@tangle-network/agent-runtime 6.0.8 → 8.0.0

package/dist/{runtime-COm9uBBx.js → runtime-CaM5Gbbv.js}

@@ -1,25 +1,26 @@
-import { A as isTraceAnalysisStore, Br as executableAgentProfileSnapshot, G as settledToIteration, Mt as coordinationProfileToolPrefix, Vr as executableAgentSpecSnapshot, X as rollingDispatch, ei as runAbortable, rn as insideCursorNamespace } from "./scope-gIYQ5ZiL.js";
-import { i as ConfigError, m as ValidationError, n as AnalystError, s as PlannerError } from "./errors-AzSuGI23.js";
-import { D as runAgentic, E as refine, M as renderReport, N as profileChatClient, O as sample, j as observe, k as ObservationError, v as loadAuthoredStrategy, x as strategyAuthorContract, y as requestStrategySource } from "./structural-rollout-BwTwTUXF.js";
-import { I as armDeadlineTimer, T as zeroSpend, a as cloneSpend, c as errorMessage, d as isAbortError, f as isAsyncIterable, h as randomSuffix, i as chargedTokens, l as fnv1a32Hex, n as addSpend, p as mapWithConcurrency, u as hasCompleteCacheBreakdown, v as sleep, y as stringifySafe } from "./util-C_cdPNC4.js";
-import { M as contentAddress, _t as notifySandboxEventObserver, pt as createSandboxTurnEventCollector, r as runtimeFailureCauseSchema } from "./failure-cause-BzjUUsRz.js";
-import { n as detachedSnapshot, t as detachedFrozen } from "./snapshot-Cgj2Wzi6.js";
-import { C as createExecutor, D as runAgentRounds, O as assertBoxlessPromptOptions, P as defaultSelectWinner, V as routerBrain, _ as withDriverExecutor, b as createExecutorRegistry, bt as verdictFromJudgeScore, gt as CheckUnavailableError, j as createSandboxLineage, k as readPromptOptions, n as createSupervisor, q as createWorktreeCliExecutor, v as InMemoryResultBlobStore, vt as gateOnDeliverable, y as InMemorySpawnJournal, yt as mapExecutorResult } from "./supervisor-1A27fE6k.js";
-import { a as concreteProfileModel, c as profileModelExecutionSettings, i as concreteModelId, l as profileProviderModel, o as enforceTokenLimits, p as canonicalObservedModelParts, t as assertExecutableAgentProfile, v as harnessRunsAgent } from "./model-policy-JOcg3NRs.js";
+import { Gr as executableAgentProfileSnapshot, It as coordinationProfileToolPrefix, Kr as executableAgentSpecSnapshot, P as isTraceAnalysisStore, Y as settledToIteration, et as rollingDispatch, si as runAbortable, sn as insideCursorNamespace } from "./supervisor-accounting-Bw4MJk-b.js";
+import { i as ConfigError, m as ValidationError, n as AnalystError, s as PlannerError } from "./errors-DG8yufqX.js";
+import { D as runAgentic, E as refine, M as renderReport, N as profileChatClient, O as sample, j as observe, k as ObservationError, v as loadAuthoredStrategy, x as strategyAuthorContract, y as requestStrategySource } from "./structural-rollout-C1xxoWcN.js";
+import { I as armDeadlineTimer, T as zeroSpend, a as cloneSpend, c as errorMessage, d as isAbortError, f as isAsyncIterable, h as randomSuffix, i as chargedTokens, l as fnv1a32Hex, n as addSpend, p as mapWithConcurrency, u as hasCompleteCacheBreakdown, v as sleep, y as stringifySafe } from "./util-fcckrkKp.js";
+import { M as contentAddress, mt as createSandboxTurnEventCollector, r as runtimeFailureCauseSchema, vt as notifySandboxEventObserver } from "./failure-cause-CVB-YE88.js";
+import { n as detachedSnapshot, t as detachedFrozen } from "./snapshot-BKI_w3JD.js";
+import { C as createExecutor, D as runAgentRounds, O as assertBoxlessPromptOptions, P as defaultSelectWinner, V as routerBrain, _ as withDriverExecutor, b as createExecutorRegistry, bt as verdictFromJudgeScore, gt as CheckUnavailableError, j as createSandboxLineage, k as readPromptOptions, n as createSupervisor, q as createWorktreeCliExecutor, v as InMemoryResultBlobStore, vt as gateOnDeliverable, y as InMemorySpawnJournal, yt as mapExecutorResult } from "./supervisor-Dpeu7rnZ.js";
+import { a as concreteProfileModel, c as profileModelExecutionSettings, i as concreteModelId, l as profileProviderModel, o as enforceTokenLimits, p as canonicalObservedModelParts, t as assertExecutableAgentProfile, v as harnessRunsAgent } from "./model-policy-yxOrDTTj.js";
 import { a as readCommittedJsonLines, c as appendCommittedJsonLine, i as readCommittedJsonFile, o as upsertCommittedJsonLine, s as withJsonlFileLock, t as isNoEntError } from "./jsonl-file-DsxVI0E_.js";
-import { A as markPutStreamVerified, L as immutableCandidateValue, N as canonicalCandidateDigest$1, S as captureMaterializedWorkspace, T as scanMaterializedWorkspaceManifest, g as persistCandidateOutputArtifact, y as WorkspaceScanLimitError, z as sha256Bytes$1 } from "./workspace-streams-B7yNMahl.js";
+import { A as markPutStreamVerified, L as immutableCandidateValue, N as canonicalCandidateDigest$1, S as captureMaterializedWorkspace, z as sha256Bytes$1 } from "./workspace-streams-DA9R3j-p.js";
+import "./continuation-CIyKnS1Q.js";
 import { a as writeAtomicDurableFile } from "./durable-file-DstVeHcj.js";
 import { i as notifyRuntimeHookEvent } from "./runtime-hooks-CsW2pfFk.js";
-import { a as reconcileInterruptedSearchCalls, c as searchExecutor, r as dedicatedLane, x as runtimeShipDecision } from "./search-executor-DTEIl58w.js";
-import { y as foldCoordinationRecords } from "./run-cancellation-D_4vJ522.js";
-import { a as downMessageRefusalReasons, p as createInMemoryRunContext } from "./coordination-manager-D9z7To7p.js";
-import { M as kernelPromptRegistry, S as validateFlowGraph, T as validateGraphTopology, h as runBrainLoop, p as coordinationControlToolNames, t as supervise } from "./supervise-tmqDU6YT.js";
-import { _ as compileGraphParameters, a as graphRegistry, b as graphRouteWhenSchema, d as recordGraphRun, g as bindGraphParameters, h as assertGraphTriggerBindings, i as graphFromStored, l as lookupGraph, m as taskShapeDigest, o as graphRunsFor, r as graphDigest, t as digestOfGraph, v as graphTriggerBindingsSchema, y as graphFileSchema } from "./graph-registry-7X2nrreR.js";
-import "./run-state-CTZVngI_.js";
+import { a as reconcileInterruptedSearchCalls, c as searchExecutor, r as dedicatedLane, x as runtimeShipDecision } from "./search-executor-B9L8W_1O.js";
+import { y as foldCoordinationRecords } from "./run-cancellation-DYszFJtQ.js";
+import { a as downMessageRefusalReasons, p as createInMemoryRunContext } from "./coordination-manager-sa_PkISw.js";
+import { M as kernelPromptRegistry, S as validateFlowGraph, T as validateGraphTopology, h as runBrainLoop, p as coordinationControlToolNames, t as supervise } from "./supervise-DWiSgPLB.js";
+import { C as assertJsonData, _ as compileGraphParameters, a as graphRegistry, b as graphFileSchema, d as recordGraphRun, g as bindGraphParameters, h as assertGraphTriggerBindings, i as graphFromStored, l as lookupGraph, m as taskShapeDigest, o as graphRunsFor, r as graphDigest, t as digestOfGraph, v as graphTriggerBindingsSchema, x as graphRouteWhenSchema, y as graphCheckNodeSchema } from "./graph-registry-czAwYwNj.js";
+import "./run-state-DHBoJjaF.js";
+import { o as runIsolatedCheck } from "./graph-tSIT_eWK.js";
 import { i as redactProtectedValue, r as redactProtectedReason } from "./protected-redaction-DilFZch5.js";
-import "./provision-supervisor-CeQTPHRr.js";
-import "./delegate-ws-KBA2H.js";
-import "./graph-2_nX4ib4.js";
+import "./provision-supervisor-Dx4TXTMM.js";
+import "./delegate-DhTkJIta.js";
 import { agentProfileSchema, canonicalAgentProfileDigest, canonicalCandidateDigest, sha256Bytes, validateAgentProfileSecurity } from "@tangle-network/agent-interface";
 import { CODING_HARNESSES, DEFAULT_TRACE_ANALYST_KINDS, InMemoryTraceStore, OUTPUT_VALUE, benjaminiHochberg, buildTrajectory, computeFindingId as computeFindingId$1, confidenceInterval, createTraceAnalyst, expandProfileAxes, makeFinding as makeFinding$1, pairedBootstrap, paretoFrontier, wilcoxonSignedRank, wilson } from "@tangle-network/agent-eval";
 import { createAgentRunOutcomeTracker } from "@tangle-network/sandbox/runtime";
@@ -29,10 +30,9 @@ import { redact } from "@tangle-network/agent-eval/traces";
 import { createHash, createHmac, randomUUID } from "node:crypto";
 import { appendFileSync, chmodSync, constants, copyFileSync, lstatSync, mkdirSync, mkdtempSync, readlinkSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
 import { dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
-import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
-import { chmod, link, lstat, mkdir, mkdtemp, open, opendir, readFile, readdir, readlink, realpath, rename, rm, stat, symlink, unlink, writeFile } from "node:fs/promises";
-import { promisify } from "node:util";
-import { tmpdir } from "node:os";
+import { execFileSync, spawn, spawnSync } from "node:child_process";
+import { link, lstat, mkdir, mkdtemp, open, readFile, readdir, realpath, rename, rm, unlink, writeFile } from "node:fs/promises";
+import { homedir, tmpdir } from "node:os";
 import { Readable } from "node:stream";
 import { createInterface } from "node:readline";
 import { SearchRecorder, asha, beam, createRunCostLedger, estimateNode, fsCampaignStorage, openSearchLedger, renderSearchSummary, runProfileMatrix, runSearch, searchClaimReserveUsd, searchModelIdentity, surfaceDiff } from "@tangle-network/agent-eval/campaign";
@@ -735,923 +735,6 @@ function deterministicCompletion(check) {
 		};
 	} };
 }
-// src/runtime/isolated-checker-outputs.ts
-const MAX_FILES = 16;
-const MAX_BYTES = 67108864;
-const MAX_TIMEOUT_MS = 12e4;
-/** Validate authored declarations before starting a check. The returned paths are detached and frozen. */
-function validateIsolatedCheckOutputs(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new ValidationError("check outputs must be a declaration object");
-	const item = value;
-	if (Object.keys(item).some((key) => ![
-		"paths",
-		"maxFileBytes",
-		"maxTotalBytes",
-		"timeoutMs"
-	].includes(key))) throw new ValidationError("check outputs has an unknown field");
-	if (!Array.isArray(item.paths) || item.paths.length < 1 || item.paths.length > MAX_FILES) throw new ValidationError("check outputs must name between 1 and 16 files");
-	const paths = [];
-	for (const path of item.paths) {
-		if (typeof path !== "string" || path.length > 512 || !/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/u.test(path) || path.split("/").some((part) => part === "." || part === ".." || part === ".git" || part === ".sidecar") || paths.some((prior) => prior === path || prior.startsWith(`${path}/`) || path.startsWith(`${prior}/`))) throw new ValidationError("check outputs paths must be distinct portable relative files");
-		paths.push(path);
-	}
-	for (const key of ["maxFileBytes", "maxTotalBytes"]) if (typeof item[key] !== "number" || !Number.isSafeInteger(item[key]) || item[key] < 1 || item[key] > MAX_BYTES) throw new ValidationError("check output byte limits must be positive integers at most 64 MiB");
-	const maxFileBytes = item.maxFileBytes;
-	const maxTotalBytes = item.maxTotalBytes;
-	if (maxFileBytes > maxTotalBytes) throw new ValidationError("check outputs maxFileBytes must not exceed maxTotalBytes");
-	if (item.timeoutMs !== void 0 && (typeof item.timeoutMs !== "number" || !Number.isSafeInteger(item.timeoutMs) || item.timeoutMs < 1 || item.timeoutMs > MAX_TIMEOUT_MS)) throw new ValidationError("check outputs timeoutMs must be a positive integer at most 120000");
-	return Object.freeze({
-		paths: Object.freeze(paths),
-		maxFileBytes,
-		maxTotalBytes,
-		...item.timeoutMs === void 0 ? {} : { timeoutMs: item.timeoutMs }
-	});
-}
-/** Resolve and validate trusted ports before any isolated work starts. */
-function prepareIsolatedCheckOutputs(options) {
-	if (options === void 0) return void 0;
-	const { executionId, artifacts, ...declaration } = options;
-	const validated = validateIsolatedCheckOutputs(declaration);
-	if (typeof executionId !== "string" || executionId.trim() === "" || executionId.length > 200 || /\p{Cc}/u.test(executionId)) throw new ValidationError("check outputs executionId must be a nonempty bounded identifier");
-	if (typeof artifacts?.put !== "function" || typeof artifacts?.read !== "function") throw new ValidationError("check outputs requires a readable output artifact port");
-	return Object.freeze({
-		...validated,
-		executionId,
-		artifacts
-	});
-}
-var OutputCaptureError = class extends Error {
-	reason;
-	constructor(reason) {
-		super(reason);
-		this.reason = reason;
-	}
-};
-/** Capture runs after command settlement, even on command failure or cancellation. There are no retries. */
-async function retainIsolatedCheckOutputs(options, inputDigest, read) {
-	const controller = new AbortController();
-	const clearTimer = armDeadlineTimer(options.timeoutMs ?? 3e4, () => controller.abort(), true);
-	const files = [];
-	const missing = [];
-	let totalBytes = 0;
-	try {
-		for (const path of options.paths) {
-			let phase = "capture-failed";
-			try {
-				const bytes = await runAbortable(() => read(path, Math.min(options.maxFileBytes, options.maxTotalBytes - totalBytes), controller.signal), controller.signal, "output capture deadline exceeded");
-				totalBytes += bytes.byteLength;
-				phase = "store-failed";
-				const artifact = await runAbortable(() => persistCandidateOutputArtifact(options.artifacts, {
-					executionId: options.executionId,
-					purpose: "grader-evidence",
-					bytes,
-					signal: controller.signal
-				}), controller.signal, "output persistence deadline exceeded");
-				files.push({
-					path,
-					artifact
-				});
-			} catch (error) {
-				missing.push({
-					path,
-					reason: controller.signal.aborted ? "timeout" : error instanceof OutputCaptureError ? error.reason : phase
-				});
-			}
-		}
-	} finally {
-		clearTimer();
-	}
-	return Object.freeze({
-		executionId: options.executionId,
-		inputDigest,
-		status: missing.length === 0 ? "retained" : "incomplete",
-		files: Object.freeze(files.map((file) => Object.freeze(file))),
-		missing: Object.freeze(missing.map((file) => Object.freeze(file)))
-	});
-}
-/** The local namespace has exited; the trusted host must keep its private copy stable. */
-function localCheckOutputReader(root) {
-	return async (path, maxBytes, signal) => {
-		try {
-			const rootInfo = await lstat(root);
-			if (!rootInfo.isDirectory() || rootInfo.isSymbolicLink()) throw new OutputCaptureError("unsafe-path");
-			let current = root;
-			const parts = path.split("/");
-			let expected;
-			for (let index = 0; index < parts.length; index++) {
-				current = join(current, parts[index]);
-				const info = await lstat(current, { bigint: true });
-				if (info.isSymbolicLink() || (index < parts.length - 1 ? !info.isDirectory() : !info.isFile() || info.nlink !== 1n)) throw new OutputCaptureError("unsafe-path");
-				expected = info;
-			}
-			signal.throwIfAborted();
-			const file = await open(current, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
-			try {
-				const before = await file.stat({ bigint: true });
-				if (!before.isFile() || before.nlink !== 1n || before.dev !== expected?.dev || before.ino !== expected?.ino) throw new OutputCaptureError("unsafe-path");
-				if (before.size > BigInt(maxBytes)) throw new OutputCaptureError("size-limit");
-				const chunks = [];
-				let total = 0;
-				const buffer = Buffer.allocUnsafe(Math.min(65536, maxBytes + 1));
-				while (true) {
-					signal.throwIfAborted();
-					const { bytesRead } = await file.read(buffer, 0, Math.min(buffer.length, maxBytes - total + 1), null);
-					if (bytesRead === 0) break;
-					total += bytesRead;
-					if (total > maxBytes) throw new OutputCaptureError("size-limit");
-					chunks.push(Buffer.from(buffer.subarray(0, bytesRead)));
-				}
-				const after = await file.stat({ bigint: true });
-				if (before.size !== BigInt(total) || before.size !== after.size || before.mtimeNs !== after.mtimeNs || before.ctimeNs !== after.ctimeNs || after.nlink !== 1n) throw new OutputCaptureError("capture-failed");
-				return Buffer.concat(chunks, total);
-			} finally {
-				await file.close();
-			}
-		} catch (error) {
-			if (error?.code === "ENOENT") throw new OutputCaptureError("missing");
-			if (["ELOOP", "ENOTDIR"].includes(error?.code ?? "")) throw new OutputCaptureError("unsafe-path");
-			throw error;
-		}
-	};
-}
-/** Preserve a whole box only after its native lifecycle owner confirms stopped state. */
-async function stopCheckBoxForRecovery(box) {
-	const controller = new AbortController();
-	const clearTimer = armDeadlineTimer(3e4, () => controller.abort(), true);
-	try {
-		await runAbortable(() => box.stop({
-			wait: true,
-			signal: controller.signal
-		}), controller.signal, "check recovery stop deadline exceeded");
-		return true;
-	} catch {
-		return false;
-	} finally {
-		clearTimer();
-	}
-}
-/** Whether kill and process exit were confirmed; recovery custody still needs a whole-box stop. */
-async function stopCheckProcess(child) {
-	const controller = new AbortController();
-	const clearTimer = armDeadlineTimer(5e3, () => controller.abort(), true);
-	try {
-		await runAbortable(async () => {
-			await child.kill("SIGKILL", { tree: true });
-			await child.wait();
-		}, controller.signal, "check process stop deadline exceeded");
-		return true;
-	} catch {
-		return false;
-	} finally {
-		clearTimer();
-	}
-}
-const isolatedCheckOutputCaptureProgram = `import base64, errno, hashlib, json, os, stat, sys
-fds=[]
-def fail(reason):
- print(json.dumps({'error':reason})); sys.exit(0)
-try:
- root,path,limit=sys.argv[1],sys.argv[2],int(sys.argv[3])
- directory=os.open(root,os.O_RDONLY|os.O_DIRECTORY|os.O_NOFOLLOW); fds.append(directory)
- parts=path.split('/')
- for part in parts[:-1]:
-  directory=os.open(part,os.O_RDONLY|os.O_DIRECTORY|os.O_NOFOLLOW,dir_fd=directory); fds.append(directory)
- before=os.stat(parts[-1],dir_fd=directory,follow_symlinks=False)
- if not stat.S_ISREG(before.st_mode) or before.st_nlink!=1: fail('unsafe-path')
- fd=os.open(parts[-1],os.O_RDONLY|os.O_NOFOLLOW|os.O_NONBLOCK,dir_fd=directory); fds.append(fd)
- opened=os.fstat(fd)
- if not stat.S_ISREG(opened.st_mode) or opened.st_nlink!=1 or (before.st_dev,before.st_ino)!=(opened.st_dev,opened.st_ino): fail('unsafe-path')
- if opened.st_size>limit: fail('size-limit')
- chunks=[]; total=0
- while True:
-  chunk=os.read(fd,min(1048576,limit-total+1))
-  if not chunk: break
-  total+=len(chunk)
-  if total>limit: fail('size-limit')
-  chunks.append(chunk)
- after=os.fstat(fd)
- if (opened.st_size,opened.st_mtime_ns,opened.st_ctime_ns,opened.st_nlink)!=(after.st_size,after.st_mtime_ns,after.st_ctime_ns,after.st_nlink) or total!=opened.st_size: fail('capture-failed')
- data=b''.join(chunks)
- print(json.dumps({'content':base64.b64encode(data).decode('ascii'),'sha256':'sha256:'+hashlib.sha256(data).hexdigest()}))
-except OSError as error:
- fail('missing' if error.errno==errno.ENOENT else 'unsafe-path' if error.errno in (errno.ELOOP,errno.ENOTDIR) else 'capture-failed')
-finally:
- for fd in reversed(fds): os.close(fd)
-`;
-/** A box with declared outputs needs python3; missing capture tooling fails closed and keeps custody. */
-function boxCheckOutputReader(box, root, timeoutMs) {
-	return async (path, maxBytes, signal) => {
-		const child = await box.process.spawnExact("/usr/bin/python3", [
-			"-I",
-			"-S",
-			"-c",
-			isolatedCheckOutputCaptureProgram,
-			root,
-			path,
-			String(maxBytes)
-		], {
-			env: {
-				PATH: "/usr/bin:/bin",
-				LANG: "C"
-			},
-			inheritEnv: false,
-			timeoutMs
-		});
-		let stopping;
-		const stop = () => {
-			stopping ??= stopCheckProcess(child);
-		};
-		signal.addEventListener("abort", stop, { once: true });
-		if (signal.aborted) stop();
-		const chunks = [];
-		const limit = Math.ceil(maxBytes / 3) * 4 + 2048;
-		let length = 0;
-		let overflow = false;
-		const collect = async (stream, keep) => {
-			for await (const text of stream) {
-				length += Buffer.byteLength(text);
-				if (length > limit) {
-					overflow = true;
-					stop();
-				} else if (keep) chunks.push(text);
-			}
-		};
-		try {
-			await Promise.all([collect(child.stdout(), true), collect(child.stderr(), false)]);
-			if (overflow || await child.wait() !== 0) throw new OutputCaptureError("capture-failed");
-			signal.throwIfAborted();
-			const value = JSON.parse(chunks.join(""));
-			if (value.error === "missing" || value.error === "unsafe-path" || value.error === "size-limit" || value.error === "capture-failed") throw new OutputCaptureError(value.error);
-			if (typeof value.content !== "string" || typeof value.sha256 !== "string") throw new OutputCaptureError("capture-failed");
-			const bytes = Buffer.from(value.content, "base64");
-			if (bytes.byteLength > maxBytes) throw new OutputCaptureError("size-limit");
-			if (sha256Bytes$1(bytes) !== value.sha256) throw new OutputCaptureError("capture-failed");
-			return bytes;
-		} catch (error) {
-			stop();
-			throw error;
-		} finally {
-			signal.removeEventListener("abort", stop);
-			await stopping;
-		}
-	};
-}
-// src/runtime/isolated-checker.ts
-const toolchains = [
-	"/usr",
-	"/bin",
-	"/lib",
-	"/lib64"
-];
-const contains = (parent, child) => {
-	const path = relative(parent, child);
-	return path === "" || path !== ".." && !path.startsWith(`..${sep}`) && !path.startsWith(sep);
-};
-/**
-* Run an untrusted check in Linux Bubblewrap, or in its own Sandbox box when `box` is set.
-* Never falls back to host execution.
-*
-* Bubblewrap requires /usr/bin/bwrap and permission to create Linux namespaces.
-* Only trusted system toolchains, private proc/dev/tmp, and the writable copy are mounted.
-* The canonical input path remains the working directory. Requested output files are retained
-* before cleanup; otherwise copy writes are discarded.
-* Time and output are bounded; input copy bytes and entries are bounded when requested.
-* The command's memory and generated files require a resource-limited placement.
-* Callers must keep the input and trusted toolchains stable while preparing the check.
-*
-* A box check creates one fresh box with no owner secrets and blocked egress (or strict egress to
-* the placement's named domains), delivers the tree's regular files verified by sha256, runs the
-* command there with only the environment `env` names, and deletes the box after successful
-* requested retention. Incomplete retention returns private recovery custody only after the
-* native owner confirms the box stopped. Box file capture requires /usr/bin/python3. Local recovery scratch is the
-* caller's responsibility; the resource-limited placement requirement still applies.
-*/
-async function runIsolatedCheck(options) {
-	if (options.box) return runInBox(options, options.box);
-	let scratch;
-	let outputs;
-	let result;
-	try {
-		const retention = prepareIsolatedCheckOutputs(options.outputs);
-		if (process.platform !== "linux") throw new Error("Linux Bubblewrap namespaces are required");
-		const { timeoutMs, maxOutputBytes, maxInputBytes, maxInputEntries } = checkLimits(options);
-		if (options.signal?.aborted) return {
-			succeeded: false,
-			reason: "cancelled",
-			diagnostic: "Check cancelled"
-		};
-		const { workspace, tree } = await protectedTree(options);
-		const binds = [];
-		for (const path of toolchains) {
-			let actual;
-			try {
-				actual = await realpath(path);
-			} catch (error) {
-				if (error.code === "ENOENT") continue;
-				throw error;
-			}
-			for (const mount of [path, actual]) if (contains(mount, workspace) || contains(workspace, mount) || contains(mount, tree) || contains(tree, mount)) throw new Error(`Toolchain overlaps protected workspace: ${path}`);
-			binds.push("--ro-bind", actual, path);
-		}
-		if (["/proc", "/dev"].some((path) => contains(path, tree) || contains(tree, path))) throw new Error("Tree overlaps a reserved namespace mount");
-		scratch = await mkdtemp(join(tmpdir(), "runtime-check-"));
-		if (contains(tree, scratch)) throw new Error("Temporary storage must be outside the input tree");
-		const copy = join(scratch, "tree");
-		await copyBoundedTree(tree, copy, maxInputBytes, maxInputEntries);
-		const input = retention ? await scanMaterializedWorkspaceManifest(copy) : void 0;
-		if (retention && input) assertOutputPathsUnoccupied(retention.paths, input);
-		result = await execute([
-			"--unshare-all",
-			"--die-with-parent",
-			"--new-session",
-			"--cap-drop",
-			"ALL",
-			"--clearenv",
-			"--setenv",
-			"PATH",
-			"/usr/bin:/bin",
-			"--setenv",
-			"HOME",
-			"/tmp",
-			"--setenv",
-			"LANG",
-			"C",
-			...Object.entries(options.env ?? {}).flatMap(([name, value]) => [
-				"--setenv",
-				name,
-				value
-			]),
-			...binds,
-			"--proc",
-			"/proc",
-			"--dev",
-			"/dev",
-			"--tmpfs",
-			"/tmp",
-			"--bind",
-			copy,
-			tree,
-			"--chdir",
-			tree,
-			"--",
-			...options.command
-		], timeoutMs, maxOutputBytes, options.signal);
-		if (retention && input && (result.succeeded || result.reason !== "refused")) {
-			outputs = await retainIsolatedCheckOutputs(retention, canonicalCandidateDigest(input), localCheckOutputReader(copy));
-			if (outputs.status === "incomplete") outputs = {
-				...outputs,
-				source: {
-					kind: "local",
-					path: scratch
-				}
-			};
-			result = withRetainedOutputs(result, outputs);
-		}
-	} catch (error) {
-		result = {
-			succeeded: false,
-			reason: error instanceof InputLimitError ? "input-limit" : "refused",
-			diagnostic: String(error)
-		};
-	}
-	if (scratch && outputs?.status !== "incomplete") try {
-		await removeScratch(scratch);
-	} catch (error) {
-		const cleanupDiagnostic = String(error);
-		result = result.succeeded ? {
-			succeeded: false,
-			reason: "cleanup-failed",
-			diagnostic: cleanupDiagnostic,
-			stdout: result.value.stdout,
-			stderr: result.value.stderr,
-			exitCode: 0
-		} : {
-			...result,
-			cleanupDiagnostic
-		};
-	}
-	return outputs ? {
-		...result,
-		outputs
-	} : result;
-}
-/** A preexisting input file must never masquerade as newly produced evaluator evidence. */
-function assertOutputPathsUnoccupied(paths, input) {
-	for (const path of paths) if (input.files.some((file) => file.path === path || file.path.startsWith(`${path}/`) || path.startsWith(`${file.path}/`))) throw new Error("Declared check output path overlaps an input file");
-}
-function withRetainedOutputs(result, outputs) {
-	if (!result.succeeded || outputs.status === "retained") return {
-		...result,
-		outputs
-	};
-	return {
-		succeeded: false,
-		reason: "failed",
-		diagnostic: "Check outputs were not completely retained",
-		stdout: result.value.stdout,
-		stderr: result.value.stderr,
-		exitCode: 0,
-		outputs
-	};
-}
-function checkLimits(options) {
-	const timeoutMs = options.timeoutMs ?? 3e4;
-	const maxOutputBytes = options.maxOutputBytes ?? 1048576;
-	const maxInputBytes = options.maxInputBytes;
-	const maxInputEntries = options.maxInputEntries;
-	if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2147483647 || !Number.isSafeInteger(maxOutputBytes) || maxOutputBytes < 1 || maxInputBytes !== void 0 && (!Number.isSafeInteger(maxInputBytes) || maxInputBytes < 1) || maxInputEntries !== void 0 && (!Number.isSafeInteger(maxInputEntries) || maxInputEntries < 1)) throw new Error("Invalid execution limits");
-	if (!options.command.length || !options.command[0]) throw new Error("A command is required");
-	return {
-		timeoutMs,
-		maxOutputBytes,
-		maxInputBytes,
-		maxInputEntries
-	};
-}
-var InputLimitError = class extends Error {};
-/** Copy in bounded chunks, preserving symlink text without reading its target. */
-async function copyBoundedTree(source, destination, maxBytes, maxEntries) {
-	let bytes = 0;
-	let entries = 0;
-	const buffer = Buffer.allocUnsafe(1048576);
-	const visit = async (from, to, isRoot = false) => {
-		if (!isRoot && ++entries > (maxEntries ?? Number.MAX_SAFE_INTEGER)) throw new InputLimitError("Input tree exceeds maxInputEntries");
-		const info = await lstat(from);
-		if (info.isSymbolicLink()) await symlink(await readlink(from), to);
-		else if (info.isDirectory()) {
-			await mkdir(to, { mode: 448 });
-			for await (const entry of await opendir(from)) await visit(join(from, entry.name), join(to, entry.name));
-			await chmod(to, info.mode & 511);
-		} else if (info.isFile()) {
-			if (maxBytes !== void 0 && info.size > maxBytes - bytes) throw new InputLimitError("Input tree exceeds maxInputBytes");
-			const input = await open(from, constants.O_RDONLY | constants.O_NOFOLLOW);
-			try {
-				const output = await open(to, "wx", info.mode & 511);
-				try {
-					while (true) {
-						const { bytesRead } = await input.read(buffer, 0, maxBytes === void 0 ? buffer.length : Math.min(buffer.length, maxBytes - bytes + 1), null);
-						if (bytesRead === 0) break;
-						bytes += bytesRead;
-						if (maxBytes !== void 0 && bytes > maxBytes) throw new InputLimitError("Input tree exceeds maxInputBytes");
-						let written = 0;
-						while (written < bytesRead) {
-							const result = await output.write(buffer, written, bytesRead - written);
-							if (result.bytesWritten === 0) throw new Error("Input copy made no write progress");
-							written += result.bytesWritten;
-						}
-					}
-				} finally {
-					await output.close();
-				}
-				await chmod(to, info.mode & 511);
-			} finally {
-				await input.close();
-			}
-		} else throw new Error(`Input tree contains an unsupported entry: ${from}`);
-	};
-	await visit(source, destination, true);
-}
-async function checkInputEntries(root, maxEntries) {
-	let count = 0;
-	const visit = async (path, isRoot = false) => {
-		if (!isRoot && ++count > maxEntries) throw new InputLimitError("Input tree exceeds maxInputEntries");
-		if (!(await lstat(path)).isDirectory()) return;
-		for await (const entry of await opendir(path)) await visit(join(path, entry.name));
-	};
-	await visit(root, true);
-}
-async function protectedTree(options) {
-	const workspace = await realpath(options.workspaceRoot);
-	const tree = await realpath(options.tree);
-	if (!contains(workspace, tree) || !(await stat(tree)).isDirectory()) throw new Error("Tree must be a directory inside the workspace");
-	return {
-		workspace,
-		tree
-	};
-}
-/** Box-workspace-relative directory that receives the tree and is the command's cwd. */
-const BOX_TREE = "tree";
-/** Setup headroom in the requested native lifetime policy; this is not a deletion guarantee. */
-const BOX_SETUP_SECONDS = 900;
-/** The box's own process timeout is a backstop behind this module's deadline. */
-const BOX_PROCESS_BACKSTOP_MS = 3e4;
-/** The box's process supervisor prefixes this to stderr when it cannot start the executable. */
-const BOX_EXEC_FAILURE = "process-supervisor: exec failed";
-async function runInBox(options, placement) {
-	let box;
-	let evidence;
-	let outputs;
-	let retention;
-	let maxLifetimeSeconds;
-	let commandAttempted = false;
-	let commandSettled = false;
-	let result;
-	try {
-		retention = prepareIsolatedCheckOutputs(options.outputs);
-		const { timeoutMs, maxOutputBytes, maxInputBytes, maxInputEntries } = checkLimits(options);
-		maxLifetimeSeconds = Math.ceil(timeoutMs / 1e3) + BOX_SETUP_SECONDS;
-		if (options.signal?.aborted) return {
-			succeeded: false,
-			reason: "cancelled",
-			diagnostic: "Check cancelled"
-		};
-		const { tree } = await protectedTree(options);
-		if (maxInputEntries !== void 0) await checkInputEntries(tree, maxInputEntries);
-		const captured = await captureMaterializedWorkspace(tree, { limits: {
-			maxFiles: maxInputEntries ?? Number.MAX_SAFE_INTEGER,
-			maxFileBytes: maxInputBytes ?? Number.MAX_SAFE_INTEGER,
-			maxTotalFileBytes: maxInputBytes ?? Number.MAX_SAFE_INTEGER
-		} });
-		if (retention) assertOutputPathsUnoccupied(retention.paths, captured.manifest);
-		if (placement.builderAccounts.length === 0 || placement.builderAccounts.some((id) => !id)) throw new Error("builderAccounts must name the account of every key the judged run holds");
-		const memoryMB = placement.resources?.memoryMB;
-		if (memoryMB !== void 0 && (!Number.isSafeInteger(memoryMB) || memoryMB < 1 || placement.resources?.advisory === true || placement.resources?.advisoryFields?.includes("memoryMB"))) throw new Error("Check box requires an explicit finite resources.memoryMB limit");
-		const account = (await placement.client.getIdentity()).customerId;
-		if (!account) throw new Error("Sandbox returned no account for the check key");
-		if (placement.builderAccounts.includes(account)) throw new Error(`Check account ${account} is an account the judged run holds a key to, so the run can reach the check box`);
-		options.signal?.throwIfAborted();
-		box = await placement.client.createIsolated({
-			environment: placement.environment,
-			agent: placement.containers === true,
-			bare: false,
-			ephemeral: placement.containers !== true,
-			egressPolicy: egressFor(placement),
-			...placement.resources ? { resources: placement.resources } : {},
-			maxLifetimeSeconds,
-			idempotencyKey: `agent-runtime-check-${randomUUID()}`
-		}, options.signal ? { signal: options.signal } : void 0);
-		const receipt = box.createReceipt();
-		if (receipt?.outcome !== "created" || receipt.ownerContext !== "isolated" || !Array.isArray(receipt.injectedSecrets) || receipt.injectedSecrets.length !== 0) throw new Error("Sandbox did not confirm a fresh box with no owner secrets");
-		const grantedMemoryMB = box.resources?.memoryMB;
-		if (memoryMB !== void 0 && (typeof grantedMemoryMB !== "number" || !Number.isSafeInteger(grantedMemoryMB) || grantedMemoryMB < 1 || grantedMemoryMB > memoryMB)) throw new Error("Sandbox did not confirm the requested finite memory cgroup limit");
-		const egress = (await box.egress.get()).policy;
-		const wanted = egressFor(placement);
-		if (egress.mode !== wanted.mode || wanted.mode === "strict" && (egress.includeImplicitDomains === true || [...egress.allowDomains ?? []].sort().join(",") !== [...wanted.allowDomains ?? []].sort().join(","))) throw new Error(`Check box egress is ${egress.mode} ${JSON.stringify(egress.allowDomains ?? [])}, not ${wanted.mode} ${JSON.stringify(wanted.allowDomains ?? [])}`);
-		const staging = await mkdtemp(join(tmpdir(), "runtime-check-box-"));
-		try {
-			for (const file of captured.files) {
-				const path = join(staging, file.path);
-				await mkdir(dirname(path), { recursive: true });
-				await writeFile(path, file.bytes, { mode: file.mode });
-			}
-			options.signal?.throwIfAborted();
-			await box.fs.uploadDir(staging, BOX_TREE);
-		} finally {
-			await rm(staging, {
-				recursive: true,
-				force: true
-			});
-		}
-		await verifyBoxTree(box, captured.manifest.files);
-		evidence = {
-			sandboxId: box.id,
-			account,
-			...memoryMB === void 0 ? {} : { memoryMB: grantedMemoryMB },
-			input: captured.manifest,
-			inputDigest: canonicalCandidateDigest(captured.manifest)
-		};
-		commandAttempted = true;
-		const execution = await executeInBox(box, options.command, timeoutMs, maxOutputBytes, options.env ?? {}, options.signal);
-		result = execution.result;
-		commandSettled = execution.commandSettled;
-	} catch (error) {
-		result = {
-			succeeded: false,
-			reason: options.signal?.aborted ? "cancelled" : error instanceof InputLimitError || error instanceof WorkspaceScanLimitError ? "input-limit" : "refused",
-			diagnostic: String(error)
-		};
-	}
-	if (box && evidence && retention && maxLifetimeSeconds !== void 0 && commandAttempted && (!commandSettled || result.succeeded || result.reason !== "refused")) {
-		outputs = commandSettled ? await retainIsolatedCheckOutputs(retention, evidence.inputDigest, boxCheckOutputReader(box, BOX_TREE, retention.timeoutMs ?? 3e4)) : {
-			executionId: retention.executionId,
-			inputDigest: evidence.inputDigest,
-			status: "incomplete",
-			files: [],
-			missing: retention.paths.map((path) => ({
-				path,
-				reason: "capture-failed"
-			}))
-		};
-		result = withRetainedOutputs(result, outputs);
-		if (outputs.status === "incomplete") {
-			if (await stopCheckBoxForRecovery(box)) outputs = {
-				...outputs,
-				source: {
-					kind: "sandbox",
-					sandboxId: box.id,
-					state: "stopped"
-				}
-			};
-			else if (!result.succeeded) result = {
-				...result,
-				cleanupDiagnostic: "Recovery source stop was not confirmed; box deletion was requested"
-			};
-		}
-	}
-	if (box && outputs?.source?.kind !== "sandbox") try {
-		await box.delete();
-	} catch (error) {
-		const cleanupDiagnostic = `Check box ${box.id} was not deleted: ${String(error)}`;
-		result = result.succeeded ? {
-			succeeded: false,
-			reason: "cleanup-failed",
-			diagnostic: cleanupDiagnostic,
-			stdout: result.value.stdout,
-			stderr: result.value.stderr,
-			exitCode: 0
-		} : {
-			...result,
-			cleanupDiagnostic: [result.cleanupDiagnostic, cleanupDiagnostic].filter(Boolean).join("; ")
-		};
-	}
-	return {
-		...result,
-		...evidence ? { box: evidence } : {},
-		...outputs ? { outputs } : {}
-	};
-}
-/** Refuse unless the box reads each file with its manifest digest. `find` names the files: a box
-* process takes 256 arguments at most. A name holding a newline or backslash, which coreutils
-* escapes, does not compare. */
-async function verifyBoxTree(box, files) {
-	const child = await box.process.spawnExact("find", [
-		".",
-		"-type",
-		"f",
-		"-exec",
-		"sha256sum",
-		"{}",
-		"+"
-	], {
-		cwd: BOX_TREE,
-		env: {
-			PATH: "/usr/bin:/bin",
-			LANG: "C"
-		},
-		inheritEnv: false,
-		timeoutMs: BOX_SETUP_SECONDS * 1e3
-	});
-	let listing = "";
-	for await (const text of child.stdout()) listing += text;
-	if (await child.wait() !== 0) throw new Error("Check box could not hash the tree it received");
-	const read = new Set(listing.split("\n").map((line) => `sha256:${line.slice(0, 64)} ${line.slice(68)}`));
-	for (const file of files) if (!read.has(`${file.sha256} ${file.path}`)) throw new Error(`Check box received different bytes for ${file.path}`);
-}
-/** Blocked unless the placement names domains; then strict, with no implicit domain list. */
-function egressFor(placement) {
-	const domains = [...new Set(placement.egress ?? [])].filter((domain) => domain.trim() !== "");
-	return domains.length === 0 ? { mode: "blocked" } : {
-		mode: "strict",
-		allowDomains: domains,
-		includeImplicitDomains: false
-	};
-}
-async function executeInBox(box, command, timeoutMs, limit, env, signal) {
-	const [executable, ...args] = command;
-	let child;
-	const deadline = new AbortController();
-	const stdout = [];
-	const stderr = [];
-	let bytes = 0;
-	let failure;
-	let stopping;
-	let stopped = false;
-	const stop = (reason) => {
-		failure ??= reason;
-		deadline.abort();
-		if (child) stopping ??= stopCheckProcess(child);
-	};
-	const clearTimer = armDeadlineTimer(timeoutMs, () => stop("timeout"), true);
-	const cancel = () => stop("cancelled");
-	signal?.addEventListener("abort", cancel, { once: true });
-	if (signal?.aborted) cancel();
-	const capture = async (stream, target) => {
-		for await (const text of stream) {
-			if (deadline.signal.aborted) break;
-			const chunk = Buffer.from(text);
-			const remaining = Math.max(0, limit - bytes);
-			bytes += chunk.length;
-			if (remaining) target.push(chunk.subarray(0, remaining));
-			if (bytes > limit) stop("output-limit");
-		}
-	};
-	let completion;
-	try {
-		child = await runAbortable(() => {
-			const launching = box.process.spawnExact(executable, args, {
-				cwd: BOX_TREE,
-				env: {
-					PATH: "/usr/bin:/bin",
-					HOME: "/tmp",
-					LANG: "C",
-					...env
-				},
-				inheritEnv: false,
-				timeoutMs: timeoutMs + BOX_PROCESS_BACKSTOP_MS
-			});
-			launching.then((late) => {
-				if (deadline.signal.aborted) stopCheckProcess(late);
-			}, () => void 0);
-			return launching;
-		}, deadline.signal, "Check interrupted");
-		const running = child;
-		completion = await runAbortable(async () => {
-			await Promise.all([capture(running.stdout(), stdout), capture(running.stderr(), stderr)]);
-			return {
-				exitCode: await running.wait(),
-				exitSignal: (await running.status()).exitSignal
-			};
-		}, deadline.signal, "Check interrupted");
-	} catch (error) {
-		if (child) stopping ??= stopCheckProcess(child);
-		if (!failure) throw error;
-	} finally {
-		clearTimer();
-		signal?.removeEventListener("abort", cancel);
-		stopped = await stopping === true;
-	}
-	const out = Buffer.concat(stdout).toString();
-	const err = Buffer.concat(stderr).toString();
-	const exitCode = completion?.exitCode ?? null;
-	const exitSignal = completion?.exitSignal;
-	const evidence = {
-		stdout: out,
-		stderr: err,
-		exitCode: exitSignal ? null : exitCode
-	};
-	const finish = (result) => ({
-		result,
-		commandSettled: completion !== void 0 || stopped
-	});
-	if (failure) return finish({
-		succeeded: false,
-		reason: failure,
-		diagnostic: err || failure,
-		...evidence
-	});
-	if (exitCode === 127 && err.startsWith(BOX_EXEC_FAILURE)) return finish({
-		succeeded: false,
-		reason: "refused",
-		diagnostic: err,
-		...evidence
-	});
-	if (exitSignal) return finish({
-		succeeded: false,
-		reason: "failed",
-		diagnostic: err || `Check killed by ${exitSignal}`,
-		...evidence
-	});
-	if (exitCode !== 0) return finish({
-		succeeded: false,
-		reason: "failed",
-		diagnostic: err || out || `Check exited ${exitCode}`,
-		...evidence
-	});
-	return finish({
-		succeeded: true,
-		value: {
-			stdout: out,
-			stderr: err
-		}
-	});
-}
-function execute(args, timeoutMs, limit, signal) {
-	return new Promise((done) => {
-		const child = spawn("/usr/bin/bwrap", [
-			"--json-status-fd",
-			"3",
-			...args
-		], {
-			env: {},
-			stdio: [
-				"ignore",
-				"pipe",
-				"pipe",
-				"pipe"
-			],
-			detached: true
-		});
-		const stdout = [];
-		const stderr = [];
-		let bytes = 0;
-		let status = "";
-		let failure;
-		const stop = (reason) => {
-			failure ??= reason;
-			if (child.pid) try {
-				process.kill(-child.pid, "SIGKILL");
-			} catch (error) {
-				if (error.code !== "ESRCH") child.kill("SIGKILL");
-			}
-		};
-		const clearTimer = armDeadlineTimer(timeoutMs, () => stop("timeout"), true);
-		const cancel = () => stop("cancelled");
-		signal?.addEventListener("abort", cancel, { once: true });
-		if (signal?.aborted) cancel();
-		const capture = (target) => (chunk) => {
-			const remaining = Math.max(0, limit - bytes);
-			bytes += chunk.length;
-			if (remaining) target.push(chunk.subarray(0, remaining));
-			if (bytes > limit) stop("output-limit");
-		};
-		child.stdio[3]?.on("data", (chunk) => {
-			if (status.length + chunk.length > 16384) {
-				stop("output-limit");
-				return;
-			}
-			status += chunk.toString();
-		});
-		child.stdout.on("data", capture(stdout));
-		child.stderr.on("data", capture(stderr));
-		let spawnError;
-		child.on("error", (error) => {
-			spawnError = error;
-		});
-		child.on("close", (code) => {
-			clearTimer();
-			signal?.removeEventListener("abort", cancel);
-			const out = Buffer.concat(stdout).toString();
-			const err = Buffer.concat(stderr).toString();
-			const evidence = {
-				stdout: out,
-				stderr: err,
-				exitCode: code
-			};
-			const executed = status.split("\n").some((line) => {
-				try {
-					const record = JSON.parse(line);
-					return record !== null && typeof record === "object" && "exit-code" in record && typeof record["exit-code"] === "number" && record["exit-code"] === code;
-				} catch {
-					return false;
-				}
-			});
-			if (failure) done({
-				succeeded: false,
-				reason: failure,
-				diagnostic: err || failure,
-				...evidence
-			});
-			else if (spawnError) done({
-				succeeded: false,
-				reason: "refused",
-				diagnostic: String(spawnError),
-				...evidence
-			});
-			else if (!executed) done({
-				succeeded: false,
-				reason: "refused",
-				diagnostic: err || "Bubblewrap did not confirm command execution",
-				...evidence
-			});
-			else if (code !== 0) done({
-				succeeded: false,
-				reason: "failed",
-				diagnostic: err || out || `Check exited ${code}`,
-				...evidence
-			});
-			else done({
-				succeeded: true,
-				value: {
-					stdout: out,
-					stderr: err
-				}
-			});
-		});
-	});
-}
-const executeFile = promisify(execFile);
-/** GNU tools traverse relative to open directories, including trees deeper than PATH_MAX.
-* Recursive chmod ignores encountered symlinks; rm never follows their targets. */
-async function removeScratch(path) {
-	const options = {
-		env: {},
-		timeout: 1e4,
-		maxBuffer: 16384
-	};
-	let permissionError;
-	try {
-		await executeFile("/bin/chmod", [
-			"--recursive",
-			"--preserve-root",
-			"u+rwX",
-			"--",
-			path
-		], options);
-	} catch (error) {
-		permissionError = error;
-	}
-	try {
-		await executeFile("/bin/rm", [
-			"--recursive",
-			"--force",
-			"--one-file-system",
-			"--",
-			path
-		], options);
-	} catch (error) {
-		throw new Error([permissionError, error].filter((value) => value !== void 0).map(String).join("; "));
-	}
-}
 // src/runtime/declared-check.ts
 /**
 * A declared check: the one frozen evaluator program that decides "done" for a run, named by
@@ -7736,7 +6819,7 @@ function graphDesignerExtraTools(env) {
 			})();
 			if (name === "designer_history") return (async () => {
 				const args = asRecord(raw ?? {}, "designer_history");
-				const { listGraphRuns } = await import("./graph-registry-gYbq4L5Z.js");
+				const { listGraphRuns } = await import("./graph-registry-uTIyyy7A.js");
 				const all = await listGraphRuns(registry);
 				return { runs: (args.taskShape === void 0 ? all : all.filter((row) => row.taskDigest === taskShapeDigest(asRecord(args.taskShape, "designer_history.taskShape")))).map(summarize) };
 			})();
@@ -7747,7 +6830,7 @@ function graphDesignerExtraTools(env) {
 				if (mode === "replay") {
 					const digest = args.graphDigest;
 					if (typeof digest !== "string" || digest.length === 0) throw new ValidationError("designer_run_graph: replay mode requires graphDigest from lookup");
-					const { loadGraph } = await import("./graph-registry-gYbq4L5Z.js");
+					const { loadGraph } = await import("./graph-registry-uTIyyy7A.js");
 					const stored = await loadGraph(registry, digest);
 					if (!stored) throw new ValidationError(`designer_run_graph: no stored graph ${digest.slice(0, 12)} — re-lookup`);
 					const graph = env.bindCheck(graphFromStored(stored, () => {
@@ -7803,14 +6886,6 @@ var GraphFileResolutionError = class extends Error {
 function refuse$2(message) {
 	throw new ValidationError(`loadGraphFile: ${message}`);
 }
-function jsonData(value, visiting = /* @__PURE__ */ new Set()) {
-	if (value === null || typeof value === "string" || typeof value === "boolean") return;
-	if (typeof value === "number" && Number.isFinite(value)) return;
-	if (!value || typeof value !== "object" || visiting.has(value)) refuse$2("definition must be finite, acyclic JSON data");
-	visiting.add(value);
-	for (const child of Object.values(value)) jsonData(child, visiting);
-	visiting.delete(value);
-}
 function bindParameters(raw, supplied) {
 	const definitions = graphFileSchema.shape.params.parse(raw.params) ?? {};
 	for (const key of Object.keys(supplied ?? {})) if (!Object.hasOwn(definitions, key)) refuse$2(`unknown parameter ${key}`);
@@ -7826,7 +6901,7 @@ function bindParameters(raw, supplied) {
 		if (type) {
 			if (!(type === "integer" ? Number.isSafeInteger(value) : type === "null" ? value === null : type === "array" ? Array.isArray(value) : type === "object" ? value !== null && typeof value === "object" && !Array.isArray(value) : typeof value === type)) refuse$2(`parameter ${key} must be ${type}`);
 		}
-		jsonData(value);
+		assertJsonData(value, "loadGraphFile");
 		return [key, value];
 	}));
 }
@@ -7920,7 +6995,7 @@ async function loadGraphFile(file, options = {}) {
 	if (document.errors.length) refuse$2(document.errors.map((error) => error.message).join("; "));
 	if (document.warnings.length) refuse$2(document.warnings.map((warning) => warning.message).join("; "));
 	const raw = format === ".json" ? JSON.parse(text) : document.toJS({ maxAliasCount: 100 });
-	jsonData(raw);
+	assertJsonData(raw, "loadGraphFile");
 	if (!raw || typeof raw !== "object" || Array.isArray(raw)) refuse$2("definition must be an object");
 	const source = raw;
 	if (Array.isArray(source.nodes) && source.nodes.some((node) => node && typeof node === "object" && "call" in node)) refuse$2("call vertices are not supported by this loader");
@@ -7933,6 +7008,7 @@ async function loadGraphFile(file, options = {}) {
 	const bindingOptions = options.trigger === void 0 ? { defer: ["trigger"] } : {};
 	const compiled = compileGraphParameters(authored, bindings, bindingOptions);
 	const bound = graphFileSchema.parse(compiled.value);
+	if (bound.entry && bound.continuation) refuse$2("continuation with entry has no root manager");
 	const boundOn = on === void 0 ? void 0 : bindGraphParameters(on, bindings, bindingOptions);
 	if (bound.check && bound.deliverable) refuse$2("use check or deliverable, not both");
 	let deliverable = bound.deliverable;
@@ -7957,15 +7033,25 @@ async function loadGraphFile(file, options = {}) {
 	if (!deliverable) refuse$2("check or deliverable is required");
 	if (deliverable.checkRef === "route" && !deliverable.when) refuse$2("route deliverable requires when");
 	if (deliverable.checkRef === "command" && !deliverable.command) refuse$2("command deliverable requires command");
-	const nodes = await Promise.all(bound.nodes.map(async (node) => ({
-		id: node.id,
-		profile: await expandProfile(node, {
-			...options,
-			cwd: options.cwd ?? dirname(file)
-		})
-	})));
+	const nodes = await Promise.all(bound.nodes.map(async (node) => {
+		if (node.check === void 0) return {
+			id: node.id,
+			profile: await expandProfile(node, {
+				...options,
+				cwd: options.cwd ?? dirname(file)
+			})
+		};
+		if (node.profile || node.seat || node.needs) refuse$2(`check node ${node.id} runs a command and takes no profile, seat or needs`);
+		if (node.id === "params" || node.id === "trigger") refuse$2(`reserved node id ${node.id}`);
+		return {
+			id: node.id,
+			profile: { name: node.id },
+			check: node.check
+		};
+	}));
 	const nodeIds = new Set(nodes.map((node) => node.id));
 	for (const id of Object.keys(options.nodeSeats ?? {})) if (!nodeIds.has(id)) refuse$2(`seat override references unknown node ${id}`);
+	if (nodes.some((node) => node.check) && !bound.entry) refuse$2("check nodes run only in a flow graph (one with entry)");
 	if (deliverable.when) {
 		for (const condition of "all" in deliverable.when ? deliverable.when.all : [deliverable.when]) if (condition.node !== void 0 && !nodeIds.has(condition.node)) refuse$2(`check references unknown node ${condition.node}`);
 	}
@@ -7978,11 +7064,14 @@ async function loadGraphFile(file, options = {}) {
 			node: entry,
 			task: {}
 		} : entry) } : {},
-		...bound.gates ? { gates: bound.gates } : {}
+		...bound.gates ? { gates: bound.gates } : {},
+		...bound.workspace ? { workspace: bound.workspace } : {},
+		...bound.continuation ? { continuation: bound.continuation } : {}
 	};
 	const triggerBindings = compiled.triggerBindings.flatMap((slot) => {
 		const [top, index, field, ...tail] = slot.path;
 		if (top === "nodes") {
+			if (field === "check") refuse$2("trigger slots in a check node command are not shell data");
 			if (field === "id") return [slot, {
 				...slot,
 				path: [
@@ -8042,7 +7131,8 @@ async function loadGraphFile(file, options = {}) {
 			"budget",
 			"gates",
 			"entry",
-			"deliverable"
+			"deliverable",
+			"continuation"
 		].includes(String(top)) ? [slot] : [];
 	});
 	assertGraphTriggerBindings(topology, triggerBindings);
@@ -8064,6 +7154,19 @@ async function loadGraphFile(file, options = {}) {
 		...boundOn === void 0 ? {} : { on: boundOn }
 	};
 }
+/**
+* The directory a graph run's nodes work in. `workspace: cwd` (the default) is `cwd`. `workspace:
+* fresh` is a new empty directory the run owns, `<root>/<runId>` (default root
+* `~/.tangle/workspaces`); a resumed run with the same id reuses it. The host passes the result as
+* the backend's working directory, where agent and check nodes both run.
+*/
+async function graphWorkspace(graph, options) {
+	if ((graph.workspace ?? "cwd") === "cwd") return options.cwd;
+	if (!/^(?!\.\.?$)[A-Za-z0-9._-]+$/.test(options.runId)) throw new ValidationError(`graphWorkspace: run id ${JSON.stringify(options.runId)} is not a directory name`);
+	const directory = join(options.root ?? join(homedir(), ".tangle", "workspaces"), options.runId);
+	await mkdir(directory, { recursive: true });
+	return directory;
+}
 // src/runtime/supervise/graph-session-observation.ts
 function measured(fact) {
 	return fact && !fact.partial && fact.value !== null ? fact.value : void 0;
@@ -9126,7 +8229,9 @@ const storedGraphSchema = graphFileSchema.pick({
 }).required().extend({
 	observed: z.literal(false).optional(),
 	triggerBindings: graphTriggerBindingsSchema.optional(),
-	nodes: z.array(node).min(1),
+	nodes: z.array(node.extend({ check: graphCheckNodeSchema.optional() })).min(1),
+	workspace: graphFileSchema.shape.workspace,
+	continuation: graphFileSchema.shape.continuation,
 	edges: z.array(edge),
 	entry: entry.optional(),
 	gates: gates.optional()
@@ -9134,40 +8239,19 @@ const storedGraphSchema = graphFileSchema.pick({
 function refuse(message) {
 	throw new ValidationError(`validateStoredGraph: ${message}`);
 }
-/** Inspect descriptors instead of invoking accessors; JSON has no getters, symbols, prototypes,
-* sparse arrays, undefined, closures or cycles. Repeated non-cyclic references remain JSON data. */
-function assertJsonData(value, visiting = /* @__PURE__ */ new Set()) {
-	if (value === null || typeof value === "string" || typeof value === "boolean") return;
-	if (typeof value === "number" && Number.isFinite(value)) return;
-	if (!value || typeof value !== "object" || visiting.has(value)) refuse("expected finite, acyclic JSON data without executable values");
-	const array = Array.isArray(value);
-	const prototype = Object.getPrototypeOf(value);
-	if (array ? prototype !== Array.prototype : prototype !== Object.prototype && prototype !== null) refuse("expected plain JSON objects and arrays");
-	visiting.add(value);
-	const descriptors = Object.getOwnPropertyDescriptors(value);
-	const keys = Reflect.ownKeys(descriptors);
-	if (array && keys.length !== value.length + 1) refuse("sparse arrays are not canonical JSON");
-	for (const key of keys) {
-		if (array && key === "length") continue;
-		const property = typeof key === "string" ? descriptors[key] : void 0;
-		if (!property || !property.enumerable || !("value" in property)) refuse("JSON data cannot contain symbols, hidden properties or accessors");
-		if (array && (!/^(0|[1-9]\d*)$/.test(key) || Number(key) >= value.length)) refuse("arrays may contain only indexed JSON values");
-		assertJsonData(property.value, visiting);
-	}
-	visiting.delete(value);
-}
 function assertExecutableNodes(graph) {
-	for (const item of graph.nodes) assertExecutableAgentProfile(item.profile, `validateStoredGraph node ${item.id}`);
+	for (const item of graph.nodes) if (item.check === void 0) assertExecutableAgentProfile(item.profile, `validateStoredGraph node ${item.id}`);
 	for (const item of graph.edges) if (item.kind === "maps" && item.graph) assertExecutableNodes(item.graph);
 }
 /** Validate compiled, runnable StoredGraph data. Authored params/seats/on envelopes belong to
 * loadGraphFile; observations belong to the registry's observation importer, never this entry.
 * No check function or model call is executed while validating environment-owned references. */
 function validateStoredGraph(value, options = {}) {
-	assertJsonData(value);
+	assertJsonData(value, "validateStoredGraph");
 	const parsed = storedGraphSchema.safeParse(value);
 	if (!parsed.success) refuse(parsed.error.message);
 	const graph = parsed.data;
+	if (graph.entry && graph.continuation) refuse("continuation with entry has no root manager");
 	if (graph.triggerBindings !== void 0) assertGraphTriggerBindings(graph, graph.triggerBindings);
 	const check = graph.deliverable;
 	if (check.checkRef === "command") {
@@ -9187,6 +8271,11 @@ function validateStoredGraph(value, options = {}) {
 		const ids = new Set(graph.nodes.map((item) => item.id));
 		for (const condition of "all" in check.when ? check.when.all : [check.when]) if (condition.node !== void 0 && !ids.has(condition.node)) refuse(`check references unknown node ${condition.node}`);
 	}
+	for (const item of graph.nodes) {
+		if (item.check === void 0) continue;
+		if (!graph.entry || check.command) refuse("check nodes need a flow graph without a command check");
+		if (item.profile.name !== item.id || Object.keys(item.profile).length !== 1) refuse(`check node ${item.id} carries a profile; its profile is { name: id }`);
+	}
 	assertExecutableNodes(graph);
 	const registry = options.registry ?? kernelPromptRegistry();
 	if (graph.entry) validateFlowGraph(graph, registry, options.analysts);
@@ -10462,6 +9551,6 @@ async function runInWorkspace(ws, body, opts = {}) {
 function tail(s) {
 	return s.slice(-400);
 }
-export { runBenchmark as $, pairwiseSignificance as $t, searchPresets as A, sanitizeMcpToolSchema as At, graphFromSessionFacts as B, assertDeclaredCheck as Bt, withUntrackedArtifacts as C, harvestCorpus as Ct, SEARCH_SPEC_CORRELATION_KEY as D, connectStdioMcp as Dt, createFencedSqlRunContext as E, McpSpawnFault as Et, loadProfile as F, secretEnvOfMcpServer as Ft, chatWorkerSeam as G, readDeclaredCheck as Gt, loadGraphFile as H, declaredCheckDeliverable as Ht, pickBestProfile as I, inlineSandboxClient as It, strategyTournament as J, completionAuthorizes as Jt, createChatSessionStore as K, runIsolatedCheck as Kt, profileRegistry as L, loopCampaignDispatch as Lt, connectRemoteSupervisor as M, mcpSecretEnvMetadataKey as Mt, connectRemoteSupervisorControl as N, resolveMcpServerLaunch as Nt, assertSearchSpec as O, materializeLocalMcp as Ot, bestProfileFor as P, resolveSecretEnv as Pt, printBenchmarkReport as Q, leaderboard as Qt, profileRunsForName as R, loopDispatch as Rt, copyUntrackedIntoClone as S, HarvestError as St, validateStoredGraph as T, resolveSandboxClient as Tt, graphDesignerExtraTools as U, declaredCheckDigest as Ut, GraphFileResolutionError as V, checkProgramDigest as Vt, chatTransportExecutor as W, declaredCheckJudge as Wt, openSandboxRun as X, sentinelCompletion as Xt, SandboxRunAbortError as Y, deterministicCompletion as Yt, createS3PrivateCasStore as Z, stopSentinel as Zt, NOTE_MAX_CHARS as _, buildSteerContext as _t, localShell as a, openSqlRunStore as an, FileCorpus as at, composeWorkerEvidence as b, observationFromRegistry as bt, createVerifierEnvironment as c, fanout as ct, harvestSurfaceDiffs as d, panel as dt, renderLeaderboardHtml as en, createPrivateCasArtifactPort as et, analystsFromRegistry as f, pipeline as ft, EVIDENCE_MAX_CHARS as g, assertTraceDerivedFindings as gt, runCoderChecks as h, widen as ht, jjWorkspace as i, SqlRunOwnershipError as in, runPersonified as it, searchSpecDigest as j, envKeyProvider as jt, compileSearchSpec as k, createMcpEnvironment as kt, boxSurfaceReader as l, flatWidenGate as lt, worktreeFanout as m, verify as mt, makeFinding$1 as n, renderLeaderboardSvg as nn, trajectoryReport as nt, runInWorkspace as o, InMemoryCorpus as ot, failuresAnalyst as p, selectValidWinner as pt, runStrategyEvolution as q, validateIsolatedCheckOutputs as qt, gitWorkspace as r, renderPairwiseMarkdown as rn, definePersona as rt, createWaterfallCollector as s, renderCorpusToInstructions as st, computeFindingId$1 as t, renderLeaderboardMarkdown as tn, equalKOnCost as tt, fsSurfaceReader as u, loopUntil as ut, VERIFY_TAIL_CHARS as v, createScopeAnalyst as vt, analyzeTrace as w, defineLeaderboard as wt, settledWorkerOut as x, inProcessSandboxClient as xt, closingWorkerNote as y, registryScopeAnalyst as yt, recordProfileRun as z, superviseDispatch as zt };
+export { printBenchmarkReport as $, renderLeaderboardHtml as $t, searchPresets as A, createMcpEnvironment as At, graphFromSessionFacts as B, superviseDispatch as Bt, withUntrackedArtifacts as C, HarvestError as Ct, SEARCH_SPEC_CORRELATION_KEY as D, McpSpawnFault as Dt, createFencedSqlRunContext as E, resolveSandboxClient as Et, loadProfile as F, resolveSecretEnv as Ft, chatTransportExecutor as G, declaredCheckJudge as Gt, graphWorkspace as H, checkProgramDigest as Ht, pickBestProfile as I, secretEnvOfMcpServer as It, runStrategyEvolution as J, deterministicCompletion as Jt, chatWorkerSeam as K, readDeclaredCheck as Kt, profileRegistry as L, inlineSandboxClient as Lt, connectRemoteSupervisor as M, envKeyProvider as Mt, connectRemoteSupervisorControl as N, mcpSecretEnvMetadataKey as Nt, assertSearchSpec as O, connectStdioMcp as Ot, bestProfileFor as P, resolveMcpServerLaunch as Pt, createS3PrivateCasStore as Q, pairwiseSignificance as Qt, profileRunsForName as R, loopCampaignDispatch as Rt, copyUntrackedIntoClone as S, inProcessSandboxClient as St, validateStoredGraph as T, defineLeaderboard as Tt, loadGraphFile as U, declaredCheckDeliverable as Ut, GraphFileResolutionError as V, assertDeclaredCheck as Vt, graphDesignerExtraTools as W, declaredCheckDigest as Wt, SandboxRunAbortError as X, stopSentinel as Xt, strategyTournament as Y, sentinelCompletion as Yt, openSandboxRun as Z, leaderboard as Zt, NOTE_MAX_CHARS as _, assertTraceDerivedFindings as _t, localShell as a, runPersonified as at, composeWorkerEvidence as b, registryScopeAnalyst as bt, createVerifierEnvironment as c, renderCorpusToInstructions as ct, harvestSurfaceDiffs as d, loopUntil as dt, renderLeaderboardMarkdown as en, runBenchmark as et, analystsFromRegistry as f, panel as ft, EVIDENCE_MAX_CHARS as g, widen as gt, runCoderChecks as h, verify as ht, jjWorkspace as i, openSqlRunStore as in, definePersona as it, searchSpecDigest as j, sanitizeMcpToolSchema as jt, compileSearchSpec as k, materializeLocalMcp as kt, boxSurfaceReader as l, fanout as lt, worktreeFanout as m, selectValidWinner as mt, makeFinding$1 as n, renderPairwiseMarkdown as nn, equalKOnCost as nt, runInWorkspace as o, FileCorpus as ot, failuresAnalyst as p, pipeline as pt, createChatSessionStore as q, completionAuthorizes as qt, gitWorkspace as r, SqlRunOwnershipError as rn, trajectoryReport as rt, createWaterfallCollector as s, InMemoryCorpus as st, computeFindingId$1 as t, renderLeaderboardSvg as tn, createPrivateCasArtifactPort as tt, fsSurfaceReader as u, flatWidenGate as ut, VERIFY_TAIL_CHARS as v, buildSteerContext as vt, analyzeTrace as w, harvestCorpus as wt, settledWorkerOut as x, observationFromRegistry as xt, closingWorkerNote as y, createScopeAnalyst as yt, recordProfileRun as z, loopDispatch as zt };
 
-//# sourceMappingURL=runtime-COm9uBBx.js.map
+//# sourceMappingURL=runtime-CaM5Gbbv.js.map