@tangle-network/agent-runtime 7.0.0 → 8.0.1

package/dist/graph-pFTeNZ-G.js

@@ -0,0 +1,1793 @@
+import { Jr as runtimeCheckFactory, Xr as runtimeFlowBrain, si as runAbortable } from "./supervisor-accounting-Ow6CChpB.js";
+import { i as ConfigError, m as ValidationError } from "./errors-DG8yufqX.js";
+import { I as armDeadlineTimer } from "./util-fcckrkKp.js";
+import { M as contentAddress, v as retainedExecutorContext } from "./failure-cause-CVB-YE88.js";
+import { Mt as defaultRunCommand, Nt as runSettledCommand } from "./supervisor-D-eT-6Tu.js";
+import { v as harnessRunsAgent } from "./model-policy-CZwhXp8O.js";
+import { a as readCommittedJsonLines, c as appendCommittedJsonLine, s as withJsonlFileLock } from "./jsonl-file-DsxVI0E_.js";
+import { S as captureMaterializedWorkspace, T as scanMaterializedWorkspaceManifest, g as persistCandidateOutputArtifact, y as WorkspaceScanLimitError, z as sha256Bytes$1 } from "./workspace-streams-DA9R3j-p.js";
+import { t as composeRuntimeHooks } from "./runtime-hooks-CsW2pfFk.js";
+import { f as createFileRunContext, m as withRunContext, p as createInMemoryRunContext } from "./coordination-manager-DAGPerJy.js";
+import { M as kernelPromptRegistry, S as validateFlowGraph, T as validateGraphTopology, _ as GraphRouteError, b as journaledGateDecider, g as createGraphOverlay, i as profileGuidanceComposer, r as superviseWithTestBrain, t as supervise, v as createFlowRun, w as graphRootProfile, x as routeFlowOf, y as flowRootProfile } from "./supervise-Cdqj_oe4.js";
+import { S as portableContinuationPolicySchema } from "./graph-registry-czAwYwNj.js";
+import { canonicalCandidateDigest } from "@tangle-network/agent-interface";
+import { randomUUID } from "node:crypto";
+import { constants, mkdirSync, realpathSync } from "node:fs";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { execFile, spawn } from "node:child_process";
+import { chmod, cp, lstat, mkdir, mkdtemp, open, opendir, readlink, realpath, rm, stat, symlink, writeFile } from "node:fs/promises";
+import { promisify } from "node:util";
+import { tmpdir } from "node:os";
+// src/runtime/isolated-checker-outputs.ts
+const MAX_FILES = 16;
+const MAX_BYTES = 67108864;
+const MAX_TIMEOUT_MS = 12e4;
+/** Validate authored declarations before starting a check. The returned paths are detached and frozen. */
+function validateIsolatedCheckOutputs(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new ValidationError("check outputs must be a declaration object");
+	const item = value;
+	if (Object.keys(item).some((key) => ![
+		"paths",
+		"maxFileBytes",
+		"maxTotalBytes",
+		"timeoutMs"
+	].includes(key))) throw new ValidationError("check outputs has an unknown field");
+	if (!Array.isArray(item.paths) || item.paths.length < 1 || item.paths.length > MAX_FILES) throw new ValidationError("check outputs must name between 1 and 16 files");
+	const paths = [];
+	for (const path of item.paths) {
+		if (typeof path !== "string" || path.length > 512 || !/^[A-Za-z0-9._-]+(?:\/[A-Za-z0-9._-]+)*$/u.test(path) || path.split("/").some((part) => part === "." || part === ".." || part === ".git" || part === ".sidecar") || paths.some((prior) => prior === path || prior.startsWith(`${path}/`) || path.startsWith(`${prior}/`))) throw new ValidationError("check outputs paths must be distinct portable relative files");
+		paths.push(path);
+	}
+	for (const key of ["maxFileBytes", "maxTotalBytes"]) if (typeof item[key] !== "number" || !Number.isSafeInteger(item[key]) || item[key] < 1 || item[key] > MAX_BYTES) throw new ValidationError("check output byte limits must be positive integers at most 64 MiB");
+	const maxFileBytes = item.maxFileBytes;
+	const maxTotalBytes = item.maxTotalBytes;
+	if (maxFileBytes > maxTotalBytes) throw new ValidationError("check outputs maxFileBytes must not exceed maxTotalBytes");
+	if (item.timeoutMs !== void 0 && (typeof item.timeoutMs !== "number" || !Number.isSafeInteger(item.timeoutMs) || item.timeoutMs < 1 || item.timeoutMs > MAX_TIMEOUT_MS)) throw new ValidationError("check outputs timeoutMs must be a positive integer at most 120000");
+	return Object.freeze({
+		paths: Object.freeze(paths),
+		maxFileBytes,
+		maxTotalBytes,
+		...item.timeoutMs === void 0 ? {} : { timeoutMs: item.timeoutMs }
+	});
+}
+/** Resolve and validate trusted ports before any isolated work starts. */
+function prepareIsolatedCheckOutputs(options) {
+	if (options === void 0) return void 0;
+	const { executionId, artifacts, ...declaration } = options;
+	const validated = validateIsolatedCheckOutputs(declaration);
+	if (typeof executionId !== "string" || executionId.trim() === "" || executionId.length > 200 || /\p{Cc}/u.test(executionId)) throw new ValidationError("check outputs executionId must be a nonempty bounded identifier");
+	if (typeof artifacts?.put !== "function" || typeof artifacts?.read !== "function") throw new ValidationError("check outputs requires a readable output artifact port");
+	return Object.freeze({
+		...validated,
+		executionId,
+		artifacts
+	});
+}
+var OutputCaptureError = class extends Error {
+	reason;
+	constructor(reason) {
+		super(reason);
+		this.reason = reason;
+	}
+};
+/** Capture runs after command settlement, even on command failure or cancellation. There are no retries. */
+async function retainIsolatedCheckOutputs(options, inputDigest, read) {
+	const controller = new AbortController();
+	const clearTimer = armDeadlineTimer(options.timeoutMs ?? 3e4, () => controller.abort(), true);
+	const files = [];
+	const missing = [];
+	let totalBytes = 0;
+	try {
+		for (const path of options.paths) {
+			let phase = "capture-failed";
+			try {
+				const bytes = await runAbortable(() => read(path, Math.min(options.maxFileBytes, options.maxTotalBytes - totalBytes), controller.signal), controller.signal, "output capture deadline exceeded");
+				totalBytes += bytes.byteLength;
+				phase = "store-failed";
+				const artifact = await runAbortable(() => persistCandidateOutputArtifact(options.artifacts, {
+					executionId: options.executionId,
+					purpose: "grader-evidence",
+					bytes,
+					signal: controller.signal
+				}), controller.signal, "output persistence deadline exceeded");
+				files.push({
+					path,
+					artifact
+				});
+			} catch (error) {
+				missing.push({
+					path,
+					reason: controller.signal.aborted ? "timeout" : error instanceof OutputCaptureError ? error.reason : phase
+				});
+			}
+		}
+	} finally {
+		clearTimer();
+	}
+	return Object.freeze({
+		executionId: options.executionId,
+		inputDigest,
+		status: missing.length === 0 ? "retained" : "incomplete",
+		files: Object.freeze(files.map((file) => Object.freeze(file))),
+		missing: Object.freeze(missing.map((file) => Object.freeze(file)))
+	});
+}
+/** The local namespace has exited; the trusted host must keep its private copy stable. */
+function localCheckOutputReader(root) {
+	return async (path, maxBytes, signal) => {
+		try {
+			const rootInfo = await lstat(root);
+			if (!rootInfo.isDirectory() || rootInfo.isSymbolicLink()) throw new OutputCaptureError("unsafe-path");
+			let current = root;
+			const parts = path.split("/");
+			let expected;
+			for (let index = 0; index < parts.length; index++) {
+				current = join(current, parts[index]);
+				const info = await lstat(current, { bigint: true });
+				if (info.isSymbolicLink() || (index < parts.length - 1 ? !info.isDirectory() : !info.isFile() || info.nlink !== 1n)) throw new OutputCaptureError("unsafe-path");
+				expected = info;
+			}
+			signal.throwIfAborted();
+			const file = await open(current, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+			try {
+				const before = await file.stat({ bigint: true });
+				if (!before.isFile() || before.nlink !== 1n || before.dev !== expected?.dev || before.ino !== expected?.ino) throw new OutputCaptureError("unsafe-path");
+				if (before.size > BigInt(maxBytes)) throw new OutputCaptureError("size-limit");
+				const chunks = [];
+				let total = 0;
+				const buffer = Buffer.allocUnsafe(Math.min(65536, maxBytes + 1));
+				while (true) {
+					signal.throwIfAborted();
+					const { bytesRead } = await file.read(buffer, 0, Math.min(buffer.length, maxBytes - total + 1), null);
+					if (bytesRead === 0) break;
+					total += bytesRead;
+					if (total > maxBytes) throw new OutputCaptureError("size-limit");
+					chunks.push(Buffer.from(buffer.subarray(0, bytesRead)));
+				}
+				const after = await file.stat({ bigint: true });
+				if (before.size !== BigInt(total) || before.size !== after.size || before.mtimeNs !== after.mtimeNs || before.ctimeNs !== after.ctimeNs || after.nlink !== 1n) throw new OutputCaptureError("capture-failed");
+				return Buffer.concat(chunks, total);
+			} finally {
+				await file.close();
+			}
+		} catch (error) {
+			if (error?.code === "ENOENT") throw new OutputCaptureError("missing");
+			if (["ELOOP", "ENOTDIR"].includes(error?.code ?? "")) throw new OutputCaptureError("unsafe-path");
+			throw error;
+		}
+	};
+}
+/** Preserve a whole box only after its native lifecycle owner confirms stopped state. */
+async function stopCheckBoxForRecovery(box) {
+	const controller = new AbortController();
+	const clearTimer = armDeadlineTimer(3e4, () => controller.abort(), true);
+	try {
+		await runAbortable(() => box.stop({
+			wait: true,
+			signal: controller.signal
+		}), controller.signal, "check recovery stop deadline exceeded");
+		return true;
+	} catch {
+		return false;
+	} finally {
+		clearTimer();
+	}
+}
+/** Whether kill and process exit were confirmed; recovery custody still needs a whole-box stop. */
+async function stopCheckProcess(child) {
+	const controller = new AbortController();
+	const clearTimer = armDeadlineTimer(5e3, () => controller.abort(), true);
+	try {
+		await runAbortable(async () => {
+			await child.kill("SIGKILL", { tree: true });
+			await child.wait();
+		}, controller.signal, "check process stop deadline exceeded");
+		return true;
+	} catch {
+		return false;
+	} finally {
+		clearTimer();
+	}
+}
+const isolatedCheckOutputCaptureProgram = `import base64, errno, hashlib, json, os, stat, sys
+fds=[]
+def fail(reason):
+ print(json.dumps({'error':reason})); sys.exit(0)
+try:
+ root,path,limit=sys.argv[1],sys.argv[2],int(sys.argv[3])
+ directory=os.open(root,os.O_RDONLY|os.O_DIRECTORY|os.O_NOFOLLOW); fds.append(directory)
+ parts=path.split('/')
+ for part in parts[:-1]:
+  directory=os.open(part,os.O_RDONLY|os.O_DIRECTORY|os.O_NOFOLLOW,dir_fd=directory); fds.append(directory)
+ before=os.stat(parts[-1],dir_fd=directory,follow_symlinks=False)
+ if not stat.S_ISREG(before.st_mode) or before.st_nlink!=1: fail('unsafe-path')
+ fd=os.open(parts[-1],os.O_RDONLY|os.O_NOFOLLOW|os.O_NONBLOCK,dir_fd=directory); fds.append(fd)
+ opened=os.fstat(fd)
+ if not stat.S_ISREG(opened.st_mode) or opened.st_nlink!=1 or (before.st_dev,before.st_ino)!=(opened.st_dev,opened.st_ino): fail('unsafe-path')
+ if opened.st_size>limit: fail('size-limit')
+ chunks=[]; total=0
+ while True:
+  chunk=os.read(fd,min(1048576,limit-total+1))
+  if not chunk: break
+  total+=len(chunk)
+  if total>limit: fail('size-limit')
+  chunks.append(chunk)
+ after=os.fstat(fd)
+ if (opened.st_size,opened.st_mtime_ns,opened.st_ctime_ns,opened.st_nlink)!=(after.st_size,after.st_mtime_ns,after.st_ctime_ns,after.st_nlink) or total!=opened.st_size: fail('capture-failed')
+ data=b''.join(chunks)
+ print(json.dumps({'content':base64.b64encode(data).decode('ascii'),'sha256':'sha256:'+hashlib.sha256(data).hexdigest()}))
+except OSError as error:
+ fail('missing' if error.errno==errno.ENOENT else 'unsafe-path' if error.errno in (errno.ELOOP,errno.ENOTDIR) else 'capture-failed')
+finally:
+ for fd in reversed(fds): os.close(fd)
+`;
+/** A box with declared outputs needs python3; missing capture tooling fails closed and keeps custody. */
+function boxCheckOutputReader(box, root, timeoutMs) {
+	return async (path, maxBytes, signal) => {
+		const child = await box.process.spawnExact("/usr/bin/python3", [
+			"-I",
+			"-S",
+			"-c",
+			isolatedCheckOutputCaptureProgram,
+			root,
+			path,
+			String(maxBytes)
+		], {
+			env: {
+				PATH: "/usr/bin:/bin",
+				LANG: "C"
+			},
+			inheritEnv: false,
+			timeoutMs
+		});
+		let stopping;
+		const stop = () => {
+			stopping ??= stopCheckProcess(child);
+		};
+		signal.addEventListener("abort", stop, { once: true });
+		if (signal.aborted) stop();
+		const chunks = [];
+		const limit = Math.ceil(maxBytes / 3) * 4 + 2048;
+		let length = 0;
+		let overflow = false;
+		const collect = async (stream, keep) => {
+			for await (const text of stream) {
+				length += Buffer.byteLength(text);
+				if (length > limit) {
+					overflow = true;
+					stop();
+				} else if (keep) chunks.push(text);
+			}
+		};
+		try {
+			await Promise.all([collect(child.stdout(), true), collect(child.stderr(), false)]);
+			if (overflow || await child.wait() !== 0) throw new OutputCaptureError("capture-failed");
+			signal.throwIfAborted();
+			const value = JSON.parse(chunks.join(""));
+			if (value.error === "missing" || value.error === "unsafe-path" || value.error === "size-limit" || value.error === "capture-failed") throw new OutputCaptureError(value.error);
+			if (typeof value.content !== "string" || typeof value.sha256 !== "string") throw new OutputCaptureError("capture-failed");
+			const bytes = Buffer.from(value.content, "base64");
+			if (bytes.byteLength > maxBytes) throw new OutputCaptureError("size-limit");
+			if (sha256Bytes$1(bytes) !== value.sha256) throw new OutputCaptureError("capture-failed");
+			return bytes;
+		} catch (error) {
+			stop();
+			throw error;
+		} finally {
+			signal.removeEventListener("abort", stop);
+			await stopping;
+		}
+	};
+}
+// src/runtime/isolated-checker.ts
+const toolchains = [
+	"/usr",
+	"/bin",
+	"/lib",
+	"/lib64"
+];
+const contains = (parent, child) => {
+	const path = relative(parent, child);
+	return path === "" || path !== ".." && !path.startsWith(`..${sep}`) && !path.startsWith(sep);
+};
+/**
+* Run an untrusted check in Linux Bubblewrap, or in its own Sandbox box when `box` is set.
+* Never falls back to host execution.
+*
+* Bubblewrap requires /usr/bin/bwrap and permission to create Linux namespaces.
+* Only trusted system toolchains, private proc/dev/tmp, and the writable copy are mounted.
+* The canonical input path remains the working directory. Requested output files are retained
+* before cleanup; otherwise copy writes are discarded.
+* Time and output are bounded; input copy bytes and entries are bounded when requested.
+* The command's memory and generated files require a resource-limited placement.
+* Callers must keep the input and trusted toolchains stable while preparing the check.
+*
+* A box check creates one fresh box with no owner secrets and blocked egress (or strict egress to
+* the placement's named domains), delivers the tree's regular files verified by sha256, runs the
+* command there with only the environment `env` names, and deletes the box after successful
+* requested retention. Incomplete retention returns private recovery custody only after the
+* native owner confirms the box stopped. Box file capture requires /usr/bin/python3. Local recovery scratch is the
+* caller's responsibility; the resource-limited placement requirement still applies.
+*/
+async function runIsolatedCheck(options) {
+	if (options.box) return runInBox(options, options.box);
+	let scratch;
+	let outputs;
+	let result;
+	try {
+		const retention = prepareIsolatedCheckOutputs(options.outputs);
+		if (process.platform !== "linux") throw new Error("Linux Bubblewrap namespaces are required");
+		const { timeoutMs, maxOutputBytes, maxInputBytes, maxInputEntries } = checkLimits(options);
+		if (options.signal?.aborted) return {
+			succeeded: false,
+			reason: "cancelled",
+			diagnostic: "Check cancelled"
+		};
+		const { workspace, tree } = await protectedTree(options);
+		const binds = [];
+		for (const path of toolchains) {
+			let actual;
+			try {
+				actual = await realpath(path);
+			} catch (error) {
+				if (error.code === "ENOENT") continue;
+				throw error;
+			}
+			for (const mount of [path, actual]) if (contains(mount, workspace) || contains(workspace, mount) || contains(mount, tree) || contains(tree, mount)) throw new Error(`Toolchain overlaps protected workspace: ${path}`);
+			binds.push("--ro-bind", actual, path);
+		}
+		if (["/proc", "/dev"].some((path) => contains(path, tree) || contains(tree, path))) throw new Error("Tree overlaps a reserved namespace mount");
+		scratch = await mkdtemp(join(tmpdir(), "runtime-check-"));
+		if (contains(tree, scratch)) throw new Error("Temporary storage must be outside the input tree");
+		const copy = join(scratch, "tree");
+		await copyBoundedTree(tree, copy, maxInputBytes, maxInputEntries);
+		const input = retention ? await scanMaterializedWorkspaceManifest(copy) : void 0;
+		if (retention && input) assertOutputPathsUnoccupied(retention.paths, input);
+		result = await execute([
+			"--unshare-all",
+			"--die-with-parent",
+			"--new-session",
+			"--cap-drop",
+			"ALL",
+			"--clearenv",
+			"--setenv",
+			"PATH",
+			"/usr/bin:/bin",
+			"--setenv",
+			"HOME",
+			"/tmp",
+			"--setenv",
+			"LANG",
+			"C",
+			...Object.entries(options.env ?? {}).flatMap(([name, value]) => [
+				"--setenv",
+				name,
+				value
+			]),
+			...binds,
+			"--proc",
+			"/proc",
+			"--dev",
+			"/dev",
+			"--tmpfs",
+			"/tmp",
+			"--bind",
+			copy,
+			tree,
+			"--chdir",
+			tree,
+			"--",
+			...options.command
+		], timeoutMs, maxOutputBytes, options.signal);
+		if (retention && input && (result.succeeded || result.reason !== "refused")) {
+			outputs = await retainIsolatedCheckOutputs(retention, canonicalCandidateDigest(input), localCheckOutputReader(copy));
+			if (outputs.status === "incomplete") outputs = {
+				...outputs,
+				source: {
+					kind: "local",
+					path: scratch
+				}
+			};
+			result = withRetainedOutputs(result, outputs);
+		}
+	} catch (error) {
+		result = {
+			succeeded: false,
+			reason: error instanceof InputLimitError ? "input-limit" : "refused",
+			diagnostic: String(error)
+		};
+	}
+	if (scratch && outputs?.status !== "incomplete") try {
+		await removeScratch(scratch);
+	} catch (error) {
+		const cleanupDiagnostic = String(error);
+		result = result.succeeded ? {
+			succeeded: false,
+			reason: "cleanup-failed",
+			diagnostic: cleanupDiagnostic,
+			stdout: result.value.stdout,
+			stderr: result.value.stderr,
+			exitCode: 0
+		} : {
+			...result,
+			cleanupDiagnostic
+		};
+	}
+	return outputs ? {
+		...result,
+		outputs
+	} : result;
+}
+/** A preexisting input file must never masquerade as newly produced evaluator evidence. */
+function assertOutputPathsUnoccupied(paths, input) {
+	for (const path of paths) if (input.files.some((file) => file.path === path || file.path.startsWith(`${path}/`) || path.startsWith(`${file.path}/`))) throw new Error("Declared check output path overlaps an input file");
+}
+function withRetainedOutputs(result, outputs) {
+	if (!result.succeeded || outputs.status === "retained") return {
+		...result,
+		outputs
+	};
+	return {
+		succeeded: false,
+		reason: "failed",
+		diagnostic: "Check outputs were not completely retained",
+		stdout: result.value.stdout,
+		stderr: result.value.stderr,
+		exitCode: 0,
+		outputs
+	};
+}
+function checkLimits(options) {
+	const timeoutMs = options.timeoutMs ?? 3e4;
+	const maxOutputBytes = options.maxOutputBytes ?? 1048576;
+	const maxInputBytes = options.maxInputBytes;
+	const maxInputEntries = options.maxInputEntries;
+	if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 2147483647 || !Number.isSafeInteger(maxOutputBytes) || maxOutputBytes < 1 || maxInputBytes !== void 0 && (!Number.isSafeInteger(maxInputBytes) || maxInputBytes < 1) || maxInputEntries !== void 0 && (!Number.isSafeInteger(maxInputEntries) || maxInputEntries < 1)) throw new Error("Invalid execution limits");
+	if (!options.command.length || !options.command[0]) throw new Error("A command is required");
+	return {
+		timeoutMs,
+		maxOutputBytes,
+		maxInputBytes,
+		maxInputEntries
+	};
+}
+var InputLimitError = class extends Error {};
+/** Copy in bounded chunks, preserving symlink text without reading its target. */
+async function copyBoundedTree(source, destination, maxBytes, maxEntries) {
+	let bytes = 0;
+	let entries = 0;
+	const buffer = Buffer.allocUnsafe(1048576);
+	const visit = async (from, to, isRoot = false) => {
+		if (!isRoot && ++entries > (maxEntries ?? Number.MAX_SAFE_INTEGER)) throw new InputLimitError("Input tree exceeds maxInputEntries");
+		const info = await lstat(from);
+		if (info.isSymbolicLink()) await symlink(await readlink(from), to);
+		else if (info.isDirectory()) {
+			await mkdir(to, { mode: 448 });
+			for await (const entry of await opendir(from)) await visit(join(from, entry.name), join(to, entry.name));
+			await chmod(to, info.mode & 511);
+		} else if (info.isFile()) {
+			if (maxBytes !== void 0 && info.size > maxBytes - bytes) throw new InputLimitError("Input tree exceeds maxInputBytes");
+			const input = await open(from, constants.O_RDONLY | constants.O_NOFOLLOW);
+			try {
+				const output = await open(to, "wx", info.mode & 511);
+				try {
+					while (true) {
+						const { bytesRead } = await input.read(buffer, 0, maxBytes === void 0 ? buffer.length : Math.min(buffer.length, maxBytes - bytes + 1), null);
+						if (bytesRead === 0) break;
+						bytes += bytesRead;
+						if (maxBytes !== void 0 && bytes > maxBytes) throw new InputLimitError("Input tree exceeds maxInputBytes");
+						let written = 0;
+						while (written < bytesRead) {
+							const result = await output.write(buffer, written, bytesRead - written);
+							if (result.bytesWritten === 0) throw new Error("Input copy made no write progress");
+							written += result.bytesWritten;
+						}
+					}
+				} finally {
+					await output.close();
+				}
+				await chmod(to, info.mode & 511);
+			} finally {
+				await input.close();
+			}
+		} else throw new Error(`Input tree contains an unsupported entry: ${from}`);
+	};
+	await visit(source, destination, true);
+}
+async function checkInputEntries(root, maxEntries) {
+	let count = 0;
+	const visit = async (path, isRoot = false) => {
+		if (!isRoot && ++count > maxEntries) throw new InputLimitError("Input tree exceeds maxInputEntries");
+		if (!(await lstat(path)).isDirectory()) return;
+		for await (const entry of await opendir(path)) await visit(join(path, entry.name));
+	};
+	await visit(root, true);
+}
+async function protectedTree(options) {
+	const workspace = await realpath(options.workspaceRoot);
+	const tree = await realpath(options.tree);
+	if (!contains(workspace, tree) || !(await stat(tree)).isDirectory()) throw new Error("Tree must be a directory inside the workspace");
+	return {
+		workspace,
+		tree
+	};
+}
+/** Box-workspace-relative directory that receives the tree and is the command's cwd. */
+const BOX_TREE = "tree";
+/** Setup headroom in the requested native lifetime policy; this is not a deletion guarantee. */
+const BOX_SETUP_SECONDS = 900;
+/** The box's own process timeout is a backstop behind this module's deadline. */
+const BOX_PROCESS_BACKSTOP_MS = 3e4;
+/** The box's process supervisor prefixes this to stderr when it cannot start the executable. */
+const BOX_EXEC_FAILURE = "process-supervisor: exec failed";
+async function runInBox(options, placement) {
+	let box;
+	let evidence;
+	let outputs;
+	let retention;
+	let maxLifetimeSeconds;
+	let commandAttempted = false;
+	let commandSettled = false;
+	let result;
+	try {
+		retention = prepareIsolatedCheckOutputs(options.outputs);
+		const { timeoutMs, maxOutputBytes, maxInputBytes, maxInputEntries } = checkLimits(options);
+		maxLifetimeSeconds = Math.ceil(timeoutMs / 1e3) + BOX_SETUP_SECONDS;
+		if (options.signal?.aborted) return {
+			succeeded: false,
+			reason: "cancelled",
+			diagnostic: "Check cancelled"
+		};
+		const { tree } = await protectedTree(options);
+		if (maxInputEntries !== void 0) await checkInputEntries(tree, maxInputEntries);
+		const captured = await captureMaterializedWorkspace(tree, { limits: {
+			maxFiles: maxInputEntries ?? Number.MAX_SAFE_INTEGER,
+			maxFileBytes: maxInputBytes ?? Number.MAX_SAFE_INTEGER,
+			maxTotalFileBytes: maxInputBytes ?? Number.MAX_SAFE_INTEGER
+		} });
+		if (retention) assertOutputPathsUnoccupied(retention.paths, captured.manifest);
+		const judge = placement.ownerStep !== true;
+		if (judge && (placement.builderAccounts.length === 0 || placement.builderAccounts.some((id) => !id))) throw new Error("builderAccounts must name the account of every key the judged run holds");
+		const memoryMB = placement.resources?.memoryMB;
+		if (memoryMB !== void 0 && (!Number.isSafeInteger(memoryMB) || memoryMB < 1 || placement.resources?.advisory === true || placement.resources?.advisoryFields?.includes("memoryMB"))) throw new Error("Check box requires an explicit finite resources.memoryMB limit");
+		const account = (await placement.client.getIdentity()).customerId;
+		if (!account) throw new Error("Sandbox returned no account for the check key");
+		if (judge && placement.builderAccounts.includes(account)) throw new Error(`Check account ${account} is an account the judged run holds a key to, so the run can reach the check box`);
+		options.signal?.throwIfAborted();
+		box = await placement.client.createIsolated({
+			environment: placement.environment,
+			agent: placement.containers === true,
+			bare: false,
+			ephemeral: placement.containers !== true && judge,
+			egressPolicy: egressFor(placement),
+			...placement.resources ? { resources: placement.resources } : {},
+			maxLifetimeSeconds,
+			idempotencyKey: `agent-runtime-check-${randomUUID()}`
+		}, options.signal ? { signal: options.signal } : void 0);
+		const receipt = box.createReceipt();
+		if (receipt?.outcome !== "created" || receipt.ownerContext !== "isolated" || !Array.isArray(receipt.injectedSecrets) || receipt.injectedSecrets.length !== 0) throw new Error("Sandbox did not confirm a fresh box with no owner secrets");
+		const grantedMemoryMB = box.resources?.memoryMB;
+		if (memoryMB !== void 0 && (typeof grantedMemoryMB !== "number" || !Number.isSafeInteger(grantedMemoryMB) || grantedMemoryMB < 1 || grantedMemoryMB > memoryMB)) throw new Error("Sandbox did not confirm the requested finite memory cgroup limit");
+		const egress = (await box.egress.get()).policy;
+		const wanted = egressFor(placement);
+		if (egress.mode !== wanted.mode || wanted.mode === "strict" && (egress.includeImplicitDomains === true || [...egress.allowDomains ?? []].sort().join(",") !== [...wanted.allowDomains ?? []].sort().join(","))) throw new Error(`Check box egress is ${egress.mode} ${JSON.stringify(egress.allowDomains ?? [])}, not ${wanted.mode} ${JSON.stringify(wanted.allowDomains ?? [])}`);
+		const staging = await mkdtemp(join(tmpdir(), "runtime-check-box-"));
+		try {
+			for (const file of captured.files) {
+				const path = join(staging, file.path);
+				await mkdir(dirname(path), { recursive: true });
+				await writeFile(path, file.bytes, { mode: file.mode });
+			}
+			options.signal?.throwIfAborted();
+			await box.fs.uploadDir(staging, BOX_TREE);
+		} finally {
+			await rm(staging, {
+				recursive: true,
+				force: true
+			});
+		}
+		await verifyBoxTree(box, captured.manifest.files);
+		evidence = {
+			sandboxId: box.id,
+			account,
+			...memoryMB === void 0 ? {} : { memoryMB: grantedMemoryMB },
+			input: captured.manifest,
+			inputDigest: canonicalCandidateDigest(captured.manifest)
+		};
+		commandAttempted = true;
+		const execution = await executeInBox(box, options.command, timeoutMs, maxOutputBytes, options.env ?? {}, options.signal);
+		result = execution.result;
+		commandSettled = execution.commandSettled;
+	} catch (error) {
+		result = {
+			succeeded: false,
+			reason: options.signal?.aborted ? "cancelled" : error instanceof InputLimitError || error instanceof WorkspaceScanLimitError ? "input-limit" : "refused",
+			diagnostic: String(error)
+		};
+	}
+	if (box && evidence && retention && maxLifetimeSeconds !== void 0 && commandAttempted && (!commandSettled || result.succeeded || result.reason !== "refused")) {
+		outputs = commandSettled ? await retainIsolatedCheckOutputs(retention, evidence.inputDigest, boxCheckOutputReader(box, BOX_TREE, retention.timeoutMs ?? 3e4)) : {
+			executionId: retention.executionId,
+			inputDigest: evidence.inputDigest,
+			status: "incomplete",
+			files: [],
+			missing: retention.paths.map((path) => ({
+				path,
+				reason: "capture-failed"
+			}))
+		};
+		result = withRetainedOutputs(result, outputs);
+		if (outputs.status === "incomplete") {
+			if (await stopCheckBoxForRecovery(box)) outputs = {
+				...outputs,
+				source: {
+					kind: "sandbox",
+					sandboxId: box.id,
+					state: "stopped"
+				}
+			};
+			else if (!result.succeeded) result = {
+				...result,
+				cleanupDiagnostic: "Recovery source stop was not confirmed; box deletion was requested"
+			};
+		}
+	}
+	if (box && outputs?.source?.kind !== "sandbox") try {
+		await box.delete();
+	} catch (error) {
+		const cleanupDiagnostic = `Check box ${box.id} was not deleted: ${String(error)}`;
+		result = result.succeeded ? {
+			succeeded: false,
+			reason: "cleanup-failed",
+			diagnostic: cleanupDiagnostic,
+			stdout: result.value.stdout,
+			stderr: result.value.stderr,
+			exitCode: 0
+		} : {
+			...result,
+			cleanupDiagnostic: [result.cleanupDiagnostic, cleanupDiagnostic].filter(Boolean).join("; ")
+		};
+	}
+	return {
+		...result,
+		...evidence ? { box: evidence } : {},
+		...outputs ? { outputs } : {}
+	};
+}
+/** Refuse unless the box reads each file with its manifest digest. `find` names the files: a box
+* process takes 256 arguments at most. A name holding a newline or backslash, which coreutils
+* escapes, does not compare. */
+async function verifyBoxTree(box, files) {
+	const child = await box.process.spawnExact("find", [
+		".",
+		"-type",
+		"f",
+		"-exec",
+		"sha256sum",
+		"{}",
+		"+"
+	], {
+		cwd: BOX_TREE,
+		env: {
+			PATH: "/usr/bin:/bin",
+			LANG: "C"
+		},
+		inheritEnv: false,
+		timeoutMs: BOX_SETUP_SECONDS * 1e3
+	});
+	let listing = "";
+	for await (const text of child.stdout()) listing += text;
+	if (await child.wait() !== 0) throw new Error("Check box could not hash the tree it received");
+	const read = new Set(listing.split("\n").map((line) => `sha256:${line.slice(0, 64)} ${line.slice(68)}`));
+	for (const file of files) if (!read.has(`${file.sha256} ${file.path}`)) throw new Error(`Check box received different bytes for ${file.path}`);
+}
+/** Blocked unless the placement names domains; then strict, with no implicit domain list. */
+function egressFor(placement) {
+	const domains = [...new Set(placement.egress ?? [])].filter((domain) => domain.trim() !== "");
+	return domains.length === 0 ? { mode: "blocked" } : {
+		mode: "strict",
+		allowDomains: domains,
+		includeImplicitDomains: false
+	};
+}
+async function executeInBox(box, command, timeoutMs, limit, env, signal) {
+	const [executable, ...args] = command;
+	let child;
+	const deadline = new AbortController();
+	const stdout = [];
+	const stderr = [];
+	let bytes = 0;
+	let failure;
+	let stopping;
+	let stopped = false;
+	const stop = (reason) => {
+		failure ??= reason;
+		deadline.abort();
+		if (child) stopping ??= stopCheckProcess(child);
+	};
+	const clearTimer = armDeadlineTimer(timeoutMs, () => stop("timeout"), true);
+	const cancel = () => stop("cancelled");
+	signal?.addEventListener("abort", cancel, { once: true });
+	if (signal?.aborted) cancel();
+	const capture = async (stream, target) => {
+		for await (const text of stream) {
+			if (deadline.signal.aborted) break;
+			const chunk = Buffer.from(text);
+			const remaining = Math.max(0, limit - bytes);
+			bytes += chunk.length;
+			if (remaining) target.push(chunk.subarray(0, remaining));
+			if (bytes > limit) stop("output-limit");
+		}
+	};
+	let completion;
+	try {
+		child = await runAbortable(() => {
+			const launching = box.process.spawnExact(executable, args, {
+				cwd: BOX_TREE,
+				env: {
+					PATH: "/usr/bin:/bin",
+					HOME: "/tmp",
+					LANG: "C",
+					...env
+				},
+				inheritEnv: false,
+				timeoutMs: timeoutMs + BOX_PROCESS_BACKSTOP_MS
+			});
+			launching.then((late) => {
+				if (deadline.signal.aborted) stopCheckProcess(late);
+			}, () => void 0);
+			return launching;
+		}, deadline.signal, "Check interrupted");
+		const running = child;
+		completion = await runAbortable(async () => {
+			await Promise.all([capture(running.stdout(), stdout), capture(running.stderr(), stderr)]);
+			return {
+				exitCode: await running.wait(),
+				exitSignal: (await running.status()).exitSignal
+			};
+		}, deadline.signal, "Check interrupted");
+	} catch (error) {
+		if (child) stopping ??= stopCheckProcess(child);
+		if (!failure) throw error;
+	} finally {
+		clearTimer();
+		signal?.removeEventListener("abort", cancel);
+		stopped = await stopping === true;
+	}
+	const out = Buffer.concat(stdout).toString();
+	const err = Buffer.concat(stderr).toString();
+	const exitCode = completion?.exitCode ?? null;
+	const exitSignal = completion?.exitSignal;
+	const evidence = {
+		stdout: out,
+		stderr: err,
+		exitCode: exitSignal ? null : exitCode
+	};
+	const finish = (result) => ({
+		result,
+		commandSettled: completion !== void 0 || stopped
+	});
+	if (failure) return finish({
+		succeeded: false,
+		reason: failure,
+		diagnostic: err || failure,
+		...evidence
+	});
+	if (exitCode === 127 && err.startsWith(BOX_EXEC_FAILURE)) return finish({
+		succeeded: false,
+		reason: "refused",
+		diagnostic: err,
+		...evidence
+	});
+	if (exitSignal) return finish({
+		succeeded: false,
+		reason: "failed",
+		diagnostic: err || `Check killed by ${exitSignal}`,
+		...evidence
+	});
+	if (exitCode !== 0) return finish({
+		succeeded: false,
+		reason: "failed",
+		diagnostic: err || out || `Check exited ${exitCode}`,
+		...evidence
+	});
+	return finish({
+		succeeded: true,
+		value: {
+			stdout: out,
+			stderr: err
+		}
+	});
+}
+function execute(args, timeoutMs, limit, signal) {
+	return new Promise((done) => {
+		const child = spawn("/usr/bin/bwrap", [
+			"--json-status-fd",
+			"3",
+			...args
+		], {
+			env: {},
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe",
+				"pipe"
+			],
+			detached: true
+		});
+		const stdout = [];
+		const stderr = [];
+		let bytes = 0;
+		let status = "";
+		let failure;
+		const stop = (reason) => {
+			failure ??= reason;
+			if (child.pid) try {
+				process.kill(-child.pid, "SIGKILL");
+			} catch (error) {
+				if (error.code !== "ESRCH") child.kill("SIGKILL");
+			}
+		};
+		const clearTimer = armDeadlineTimer(timeoutMs, () => stop("timeout"), true);
+		const cancel = () => stop("cancelled");
+		signal?.addEventListener("abort", cancel, { once: true });
+		if (signal?.aborted) cancel();
+		const capture = (target) => (chunk) => {
+			const remaining = Math.max(0, limit - bytes);
+			bytes += chunk.length;
+			if (remaining) target.push(chunk.subarray(0, remaining));
+			if (bytes > limit) stop("output-limit");
+		};
+		child.stdio[3]?.on("data", (chunk) => {
+			if (status.length + chunk.length > 16384) {
+				stop("output-limit");
+				return;
+			}
+			status += chunk.toString();
+		});
+		child.stdout.on("data", capture(stdout));
+		child.stderr.on("data", capture(stderr));
+		let spawnError;
+		child.on("error", (error) => {
+			spawnError = error;
+		});
+		child.on("close", (code) => {
+			clearTimer();
+			signal?.removeEventListener("abort", cancel);
+			const out = Buffer.concat(stdout).toString();
+			const err = Buffer.concat(stderr).toString();
+			const evidence = {
+				stdout: out,
+				stderr: err,
+				exitCode: code
+			};
+			const executed = status.split("\n").some((line) => {
+				try {
+					const record = JSON.parse(line);
+					return record !== null && typeof record === "object" && "exit-code" in record && typeof record["exit-code"] === "number" && record["exit-code"] === code;
+				} catch {
+					return false;
+				}
+			});
+			if (failure) done({
+				succeeded: false,
+				reason: failure,
+				diagnostic: err || failure,
+				...evidence
+			});
+			else if (spawnError) done({
+				succeeded: false,
+				reason: "refused",
+				diagnostic: String(spawnError),
+				...evidence
+			});
+			else if (!executed) done({
+				succeeded: false,
+				reason: "refused",
+				diagnostic: err || "Bubblewrap did not confirm command execution",
+				...evidence
+			});
+			else if (code !== 0) done({
+				succeeded: false,
+				reason: "failed",
+				diagnostic: err || out || `Check exited ${code}`,
+				...evidence
+			});
+			else done({
+				succeeded: true,
+				value: {
+					stdout: out,
+					stderr: err
+				}
+			});
+		});
+	});
+}
+const executeFile = promisify(execFile);
+/** GNU tools traverse relative to open directories, including trees deeper than PATH_MAX.
+* Recursive chmod ignores encountered symlinks; rm never follows their targets. */
+async function removeScratch(path) {
+	const options = {
+		env: {},
+		timeout: 1e4,
+		maxBuffer: 16384
+	};
+	let permissionError;
+	try {
+		await executeFile("/bin/chmod", [
+			"--recursive",
+			"--preserve-root",
+			"u+rwX",
+			"--",
+			path
+		], options);
+	} catch (error) {
+		permissionError = error;
+	}
+	try {
+		await executeFile("/bin/rm", [
+			"--recursive",
+			"--force",
+			"--one-file-system",
+			"--",
+			path
+		], options);
+	} catch (error) {
+		throw new Error([permissionError, error].filter((value) => value !== void 0).map(String).join("; "));
+	}
+}
+// src/runtime/supervise/graph-backend.ts
+/** Graph nodes expose JSON outputs through Runtime's resumable execution transports. */
+function graphExecutionOptions(options) {
+	if (options.makeLeafAgent) return options;
+	const backend = options.backend;
+	if (backend) return backend.backend === "bridge" || backend.backend === "provider" ? {
+		...options,
+		backend: {
+			...backend,
+			outputFormat: "json"
+		}
+	} : options;
+	const bridgeUrl = process.env.CLI_BRIDGE_URL;
+	const bridgeBearer = process.env.BRIDGE_BEARER ?? process.env.CLI_BRIDGE_BEARER;
+	if (!bridgeUrl || !bridgeBearer) throw new ValidationError("runGraph: start CLI Bridge and supply backend: { backend: \"bridge\", bridgeUrl, bridgeBearer, cwd }, or configure CLI_BRIDGE_URL and BRIDGE_BEARER");
+	return {
+		...options,
+		backend: {
+			backend: "bridge",
+			bridgeUrl,
+			bridgeBearer,
+			cwd: process.cwd(),
+			outputFormat: "json"
+		}
+	};
+}
+// src/runtime/supervise/stored-graph-check.ts
+/** Driver-owned journal identity. Worker output never supplies any part of this authority. */
+function receiptKey(receipt) {
+	return contentAddress({
+		binding: receipt.binding,
+		checkDigest: receipt.checkDigest,
+		nodeName: receipt.nodeName,
+		nodeId: receipt.nodeId,
+		attemptId: receipt.attemptId,
+		outputDigest: receipt.outputDigest
+	});
+}
+function isReceipt(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+	const row = value;
+	if (row.version !== 1 || ![
+		"key",
+		"binding",
+		"checkDigest",
+		"nodeName",
+		"nodeId",
+		"attemptId",
+		"outputDigest",
+		"output"
+	].every((key) => typeof row[key] === "string") || !row.nodeName || !row.nodeId || !row.attemptId || !(row.exitCode === null || Number.isSafeInteger(row.exitCode)) || typeof row.outputTruncated !== "boolean" || typeof row.nativeValid !== "boolean" || typeof row.valid !== "boolean") return false;
+	const receipt = value;
+	return receipt.key === receiptKey(receipt) && receipt.valid === (receipt.exitCode === 0 && receipt.nativeValid);
+}
+async function appendReceipt(file, workspace, receipt) {
+	await withJsonlFileLock(file, async (canonicalPath) => {
+		if (workspace !== void 0 && within(workspace, canonicalPath)) throw new ValidationError("runGraph: command receipt journal resolves inside worker workspace");
+		await appendCommittedJsonLine(canonicalPath, {
+			...receipt,
+			key: receiptKey(receipt)
+		});
+	});
+}
+function within(directory, path) {
+	const offset = relative(directory, path);
+	return offset === "" || !isAbsolute(offset) && offset !== ".." && !offset.startsWith("../");
+}
+/** The run's working directory (a loopback Bridge cwd or local CLI workspace) and its driver-owned
+*  run directory, which must lie outside it. */
+function localCheckDirectories(options) {
+	const cwd = backendWorkspace(options);
+	if (!cwd) throw new ValidationError("runGraph: command checks require a loopback Bridge or local CLI workspace; provider node binding is unsupported");
+	return {
+		cwd,
+		runDir: driverRunDir(options, cwd)
+	};
+}
+function backendWorkspace(options) {
+	const backend = options.backend;
+	if (!backend) return void 0;
+	const workspace = backend.backend === "bridge" ? backend.cwd : backend.backend === "cli-in-place" ? backend.workspacePath : void 0;
+	return !workspace || backend.backend === "bridge" && ![
+		"localhost",
+		"127.0.0.1",
+		"[::1]"
+	].includes(new URL(backend.bridgeUrl).hostname) ? void 0 : realpathSync(workspace);
+}
+function driverRunDir(options, workspace) {
+	if (!options.runDir) throw new ValidationError("runGraph: command checks require a driver-owned runDir outside the workspace");
+	mkdirSync(options.runDir, { recursive: true });
+	const runDir = realpathSync(options.runDir);
+	if (workspace !== void 0 && within(workspace, runDir)) throw new ValidationError("runGraph: command check runDir must be outside the worker workspace");
+	return runDir;
+}
+/** Lower a named check onto the local workspace, with evidence in the driver's durable state.
+* The run directory has the same trust boundary as RunContext journals: keep it outside the
+* worker workspace and do not mount it into the worker. A remote Bridge cannot run a host check.
+* Provider validators are refused because their context does not identify the admitted node.
+*/
+function bindGraphCommand(graph, options) {
+	const { command: definition, ...deliverable } = graph.deliverable;
+	if (!definition) return {
+		graph,
+		options
+	};
+	const { command, timeoutMs = 6e4 } = definition;
+	if (!command.trim() || !Number.isSafeInteger(timeoutMs) || timeoutMs <= 0) throw new ValidationError("graphFromStored: command check needs a command and positive timeoutMs");
+	if (options.makeLeafAgent || graph.nodes.some((node) => node.check)) throw new ValidationError("runGraph: command checks need a backend and no check nodes");
+	const { cwd, runDir } = localCheckDirectories(options);
+	const file = join(runDir, "command-checks.jsonl");
+	const checkDigest = contentAddress({
+		command,
+		timeoutMs,
+		cwd
+	});
+	const binding = contentAddress({
+		graph: {
+			...graph,
+			deliverable: {
+				...deliverable,
+				check: void 0
+			}
+		},
+		runId: options.runId ?? options.runContext?.runId,
+		checkDigest
+	});
+	const nodeNames = new Set(graph.nodes.map((node) => node.id));
+	const checkFinal = async (out) => {
+		if (!out || typeof out !== "object" || Array.isArray(out)) return false;
+		const entries = Object.entries(out);
+		if (entries.length === 0 || entries.some(([name]) => !nodeNames.has(name))) return false;
+		return withJsonlFileLock(file, async (canonicalPath) => {
+			if (within(cwd, canonicalPath)) return false;
+			const latest = /* @__PURE__ */ new Map();
+			for await (const raw of readCommittedJsonLines(canonicalPath, { allowMissing: true })) {
+				if (!isReceipt(raw)) return false;
+				if (raw.binding !== binding || raw.checkDigest !== checkDigest) continue;
+				latest.set(contentAddress([raw.nodeName, raw.outputDigest]), raw);
+			}
+			return entries.every(([name, output]) => latest.get(contentAddress([name, contentAddress(output)]))?.valid === true);
+		});
+	};
+	const checkLeaf = async (out, context) => {
+		const node = context.node;
+		const nodeName = context.profile.name;
+		if (!node || !node.nodeId || !node.attemptId || !nodeName || !nodeNames.has(nodeName)) return false;
+		const outputDigest = contentAddress(out);
+		let result;
+		try {
+			result = await defaultRunCommand({
+				command,
+				cwd,
+				timeoutMs,
+				signal: context.signal
+			});
+		} catch (error) {
+			result = {
+				exitCode: null,
+				output: error instanceof Error ? error.message : String(error)
+			};
+		}
+		const bytes = Buffer.from(result.output);
+		const limit = 65536;
+		const receipt = {
+			version: 1,
+			binding,
+			checkDigest,
+			nodeName,
+			nodeId: node.nodeId,
+			attemptId: node.attemptId,
+			outputDigest,
+			exitCode: result.exitCode,
+			output: bytes.subarray(0, limit).toString("utf8"),
+			outputTruncated: bytes.length > limit,
+			nativeValid: context.originalVerdict?.valid !== false,
+			valid: result.exitCode === 0 && context.originalVerdict?.valid !== false
+		};
+		await appendReceipt(file, cwd, receipt);
+		return receipt.valid;
+	};
+	return {
+		graph: {
+			...graph,
+			deliverable: {
+				...deliverable,
+				check: (out, context) => context === void 0 ? checkFinal(out) : checkLeaf(out, context)
+			}
+		},
+		options
+	};
+}
+const CHECK_OUTPUT_LIMIT = 65536;
+const CHECK_TIMEOUT_MS = 9e5;
+const safeNodeFile = /^(?!\.\.?$)[A-Za-z0-9._-]+$/;
+function tail(text) {
+	const bytes = Buffer.from(text);
+	return bytes.length <= CHECK_OUTPUT_LIMIT ? {
+		output: text,
+		truncated: false
+	} : {
+		output: bytes.subarray(bytes.length - CHECK_OUTPUT_LIMIT).toString("utf8"),
+		truncated: true
+	};
+}
+function lastJsonObject(stdout) {
+	const line = stdout.trimEnd().split("\n").at(-1)?.trim();
+	if (!line?.startsWith("{")) return void 0;
+	try {
+		const value = JSON.parse(line);
+		return value && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+	} catch {
+		return;
+	}
+}
+/** Each settled result a routes spawn carries: its source and its evidence, by node id. */
+function evidenceOf(task) {
+	if (!task || typeof task !== "object") return [];
+	const { from, evidence } = task;
+	const entries = /* @__PURE__ */ new Map();
+	if (from && typeof from === "object" && "node" in from && "result" in from) entries.set(String(from.node), from.result);
+	if (evidence && typeof evidence === "object" && !Array.isArray(evidence)) for (const [id, result] of Object.entries(evidence)) entries.set(id, result);
+	return [...entries];
+}
+async function writeEvidence(directory, task) {
+	await mkdir(directory, { recursive: true });
+	for (const [id, result] of evidenceOf(task)) {
+		if (!safeNodeFile.test(id)) throw new ValidationError(`runGraph: evidence node id ${id}`);
+		await writeFile(join(directory, `${id}.json`), `${JSON.stringify(result)}\n`);
+	}
+}
+async function readSecrets(names, environment, node) {
+	const secrets = {};
+	for (const name of names ?? []) {
+		const value = environment[name];
+		if (!value) throw new ValidationError(`runGraph: check node ${node} needs secret ${name}`);
+		secrets[name] = value;
+	}
+	return secrets;
+}
+/** Run one check node's command locally, in the run's working directory. */
+async function runLocalCheck(check, cwd, evidence, signal, secrets) {
+	const timeoutMs = check.timeoutMs ?? CHECK_TIMEOUT_MS;
+	const result = await runSettledCommand({
+		command: "/bin/sh",
+		args: ["-c", check.command],
+		cwd,
+		timeoutMs,
+		signal,
+		env: {
+			...secrets,
+			GRAPH_EVIDENCE: evidence
+		}
+	});
+	const timedOut = result.timedOut ? `\n[check timed out after ${timeoutMs} ms]` : "";
+	return {
+		exitCode: result.timedOut ? null : result.exitCode,
+		stdout: result.stdout,
+		output: result.stdout + result.stderr + timedOut
+	};
+}
+/** Run one check node's command in a fresh box on the check account, as a declared check does. */
+async function runBoxCheck(check, node, placement, evidence, signal, secrets) {
+	const workspaceRoot = await mkdtemp(join(evidence, "..", "box-"));
+	try {
+		const tree = join(workspaceRoot, "tree");
+		await mkdir(tree);
+		await cp(evidence, join(tree, "_evidence"), { recursive: true });
+		const result = await runIsolatedCheck({
+			workspaceRoot,
+			tree,
+			command: [
+				"/bin/sh",
+				"-c",
+				`GRAPH_EVIDENCE="$PWD/_evidence"; export GRAPH_EVIDENCE; ${check.command}`
+			],
+			timeoutMs: check.timeoutMs ?? CHECK_TIMEOUT_MS,
+			maxOutputBytes: 16 * CHECK_OUTPUT_LIMIT,
+			env: secrets,
+			signal,
+			box: {
+				client: placement.client,
+				builderAccounts: placement.builderAccounts ?? ["run-owner"],
+				ownerStep: true,
+				environment: check.environment,
+				...check.egress === void 0 ? {} : { egress: check.egress },
+				...check.resources === void 0 ? {} : { resources: check.resources }
+			}
+		});
+		if (result.succeeded) return {
+			exitCode: 0,
+			stdout: result.value.stdout,
+			output: result.value.stdout + result.value.stderr
+		};
+		const stdout = result.stdout ?? "";
+		const output = stdout + (result.stderr ?? "");
+		if (result.reason === "failed" && typeof result.exitCode === "number") return {
+			exitCode: result.exitCode,
+			stdout,
+			output
+		};
+		if (result.reason === "timeout") return {
+			exitCode: null,
+			stdout,
+			output: `${output}\n[check timed out]`
+		};
+		throw new Error(redact(`runGraph: check node ${node} box ${result.reason}: ${result.diagnostic}`, secrets));
+	} finally {
+		await rm(workspaceRoot, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+/** Every resolved secret value becomes `[redacted:NAME]` before output leaves the check. */
+function redact(text, secrets) {
+	return Object.entries(secrets).sort(([, a], [, b]) => b.length - a.length).reduce((out, [name, value]) => out.replaceAll(value, `[redacted:${name}]`), text);
+}
+function checkOutput(receipt) {
+	return {
+		pass: receipt.valid,
+		exitCode: receipt.exitCode,
+		output: receipt.output,
+		...receipt.json === void 0 ? {} : { json: receipt.json }
+	};
+}
+/** The receipt a run context's journal holds for this binding, as executor evidence. */
+async function replayContextReceipt(context, runId, binding, checkDigest) {
+	for (const event of await context.journal.loadTree(runId) ?? []) {
+		if (event.kind !== "execution-evidence") continue;
+		const row = (await context.blobs.get(event.outRef))?.graphCheckReceipt;
+		if (isReceipt(row) && row.binding === binding && row.checkDigest === checkDigest) return checkOutput(row);
+	}
+}
+/** A node attempt's journaled settle, so a resumed run never runs a settled command again. */
+async function replayCheckReceipt(file, binding, checkDigest) {
+	return withJsonlFileLock(file, async (canonicalPath) => {
+		for await (const row of readCommittedJsonLines(canonicalPath, { allowMissing: true })) if (isReceipt(row) && row.binding === binding && row.checkDigest === checkDigest) return checkOutput(row);
+	});
+}
+/**
+* Bind a flow graph's check nodes. Each spawn of a check node runs its command once and settles
+* `{ pass, exitCode, output, json }` as a usable result, so routes branch on `/pass`. The receipt
+* rides the run's `command-checks.jsonl` beside the command deliverable's, and a node attempt that
+* already holds a receipt replays it instead of running the command again.
+*/
+function bindGraphCheckNodes(graph, options) {
+	const checks = new Map(graph.nodes.flatMap((node) => node.check === void 0 ? [] : [[node.id, node.check]]));
+	if (checks.size === 0) return void 0;
+	if (graph.entry === void 0) throw new ValidationError("runGraph: check nodes run only in a flow graph (one with entry)");
+	for (const node of graph.nodes) if (!safeNodeFile.test(node.id)) throw new ValidationError(`runGraph: node id ${JSON.stringify(node.id)} cannot name an evidence file; use letters, digits, '.', '_' and '-'`);
+	for (const edge of graph.edges) if (edge.kind === "maps" && [edge.to, edge.join].some((id) => id && checks.has(id))) throw new ValidationError("runGraph: a check node runs from entry or routes, not a maps edge");
+	const placement = options.checkPlacement;
+	for (const [id, check] of checks) {
+		const timeoutMs = check.timeoutMs ?? CHECK_TIMEOUT_MS;
+		if (!check.command.trim() || !Number.isSafeInteger(timeoutMs) || timeoutMs <= 0) throw new ValidationError(`runGraph: check node ${id} needs a command and positive timeoutMs`);
+		if (placement && !check.environment?.trim()) throw new ValidationError(`runGraph: check node ${id} needs environment for box placement`);
+	}
+	const local = placement === void 0 ? localCheckDirectories(options) : void 0;
+	const workspace = local?.cwd ?? backendWorkspace(options);
+	const context = local || options.runDir ? void 0 : options.runContext;
+	const runDir = context ? void 0 : local?.runDir ?? driverRunDir(options, workspace);
+	const file = runDir === void 0 ? void 0 : join(runDir, "command-checks.jsonl");
+	const runId = options.runId ?? options.runContext?.runId;
+	const leaf = (profile, spawn) => {
+		const id = profile.name;
+		const check = checks.get(id);
+		if (check === void 0) throw new ValidationError(`runGraph: ${id} is not a check node`);
+		const checkDigest = contentAddress({
+			...check,
+			timeoutMs: check.timeoutMs ?? CHECK_TIMEOUT_MS,
+			at: local?.cwd ?? "box"
+		});
+		const binding = contentAddress({
+			runId,
+			node: id,
+			checkDigest,
+			at: spawn?.assignmentId
+		});
+		const executorFactory = (_spec, context_) => {
+			let artifact;
+			const settle = (out, ms) => {
+				artifact = {
+					out,
+					outRef: contentAddress(out),
+					verdict: {
+						valid: true,
+						score: out.pass ? 1 : 0
+					},
+					spent: {
+						iterations: 1,
+						tokens: {
+							input: 0,
+							output: 0
+						},
+						tokensKnown: true,
+						usd: 0,
+						usdKnown: true,
+						ms
+					}
+				};
+				return artifact;
+			};
+			const execute = async (task, signal) => {
+				const node = context_.node;
+				if (!node?.nodeId || !node.attemptId || !spawn) throw new ValidationError(`runGraph: check node ${id} ran outside a supervised node`);
+				const attempt = {
+					binding,
+					checkDigest,
+					nodeId: node.nodeId,
+					attemptId: node.attemptId
+				};
+				const prior = file ? await replayCheckReceipt(file, binding, checkDigest) : await replayContextReceipt(context, runId, binding, checkDigest);
+				if (prior) return settle(prior, 0);
+				const started = Date.now();
+				const staged = runDir ? void 0 : await mkdtemp(join(tmpdir(), "graph-check-"));
+				const evidence = join(runDir ?? staged, "graph-evidence", contentAddress(attempt).slice(7, 31));
+				const box = placement;
+				const secrets = await readSecrets(check.secrets, local ? process.env : typeof box.env === "function" ? await box.env({
+					node: id,
+					secrets: check.secrets ?? [],
+					signal
+				}) : box.env ?? {}, id);
+				let ran;
+				try {
+					await writeEvidence(evidence, task);
+					ran = local ? await runLocalCheck(check, local.cwd, evidence, signal, secrets) : await runBoxCheck(check, id, placement, evidence, signal, secrets);
+				} finally {
+					if (staged) await rm(staged, {
+						recursive: true,
+						force: true
+					});
+				}
+				const { output, truncated } = tail(redact(ran.output, secrets));
+				const json = lastJsonObject(redact(ran.stdout, secrets));
+				const receipt = {
+					version: 1,
+					...attempt,
+					nodeName: id,
+					outputDigest: contentAddress(task),
+					exitCode: ran.exitCode,
+					output,
+					outputTruncated: truncated,
+					nativeValid: true,
+					valid: ran.exitCode === 0,
+					...json === void 0 ? {} : { json }
+				};
+				if (file) await appendReceipt(file, workspace, receipt);
+				else await retainedExecutorContext(context_)?.onEvidence?.({ graphCheckReceipt: {
+					...receipt,
+					key: receiptKey(receipt)
+				} });
+				return settle(checkOutput(receipt), Date.now() - started);
+			};
+			return {
+				runtime: "graph-check",
+				execute,
+				recover: execute,
+				async teardown() {
+					return { destroyed: true };
+				},
+				resultArtifact() {
+					if (!artifact) throw new ValidationError(`runGraph: check node ${id} has not settled`);
+					return artifact;
+				}
+			};
+		};
+		return {
+			name: id,
+			act: async () => "",
+			executorSpec: {
+				profile,
+				harness: null,
+				executorFactory: runtimeCheckFactory(executorFactory)
+			}
+		};
+	};
+	return {
+		names: [...checks.keys()],
+		leaf
+	};
+}
+// src/runtime/supervise/graph.ts
+/**
+* `runGraph` interprets a topology on `supervise()`. Nodes are canonical `AgentProfile`s, edges
+* carry versioned {@link PromptHandle} directives, and `deliverable` and one conserved `budget`
+* are mandatory. It does not schedule: `runAgentRounds` is not the substrate. A spawn's
+* `profile.name` is the node id, so a driver cannot add capabilities the node did not define.
+* Every delegates, analyzes, maps, or routes hop is an edge-ledger row (`delivered`, `stripped`,
+* `empty`, `unpropagated`, `failed`) on the result and in the journal. Edge text lives in the
+* prompt registry. A delegates edge at its traversal cap refuses. `continuity: 'resume'`
+* re-attaches to the node's latest settled session; ledger hops say `fresh`, `resume`, or `steer`.
+* A `maps` edge spawns one authorized item per selected array element and then the join, on the
+* same pool, with no model turn. With `entry` set, Runtime owns the root and fires `routes` on
+* settle (`graph-flow.ts`). An `analyzes` edge names a registry lens or a graph node, never a
+* delegates target, and an id in both places is refused.
+*
+* @experimental
+*/
+/** A delegates edge exhausted its traversal cap and the run produced no winner: the cap, not the
+*  task, ended it. Carries the full evidence so failing loud loses nothing. */
+var GraphEdgeCapError = class extends Error {
+	exhaustedEdges;
+	ledger;
+	result;
+	constructor(exhaustedEdges, ledger, result) {
+		super(`runGraph: edge traversal cap exhausted on ${exhaustedEdges.join(", ")} and the run delivered no winner — the cap (the cyclic-graph backstop), not the task, ended this run. Raise maxTraversals on the edge or fix the cycle; the full edge ledger and the supervised result ride on this error.`);
+		this.name = "GraphEdgeCapError";
+		this.exhaustedEdges = exhaustedEdges;
+		this.ledger = ledger;
+		this.result = result;
+	}
+};
+/**
+* Every `SuperviseOptions` key, partitioned by what `runGraph` does with it.
+*
+* `runGraph` starts one `supervise()` run, so every option that run honors is a graph option too
+* unless the graph itself owns the value. This used to be an opt-in list written by hand, and the
+* hand lost: 25 of 49 keys never reached `supervise()` from a graph, including `childSettleGraceMs`
+* (a root-driver failure tore down children that had ALREADY computed the deliverable) and
+* `driverRetry` (agent-runtime#963). Each absence was discovered by losing a run.
+*
+* The four lists below must cover `keyof SuperviseOptions` exactly. `everySuperviseOptionIsClassified`
+* below fails to COMPILE, naming the offender, when a key belongs to none of them — so the next
+* option added to `supervise()` cannot go missing here silently. It has to be classified, and
+* classifying it as forwarded is one word.
+*/
+/** The graph derives these from the `AgentGraph` itself; a caller value would be overwritten. */
+const GRAPH_OWNED_SUPERVISE_OPTIONS = [
+	"rootDriverFromBackend",
+	"resolveSpawnProfile",
+	"budget",
+	"deliverable",
+	"makeWorkerAgent",
+	"onCoordinationEvent",
+	"analyzeOnSettle",
+	"mapOnSettle",
+	"routeFlow",
+	"checkNodes",
+	"continuityByProfile",
+	"inheritSpawnRights",
+	"promptRegistry"
+];
+/** Caller-facing on `RunGraphOptions`, but the graph wraps or defaults the value before it goes in:
+*  `hooks` composes with the graph's own spawn-binding hook, `authorizeMessage` is wrapped so a
+*  narrowed instruction ledgers `stripped`, `authorizeSpawn` runs AFTER the graph has pinned the
+*  node (so a product sees the canonical profile, never the driver's stub), `makeLeafAgent` is the
+*  caller's leaf override slotted under the graph's pinning, `analysts` rides only with analyze
+*  routes, and `journal`/`blobs`/`runId` get graph defaults. */
+const GRAPH_TRANSFORMED_SUPERVISE_OPTIONS = [
+	"hooks",
+	"authorizeMessage",
+	"authorizeSpawn",
+	"makeLeafAgent",
+	"analysts",
+	"journal",
+	"blobs",
+	"runId",
+	"decideGate"
+];
+/** Not reachable from a graph, with the reason. `registry` is a NAME COLLISION, not a policy:
+*  `RunGraphOptions.registry` is the directive `PromptRegistry` and `SuperviseOptions.registry` is
+*  the `SuperviseRegistry` name→value table. Two different types under one name; the graph's wins.
+*  Giving the supervise one a graph channel means renaming a public option, so it is recorded here
+*  rather than silently dropped. */
+const GRAPH_REFUSED_SUPERVISE_OPTIONS = ["registry"];
+/**
+* Forwarded to the root `supervise()` VERBATIM. Everything not owned, transformed, or refused
+* above belongs here — the default is "a graph honors it", not "someone remembered to add it".
+*/
+const GRAPH_FORWARDED_SUPERVISE_OPTIONS = [
+	"parking",
+	"backend",
+	"profileGuidance",
+	"escalateQuestion",
+	"rootHandle",
+	"signal",
+	"execution",
+	"resolveDeliverable",
+	"coordination",
+	"peerMail",
+	"peerAudit",
+	"traceTools",
+	"driverBackend",
+	"profileSecurity",
+	"authorizeSpawn",
+	"router",
+	"driveHarness",
+	"selectSeat",
+	"driverRetry",
+	"onDriverAttempt",
+	"continuation",
+	"childSettleGraceMs",
+	"teardownConfirmMs",
+	"retainedAtSettlement",
+	"resolveDriveHarness",
+	"driveHarnessMaterialization",
+	"resolveSupervisorTools",
+	"extraTools",
+	"executeExtraTool",
+	"recoverExecutor",
+	"perWorker",
+	"reservationPolicy",
+	"deadlineCheckIn",
+	"budgetStopHoldMs",
+	"workerSlots",
+	"watchWorkers",
+	"stallAfterMs",
+	"wake",
+	"runDir",
+	"resume",
+	"segment",
+	"runContext",
+	"steerDir",
+	"stopRule",
+	"onProgressStop",
+	"maxDepth",
+	"maxTurns",
+	"compaction",
+	"now",
+	"allowedModels",
+	"finalizer",
+	"otel",
+	"graphRegistry"
+];
+/**
+* Every key `RunGraphOptions` accepts, as data: the forwarded and transformed `SuperviseOptions`
+* keys, the name-colliding `registry`, and the graph's own `brain`. `GRAPH_OWNED_SUPERVISE_OPTIONS`
+* is deliberately absent — a caller value for one of those is overwritten by the graph, so it is
+* refused by name rather than discarded.
+*
+* The assignment below fails to COMPILE, naming the key, when `RunGraphOptions` declares something
+* this list does not carry.
+*/
+const runGraphOptionKeys = [
+	...GRAPH_FORWARDED_SUPERVISE_OPTIONS,
+	...GRAPH_TRANSFORMED_SUPERVISE_OPTIONS,
+	...GRAPH_REFUSED_SUPERVISE_OPTIONS,
+	"brain",
+	"checkPlacement"
+];
+const runGraphOptionKeySet = new Set(runGraphOptionKeys);
+const graphOwnedOptionKeySet = new Set(GRAPH_OWNED_SUPERVISE_OPTIONS);
+/**
+* Refuse an option key the graph would not read, naming it and saying which kind it is.
+*
+* A graph-owned key is the sharper case: it type-checks against a widened `SuperviseOptions`
+* value, the graph derives its own value and overwrites the caller's, the run succeeds, and the
+* capability the caller asked for is not there. The rename of the leaf seam from `makeWorkerAgent`
+* to `makeLeafAgent` is the shape of the failure — the old name stayed a valid `SuperviseOptions`
+* key AND a graph-owned one, so a caller that kept passing it got a run with no leaf override and
+* no complaint.
+*/
+function assertRunGraphOptionKeys(opts) {
+	const graphOwned = [];
+	const unknown = [];
+	for (const key of Object.keys(opts)) {
+		if (runGraphOptionKeySet.has(key)) continue;
+		if (graphOwnedOptionKeySet.has(key)) graphOwned.push(key);
+		else unknown.push(key);
+	}
+	if (graphOwned.length > 0) throw new ConfigError(`runGraph: ${graphOwned.sort().join(", ")} — the graph derives this from the AgentGraph itself, so a caller value is overwritten and the capability it asks for would silently be absent`);
+	if (unknown.length > 0) throw new ConfigError(`runGraph: unknown option ${unknown.sort().join(", ")} — no reader consults that name, so the value would be discarded and the capability it asks for would silently be absent`);
+}
+/** Copy every forwarded option the caller actually set. Absent stays absent: `supervise()` and the
+*  graph must not disagree about what "unset" means. */
+function forwardedSuperviseOptions(opts) {
+	const forwarded = {};
+	for (const key of GRAPH_FORWARDED_SUPERVISE_OPTIONS) {
+		const value = opts[key];
+		if (value !== void 0) forwarded[key] = value;
+	}
+	return forwarded;
+}
+/** Validate the graph and resolve every directive BEFORE any compute is spent — an invalid
+*  topology or an unknown directive is a configuration fault, never a mid-run surprise. */
+function validateGraph(graph, registry, analysts) {
+	if (graph.entry === void 0) {
+		if (!Array.isArray(graph.nodes) || graph.nodes.length === 0) throw new ValidationError("runGraph: graph.nodes must be a non-empty array");
+		if (!Array.isArray(graph.edges) || graph.edges.length === 0) throw new ValidationError("runGraph: graph.edges must be a non-empty array");
+	}
+	if (typeof graph.deliverable?.check !== "function") throw new ValidationError("runGraph: graph.deliverable is mandatory (termination oracle)");
+	if (typeof graph.budget !== "object" || graph.budget === null) throw new ValidationError("runGraph: graph.budget is mandatory (the conserved pool)");
+	if (graph.entry !== void 0) return validateFlowGraph(graph, registry, analysts);
+	if (graph.gates !== void 0) throw new ValidationError("runGraph: graph.gates needs graph.entry");
+	return validateGraphTopology(graph.nodes, graph.edges, registry, analysts);
+}
+/**
+* Execute an {@link AgentGraph}. A flow graph (`entry` set) runs from its entries and routes edges
+* under a runtime-owned root that places no model call. Otherwise the root node becomes the
+* supervisor (`supervise()` — the execution core), each worker node is spawnable BY NODE ID
+* (`spawn_worker` with `profile: { name: '<node id>' }`; the node's canonical profile is pinned by
+* the graph), each
+* delegates directive is appended to the worker profile's `prompt.instructions` per traversal,
+* and each analyzes edge becomes an analyst-on-settle route with a real DESTINATION. Every
+* traversal is ledgered and journaled.
+*/
+function runGraph(graph, opts) {
+	const { brain, ...runtimeOptions } = graphExecutionOptions(opts);
+	return superviseAgentGraph(graph, runtimeOptions, brain);
+}
+/** Alias for graph tests written before `RunGraphOptions.brain` was production. The production
+*  entry accepts the same shape; this wrapper only keeps the `/testing` import path working. */
+function runGraphWithTestBrain(graph, opts) {
+	const { brain, ...runtimeOptions } = opts;
+	return superviseAgentGraph(graph, runtimeOptions, brain);
+}
+/**
+* The graph supervise run, as its own entry: the engine's `run-graph` preset node executes exactly
+* this, so the preset and `runGraph` are the same code path by construction (agent-runtime#982).
+*/
+/**
+* Every refusal a graph earns before any compute, in one place: the authoring contract. `runGraph`
+* calls it FIRST so a malformed graph throws synchronously, exactly as it did before the engine
+* preset (agent-runtime#982) moved execution behind a promise.
+*/
+function assertRunGraphAuthoring(graph, opts, brain) {
+	assertRunGraphOptionKeys(opts);
+	if (graph.continuation !== void 0) {
+		portableContinuationPolicySchema.parse(graph.continuation);
+		if (opts.continuation !== void 0) throw new ValidationError("runGraph: graph.continuation and opts.continuation have two policy owners");
+		if (graph.entry !== void 0) throw new ValidationError("runGraph: graph.continuation with graph.entry has no root manager");
+	}
+	const validated = validateGraph(graph, opts.registry ?? kernelPromptRegistry(), opts.analysts);
+	const requireLeaves = () => {
+		if (!opts.backend && !opts.makeLeafAgent) throw new ValidationError("runGraph: provide opts.backend (where nodes run) or opts.makeLeafAgent");
+	};
+	if (validated.flow !== void 0) {
+		const rootOptions = [...brain ? ["brain"] : [], ...[
+			"driverBackend",
+			"finalizer",
+			"maxTurns",
+			"compaction"
+		].filter((key) => opts[key] !== void 0)];
+		if (rootOptions.length > 0) throw new ValidationError(`runGraph: ${rootOptions.join(", ")} with graph.entry — a flow graph has no root manager: Runtime spawns its entries and traverses its routes edges, and the graph owns the run's output`);
+		if ((graph.gates?.length ?? 0) > 0 && opts.decideGate === void 0) throw new ValidationError("runGraph: graph.gates needs opts.decideGate to answer them");
+		requireLeaves();
+		return validated;
+	}
+	const { root } = validated;
+	if (graph.continuation !== void 0 && !harnessRunsAgent(root.profile.harness)) throw new ValidationError("runGraph: graph.continuation requires an external-harness root");
+	if (brain && opts.driverBackend) throw new ValidationError("runGraph: brain and driverBackend are mutually exclusive — a caller brain makes the root model calls, a driverBackend places a harness that makes its own");
+	if (brain && harnessRunsAgent(root.profile.harness)) throw new ValidationError(`runGraph: root node '${root.id}' declares harness '${root.profile.harness}', so the harness drives it — a caller brain applies only to a router-brained root (profile.harness omitted or 'cli-base')`);
+	requireLeaves();
+	return validated;
+}
+function superviseAgentGraph(graph, opts, brain) {
+	const { continuation, ...topology } = graph;
+	graph = {
+		...topology,
+		...continuation === void 0 ? {} : { continuation: portableContinuationPolicySchema.parse(continuation) }
+	};
+	if (graph.deliverable.command !== void 0) {
+		const bound = bindGraphCommand(graph, opts);
+		return superviseAgentGraph(bound.graph, bound.options, brain);
+	}
+	const registry = opts.registry ?? kernelPromptRegistry();
+	if (opts.runContext?.acquire !== void 0) return withRunContext(opts.runContext, opts.signal, (runContext, signal) => superviseAgentGraph(graph, {
+		...opts,
+		runContext,
+		...signal === void 0 ? {} : { signal }
+	}, brain));
+	const validated = assertRunGraphAuthoring(graph, opts, brain);
+	const context = opts.runContext ?? (opts.runDir === void 0 ? createInMemoryRunContext() : createFileRunContext(resolve(opts.runDir)));
+	const journal = opts.journal ?? context.journal;
+	const blobs = opts.blobs ?? context.blobs;
+	const runId = opts.runId ?? opts.runContext?.runId ?? `graph-${canonicalCandidateDigest(graph.nodes.map((n) => n.id)).slice(7, 19)}`;
+	const now = opts.now ?? Date.now;
+	const checkNodes = bindGraphCheckNodes(graph, {
+		...opts,
+		runId
+	});
+	const guidance = profileGuidanceComposer(opts.profileGuidance);
+	const overlay = createGraphOverlay(validated, {
+		registry,
+		journal,
+		runId,
+		now,
+		...guidance ? { guidance } : {},
+		...opts.authorizeSpawn ? { authorizeSpawn: opts.authorizeSpawn } : {}
+	});
+	const flow = validated.flow === void 0 ? void 0 : createFlowRun(overlay.nodeOfWorker);
+	const callerAuthorizeMessage = opts.authorizeMessage;
+	const authorizeMessage = overlay.observeMessages((input) => callerAuthorizeMessage ? callerAuthorizeMessage(input) : { instruction: input.instruction });
+	const hooks = composeRuntimeHooks({ onEvent: (event) => {
+		if (event.target !== "agent.spawn" || event.phase !== "after") return;
+		const payload = event.payload;
+		if (typeof payload?.childId !== "string" || typeof payload.assignmentId !== "string") return;
+		return overlay.bindSpawn(event.parentId, payload.assignmentId, payload.childId);
+	} }, opts.hooks);
+	const rootProfile = flow === void 0 ? graphRootProfile(validated, registry) : flowRootProfile;
+	const rootBrain = flow === void 0 ? brain : runtimeFlowBrain();
+	const task = flow === void 0 ? graph.deliverable.describe ?? `Deliver the graph's deliverable by driving your worker nodes (root: '${validated.root.id}').` : graph.deliverable.describe ?? "Runtime runs this flow graph from its entries.";
+	const start = async () => {
+		const superviseOptions = {
+			...forwardedSuperviseOptions(opts),
+			rootDriverFromBackend: flow !== void 0,
+			budget: graph.budget,
+			...graph.continuation === void 0 ? {} : { continuation: graph.continuation },
+			deliverable: flow?.routeCheck(graph.deliverable) ?? graph.deliverable,
+			authorizeSpawn: overlay.authorizeSpawn,
+			resolveSpawnProfile: overlay.resolveSpawnProfile,
+			inheritSpawnRights: false,
+			promptRegistry: registry,
+			...opts.makeLeafAgent ? { makeLeafAgent: opts.makeLeafAgent } : {},
+			journal,
+			blobs,
+			runId,
+			hooks,
+			onCoordinationEvent: async (context, _eventId, record) => {
+				if (record.event.type === "route" && context.depth !== 0) return;
+				overlay.onCoordinationEvent(record.event);
+				flow?.observe(record.event);
+			},
+			...overlay.routes.length > 0 ? {
+				analyzeOnSettle: overlay.routes,
+				...opts.analysts ? { analysts: opts.analysts } : {}
+			} : {},
+			...overlay.maps.length > 0 ? { mapOnSettle: overlay.maps } : {},
+			...Object.keys(overlay.continuityByProfile).length > 0 ? { continuityByProfile: overlay.continuityByProfile } : {},
+			...flow === void 0 ? {} : {
+				routeFlow: routeFlowOf(validated),
+				...checkNodes && { checkNodes },
+				...opts.decideGate && { decideGate: journaledGateDecider(opts.decideGate, journal, runId) },
+				finalizer: flow.finalizer,
+				wake: {
+					debounceMs: 0,
+					...opts.wake
+				}
+			},
+			authorizeMessage
+		};
+		const supervised = rootBrain === void 0 ? await supervise(rootProfile, task, superviseOptions) : await superviseWithTestBrain(rootProfile, task, {
+			...superviseOptions,
+			brain: rootBrain
+		});
+		const { ledger, exhaustedEdges, exhaustedDelegates } = await overlay.settle();
+		const concluded = flow?.conclude(supervised);
+		if (concluded?.kind === "unrouted") throw new GraphRouteError(concluded.unrouted, ledger, supervised);
+		const result = concluded?.result ?? supervised;
+		const stopped = concluded?.stopped;
+		const lifecycleEnded = result.kind === "no-winner" && (result.reason === "aborted" || result.reason === "cancelled" || result.reason === "budget-exhausted" || result.reason === "deadline");
+		if (result.kind !== "winner" && !lifecycleEnded && exhaustedDelegates.length > 0) throw new GraphEdgeCapError(exhaustedDelegates, ledger, result);
+		return {
+			result,
+			ledger,
+			exhaustedEdges,
+			runId,
+			...stopped ? { stopped } : {}
+		};
+	};
+	return start();
+}
+export { graphExecutionOptions as a, superviseAgentGraph as i, runGraph as n, runIsolatedCheck as o, runGraphWithTestBrain as r, validateIsolatedCheckOutputs as s, GraphEdgeCapError as t };
+
+//# sourceMappingURL=graph-pFTeNZ-G.js.map