagMap(value, record, redactScalar, redactIdentifier);
+  }
+  if (fieldName === "tag") {
+    return transformTagFilter(value, record, redactScalar, redactIdentifier);
+  }
+  const entries = [];
+  const seenKeys = /* @__PURE__ */ new Set();
+  for (const [key, entry] of Object.entries(value)) {
+    const redactedKey = redactScalar(key, record);
+    if (seenKeys.has(redactedKey)) {
+      throw new Error("protected evidence redaction produced an ambiguous object key");
+    }
+    seenKeys.add(redactedKey);
+    entries.push([
+      redactedKey,
+      transformProtectedRecord(entry, key, record, redactScalar, redactIdentifier)
+    ]);
+  }
+  return Object.fromEntries(entries);
+}
+function transformTagMap(value, record, redactScalar, redactIdentifier) {
+  const entries = [];
+  const seenKeys = /* @__PURE__ */ new Set();
+  for (const [key, entry] of Object.entries(value)) {
+    const redactedKey = redactIdentifier(key, record);
+    if (seenKeys.has(redactedKey)) {
+      throw new Error("protected evidence redaction produced an ambiguous trace tag");
+    }
+    seenKeys.add(redactedKey);
+    entries.push([
+      redactedKey,
+      typeof entry === "string" ? redactIdentifier(entry, record) : transformProtectedRecord(entry, key, record, redactScalar, redactIdentifier)
+    ]);
+  }
+  return Object.fromEntries(entries);
+}
+function transformTagFilter(value, record, redactScalar, redactIdentifier) {
+  const output = {};
+  for (const [key, entry] of Object.entries(value)) {
+    const redactedKey = redactScalar(key, record);
+    output[redactedKey] = (key === "key" || key === "value") && typeof entry === "string" ? redactIdentifier(entry, record) : transformProtectedRecord(entry, key, record, redactScalar, redactIdentifier);
+  }
+  return output;
+}
+function isIdentifierFieldName(name) {
+  return /ids?$/i.test(name);
+}
 function protectedRedactionRules(protectedValues) {
   const exactRules = protectedValueVariants(protectedValues).sort((left, right) => right.length - left.length || left.localeCompare(right)).map((value, index) => ({
     id: `candidate-access-${index}`,
@@ -2904,75 +3138,24 @@ function escapeRegularExpression(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
-// src/candidate-execution/workspace-snapshot.ts
-import {
-  agentCandidateWorkspaceManifestMaterialSchema as agentCandidateWorkspaceManifestMaterialSchema2,
-  agentCandidateWorkspaceSnapshotEvidenceSchema
-} from "@tangle-network/agent-interface";
-function provisionalCandidateWorkspaceSnapshot(materialInput, archive) {
-  const material = immutableCandidateValue(
-    agentCandidateWorkspaceManifestMaterialSchema2.parse(materialInput)
-  );
-  const manifestBytes = canonicalCandidateBytes(material);
-  const snapshot = Object.freeze({
-    schemaVersion: 2,
-    kind: "agent-candidate-workspace-snapshot",
-    digest: sha256Bytes(manifestBytes),
-    material,
-    manifest: Object.freeze(embeddedCandidateArtifact(manifestBytes)),
-    archive: Object.freeze(embeddedCandidateArtifact(archive))
-  });
-  return Object.freeze({ material, manifestBytes, snapshot });
-}
-async function persistCandidateWorkspaceSnapshot(port, input) {
-  input.signal?.throwIfAborted();
-  const material = immutableCandidateValue(input.material);
-  const manifestBytes = canonicalCandidateBytes(material);
-  const [manifest, archive] = await Promise.all([
-    persistCandidateOutputArtifact(port, {
-      executionId: input.executionId,
-      purpose: input.purpose === "task" ? "task-manifest" : "memory-after-manifest",
-      bytes: manifestBytes,
-      ...input.signal ? { signal: input.signal } : {}
-    }),
-    persistCandidateOutputArtifact(port, {
-      executionId: input.executionId,
-      purpose: input.purpose === "task" ? "task-archive" : "memory-after-archive",
-      bytes: input.archive,
-      ...input.signal ? { signal: input.signal } : {}
-    })
-  ]);
-  return immutableCandidateValue(
-    agentCandidateWorkspaceSnapshotEvidenceSchema.parse({
-      schemaVersion: 2,
-      kind: "agent-candidate-workspace-snapshot",
-      digest: sha256Bytes(manifestBytes),
-      material,
-      manifest,
-      archive
-    })
-  );
-}
-
 // src/candidate-execution/finalize.ts
-async function finalizeAgentCandidateRun(state, capture, traceStore, settlement, evidence, protectedValues, writeRedactionReport, signal) {
+async function finalizeAgentCandidateRun(state, capture, traceStore, traceIdentity, settlement, evidence, protectedValues, writeRedactionReport, signal) {
   let termination;
   try {
     signal?.throwIfAborted();
-    const protectedCapture = sealAgentCandidateProtectedRunCapture(capture);
-    if (protectedCapture.executionId !== state.executionId) {
+    if (capture.executionId !== state.executionId) {
       throw new Error("protected capture execution id does not match the prepared execution");
     }
-    termination = protectedCapture.termination;
+    termination = capture.termination;
     if (termination.kind === "timeout" && termination.timeoutMs !== state.executionPlan.value.material.limits.timeoutMs) {
       throw new Error("timeout termination does not match the frozen execution limit");
     }
-    const run = await traceStore.getRun(state.trace.runId);
-    if (!run) throw new Error(`protected trace run is missing: ${state.trace.runId}`);
+    const run = await traceStore.getRun(traceIdentity.runId);
+    if (!run) throw new Error(`protected trace run is missing: ${traceIdentity.runId}`);
     if (run.status === "running" || run.endedAt === void 0) {
       throw new Error("protected trace run is not terminal");
     }
-    assertTraceBindings(run.tags, state);
+    assertTraceBindings(run.tags, traceIdentity.tags);
     const [spans, events, budget, artifacts] = await Promise.all([
       traceStore.spans({ runId: run.runId }),
       traceStore.events({ runId: run.runId }),
@@ -2994,31 +3177,14 @@ async function finalizeAgentCandidateRun(state, capture, traceStore, settlement,
     const modelSpans = orderedSpans.filter(isLlmSpan2);
     assertTraceMatchesModelSettlement(modelSpans, settlement);
     enforceLimits(state, run.startedAt, run.endedAt, orderedSpans, settlement);
-    const finalCapture = sealAgentCandidateExecutorFinalCapture(evidence.finalCapture);
     const memory = await memoryReceipt(
       state,
-      finalCapture,
-      evidence.outputArtifacts,
-      protectedValues,
+      evidence.finalCapture,
+      evidence.persistedCapture.memoryAfter,
       signal
     );
-    const executorCaptureBytes = encodeAgentCandidateExecutorCapture({
-      executionId: protectedCapture.executionId,
-      executionPlanDigest: state.executionPlan.value.digest,
-      termination: protectedCapture.termination,
-      taskOutcome: evidence.taskOutcome.evidence,
-      ...memory.mode === "isolated" ? { memoryAfter: memory.afterState } : {}
-    });
-    assertNoProtectedBytes(executorCaptureBytes, protectedValues);
-    const executorCapture = await persistCandidateOutputArtifact(evidence.outputArtifacts, {
-      executionId: state.executionId,
-      purpose: "executor-capture",
-      bytes: executorCaptureBytes,
-      signal
-    });
     const redacted = redactProtectedValue(
       {
-        schemaVersion: 1,
         run: { ...run, redactionVersion: REDACTION_VERSION2 },
         spans: orderedSpans,
         events: orderedEvents,
@@ -3049,22 +3215,26 @@ async function finalizeAgentCandidateRun(state, capture, traceStore, settlement,
       signal
     });
     const trace = {
-      schemaVersion: 1,
       artifact: traceArtifact,
       eventCount: 1 + orderedSpans.length + orderedEvents.length + orderedBudget.length + orderedArtifacts.length,
       modelCallCount: modelSpans.length
     };
     const document = canonicalCandidateDocument({
-      schemaVersion: 3,
       kind: "agent-candidate-run",
       digestAlgorithm: "rfc8785-sha256",
       bundleDigest: state.bundle.digest,
+      runCellDigest: state.executionPlan.value.material.runCell.digest,
       materializationReceiptDigest: state.materializationReceipt.digest,
       executionPlanDigest: state.executionPlan.value.digest,
+      timing: {
+        startedAtMs: run.startedAt,
+        endedAtMs: run.endedAt,
+        durationMs: run.endedAt - run.startedAt
+      },
       memory,
       trace,
       termination,
-      executorCapture,
+      executorCapture: evidence.persistedCapture.evidence,
       modelSettlement: evidence.modelSettlement,
       taskOutcome: evidence.taskOutcome.evidence,
       benchmarkResult: evidence.benchmarkResult
@@ -3080,8 +3250,8 @@ async function finalizeAgentCandidateRun(state, capture, traceStore, settlement,
       succeeded: true,
       receipt: document,
       artifacts: {
-        executorCapture,
         modelSettlement: evidence.modelSettlement.artifact,
+        executorCapture: evidence.persistedCapture.evidence,
         taskOutcome: evidence.taskOutcome.evidence.artifact,
         benchmarkResult: evidence.benchmarkResult.artifact,
         runReceipt
@@ -3101,8 +3271,7 @@ async function finalizeAgentCandidateRun(state, capture, traceStore, settlement,
     };
   }
 }
-function assertTraceBindings(tags, state) {
-  const expected = state.trace.tags;
+function assertTraceBindings(tags, expected) {
   for (const name of Object.values(CANDIDATE_TRACE_TAGS)) {
     if (tags?.[name] !== expected[name]) {
       throw new Error(`protected trace is not bound to prepared execution tag ${name}`);
@@ -3126,45 +3295,30 @@ function enforceLimits(state, startedAt, endedAt, spans, settlement) {
   for (const [actual, limit, label] of checks) {
     if (actual > limit) throw new Error(`protected ${label} ${actual} exceeds ${limit}`);
   }
-  if (settlement.costUsdNanos > usdToNanos(limits.maxCostUsd, "frozen maxCostUsd")) {
-    throw new Error(`protected cost USD ${usage.costUsd} exceeds ${limits.maxCostUsd}`);
+  if (usage.costUsdNanos > usdToNanos(limits.maxCostUsd, "frozen maxCostUsd")) {
+    throw new Error(
+      `protected cost USD ${usage.costUsdNanos / 1e9} exceeds ${limits.maxCostUsd}`
+    );
   }
 }
-async function memoryReceipt(state, capture, outputArtifacts, protectedValues, signal) {
+async function memoryReceipt(state, capture, persisted, signal) {
   signal?.throwIfAborted();
   if (state.memory.mode === "disabled") {
-    if (capture.memoryAfter !== void 0) {
+    if (capture.memoryAfter !== void 0 || persisted !== void 0) {
       throw new Error("disabled memory cannot return an after-state");
     }
     return { mode: "disabled" };
   }
   if (!capture.memoryAfter) throw new Error("isolated memory is missing its protected after-state");
-  const archive = Uint8Array.from(capture.memoryAfter.archive);
-  if (archive.byteLength === 0) throw new Error("isolated memory archive cannot be empty");
-  const provisional = provisionalCandidateWorkspaceSnapshot(capture.memoryAfter.afterState, archive);
-  const afterState = provisional.material;
-  assertNoProtectedBytes(provisional.manifestBytes, protectedValues);
-  assertNoProtectedBytes(archive, protectedValues);
-  const root = await mkdtemp2(join2(tmpdir2(), "agent-candidate-memory-after-"));
-  try {
-    await state.ports.workspaces.materialize({
-      role: "memory",
-      snapshot: provisional.snapshot,
-      archive: Uint8Array.from(archive),
-      destination: root
-    });
-    const files = await readMaterializedWorkspaceFiles(root, afterState);
-    for (const file of files) assertNoProtectedBytes(file.bytes, protectedValues);
-    signal?.throwIfAborted();
-  } finally {
-    await rm2(root, { recursive: true, force: true });
-  }
-  const snapshot = await persistCandidateWorkspaceSnapshot(outputArtifacts, {
-    executionId: state.executionId,
-    material: afterState,
-    archive,
-    purpose: "memory-after",
-    signal
+  if (!persisted) throw new Error("isolated memory is missing persisted capture evidence");
+  const afterState = capture.memoryAfter.afterState;
+  const manifestBytes = canonicalCandidateBytes(afterState);
+  const snapshot = agentCandidateWorkspaceSnapshotEvidenceSchema.parse({
+    kind: "agent-candidate-workspace-snapshot",
+    digest: sha256Bytes(manifestBytes),
+    material: afterState,
+    manifest: persisted.manifest,
+    archive: persisted.archive
   });
   return {
     mode: "isolated",
@@ -3194,19 +3348,20 @@ function compareStrings(a, b) {
 }
 
 // src/candidate-execution/outcome-evidence.ts
-import { mkdtemp as mkdtemp3, rm as rm3 } from "fs/promises";
-import { tmpdir as tmpdir3 } from "os";
-import { join as join3 } from "path";
+import { mkdtemp as mkdtemp2, rm as rm2 } from "fs/promises";
+import { tmpdir as tmpdir2 } from "os";
+import { join as join2 } from "path";
 import {
   agentCandidateBenchmarkResultEvidenceSchema,
   agentCandidateModelSettlementEvidenceSchema,
-  agentCandidateTaskOutcomeEvidenceSchema
+  agentCandidateTaskOutcomeEvidenceSchema,
+  agentCandidateWorkspaceSnapshotEvidenceSchema as agentCandidateWorkspaceSnapshotEvidenceSchema2
 } from "@tangle-network/agent-interface";
 
 // src/candidate-execution/benchmark-grader.ts
 async function runBoundCandidateBenchmarkGrader(input) {
   input.signal?.throwIfAborted();
-  const descriptor = snapshotGraderDescriptor(input.grader);
+  const descriptor = snapshotGraderDescriptor(input.grader, input.expectedGrader);
   const implementationBytes = await readVerifiedArtifact(descriptor.artifact, input.artifacts);
   if (implementationBytes.byteLength === 0) {
     throw new Error("candidate benchmark grader implementation cannot be empty");
@@ -3214,6 +3369,7 @@ async function runBoundCandidateBenchmarkGrader(input) {
   const expectedImplementationDigest = sha256Bytes(implementationBytes);
   const termination = immutableCandidateValue(input.termination);
   const run = input.grader.run;
+  const startedAtMs = Date.now();
   const result = await run(
     Object.freeze({
       executionId: input.executionId,
@@ -3223,6 +3379,7 @@ async function runBoundCandidateBenchmarkGrader(input) {
       signal: input.signal ?? new AbortController().signal
     })
   );
+  const endedAtMs = Math.max(startedAtMs, Date.now());
   input.signal?.throwIfAborted();
   assertExactRunnerResult(result);
   const evidence = Uint8Array.from(result.evidence);
@@ -3242,19 +3399,42 @@ async function runBoundCandidateBenchmarkGrader(input) {
   }
   return Object.freeze({
     grader: descriptor,
+    grading: immutableCandidateValue({
+      usage: emptyFixedSpend(),
+      timing: {
+        startedAtMs,
+        endedAtMs,
+        durationMs: endedAtMs - startedAtMs
+      }
+    }),
     evaluation: result.evaluation,
     evidence
   });
 }
-function snapshotGraderDescriptor(grader) {
+function snapshotGraderDescriptor(grader, expected) {
   if (!grader.name || !grader.version) {
     throw new Error("candidate benchmark grader name and version must be non-empty");
   }
-  return immutableCandidateValue({
+  const actual = {
     name: grader.name,
     version: grader.version,
+    format: "tangle-grader",
     artifact: grader.artifact
-  });
+  };
+  if (canonicalCandidateDigest(actual) !== canonicalCandidateDigest(expected)) {
+    throw new Error("candidate benchmark grader does not match the signed task grader");
+  }
+  return immutableCandidateValue(expected);
+}
+function emptyFixedSpend() {
+  return {
+    inputTokens: 0,
+    outputTokens: 0,
+    cachedInputTokens: 0,
+    reasoningTokens: 0,
+    modelCalls: 0,
+    costUsdNanos: 0
+  };
 }
 function detachedImplementation(bytes) {
   const stored = Uint8Array.from(bytes);
@@ -3286,6 +3466,104 @@ function assertExactRunnerResult(value) {
   }
 }
 
+// src/candidate-execution/executor-capture-evidence.ts
+async function persistAgentCandidateExecutorCapture(identity, expected, capture, outputArtifacts, signal) {
+  const executorEvidence = capture.evidence ? await persistCandidateOutputArtifact(outputArtifacts, {
+    executionId: identity.executionId,
+    purpose: "executor-native-evidence",
+    bytes: capture.evidence,
+    signal
+  }) : void 0;
+  const taskOutcome = capture.taskOutcome ? await persistTaskCapture(
+    identity.executionId,
+    expected,
+    capture.taskOutcome,
+    outputArtifacts,
+    signal
+  ) : void 0;
+  const memoryAfter = capture.memoryAfter ? await persistWorkspaceCapture(
+    identity.executionId,
+    "memory-after-manifest",
+    "memory-after-archive",
+    capture.memoryAfter.afterState,
+    capture.memoryAfter.archive,
+    outputArtifacts,
+    signal
+  ) : void 0;
+  const bytes = canonicalCandidateBytes({
+    kind: "agent-candidate-executor-capture",
+    executionPlanDigest: identity.executionPlanDigest,
+    ...executorEvidence ? { executorEvidence } : {},
+    ...taskOutcome ? { taskOutcome } : {},
+    ...memoryAfter ? { memoryAfter } : {}
+  });
+  const evidence = await persistCandidateOutputArtifact(outputArtifacts, {
+    executionId: identity.executionId,
+    purpose: "executor-capture",
+    bytes,
+    signal
+  });
+  return Object.freeze({
+    evidence,
+    ...taskOutcome ? { taskOutcome: Object.freeze(taskOutcome) } : {},
+    ...memoryAfter ? { memoryAfter: Object.freeze(memoryAfter) } : {}
+  });
+}
+async function persistTaskCapture(executionId, expected, capture, outputArtifacts, signal) {
+  if (capture.kind === "output") {
+    if (expected.kind !== "output")
+      throw new Error("captured output does not match the signed task");
+    const artifact = await persistCandidateOutputArtifact(outputArtifacts, {
+      executionId,
+      purpose: "task-output",
+      bytes: capture.bytes,
+      signal
+    });
+    return {
+      kind: "output",
+      spec: { mediaType: expected.mediaType, maxBytes: expected.maxBytes },
+      artifact
+    };
+  }
+  if (expected.kind !== "workspace") {
+    throw new Error("captured workspace does not match the signed task");
+  }
+  const workspace = await persistWorkspaceCapture(
+    executionId,
+    "task-manifest",
+    "task-archive",
+    capture.afterState,
+    capture.archive,
+    outputArtifacts,
+    signal
+  );
+  const gitDiff = await persistCandidateOutputArtifact(outputArtifacts, {
+    executionId,
+    purpose: "task-patch",
+    bytes: capture.gitDiff,
+    signal
+  });
+  return { kind: "workspace", resultTree: capture.resultTree, ...workspace, gitDiff };
+}
+async function persistWorkspaceCapture(executionId, manifestPurpose, archivePurpose, afterState, archiveBytes, outputArtifacts, signal) {
+  const manifestBytes = canonicalCandidateBytes(afterState);
+  const [manifest, archive] = await Promise.all([
+    persistCandidateOutputArtifact(outputArtifacts, {
+      executionId,
+      purpose: manifestPurpose,
+      bytes: manifestBytes,
+      signal
+    }),
+    persistCandidateOutputArtifact(outputArtifacts, {
+      executionId,
+      purpose: archivePurpose,
+      bytes: archiveBytes,
+      signal
+    })
+  ]);
+  return { afterState, manifest, archive };
+}
+
 // src/candidate-execution/outcome-evidence.ts
 async function persistCandidateModelSettlement(state, settlement, outputArtifacts) {
   return await persistCandidateModelSettlementEvidence(
@@ -3300,7 +3578,6 @@ async function persistCandidateModelSettlement(state, settlement, outputArtifact
 }
 async function persistCandidateModelSettlementEvidence(identity, settlement, outputArtifacts) {
   const material = {
-    schemaVersion: 2,
     kind: "agent-candidate-model-settlement-material",
     executionPlanDigest: identity.executionPlanDigest,
     preparationId: settlement.value.preparationId,
@@ -3321,7 +3598,7 @@ async function persistCandidateModelSettlementEvidence(identity, settlement, out
       reasoningTokens: call.reasoningTokens ?? 0,
       costUsdNanos: call.costUsdNanos
     })),
-    usage: settlement.fixedUsage
+    usage: settlement.usage
   };
   const bytes = canonicalCandidateBytes(material);
   const digest = sha256Bytes(bytes);
@@ -3332,7 +3609,6 @@ async function persistCandidateModelSettlementEvidence(identity, settlement, out
   });
   return immutableCandidateValue(
     agentCandidateModelSettlementEvidenceSchema.parse({
-      schemaVersion: 2,
       kind: "agent-candidate-model-settlement",
       digest,
       material,
@@ -3340,16 +3616,53 @@ async function persistCandidateModelSettlementEvidence(identity, settlement, out
     })
   );
 }
-async function persistVerifiedCandidateTaskOutcome(state, capture, outputArtifacts, protectedValues, signal) {
+async function persistVerifiedAgentCandidateExecutorCapture(state, capture, outputArtifacts, protectedValues, signal) {
   signal?.throwIfAborted();
+  const taskCapture = capture.taskOutcome;
+  if (!taskCapture) throw new Error("candidate final capture is missing the task outcome");
+  if (capture.evidence) assertNoProtectedBytes(capture.evidence, protectedValues);
+  const expected = state.benchmarkTask.outcome;
+  if (taskCapture.kind !== expected.kind) {
+    throw new Error(
+      `candidate captured ${taskCapture.kind} outcome does not match expected ${expected.kind} outcome`
+    );
+  }
+  const verified = taskCapture.kind === "output" && expected.kind === "output" ? verifyOutputTaskCapture(taskCapture.bytes, expected, protectedValues) : taskCapture.kind === "workspace" && expected.kind === "workspace" ? await verifyWorkspaceTaskCapture(state, taskCapture, protectedValues, signal) : void 0;
+  if (!verified) throw new Error("candidate task outcome kind could not be narrowed");
+  await verifyMemoryCapture(state, capture, protectedValues, signal);
+  const persistedCapture = await persistAgentCandidateExecutorCapture(
+    {
+      executionId: state.executionId,
+      executionPlanDigest: state.executionPlan.value.digest
+    },
+    expected,
+    capture,
+    outputArtifacts,
+    signal
+  );
+  const persisted = persistedCapture.taskOutcome;
+  if (!persisted || persisted.kind !== verified.kind) {
+    throw new Error("persisted task capture kind changed");
+  }
+  const taskOutcome = verified.kind === "output" && persisted.kind === "output" ? await persistVerifiedOutputTaskOutcome(state, verified, persisted, outputArtifacts, signal) : verified.kind === "workspace" && persisted.kind === "workspace" ? await persistVerifiedWorkspaceTaskOutcome(
+    state,
+    verified,
+    persisted,
+    outputArtifacts,
+    signal
+  ) : void 0;
+  if (!taskOutcome) throw new Error("persisted task outcome kind could not be narrowed");
+  return Object.freeze({ persistedCapture, taskOutcome });
+}
+async function verifyWorkspaceTaskCapture(state, capture, protectedValues, signal) {
+  const repository = state.benchmarkTask.repository;
+  if (!repository) throw new Error("workspace task outcome is missing repository identity");
   const patch = Uint8Array.from(capture.gitDiff);
   const archive = Uint8Array.from(capture.archive);
   if (archive.byteLength === 0) throw new Error("candidate task archive cannot be empty");
   assertNoProtectedBytes(patch, protectedValues);
   assertNoProtectedBytes(archive, protectedValues);
-  const provisional = provisionalCandidateWorkspaceSnapshot(capture.afterState, archive);
-  const afterState = provisional.material;
-  const repository = workspaceTaskRepository(state.executionPlan.value.material.task);
+  const afterState = immutableCandidateValue(capture.afterState);
   const verified = await verifyTaskOutcomePatch({
     repositoryRoot: state.roots.staging.taskRoot,
     baseCommit: repository.baseCommit,
@@ -3359,24 +3672,38 @@ async function persistVerifiedCandidateTaskOutcome(state, capture, outputArtifac
     afterState
   });
   signal?.throwIfAborted();
-  assertNoProtectedBytes(provisional.manifestBytes, protectedValues);
-  await verifyTaskOutcomeArchive(state, provisional.snapshot, archive, protectedValues);
-  signal?.throwIfAborted();
-  const snapshot = await persistCandidateWorkspaceSnapshot(outputArtifacts, {
-    executionId: state.executionId,
+  const manifestBytes = canonicalCandidateBytes(afterState);
+  assertNoProtectedBytes(manifestBytes, protectedValues);
+  const provisionalSnapshot = agentCandidateWorkspaceSnapshotEvidenceSchema2.parse({
+    kind: "agent-candidate-workspace-snapshot",
+    digest: sha256Bytes(manifestBytes),
     material: afterState,
-    archive,
-    purpose: "task",
-    signal
+    manifest: embeddedCandidateArtifact(manifestBytes),
+    archive: embeddedCandidateArtifact(archive)
   });
-  const gitDiff = await persistCandidateOutputArtifact(outputArtifacts, {
-    executionId: state.executionId,
-    purpose: "task-patch",
-    bytes: patch,
-    signal
+  await verifyTaskOutcomeArchive(state, provisionalSnapshot, archive, protectedValues);
+  signal?.throwIfAborted();
+  return {
+    kind: "workspace",
+    patch,
+    archive,
+    afterState,
+    manifestBytes,
+    resultCommit: verified.resultCommit,
+    resultTree: verified.resultTree,
+    repository
+  };
+}
+async function persistVerifiedWorkspaceTaskOutcome(state, verified, persisted, outputArtifacts, signal) {
+  const { afterState, manifestBytes, patch, repository } = verified;
+  const snapshot = agentCandidateWorkspaceSnapshotEvidenceSchema2.parse({
+    kind: "agent-candidate-workspace-snapshot",
+    digest: sha256Bytes(manifestBytes),
+    material: afterState,
+    manifest: persisted.manifest,
+    archive: persisted.archive
   });
   const material = {
-    schemaVersion: 2,
     kind: "agent-candidate-task-outcome-material",
     executionPlanDigest: state.executionPlan.value.digest,
     outcome: {
@@ -3396,10 +3723,60 @@ async function persistVerifiedCandidateTaskOutcome(state, capture, outputArtifac
       afterState: snapshot,
       gitDiff: {
         format: "git-diff-binary",
-        artifact: gitDiff
+        artifact: persisted.gitDiff
       }
     }
   };
+  const evidence = await persistTaskOutcomeEvidence(state, material, outputArtifacts, signal);
+  const storedPatch = Uint8Array.from(patch);
+  return Object.freeze({
+    kind: "workspace",
+    evidence,
+    get patch() {
+      return Uint8Array.from(storedPatch);
+    },
+    [verifiedTaskOutcomeBrand]: true
+  });
+}
+function verifyOutputTaskCapture(capturedBytes, expected, protectedValues) {
+  if (capturedBytes.byteLength === 0) throw new Error("candidate task output cannot be empty");
+  if (capturedBytes.byteLength > expected.maxBytes) {
+    throw new Error(`candidate task output exceeds the frozen ${expected.maxBytes}-byte maximum`);
+  }
+  const output = Uint8Array.from(capturedBytes);
+  assertNoProtectedBytes(output, protectedValues);
+  return {
+    kind: "output",
+    bytes: output,
+    spec: { mediaType: expected.mediaType, maxBytes: expected.maxBytes }
+  };
+}
+async function persistVerifiedOutputTaskOutcome(state, verified, persisted, outputArtifacts, signal) {
+  if (persisted.spec.mediaType !== verified.spec.mediaType || persisted.spec.maxBytes !== verified.spec.maxBytes) {
+    throw new Error("persisted task output changed the signed media constraints");
+  }
+  const material = {
+    kind: "agent-candidate-task-outcome-material",
+    executionPlanDigest: state.executionPlan.value.digest,
+    outcome: {
+      kind: "output",
+      spec: verified.spec,
+      artifact: persisted.artifact
+    }
+  };
+  const evidence = await persistTaskOutcomeEvidence(state, material, outputArtifacts, signal);
+  const storedOutput = Uint8Array.from(verified.bytes);
+  return Object.freeze({
+    kind: "output",
+    evidence,
+    spec: immutableCandidateValue(verified.spec),
+    get bytes() {
+      return Uint8Array.from(storedOutput);
+    },
+    [verifiedTaskOutcomeBrand]: true
+  });
+}
+async function persistTaskOutcomeEvidence(state, material, outputArtifacts, signal) {
   const bytes = canonicalCandidateBytes(material);
   const digest = sha256Bytes(bytes);
   const artifact = await persistCandidateOutputArtifact(outputArtifacts, {
@@ -3408,23 +3785,14 @@ async function persistVerifiedCandidateTaskOutcome(state, capture, outputArtifac
     bytes,
     signal
   });
-  const evidence = immutableCandidateValue(
+  return immutableCandidateValue(
     agentCandidateTaskOutcomeEvidenceSchema.parse({
-      schemaVersion: 2,
       kind: "agent-candidate-task-outcome",
       digest,
       material,
       artifact
     })
   );
-  const storedPatch = Uint8Array.from(patch);
-  return Object.freeze({
-    evidence,
-    get patch() {
-      return Uint8Array.from(storedPatch);
-    },
-    [verifiedTaskOutcomeBrand]: true
-  });
 }
 async function persistCandidateBenchmarkResult(state, termination, outcome, grader, outputArtifacts, protectedValues, signal) {
   signal?.throwIfAborted();
@@ -3433,6 +3801,7 @@ async function persistCandidateBenchmarkResult(state, termination, outcome, grad
     executionId: state.executionId,
     termination: frozenTermination,
     outcome,
+    expectedGrader: state.benchmarkTask.grader,
     grader,
     artifacts: outputArtifacts,
     signal
@@ -3448,24 +3817,13 @@ async function persistCandidateBenchmarkResult(state, termination, outcome, grad
     bytes: rawEvidence,
     signal
   });
-  const task = state.executionPlan.value.material.task;
   const material = {
-    schemaVersion: 1,
     kind: "agent-candidate-benchmark-result-material",
     executionPlanDigest: state.executionPlan.value.digest,
     taskOutcomeDigest: outcome.evidence.digest,
-    benchmark: {
-      name: task.benchmark,
-      version: task.benchmarkVersion,
-      taskId: task.taskId,
-      splitDigest: task.splitDigest
-    },
-    grader: {
-      name: graded.grader.name,
-      version: graded.grader.version,
-      artifact: graded.grader.artifact
-    },
+    grader: graded.grader,
     evidence: evidenceRef,
+    grading: graded.grading,
     score: evaluation.score,
     passed: evaluation.passed,
     dimensions: evaluation.dimensions
@@ -3480,7 +3838,6 @@ async function persistCandidateBenchmarkResult(state, termination, outcome, grad
   });
   return immutableCandidateValue(
     agentCandidateBenchmarkResultEvidenceSchema.parse({
-      schemaVersion: 1,
       kind: "agent-candidate-benchmark-result",
       digest,
       material,
@@ -3489,7 +3846,7 @@ async function persistCandidateBenchmarkResult(state, termination, outcome, grad
   );
 }
 async function verifyTaskOutcomeArchive(state, snapshot, archive, protectedValues) {
-  const root = await mkdtemp3(join3(tmpdir3(), "agent-candidate-task-archive-"));
+  const root = await mkdtemp2(join2(tmpdir2(), "agent-candidate-task-archive-"));
   try {
     await state.ports.workspaces.materialize({
       role: "task",
@@ -3500,7 +3857,40 @@ async function verifyTaskOutcomeArchive(state, snapshot, archive, protectedValue
     const files = await readMaterializedWorkspaceFiles(root, snapshot.material);
     for (const file of files) assertNoProtectedBytes(file.bytes, protectedValues);
   } finally {
-    await rm3(root, { recursive: true, force: true });
+    await rm2(root, { recursive: true, force: true });
+  }
+}
+async function verifyMemoryCapture(state, capture, protectedValues, signal) {
+  if (state.memory.mode === "disabled") {
+    if (capture.memoryAfter) throw new Error("disabled memory cannot return an after-state");
+    return;
+  }
+  const memory = capture.memoryAfter;
+  if (!memory) throw new Error("isolated memory is missing its protected after-state");
+  if (memory.archive.byteLength === 0) throw new Error("isolated memory archive cannot be empty");
+  const manifestBytes = canonicalCandidateBytes(memory.afterState);
+  assertNoProtectedBytes(manifestBytes, protectedValues);
+  assertNoProtectedBytes(memory.archive, protectedValues);
+  const snapshot = agentCandidateWorkspaceSnapshotEvidenceSchema2.parse({
+    kind: "agent-candidate-workspace-snapshot",
+    digest: sha256Bytes(manifestBytes),
+    material: memory.afterState,
+    manifest: embeddedCandidateArtifact(manifestBytes),
+    archive: embeddedCandidateArtifact(memory.archive)
+  });
+  const root = await mkdtemp2(join2(tmpdir2(), "agent-candidate-memory-after-"));
+  try {
+    await state.ports.workspaces.materialize({
+      role: "memory",
+      snapshot,
+      archive: Uint8Array.from(memory.archive),
+      destination: root
+    });
+    const files = await readMaterializedWorkspaceFiles(root, memory.afterState);
+    for (const file of files) assertNoProtectedBytes(file.bytes, protectedValues);
+    signal?.throwIfAborted();
+  } finally {
+    await rm2(root, { recursive: true, force: true });
   }
 }
 function normalizeEvaluation(evaluation, termination) {
@@ -3532,81 +3922,60 @@ function assertUnitScore(value, label) {
 }
 
 // src/candidate-execution/protected-trace-store.ts
-import { REDACTION_VERSION as REDACTION_VERSION3 } from "@tangle-network/agent-eval";
-var ProtectedAgentCandidateTraceStore = class {
-  constructor(inner, protectedValues) {
-    this.inner = inner;
-    this.protectedValues = protectedValues;
-  }
-  inner;
-  protectedValues;
-  aggregate = {
-    version: REDACTION_VERSION3,
-    redactionCount: 0,
-    byRule: {}
-  };
-  report() {
-    return {
-      version: this.aggregate.version,
-      redactionCount: this.aggregate.redactionCount,
-      byRule: { ...this.aggregate.byRule }
-    };
-  }
-  async appendRun(run) {
-    await this.inner.appendRun(this.redact(run));
-  }
-  async updateRun(runId, patch) {
-    await this.inner.updateRun(this.redact(runId), this.redact(patch));
-  }
-  async appendSpan(span) {
-    if (span.kind === "llm") {
-      throw new Error("candidate executors cannot author protected model spans");
+function createProtectedAgentCandidateTraceAccess(inner, protectedValues) {
+  const redactor = createProtectedRecordRedactor(protectedValues);
+  const pendingWrites = /* @__PURE__ */ new Set();
+  let acceptsWrites = true;
+  const write = (operation) => {
+    if (!acceptsWrites) {
+      return Promise.reject(new Error("candidate trace writes are closed"));
     }
-    await this.inner.appendSpan(this.redact(span));
-  }
-  async updateSpan(spanId, patch) {
-    if (patch.kind === "llm") {
-      throw new Error("candidate executors cannot author protected model spans");
-    }
-    await this.inner.updateSpan(this.redact(spanId), this.redact(patch));
-  }
-  async appendEvent(event) {
-    await this.inner.appendEvent(this.redact(event));
-  }
-  async appendArtifact(artifact) {
-    await this.inner.appendArtifact(this.redact(artifact));
-  }
-  async appendBudgetEntry(entry) {
-    await this.inner.appendBudgetEntry(this.redact(entry));
-  }
-  getRun(...args) {
-    return this.inner.getRun(...args);
-  }
-  listRuns(...args) {
-    return this.inner.listRuns(...args);
-  }
-  spans(...args) {
-    return this.inner.spans(...args);
-  }
-  events(...args) {
-    return this.inner.events(...args);
-  }
-  budget(...args) {
-    return this.inner.budget(...args);
-  }
-  artifacts(...args) {
-    return this.inner.artifacts(...args);
-  }
-  redact(value) {
-    const redacted = redactProtectedValue(value, this.protectedValues);
-    this.aggregate.version = redacted.report.version;
-    this.aggregate.redactionCount += redacted.report.redactionCount;
-    for (const [rule, count] of Object.entries(redacted.report.byRule)) {
-      this.aggregate.byRule[rule] = (this.aggregate.byRule[rule] ?? 0) + count;
+    let started;
+    try {
+      started = operation();
+    } catch (error) {
+      return Promise.reject(error);
     }
-    return redacted.value;
-  }
-};
+    let tracked;
+    tracked = started.finally(() => pendingWrites.delete(tracked));
+    pendingWrites.add(tracked);
+    return tracked;
+  };
+  const store = Object.freeze({
+    appendRun: (run) => write(() => inner.appendRun(redactor.record(run))),
+    updateRun: (runId, patch) => write(() => inner.updateRun(redactor.identifier(runId), redactor.record(patch))),
+    appendSpan: (span) => write(async () => {
+      if (span.kind === "llm") {
+        throw new Error("candidate executors cannot author protected model spans");
+      }
+      await inner.appendSpan(redactor.record(span));
+    }),
+    updateSpan: (spanId, patch) => write(async () => {
+      if (patch.kind === "llm") {
+        throw new Error("candidate executors cannot author protected model spans");
+      }
+      await inner.updateSpan(redactor.identifier(spanId), redactor.record(patch));
+    }),
+    appendEvent: (event) => write(() => inner.appendEvent(redactor.record(event))),
+    appendArtifact: (artifact) => write(() => inner.appendArtifact(redactor.record(artifact))),
+    appendBudgetEntry: (entry) => write(() => inner.appendBudgetEntry(redactor.record(entry))),
+    getRun: async (runId) => inner.getRun(redactor.identifier(runId)),
+    listRuns: async (filter) => inner.listRuns(filter ? redactor.query(filter) : void 0),
+    spans: async (filter) => inner.spans(filter ? redactor.query(filter) : void 0),
+    events: async (filter) => inner.events(filter ? redactor.query(filter) : void 0),
+    budget: async (runId) => inner.budget(redactor.identifier(runId)),
+    artifacts: async (runId) => inner.artifacts(redactor.identifier(runId))
+  });
+  return Object.freeze({
+    store,
+    closeWrites: async () => {
+      acceptsWrites = false;
+      await Promise.all([...pendingWrites]);
+    },
+    identity: (trace) => redactor.traceIdentity(trace),
+    report: () => redactor.report()
+  });
+}
 var RecoveryAgentCandidateTraceStore = class {
   constructor(inner) {
     this.inner = inner;
@@ -3683,9 +4052,29 @@ async function executePreparedAgentCandidate(prepared, options) {
   } catch (error) {
     return await failBeforeActivation(prepared, state, error, "failed", cleanupTimeoutMs);
   }
+  let preparationEvidence;
+  try {
+    const [executionPlan, materializationReceipt] = await Promise.all([
+      persistCandidateOutputArtifact(options.outputArtifacts, {
+        executionId: state.executionId,
+        purpose: "execution-plan",
+        bytes: state.executionPlan.bytes
+      }),
+      persistCandidateOutputArtifact(options.outputArtifacts, {
+        executionId: state.executionId,
+        purpose: "materialization-receipt",
+        bytes: state.materializationReceipt.bytes
+      })
+    ]);
+    preparationEvidence = Object.freeze({ executionPlan, materializationReceipt });
+  } catch (error) {
+    return await failBeforeActivation(prepared, state, error, "failed", cleanupTimeoutMs);
+  }
   let acquired;
   try {
-    acquired = await options.claimStore.tryClaim(candidateExecutionClaim(prepared));
+    acquired = await options.claimStore.tryClaim(
+      candidateExecutionClaim(prepared, preparationEvidence)
+    );
   } catch (error) {
     return await failBeforeActivation(prepared, state, error, "failed", cleanupTimeoutMs);
   }
@@ -3830,25 +4219,36 @@ async function executePreparedAgentCandidate(prepared, options) {
     );
   }
   const protectedValues = protectedEnvironmentValues(activation, memoryActivation);
-  const protectedTraceStore = new ProtectedAgentCandidateTraceStore(
+  const protectedTrace = createProtectedAgentCandidateTraceAccess(
     options.traceStore,
     protectedValues
   );
+  const persistedTrace = protectedTrace.identity(state.trace);
   const execution = await runAndStopExecutor(
     options.executor,
     request,
-    protectedTraceStore,
+    state.benchmarkTask.outcome,
+    protectedTrace.store,
     deadlineAtMs,
     cleanupTimeoutMs
   );
   beginPreparedCandidateSettlement(prepared);
   const cleanupDeadlineAtMs = candidateCleanupDeadline(cleanupTimeoutMs);
   const accessReason = execution.kind === "timeout" || execution.termination?.kind === "timeout" ? "timeout" : execution.kind === "capture" ? "completed" : "failed";
-  const [memoryClose, settlementResult] = await Promise.all([
+  const traceClosure = withinCandidateCleanupDeadline(
+    () => protectedTrace.closeWrites(),
+    cleanupDeadlineAtMs,
+    "candidate trace write closure"
+  ).then(
+    () => ({ closed: true, error: void 0 }),
+    (error) => ({ closed: false, error })
+  );
+  const [traceClose, memoryClose, settlementResult] = await Promise.all([
+    traceClosure,
     closeMemoryAccess(state, accessReason, cleanupDeadlineAtMs),
     settleModelGrant(state, accessReason, cleanupDeadlineAtMs)
   ]);
-  if (!execution.processStopped || !settlementResult.settlement || !memoryClose.closed) {
+  if (!execution.processStopped || !traceClose.closed || !settlementResult.settlement || !memoryClose.closed) {
     consumePreparedCandidateExecution(prepared, "failed");
     return failedAgentCandidateRun(
       state,
@@ -3856,6 +4256,7 @@ async function executePreparedAgentCandidate(prepared, options) {
         joinErrors(
           execution.error,
           !execution.processStopped ? new Error("candidate process termination is not proven") : void 0,
+          traceClose.error,
           memoryClose.error,
           settlementResult.error ?? (!settlementResult.settlement ? new Error("model settlement failed") : void 0),
           new Error("candidate claim remains recoverable until protected cleanup is proven")
@@ -3922,12 +4323,12 @@ async function executePreparedAgentCandidate(prepared, options) {
         async (signal) => {
           await appendAuthoritativeModelSettlementSpans(
             options.traceStore,
-            state.trace.runId,
+            persistedTrace.runId,
             settlementResult.settlement
           );
-          const taskOutcome = await persistVerifiedCandidateTaskOutcome(
+          const { persistedCapture, taskOutcome } = await persistVerifiedAgentCandidateExecutorCapture(
             state,
-            execution.finalCapture.taskOutcome,
+            execution.finalCapture,
             options.outputArtifacts,
             protectedValues,
             signal
@@ -3945,16 +4346,18 @@ async function executePreparedAgentCandidate(prepared, options) {
             state,
             capture,
             options.traceStore,
+            persistedTrace,
             settlementResult.settlement,
             {
               finalCapture: execution.finalCapture,
+              persistedCapture,
               modelSettlement,
               taskOutcome,
               benchmarkResult,
               outputArtifacts: options.outputArtifacts
             },
             protectedValues,
-            protectedTraceStore.report(),
+            protectedTrace.report(),
             signal
           );
         },
@@ -3973,18 +4376,16 @@ async function executePreparedAgentCandidate(prepared, options) {
   let terminal;
   try {
     terminal = result.succeeded ? {
-      schemaVersion: 1,
       status: "succeeded",
-      usage: settlementResult.settlement.fixedUsage,
+      usage: settlementResult.settlement.usage,
       modelSettlement: result.artifacts.modelSettlement,
       taskOutcome: result.artifacts.taskOutcome,
       benchmarkResult: result.artifacts.benchmarkResult,
       runReceipt: result.artifacts.runReceipt
     } : {
-      schemaVersion: 1,
       status: "failed",
       failureClass,
-      usage: settlementResult.settlement.fixedUsage,
+      usage: settlementResult.settlement.usage,
       modelSettlement: modelSettlement.artifact,
       failureEvidence: await withinCandidateCleanupDeadline(
         () => persistFailureEvidence(
@@ -4031,7 +4432,7 @@ async function executePreparedAgentCandidate(prepared, options) {
     settlementResult.settlement.usage
   );
 }
-async function runAndStopExecutor(executor, request, traceStore, deadlineAtMs, cleanupTimeoutMs) {
+async function runAndStopExecutor(executor, request, expectedOutcome, traceStore, deadlineAtMs, cleanupTimeoutMs) {
   const timeoutMs = request.hardLimits.timeoutMs;
   const timeoutError = new CandidateExecutionDeadlineError(timeoutMs);
   if (Date.now() >= deadlineAtMs) {
@@ -4086,10 +4487,10 @@ async function runAndStopExecutor(executor, request, traceStore, deadlineAtMs, c
   }
   if (!capture || timedOut) controller.abort(executionError);
   const stopReason = timedOut ? "timeout" : capture ? "completed" : "failed";
-  let stopped;
+  const cleanupDeadlineAtMs = Date.now() + cleanupTimeoutMs;
   try {
-    stopped = await withinCandidateCleanupDeadline(
-      () => executor.stopAndCapture(
+    const stopped = await withinCandidateCleanupDeadline(
+      (cleanupSignal) => executor.stop(
         {
           executionId: request.executionId,
           executionPlanDigest: request.executionPlan.value.digest
@@ -4097,35 +4498,65 @@ async function runAndStopExecutor(executor, request, traceStore, deadlineAtMs, c
         {
           traceStore,
           reason: stopReason,
-          signal: controller.signal,
-          deadlineAtMs
+          signal: cleanupSignal,
+          deadlineAtMs: cleanupDeadlineAtMs
         }
       ),
-      Date.now() + cleanupTimeoutMs,
+      cleanupDeadlineAtMs,
       "candidate process termination"
     );
-    if (!stopped || typeof stopped !== "object" || stopped.stopped !== true) {
-      throw new Error("candidate executor did not acknowledge exact process termination");
-    }
+    sealAgentCandidateExecutorStopAcknowledgement(stopped);
   } catch (stopError) {
+    let disposalError2;
+    try {
+      await disposeExecutor(executor, request, cleanupDeadlineAtMs);
+    } catch (error) {
+      disposalError2 = error;
+    }
     if (timer) clearTimeout(timer);
     controller.abort(stopError);
     return {
       kind: "error",
-      error: new Error(joinErrors(executionError, stopError)),
+      error: new Error(joinErrors(executionError, stopError, disposalError2)),
       ...timedOut ? { termination: { kind: "timeout", timeoutMs } } : {},
       processStopped: false
     };
   }
   let finalCapture;
+  let finalCaptureError;
   try {
-    finalCapture = sealAgentCandidateExecutorFinalCapture(stopped);
+    finalCapture = sealAgentCandidateExecutorFinalCapture(
+      await withinCandidateCleanupDeadline(
+        (cleanupSignal) => executor.capture(
+          {
+            executionId: request.executionId,
+            executionPlanDigest: request.executionPlan.value.digest
+          },
+          {
+            traceStore,
+            signal: cleanupSignal
+          }
+        ),
+        cleanupDeadlineAtMs,
+        "candidate final evidence capture"
+      ),
+      expectedOutcome
+    );
   } catch (captureError) {
+    finalCaptureError = captureError;
+  }
+  let disposalError;
+  try {
+    await disposeExecutor(executor, request, cleanupDeadlineAtMs);
+  } catch (disposeError) {
+    disposalError = disposeError;
+  }
+  if (finalCaptureError || disposalError || !finalCapture) {
     if (timer) clearTimeout(timer);
-    controller.abort(captureError);
+    controller.abort(finalCaptureError ?? disposalError);
     return {
       kind: "error",
-      error: new Error(joinErrors(executionError, captureError)),
+      error: new Error(joinErrors(executionError, finalCaptureError, disposalError)),
       ...timedOut ? { termination: { kind: "timeout", timeoutMs } } : {},
       processStopped: true
     };
@@ -4161,6 +4592,25 @@ async function runAndStopExecutor(executor, request, traceStore, deadlineAtMs, c
     processStopped: true
   };
 }
+async function disposeExecutor(executor, request, cleanupDeadlineAtMs) {
+  const dispose = executor.dispose;
+  if (!dispose) return;
+  const disposed = await withinCandidateCleanupDeadline(
+    (cleanupSignal) => dispose.call(
+      executor,
+      {
+        executionId: request.executionId,
+        executionPlanDigest: request.executionPlan.value.digest
+      },
+      { signal: cleanupSignal }
+    ),
+    cleanupDeadlineAtMs,
+    "candidate execution resource disposal"
+  );
+  if (!disposed || disposed.disposed !== true || Object.keys(disposed).some((key) => key !== "disposed")) {
+    throw new Error("candidate executor did not acknowledge resource disposal");
+  }
+}
 async function failBeforeActivation(prepared, state, error, reason, cleanupTimeoutMs) {
   beginPreparedCandidateSettlement(prepared);
   const cleanupDeadlineAtMs = candidateCleanupDeadline(cleanupTimeoutMs);
@@ -4215,10 +4665,9 @@ async function failClaimedExecution(prepared, state, lease, claimStore, outputAr
         claimStore,
         lease,
         {
-          schemaVersion: 1,
           status: "failed",
           failureClass,
-          usage: settled.settlement.fixedUsage,
+          usage: settled.settlement.usage,
           modelSettlement: modelSettlement.artifact,
           failureEvidence
         },
@@ -4315,7 +4764,6 @@ async function finishClaim(store, lease, terminal, deadlineAtMs) {
 }
 async function persistFailureEvidence(state, reason, failureClass, termination, outputArtifacts) {
   const bytes = canonicalCandidateBytes({
-    schemaVersion: 1,
     kind: "agent-candidate-execution-failure",
     executionId: state.executionId,
     bundleDigest: state.bundle.digest,
@@ -4347,10 +4795,24 @@ var CandidateExecutionDeadlineError = class extends Error {
 };
 
 // src/candidate-execution/verify.ts
-import { agentCandidateBundleSchema as agentCandidateBundleSchema2 } from "@tangle-network/agent-interface";
+import { agentCandidateBundleSchema } from "@tangle-network/agent-interface";
 var verifiedCandidateState = /* @__PURE__ */ new WeakMap();
+var AGENT_CANDIDATE_EXECUTION_SUPPORT = Object.freeze({
+  outcomes: Object.freeze(["workspace", "output"]),
+  code: Object.freeze(["disabled", "no-op", "git-patch"]),
+  memory: Object.freeze(["disabled", "isolated"]),
+  knowledge: true,
+  profile: Object.freeze({
+    mcpTransports: Object.freeze(["stdio"]),
+    remoteMcp: false,
+    tools: false,
+    permissions: false,
+    modes: false,
+    confidential: false
+  })
+});
 async function verifyAgentCandidateBundle(input, ports) {
-  const parsed = agentCandidateBundleSchema2.parse(input);
+  const parsed = agentCandidateBundleSchema.parse(input);
   const withoutDigest = omitTopLevelDigest(parsed);
   const actualDigest = canonicalCandidateDigest(withoutDigest);
   if (actualDigest !== parsed.digest) {
@@ -4358,6 +4820,7 @@ async function verifyAgentCandidateBundle(input, ports) {
   }
   const canonicalBytes = canonicalCandidateBytes(withoutDigest);
   verifyBytes(canonicalBytes, parsed.digest, canonicalBytes.byteLength, "candidate bundle");
+  assertCandidateProfileExecutionSupport(parsed.profile);
   const artifactBytes = /* @__PURE__ */ new Map();
   const readArtifact = async (artifact) => {
     const key = artifactCacheKey(artifact);
@@ -4454,35 +4917,29 @@ function resourceKey(resource) {
   return canonicalCandidateDigest(resource);
 }
 
-// src/candidate-execution/prepare.ts
-import { randomBytes as randomBytes2 } from "crypto";
-import { lstat as lstat2, readdir as readdir2 } from "fs/promises";
-import { isAbsolute, posix, relative as relative2, resolve as resolveHostPath } from "path";
-import {
-  agentCandidateContainerSchema,
-  agentCandidateExecutionLimitsSchema,
-  agentCandidateExecutionPlanEvidenceSchema as agentCandidateExecutionPlanEvidenceSchema2,
-  agentCandidateExecutionPlanMaterialSchema,
-  agentCandidateMaterializationReceiptSchema as agentCandidateMaterializationReceiptSchema2,
-  agentCandidateModelAccessNetworkSchema,
-  agentCandidateWorkspaceSnapshotEvidenceSchema as agentCandidateWorkspaceSnapshotEvidenceSchema2,
-  sha256DigestSchema
-} from "@tangle-network/agent-interface";
-import {
-  applyAgentCandidateWorkspacePlan,
-  materializeCandidateProfile
-} from "@tangle-network/agent-profile-materialize";
-
 // src/candidate-execution/knowledge.ts
-import { mkdtemp as mkdtemp4, rm as rm4 } from "fs/promises";
-import { tmpdir as tmpdir4 } from "os";
-import { join as join4 } from "path";
-async function prepareAgentCandidateKnowledge(candidate, ports) {
+import { mkdtemp as mkdtemp3, rm as rm3 } from "fs/promises";
+import { tmpdir as tmpdir3 } from "os";
+import { join as join3, posix } from "path";
+import { hashKnowledgeBase } from "@tangle-network/agent-knowledge";
+var CANDIDATE_KNOWLEDGE_ROOT_ENV = "TANGLE_CANDIDATE_KNOWLEDGE_ROOT";
+var CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV = "TANGLE_CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG";
+function candidateKnowledgeExecutionPaths(taskRoot, hasRetrievalConfig) {
+  if (!posix.isAbsolute(taskRoot) || posix.normalize(taskRoot) !== taskRoot) {
+    throw new Error("candidate knowledge requires a normalized absolute task root");
+  }
+  const parent = posix.join(taskRoot, ".tangle");
+  return {
+    root: posix.join(parent, "knowledge"),
+    ...hasRetrievalConfig ? { retrievalConfig: posix.join(parent, "knowledge-retrieval-config.json") } : {}
+  };
+}
+async function prepareAgentCandidateKnowledge(candidate, ports, arm) {
   const knowledge = candidate.bundle.knowledge;
   if (!knowledge) return void 0;
   const archive = await verifiedArtifactBytes(candidate, knowledge.snapshot.archive);
   const retrievalConfig = knowledge.retrievalConfig ? await verifiedArtifactBytes(candidate, knowledge.retrievalConfig) : void 0;
-  const root = await mkdtemp4(join4(tmpdir4(), "agent-candidate-knowledge-"));
+  const root = await mkdtemp3(join3(tmpdir3(), "agent-candidate-knowledge-"));
   try {
     await ports.workspaces.materialize({
       role: "knowledge",
@@ -4490,6 +4947,13 @@ async function prepareAgentCandidateKnowledge(candidate, ports) {
       archive,
       destination: root
     });
+    const expectedHash = arm === "baseline" ? knowledge.candidate.baseHash : knowledge.candidate.candidateHash;
+    const actualHash = `sha256:${await hashKnowledgeBase(root)}`;
+    if (actualHash !== expectedHash) {
+      throw new Error(
+        `materialized ${arm} knowledge does not match its measured content: expected ${expectedHash}, got ${actualHash}`
+      );
+    }
     const files = await readMaterializedWorkspaceFiles(root, knowledge.snapshot.material);
     return Object.freeze({
       candidate: knowledge.candidate,
@@ -4502,25 +4966,32 @@ async function prepareAgentCandidateKnowledge(candidate, ports) {
       ...retrievalConfig ? { retrievalConfig: Uint8Array.from(retrievalConfig) } : {}
     });
   } finally {
-    await rm4(root, { recursive: true, force: true });
+    await rm3(root, { recursive: true, force: true });
   }
 }
 
 // src/candidate-execution/prepare.ts
-var MATERIALIZER_HARNESSES = /* @__PURE__ */ new Set([
-  "claude-code",
-  "claude",
-  "claudish",
-  "nanoclaw",
-  "codex",
-  "opencode",
-  "kimi-code",
-  "kimi",
-  "pi",
-  "gemini",
-  "hermes",
-  "openclaw"
-]);
+import { randomBytes as randomBytes3 } from "crypto";
+import { lstat as lstat2, readdir as readdir2 } from "fs/promises";
+import { isAbsolute, posix as posix2, relative as relative2, resolve as resolveHostPath } from "path";
+import {
+  agentCandidateBenchmarkSuiteSchema as agentCandidateBenchmarkSuiteSchema2,
+  agentCandidateBenchmarkTaskSchema as agentCandidateBenchmarkTaskSchema2,
+  agentCandidateContainerSchema,
+  agentCandidateExecutionLimitsSchema,
+  agentCandidateExecutionPlanEvidenceSchema as agentCandidateExecutionPlanEvidenceSchema2,
+  agentCandidateExecutionPlanMaterialSchema,
+  agentCandidateMaterializationReceiptSchema as agentCandidateMaterializationReceiptSchema2,
+  agentCandidateModelAccessNetworkSchema,
+  agentCandidateRunCellSchema,
+  agentCandidateTaskOutcomeSpecSchema,
+  agentCandidateWorkspaceSnapshotEvidenceSchema as agentCandidateWorkspaceSnapshotEvidenceSchema3,
+  sha256DigestSchema
+} from "@tangle-network/agent-interface";
+import {
+  applyAgentCandidateWorkspacePlan,
+  materializeCandidateProfile
+} from "@tangle-network/agent-profile-materialize";
 var MIN_RESERVATION_TTL_MS = 15 * 6e4;
 var PREPARED_HOLD_MARGIN_MS = 5 * 6e4;
 async function prepareAgentCandidateExecution(candidate, task, ports, options = {}) {
@@ -4528,12 +4999,23 @@ async function prepareAgentCandidateExecution(candidate, task, ports, options =
   const verifiedState = getVerifiedCandidateState(candidate);
   assertSameVerificationPorts(verifiedState.ports, ports);
   const bundle = candidate.bundle;
-  assertCandidateProfileExecutionSupport(bundle.profile);
-  const harness = materializerHarness(bundle.execution.harness);
+  if (task.runCell.bundleDigest !== bundle.digest) {
+    throw new Error("candidate experiment cell does not bind the verified bundle");
+  }
+  const benchmarkTask = task.task;
+  const attempt = {
+    number: task.runCell.attempt,
+    maxAttempts: benchmarkTask.attempt.maxAttempts,
+    retryPolicy: benchmarkTask.attempt.retryPolicy
+  };
+  const harness = candidateMaterializerHarness(bundle.execution.harness);
   assertTaskInput(task, bundle.execution.instructionDelivery);
-  const resultTimeoutMs = candidateResultTimeout(options.resultTimeoutMs, task.limits.timeoutMs);
+  const resultTimeoutMs = candidateResultTimeout(
+    options.resultTimeoutMs,
+    benchmarkTask.limits.timeoutMs
+  );
   const ownerWindowMs = candidateExecutionOwnerWindowMs(
-    task.limits.timeoutMs,
+    benchmarkTask.limits.timeoutMs,
     cleanupTimeoutMs,
     resultTimeoutMs
   );
@@ -4542,22 +5024,26 @@ async function prepareAgentCandidateExecution(candidate, task, ports, options =
     throw new Error("candidate reservation window exceeds the supported timer range");
   }
   assertDisjointHostStagingRoots(task);
-  const instructionBytes = Buffer.from(task.instruction, "utf8");
-  const instructionDigest = sha256Bytes(instructionBytes);
-  const taskArtifacts = await verifyWorkspaceSnapshotArtifacts(task.workspace, ports.artifacts);
+  const instructionBytes = Buffer.from(benchmarkTask.instruction, "utf8");
+  const taskArtifacts = await verifyWorkspaceSnapshotArtifacts(
+    benchmarkTask.workspace,
+    ports.artifacts
+  );
   await ports.workspaces.materialize({
     role: "task",
-    snapshot: task.workspace,
+    snapshot: benchmarkTask.workspace,
     archive: taskArtifacts.archive,
     destination: task.stagingRoots.taskRoot
   });
-  await verifyMaterializedWorkspace(task.stagingRoots.taskRoot, task.workspace.material, {
+  await verifyMaterializedWorkspace(task.stagingRoots.taskRoot, benchmarkTask.workspace.material, {
     ignoredProtectedRootEntries: [".git", ".sidecar"]
   });
-  await verifyTaskCheckout(task.stagingRoots.taskRoot, task.repository);
+  if (benchmarkTask.repository) {
+    await verifyTaskCheckout(task.stagingRoots.taskRoot, benchmarkTask.repository);
+  }
   const taskExecutorFiles = await readMaterializedWorkspaceFiles(
     task.stagingRoots.taskRoot,
-    task.workspace.material,
+    benchmarkTask.workspace.material,
     { ignoredProtectedRootEntries: [".git", ".sidecar"] }
   );
   let candidateArchive;
@@ -4595,30 +5081,33 @@ async function prepareAgentCandidateExecution(candidate, task, ports, options =
   );
   await verifyMaterializedProfileWorkspace(
     task.stagingRoots.profileRoot,
-    profileApplication.profilePlan.material
+    profileApplication.profileActivation.profilePlan.material
   );
   const profilePlanBytes = await readVerifiedArtifact(
-    profileApplication.profilePlan.artifact,
+    profileApplication.profileActivation.profilePlan.artifact,
     ports.artifacts
   );
   if (!Buffer.from(profilePlanBytes).equals(
-    Buffer.from(canonicalCandidateBytes(profileApplication.profilePlan.material))
+    Buffer.from(
+      canonicalCandidateBytes(profileApplication.profileActivation.profilePlan.material)
+    )
   )) {
     throw new Error("profile materializer did not capture exact canonical plan bytes");
   }
+  const profileActivation = profileApplication.profileActivation;
   const container = await resolveContainer(candidate, task, ports);
   const resolvedModel = await resolveModel(candidate, task, ports);
-  const preparationId = `candidate-preparation-v1.${randomBytes2(32).toString("base64url")}`;
+  const preparationId = `candidate-preparation.${randomBytes3(32).toString("base64url")}`;
   const reservationExpiresAtMs = Date.now() + Math.max(MIN_RESERVATION_TTL_MS, reservationWindowMs);
   const modelReservation = await withinCandidateCleanupDeadline(
     () => ports.models.reserveGrant({
       executionId: task.executionId,
       preparationId,
       expiresAtMs: reservationExpiresAtMs,
-      attempt: task.attempt,
+      attempt,
       bundleDigest: bundle.digest,
       resolved: resolvedModel,
-      limits: modelLimits2(task.limits)
+      limits: modelLimits2(benchmarkTask.limits)
     }),
     candidateCleanupDeadline(cleanupTimeoutMs),
     "protected model reservation"
@@ -4627,7 +5116,7 @@ async function prepareAgentCandidateExecution(candidate, task, ports, options =
   try {
     validateProtectedModelReservation(
       modelReservation,
-      task.limits,
+      benchmarkTask.limits,
       preparationId,
       reservationExpiresAtMs
     );
@@ -4640,7 +5129,11 @@ async function prepareAgentCandidateExecution(candidate, task, ports, options =
       cleanupTimeoutMs
     );
     const memory = preparedMemory.value;
-    const knowledge = await prepareAgentCandidateKnowledge(candidate, ports);
+    const knowledge = await prepareAgentCandidateKnowledge(candidate, ports, task.runCell.arm);
+    const knowledgePaths = knowledge ? candidateKnowledgeExecutionPaths(
+      task.executionRoots.taskRoot,
+      knowledge.retrievalConfig !== void 0
+    ) : void 0;
     const baseLaunch = buildLaunch(candidate, task, profileApplication.flags);
     const publicEnv = mergePublicEnvironment(
       bundle.execution.env ?? {},
@@ -4650,30 +5143,25 @@ async function prepareAgentCandidateExecution(candidate, task, ports, options =
           kind: "public",
           value: bundle.execution.instructionDelivery.path
         }
+      } : {},
+      knowledgePaths ? {
+        [CANDIDATE_KNOWLEDGE_ROOT_ENV]: {
+          kind: "public",
+          value: knowledgePaths.root
+        },
+        ...knowledgePaths.retrievalConfig ? {
+          [CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV]: {
+            kind: "public",
+            value: knowledgePaths.retrievalConfig
+          }
+        } : {}
       } : {}
     );
-    const routes = modelRoutes(bundle.profile, task.model.requested);
+    const routes = modelRoutes(bundle.profile, benchmarkTask.model.requested);
     const executionMaterial = {
-      schemaVersion: 2,
       kind: "agent-candidate-execution-plan-material",
-      bundleDigest: bundle.digest,
+      runCell: task.runCell,
       executionId: task.executionId,
-      attempt: task.attempt,
-      task: {
-        benchmark: task.benchmark,
-        benchmarkVersion: task.benchmarkVersion,
-        taskId: task.taskId,
-        splitDigest: task.splitDigest,
-        instruction: {
-          encoding: "utf8",
-          sha256: instructionDigest,
-          byteLength: instructionBytes.byteLength,
-          delivery: bundle.execution.instructionDelivery
-        },
-        repository: task.repository,
-        outcome: { kind: "workspace" },
-        workspace: task.workspace
-      },
       workspaces: {
         taskRoot: task.executionRoots.taskRoot,
         ...task.executionRoots.candidateRoot ? { candidateRoot: task.executionRoots.candidateRoot } : {}
@@ -4683,6 +5171,8 @@ async function prepareAgentCandidateExecution(candidate, task, ports, options =
       profile: profileApplication.application,
       harness: bundle.execution.harness,
       harnessVersion: bundle.execution.harnessVersion,
+      instructionDelivery: bundle.execution.instructionDelivery,
+      limits: benchmarkTask.limits,
       container,
       model: {
         policy: "single",
@@ -4694,7 +5184,6 @@ async function prepareAgentCandidateExecution(candidate, task, ports, options =
         },
         routes
       },
-      grader: task.grader,
       launch: {
         executable: baseLaunch.executable,
         args: baseLaunch.args,
@@ -4703,7 +5192,6 @@ async function prepareAgentCandidateExecution(candidate, task, ports, options =
       },
       ...bundle.knowledge ? { knowledgeManifestDigest: bundle.knowledge.snapshot.digest } : {},
       memory,
-      limits: task.limits,
       network: { mode: "disabled" }
     };
     agentCandidateExecutionPlanMaterialSchema.parse(executionMaterial);
@@ -4713,7 +5201,6 @@ async function prepareAgentCandidateExecution(candidate, task, ports, options =
       throw new Error("execution plan canonical serializers disagree");
     }
     const executionPlan = agentCandidateExecutionPlanEvidenceSchema2.parse({
-      schemaVersion: 2,
       kind: "agent-candidate-execution-plan",
       digest: executionDigest,
       material: executionMaterial,
@@ -4722,11 +5209,24 @@ async function prepareAgentCandidateExecution(candidate, task, ports, options =
     const entrypoint = candidateEntrypointReceipt(candidate);
     const materializationReceipt = canonicalCandidateDocument(
       {
-        schemaVersion: 2,
         kind: "agent-candidate-materialization",
         digestAlgorithm: "rfc8785-sha256",
         bundleDigest: bundle.digest,
-        profilePlan: profileApplication.profilePlan,
+        benchmark: {
+          suite: {
+            digest: task.benchmarkSuite.digest,
+            material: embeddedCandidateArtifact(
+              canonicalCandidateBytes(omitTopLevelDigest(task.benchmarkSuite))
+            )
+          },
+          task: {
+            digest: benchmarkTask.digest,
+            material: embeddedCandidateArtifact(
+              canonicalCandidateBytes(omitTopLevelDigest(benchmarkTask))
+            )
+          }
+        },
+        profileActivation,
         executionPlan,
         ...bundle.execution.workspace ? { candidateWorkspace: bundle.execution.workspace } : {},
         codeKind: bundle.code.kind,
@@ -4740,7 +5240,7 @@ async function prepareAgentCandidateExecution(candidate, task, ports, options =
       }
     );
     agentCandidateMaterializationReceiptSchema2.parse(materializationReceipt.value);
-    const traceRunId = `${task.executionId}:attempt-${task.attempt.number}:${canonicalCandidateDigest({ preparationId }).slice(7, 23)}`;
+    const traceRunId = `${task.executionId}:attempt-${attempt.number}:${canonicalCandidateDigest({ preparationId }).slice(7, 23)}`;
     const traceTags = {
       [CANDIDATE_TRACE_TAGS.executionId]: task.executionId,
       [CANDIDATE_TRACE_TAGS.bundleDigest]: bundle.digest,
@@ -4758,16 +5258,19 @@ async function prepareAgentCandidateExecution(candidate, task, ports, options =
     return createPreparedCandidateExecution({
       ports,
       bundle,
+      benchmarkSuite: task.benchmarkSuite,
+      benchmarkTask,
       executionId: task.executionId,
       roots: {
         execution: { ...task.executionRoots },
         staging: { ...task.stagingRoots }
       },
       profilePlan: {
-        value: profileApplication.profilePlan,
+        value: profileApplication.profileActivation.profilePlan,
         bytes: profilePlanBytes,
         written: [...profileApplication.application.mountPaths]
       },
+      profileActivation,
       executionPlan: { value: executionPlan, bytes: executionBytes },
       materializationReceipt,
       launch: {
@@ -4798,7 +5301,7 @@ async function prepareAgentCandidateExecution(candidate, task, ports, options =
         ...candidateExecutorFiles ? { candidateFiles: candidateExecutorFiles } : {},
         profileFiles: exactProfileExecutorFiles(
           profileWorkspacePlan.files,
-          profileApplication.profilePlan.material.files
+          profileApplication.profileActivation.profilePlan.material.files
         )
       },
       ...preparedMemory.accessDigest && preparedMemory.value.mode === "isolated" ? {
@@ -4883,34 +5386,54 @@ function assertSameVerificationPorts(verified, execution) {
   }
 }
 function assertTaskInput(task, delivery) {
+  const benchmarkTask = agentCandidateBenchmarkTaskSchema2.parse(task.task);
+  const benchmarkSuite = agentCandidateBenchmarkSuiteSchema2.parse(task.benchmarkSuite);
+  const runCell = agentCandidateRunCellSchema.parse(task.runCell);
   const requiredStrings = [
     ["executionId", task.executionId],
-    ["benchmark", task.benchmark],
-    ["benchmarkVersion", task.benchmarkVersion],
-    ["taskId", task.taskId],
-    ["repository identity", task.repository.identity],
-    ["repository root identity", task.repository.rootIdentity]
+    ["benchmark", benchmarkTask.benchmark.name],
+    ["benchmarkVersion", benchmarkTask.benchmark.version],
+    ["taskId", benchmarkTask.scenario.id]
   ];
+  if (benchmarkTask.outcome.kind === "workspace" && !benchmarkTask.repository) {
+    throw new Error("workspace task outcome requires repository identity");
+  }
+  if (benchmarkTask.repository) {
+    requiredStrings.push(
+      ["repository identity", benchmarkTask.repository.identity],
+      ["repository root identity", benchmarkTask.repository.rootIdentity]
+    );
+  }
   for (const [name, value] of requiredStrings) {
     if (!value.trim()) throw new Error(`${name} must be non-empty`);
   }
   if (!/^[A-Za-z0-9._:-]{1,200}$/.test(task.executionId)) {
     throw new Error("executionId must be a stable filesystem-neutral identifier");
   }
-  if (!task.instruction || !isWellFormedUnicode(task.instruction)) {
+  if (!benchmarkTask.instruction || !isWellFormedUnicode(benchmarkTask.instruction)) {
     throw new Error("task instruction must be non-empty well-formed Unicode");
   }
-  sha256DigestSchema.parse(task.splitDigest);
-  agentCandidateWorkspaceSnapshotEvidenceSchema2.parse(task.workspace);
-  agentCandidateExecutionLimitsSchema.parse(task.limits);
-  if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(task.repository.baseCommit)) {
-    throw new Error("task repository base commit is not a full Git object id");
+  if (canonicalCandidateDigest(omitTopLevelDigest(benchmarkTask)) !== benchmarkTask.digest || canonicalCandidateDigest(omitTopLevelDigest(benchmarkSuite)) !== benchmarkSuite.digest || canonicalCandidateDigest(omitTopLevelDigest(runCell)) !== runCell.digest) {
+    throw new Error("candidate experiment cell contains an invalid content digest");
   }
-  if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(task.repository.baseTree)) {
-    throw new Error("task repository base tree is not a full Git object id");
+  const cellIndex = runCell.taskIndex * benchmarkSuite.reps + runCell.repetition;
+  if (runCell.suiteDigest !== benchmarkSuite.digest || runCell.taskDigest !== benchmarkTask.digest || benchmarkSuite.taskDigests[runCell.taskIndex] !== benchmarkTask.digest || runCell.repetition >= benchmarkSuite.reps || benchmarkSuite.seeds[cellIndex] !== runCell.seed || runCell.attempt > benchmarkTask.attempt.maxAttempts) {
+    throw new Error("candidate experiment cell does not match its signed suite and task");
   }
-  if (task.repository.baseCommit.length !== task.repository.baseTree.length) {
-    throw new Error("task repository Git object formats disagree");
+  sha256DigestSchema.parse(benchmarkTask.benchmark.splitDigest);
+  agentCandidateTaskOutcomeSpecSchema.parse(benchmarkTask.outcome);
+  agentCandidateWorkspaceSnapshotEvidenceSchema3.parse(benchmarkTask.workspace);
+  agentCandidateExecutionLimitsSchema.parse(benchmarkTask.limits);
+  if (benchmarkTask.repository) {
+    if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(benchmarkTask.repository.baseCommit)) {
+      throw new Error("task repository base commit is not a full Git object id");
+    }
+    if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(benchmarkTask.repository.baseTree)) {
+      throw new Error("task repository base tree is not a full Git object id");
+    }
+    if (benchmarkTask.repository.baseCommit.length !== benchmarkTask.repository.baseTree.length) {
+      throw new Error("task repository Git object formats disagree");
+    }
   }
   for (const [name, root] of [
     ["execution task root", task.executionRoots.taskRoot],
@@ -4920,34 +5443,36 @@ function assertTaskInput(task, delivery) {
     ["staging profile root", task.stagingRoots.profileRoot]
   ]) {
     if (root === void 0) continue;
-    const canonical = name.startsWith("execution") ? posix.isAbsolute(root) && posix.normalize(root) === root : isAbsolute(root) && resolveHostPath(root) === root;
+    const canonical = name.startsWith("execution") ? posix2.isAbsolute(root) && posix2.normalize(root) === root : isAbsolute(root) && resolveHostPath(root) === root;
     if (!canonical) throw new Error(`${name} must be a canonical absolute path`);
   }
-  if (!Number.isInteger(task.attempt.number) || !Number.isInteger(task.attempt.maxAttempts) || task.attempt.number < 1 || task.attempt.number > task.attempt.maxAttempts || task.attempt.retryPolicy === "none" && task.attempt.maxAttempts !== 1) {
+  if (!Number.isInteger(runCell.attempt) || !Number.isInteger(benchmarkTask.attempt.maxAttempts) || runCell.attempt < 1 || runCell.attempt > benchmarkTask.attempt.maxAttempts || benchmarkTask.attempt.retryPolicy === "none" && benchmarkTask.attempt.maxAttempts !== 1) {
     throw new Error("task attempt policy is invalid");
   }
-  const limits = task.limits;
+  const limits = benchmarkTask.limits;
   if (!Number.isInteger(limits.timeoutMs) || limits.timeoutMs <= 0 || limits.timeoutMs > MAX_CANDIDATE_TIMER_INTERVAL_MS || !Number.isInteger(limits.maxSteps) || limits.maxSteps <= 0 || !Number.isInteger(limits.maxModelCalls) || limits.maxModelCalls < 0 || !Number.isInteger(limits.maxInputTokens) || limits.maxInputTokens < 0 || !Number.isInteger(limits.maxOutputTokens) || limits.maxOutputTokens < 0 || !Number.isFinite(limits.maxCostUsd) || limits.maxCostUsd < 0) {
     throw new Error("task execution limits are invalid");
   }
   usdToNanos(limits.maxCostUsd, "task maxCostUsd");
-  if (!task.model.requested.trim()) throw new Error("evaluator model request must be non-empty");
-  if (!task.grader.name.trim() || !task.grader.version.trim()) {
+  if (!benchmarkTask.model.requested.trim()) {
+    throw new Error("evaluator model request must be non-empty");
+  }
+  if (!benchmarkTask.grader.name.trim() || !benchmarkTask.grader.version.trim()) {
     throw new Error("evaluator benchmark grader identity must be non-empty");
   }
-  if (!Number.isInteger(task.grader.artifact.byteLength) || task.grader.artifact.byteLength <= 0) {
+  if (!Number.isInteger(benchmarkTask.grader.artifact.byteLength) || benchmarkTask.grader.artifact.byteLength <= 0) {
     throw new Error("evaluator benchmark grader artifact must be non-empty");
   }
-  sha256DigestSchema.parse(task.grader.artifact.sha256);
-  if (task.evaluatorTaskContainer) {
-    if (task.evaluatorTaskContainer.source !== "evaluator-task-container" || !task.evaluatorTaskContainer.image.trim() || !task.evaluatorTaskContainer.platform.os.trim() || !task.evaluatorTaskContainer.platform.architecture.trim()) {
+  sha256DigestSchema.parse(benchmarkTask.grader.artifact.sha256);
+  if (benchmarkTask.evaluatorTaskContainer) {
+    if (benchmarkTask.evaluatorTaskContainer.source !== "evaluator-task-container" || !benchmarkTask.evaluatorTaskContainer.image.trim() || !benchmarkTask.evaluatorTaskContainer.platform.os.trim() || !benchmarkTask.evaluatorTaskContainer.platform.architecture.trim()) {
       throw new Error("evaluator task container evidence is incomplete");
     }
-    sha256DigestSchema.parse(task.evaluatorTaskContainer.indexDigest);
-    sha256DigestSchema.parse(task.evaluatorTaskContainer.manifestDigest);
+    sha256DigestSchema.parse(benchmarkTask.evaluatorTaskContainer.indexDigest);
+    sha256DigestSchema.parse(benchmarkTask.evaluatorTaskContainer.manifestDigest);
     agentCandidateContainerSchema.parse({
-      image: task.evaluatorTaskContainer.image,
-      indexDigest: task.evaluatorTaskContainer.indexDigest
+      image: benchmarkTask.evaluatorTaskContainer.image,
+      indexDigest: benchmarkTask.evaluatorTaskContainer.indexDigest
     });
   }
   if (delivery.kind === "utf8-file") {
@@ -4957,8 +5482,8 @@ function assertTaskInput(task, delivery) {
   }
 }
 function executionPathsOverlap(left, right) {
-  const a = posix.normalize(left);
-  const b = posix.normalize(right);
+  const a = posix2.normalize(left);
+  const b = posix2.normalize(right);
   return a === b || b.startsWith(a === "/" ? "/" : `${a}/`) || a.startsWith(b === "/" ? "/" : `${b}/`);
 }
 function assertDisjointHostStagingRoots(task) {
@@ -4990,51 +5515,45 @@ async function assertEmptyDirectory(path) {
     throw new Error("profile staging root must be empty before materialization");
   }
 }
-function materializerHarness(harness) {
-  if (!MATERIALIZER_HARNESSES.has(harness)) {
-    throw new Error(
-      `sealed candidate profile materialization is unsupported for harness ${harness}`
-    );
-  }
-  return harness;
-}
 async function resolveContainer(candidate, task, ports) {
   const environment = candidate.bundle.execution.environment;
+  const evaluatorTaskContainer = task.task.evaluatorTaskContainer;
   const pinned = environment.kind === "pinned-container" ? environment.container : void 0;
-  if (environment.kind === "evaluator-task-container" && !task.evaluatorTaskContainer) {
+  if (environment.kind === "evaluator-task-container" && !evaluatorTaskContainer) {
     throw new Error("evaluator-task-container candidate requires an evaluator-owned task image");
   }
-  if (environment.kind === "pinned-container" && task.evaluatorTaskContainer) {
+  if (environment.kind === "pinned-container" && evaluatorTaskContainer) {
     throw new Error("pinned candidate containers cannot be replaced by a task image");
   }
   const resolved = await ports.containers.resolve({
     candidate: pinned,
-    evaluatorTaskContainer: task.evaluatorTaskContainer
+    evaluatorTaskContainer
   });
   if (resolved.source !== environment.kind) throw new Error("resolved container source drifted");
   if (pinned && (resolved.image !== pinned.image || resolved.indexDigest !== pinned.indexDigest)) {
     throw new Error("resolved pinned container does not match the candidate image index");
   }
-  if (task.evaluatorTaskContainer && JSON.stringify(resolved) !== JSON.stringify(task.evaluatorTaskContainer)) {
+  if (evaluatorTaskContainer && canonicalCandidateDigest(resolved) !== canonicalCandidateDigest(evaluatorTaskContainer)) {
     throw new Error("resolved task container does not match evaluator-owned image evidence");
   }
   return resolved;
 }
 async function resolveModel(candidate, task, ports) {
   const hints = candidate.bundle.profile.model;
-  if (hints?.default !== void 0 && hints.default !== task.model.requested) {
+  const expected = task.task.model;
+  if (hints?.default !== void 0 && hints.default !== expected.requested) {
     throw new Error("candidate model preference conflicts with the evaluator-owned model");
   }
-  if (hints?.reasoningEffort !== void 0 && hints.reasoningEffort !== task.model.reasoningEffort) {
+  if (hints?.reasoningEffort !== void 0 && hints.reasoningEffort !== expected.reasoningEffort) {
     throw new Error("candidate reasoning effort conflicts with the evaluator-owned effort");
   }
   const resolved = await ports.models.resolve({
-    requested: task.model.requested,
+    requested: expected.requested,
     harness: candidate.bundle.execution.harness,
-    reasoningEffort: task.model.reasoningEffort
+    reasoningEffort: expected.reasoningEffort
   });
-  if (resolved.requested !== task.model.requested || resolved.reasoningEffort !== task.model.reasoningEffort) {
-    throw new Error("model resolver drifted from the evaluator-owned request");
+  if (canonicalCandidateDigest(resolved) !== canonicalCandidateDigest(expected)) {
+    throw new Error("model resolver drifted from the signed benchmark model");
   }
   return resolved;
 }
@@ -5043,7 +5562,7 @@ async function prepareMemory(candidate, task, ports, preparationId, expiresAtMs,
   if (policy.mode === "disabled") return { value: { mode: "disabled" } };
   const seed = policy.seed ? await verifiedArtifactBytes(candidate, policy.seed) : void 0;
   const executionSegment = canonicalCandidateDigest({ executionId: task.executionId }).slice(7);
-  const taskSegment = canonicalCandidateDigest({ taskId: task.taskId }).slice(7);
+  const taskSegment = canonicalCandidateDigest({ taskDigest: task.task.digest }).slice(7);
   const preparationSegment = canonicalCandidateDigest({ preparationId }).slice(7, 23);
   const effectiveNamespace = `candidate/${candidate.bundle.digest.slice(7, 23)}/${executionSegment}/${taskSegment}/${preparationSegment}`;
   const reset = await withinCandidateCleanupDeadline(
@@ -5110,7 +5629,7 @@ function buildLaunch(candidate, task, profileFlags) {
   }
   const candidateRoot = task.executionRoots.candidateRoot;
   if (!candidateRoot) throw new Error("candidate entrypoint requires a container candidate root");
-  const entrypoint = posix.join(candidateRoot, launch.entrypoint);
+  const entrypoint = posix2.join(candidateRoot, launch.entrypoint);
   const candidateArgs = launch.args ?? [];
   if (launch.interpreter) {
     return {
@@ -5160,7 +5679,7 @@ function candidateEntrypointReceipt(candidate) {
 function absoluteExecutionCwd(cwd, roots) {
   const root = cwd.workspace === "task" ? roots.taskRoot : roots.candidateRoot;
   if (!root) throw new Error("candidate cwd is missing its execution workspace root");
-  const absolute = cwd.path === "." ? root : posix.join(root, cwd.path);
+  const absolute = cwd.path === "." ? root : posix2.join(root, cwd.path);
   if (absolute !== root && !absolute.startsWith(`${root}/`)) {
     throw new Error("candidate cwd escapes its execution workspace");
   }
@@ -5236,20 +5755,20 @@ export {
   canonicalCandidateDigest,
   immutableCandidateValue,
   canonicalCandidateDocument,
+  verifyCanonicalCandidateDocument,
   embeddedCandidateArtifact,
   omitTopLevelDigest,
   deepFreezeCandidate,
-  sealAgentCandidateBundle,
+  candidateMaterializerHarness,
+  createAgentCandidateProfileActivation,
+  parseAgentCandidateProfileActivation,
   freezeGenericAgentCandidateProfile,
   assertCandidateProfileBinding,
   parseExactAgentProfile,
   parseExactAgentProfileDiff,
   applyExactAgentProfileDiff,
   parseExactCandidateProfile,
-  CLAIM_FORMAT_VERSION,
-  PENDING_FORMAT_VERSION,
-  TERMINAL_FORMAT_VERSION,
-  PHASE_FORMAT_VERSION,
+  agentCandidateProfileAsAgentProfile,
   assertExactObjectKeys,
   terminalRecord,
   recoveredTerminalRecord,
@@ -5264,6 +5783,7 @@ export {
   candidateCleanupTimeout,
   candidateCleanupDeadline,
   withinCandidateCleanupDeadline,
+  readVerifiedArtifact,
   verifyBytes,
   verifyMaterializedWorkspace,
   captureMaterializedWorkspace,
@@ -5281,12 +5801,17 @@ export {
   candidateClaimFileInternals,
   sealAgentCandidateModelSettlement,
   usdToNanos,
-  sealAgentCandidateExecutorFinalCapture,
+  sealAgentCandidateExecutorStopAcknowledgement,
   persistCandidateOutputArtifact,
   persistCandidateModelSettlementEvidence,
   RecoveryAgentCandidateTraceStore,
   executePreparedAgentCandidate,
+  AGENT_CANDIDATE_EXECUTION_SUPPORT,
   verifyAgentCandidateBundle,
+  verifiedResourceTextByDigest,
+  CANDIDATE_KNOWLEDGE_ROOT_ENV,
+  CANDIDATE_KNOWLEDGE_RETRIEVAL_CONFIG_ENV,
+  candidateKnowledgeExecutionPaths,
   prepareAgentCandidateExecution
 };
-//# sourceMappingURL=chunk-CNH7DF7Z.js.map
+//# sourceMappingURL=chunk-YOLKCWRV.js.map