@the-open-engine/zeroshot 6.25.0 → 6.26.0

package/src/hosted-target/zero-cloud-v1-adapter.ts

@@ -0,0 +1,386 @@
+import { MAX_ERROR_BODY_BYTES, MAX_RESPONSE_BYTES, MAX_RETRY_ELAPSED_MS, IDEMPOTENCY_KEY_PATTERN } from './bounds.ts';
+import {
+  TargetAuthError,
+  TargetConflictError,
+  TargetNotFoundError,
+  TargetProtocolError,
+  TargetRateLimitError,
+  TargetTransportError,
+} from './errors.ts';
+import { TargetAdapterError } from './errors.ts';
+import { DefaultRetryPolicy, parseRetryAfter } from './retry.ts';
+import {
+  assertCapsule,
+  assertCapsuleAccess,
+  assertCapsuleLimits,
+  assertCapsuleListPage,
+} from './response-validation.ts';
+import type { TargetAdapter } from './target-adapter.ts';
+import type {
+  AllocateRequest,
+  Capsule,
+  CapsuleAccess,
+  CapsuleLimits,
+  CapsuleListPage,
+  Clock,
+  HttpTransport,
+  RetryPolicy,
+  TargetAccessTokenProvider,
+  TargetDiscovery,
+} from './types.ts';
+
+interface ZeroCloudV1Options {
+  readonly discovery: TargetDiscovery;
+  readonly organization: string;
+  readonly tokenProvider: TargetAccessTokenProvider;
+  readonly transport?: HttpTransport;
+  readonly clock?: Clock;
+  readonly retryPolicy?: RetryPolicy;
+}
+
+const DEFAULT_TRANSPORT: HttpTransport = {
+  fetch(url: string, init: RequestInit & { redirect: 'error' }): Promise<Response> {
+    return globalThis.fetch(url, init);
+  },
+};
+
+const DEFAULT_CLOCK: Clock = { now: () => Date.now() };
+
+function throwIfAborted(signal?: AbortSignal): void {
+  if (signal?.aborted) {
+    throw signal.reason === undefined
+      ? new DOMException('The operation was aborted', 'AbortError')
+      : signal.reason;
+  }
+}
+
+async function waitForRetryDelay(delayMs: number, signal?: AbortSignal): Promise<void> {
+  throwIfAborted(signal);
+  if (delayMs <= 0) return;
+
+  await new Promise<void>((resolve, reject) => {
+    const onAbort = (): void => {
+      clearTimeout(timer);
+      reject(
+        signal!.reason === undefined
+          ? new DOMException('The operation was aborted', 'AbortError')
+          : signal!.reason,
+      );
+    };
+    const timer = setTimeout(() => {
+      signal?.removeEventListener('abort', onAbort);
+      resolve();
+    }, delayMs);
+    signal?.addEventListener('abort', onAbort, { once: true });
+  });
+}
+
+function originOf(url: string): string {
+  try {
+    const u = new URL(url);
+    return u.origin;
+  } catch {
+    throw new TargetProtocolError(`Invalid URL: ${url}`);
+  }
+}
+
+export class ZeroCloudV1TargetAdapter implements TargetAdapter {
+  private readonly discovery: TargetDiscovery;
+  private readonly organization: string;
+  private readonly tokenProvider: TargetAccessTokenProvider;
+  private readonly transport: HttpTransport;
+  private readonly clock: Clock;
+  private readonly retryPolicy: RetryPolicy;
+  private readonly expectedOrigin: string;
+
+  constructor(opts: ZeroCloudV1Options) {
+    this.discovery = opts.discovery;
+    this.organization = opts.organization;
+    this.tokenProvider = opts.tokenProvider;
+    this.transport = opts.transport ?? DEFAULT_TRANSPORT;
+    this.clock = opts.clock ?? DEFAULT_CLOCK;
+    this.retryPolicy = opts.retryPolicy ?? new DefaultRetryPolicy();
+    this.expectedOrigin = originOf(opts.discovery.capsuleV1);
+  }
+
+  async allocate(req: AllocateRequest, signal?: AbortSignal): Promise<Capsule> {
+    if (!IDEMPOTENCY_KEY_PATTERN.test(req.idempotencyKey)) {
+      throw new TargetProtocolError(
+        `Invalid idempotency key: must match ${IDEMPOTENCY_KEY_PATTERN}`,
+      );
+    }
+
+    const body = JSON.stringify({ profile: req.profile, organization: this.organization });
+
+    return this._withRetry(async () => {
+      const resp = await this._request('POST', '/capsules', {
+        signal,
+        body,
+        headers: { 'Idempotency-Key': req.idempotencyKey },
+      });
+      const json = await this._readJson(resp);
+      return assertCapsule(json);
+    }, signal);
+  }
+
+  async list(cursor?: string, signal?: AbortSignal): Promise<CapsuleListPage> {
+    return this._withRetry(async () => {
+      const params = new URLSearchParams({ organization: this.organization });
+      if (cursor) params.set('cursor', cursor);
+      const resp = await this._request('GET', `/capsules?${params.toString()}`, { signal });
+      const json = await this._readJson(resp);
+      const page = assertCapsuleListPage(json);
+      if (page.cursor !== undefined && page.cursor === cursor) {
+        throw new TargetProtocolError(
+          `Pagination loop detected: server returned the same cursor "${cursor}"`,
+        );
+      }
+      return page;
+    }, signal);
+  }
+
+  async inspect(capsuleId: string, signal?: AbortSignal): Promise<Capsule> {
+    return this._withRetry(async () => {
+      const resp = await this._request('GET', `/capsules/${encodeURIComponent(capsuleId)}`, {
+        signal,
+      });
+      const json = await this._readJson(resp);
+      return assertCapsule(json);
+    }, signal);
+  }
+
+  async terminate(capsuleId: string, signal?: AbortSignal): Promise<void> {
+    await this._withRetry(async () => {
+      const resp = await this._request(
+        'DELETE',
+        `/capsules/${encodeURIComponent(capsuleId)}`,
+        { signal },
+      );
+      if (resp.status !== 204) {
+        const json = await this._readJson(resp);
+        throw new TargetProtocolError(`Unexpected terminate response: ${JSON.stringify(json)}`);
+      }
+    }, signal);
+  }
+
+  async limits(signal?: AbortSignal): Promise<CapsuleLimits> {
+    return this._withRetry(async () => {
+      const params = new URLSearchParams({ organization: this.organization });
+      const resp = await this._request('GET', `/limits?${params.toString()}`, { signal });
+      const json = await this._readJson(resp);
+      return assertCapsuleLimits(json);
+    }, signal);
+  }
+
+  async access(capsuleId: string, signal?: AbortSignal): Promise<CapsuleAccess> {
+    return this._withRetry(async () => {
+      const resp = await this._request(
+        'POST',
+        `/capsules/${encodeURIComponent(capsuleId)}/access`,
+        { signal },
+      );
+      const json = await this._readJson(resp);
+      return assertCapsuleAccess(json);
+    }, signal);
+  }
+
+  private async _request(
+    method: string,
+    path: string,
+    opts: { signal?: AbortSignal | undefined; body?: string | undefined; headers?: Record<string, string> | undefined },
+  ): Promise<Response> {
+    const url = `${this.discovery.capsuleV1}${path}`;
+
+    const responseOrigin = originOf(url);
+    if (responseOrigin !== this.expectedOrigin) {
+      throw new TargetProtocolError(
+        `Origin mismatch: expected ${this.expectedOrigin}, got ${responseOrigin}`,
+      );
+    }
+
+    let token: string;
+    try {
+      token = await this.tokenProvider.getAccessToken(opts.signal);
+    } catch (err) {
+      throw new TargetTransportError('Failed to acquire access token', err);
+    }
+
+    const headers: Record<string, string> = {
+      'Authorization': `Bearer ${token}`,
+      'Content-Type': 'application/json',
+      'Accept': 'application/json',
+      ...opts.headers,
+    };
+
+    let response: Response;
+    const fetchInit: RequestInit & { redirect: 'error' } = {
+      method,
+      headers,
+      redirect: 'error',
+    };
+    if (opts.body !== undefined) fetchInit.body = opts.body;
+    if (opts.signal !== undefined) fetchInit.signal = opts.signal;
+
+    try {
+      response = await this.transport.fetch(url, fetchInit);
+    } catch (err) {
+      if (err instanceof TargetAdapterError) throw err;
+      const msg = err instanceof Error ? err.message : String(err);
+      if (msg.includes('redirect')) {
+        throw new TargetProtocolError(`Redirect rejected for ${method} ${path}`, err);
+      }
+      throw new TargetTransportError(`Network error during ${method} ${path}`, err);
+    }
+
+    if (response.status < 200 || response.status >= 300) {
+      await this._mapStatusError(response, method, path, opts.headers);
+    }
+
+    return response;
+  }
+
+  private async _mapStatusError(
+    response: Response,
+    method: string,
+    path: string,
+    headers?: Record<string, string>,
+  ): Promise<never> {
+    const status = response.status;
+    const errorBody = await this._readErrorBody(response);
+    const context = `${status} ${method} ${path}: ${errorBody}`;
+
+    if (status === 401 || status === 403) throw new TargetAuthError(context);
+    if (status === 404) throw new TargetNotFoundError(context);
+    if (status === 409) {
+      const idempotencyKey = headers?.['Idempotency-Key'] ?? 'unknown';
+      throw new TargetConflictError(idempotencyKey, context);
+    }
+    if (status === 429) {
+      const retryAfterMs = parseRetryAfter(response.headers.get('Retry-After'), this.clock);
+      throw new TargetRateLimitError(context, retryAfterMs ?? undefined);
+    }
+    if (status >= 500) throw new TargetTransportError(context);
+    throw new TargetProtocolError(`Unexpected status ${context}`);
+  }
+
+  private async _readJson(response: Response): Promise<unknown> {
+    const contentLength = response.headers.get('Content-Length');
+    if (contentLength !== null) {
+      const len = parseInt(contentLength, 10);
+      if (Number.isFinite(len) && len > MAX_RESPONSE_BYTES) {
+        throw new TargetProtocolError(
+          `Response too large: ${len} bytes exceeds limit of ${MAX_RESPONSE_BYTES}`,
+        );
+      }
+    }
+
+    let text: string;
+    try {
+      const reader = response.body?.getReader();
+      if (!reader) {
+        text = await response.text();
+      } else {
+        const chunks: Uint8Array[] = [];
+        let totalBytes = 0;
+        while (true) {
+          const { done, value } = await reader.read();
+          if (done) break;
+          totalBytes += value.byteLength;
+          if (totalBytes > MAX_RESPONSE_BYTES) {
+            reader.cancel();
+            throw new TargetProtocolError(
+              `Response body exceeds limit of ${MAX_RESPONSE_BYTES} bytes`,
+            );
+          }
+          chunks.push(value);
+        }
+        const combined = new Uint8Array(totalBytes);
+        let offset = 0;
+        for (const chunk of chunks) {
+          combined.set(chunk, offset);
+          offset += chunk.byteLength;
+        }
+        text = new TextDecoder().decode(combined);
+      }
+    } catch (err) {
+      if (err instanceof TargetProtocolError) throw err;
+      throw new TargetProtocolError('Failed to read response body', err);
+    }
+
+    try {
+      return JSON.parse(text);
+    } catch (err) {
+      throw new TargetProtocolError('Invalid JSON in response body', err);
+    }
+  }
+
+  private async _readErrorBody(response: Response): Promise<string> {
+    const reader = response.body?.getReader();
+    if (!reader) return '';
+
+    const chunks: Uint8Array[] = [];
+    let totalBytes = 0;
+    try {
+      while (totalBytes < MAX_ERROR_BODY_BYTES) {
+        const { done, value } = await reader.read();
+        if (done) break;
+
+        const remaining = MAX_ERROR_BODY_BYTES - totalBytes;
+        const retained = value.byteLength > remaining ? value.slice(0, remaining) : value;
+        chunks.push(retained);
+        totalBytes += retained.byteLength;
+        if (retained.byteLength !== value.byteLength || totalBytes === MAX_ERROR_BODY_BYTES) {
+          void reader.cancel().catch(() => undefined);
+          break;
+        }
+      }
+    } catch {
+      void reader.cancel().catch(() => undefined);
+      return '<unreadable>';
+    }
+
+    const combined = new Uint8Array(totalBytes);
+    let offset = 0;
+    for (const chunk of chunks) {
+      combined.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    return new TextDecoder().decode(combined);
+  }
+
+  private async _withRetry<T>(
+    fn: () => Promise<T>,
+    signal?: AbortSignal,
+  ): Promise<T> {
+    const startTime = this.clock.now();
+    let attempt = 0;
+
+    while (true) {
+      throwIfAborted(signal);
+      try {
+        return await fn();
+      } catch (err) {
+        throwIfAborted(signal);
+        if (!(err instanceof TargetAdapterError)) throw err;
+        if (err instanceof TargetAuthError) throw err;
+
+        attempt++;
+        const elapsed = this.clock.now() - startTime;
+        const decision = this.retryPolicy.shouldRetry(attempt, elapsed, err);
+        const remaining = MAX_RETRY_ELAPSED_MS - elapsed;
+
+        if (
+          !decision.retry ||
+          !Number.isFinite(decision.delayMs) ||
+          decision.delayMs < 0 ||
+          decision.delayMs >= remaining
+        ) {
+          throw err;
+        }
+
+        await waitForRetryDelay(decision.delayMs, signal);
+        if (this.clock.now() - startTime >= MAX_RETRY_ELAPSED_MS) throw err;
+      }
+    }
+  }
+}

package/src/omp-session-limits.js

@@ -14,4 +14,28 @@ const OMP_SESSION_LIMITS = Object.freeze({
   maxReferencedBlobBytes: 67108864,
 });
 
-module.exports = { OMP_SESSION_LIMITS };
+/**
+ * The largest single JSONL record the verifier will buffer, DERIVED from the constants above
+ * rather than chosen — it is `maxReferencedBlobBytes`, and it is not a new knob (there is nothing
+ * to configure and no caller may override it).
+ *
+ * Why a per-record bound is needed at all: `maxSessionBytes` bounds the *file*, not a line within
+ * it. A hostile 256 MiB session with no newline in it is one record, and buffering it would cost
+ * the raw bytes, a concatenated copy, a UTF-16 string for JSON.parse, and the parsed value — a
+ * multi-hundred-megabyte spike driven entirely by the attacker's choice of where to put newlines.
+ *
+ * Why this value: `maxReferencedBlobBytes` is the issue's own answer to "how large may one
+ * addressable unit of session content be". OMP externalizes anything bigger than a message to the
+ * shared CAS store (blob-store.ts) and leaves only a 76-byte `blob:sha256:<hex>` reference in the
+ * record, so a legitimate record is orders of magnitude smaller than this; the bound exists to cap
+ * the pathological case, not to constrain real transcripts.
+ *
+ * Remaining allocation, exactly: verification buffers at most MAX_SESSION_RECORD_BYTES of raw
+ * record bytes, and `JSON.parse` necessarily materializes that record as one UTF-16 string plus its
+ * parsed value. Peak per-record cost is therefore O(MAX_SESSION_RECORD_BYTES) and independent of
+ * `maxSessionBytes`, the record count, and the file's newline placement. Nothing else in the
+ * verifier accumulates session, artifact, or blob bytes.
+ */
+const MAX_SESSION_RECORD_BYTES = OMP_SESSION_LIMITS.maxReferencedBlobBytes;
+
+module.exports = { OMP_SESSION_LIMITS, MAX_SESSION_RECORD_BYTES };

package/src/omp-session-partition.js

@@ -1,6 +1,6 @@
 const fs = require('fs');
 const path = require('path');
-const { randomUUID } = require('crypto');
+const { createHash, randomUUID } = require('crypto');
 const { isInsideOmpBlobsDir } = require('./omp-blob-root');
 
 // Every OMP session partition lives under <storageRoot>/omp-sessions/<uuid>/. storageRoot is the
@@ -83,16 +83,34 @@ function currentUid() {
   return typeof process.getuid === 'function' ? String(process.getuid()) : '0';
 }
 
+function stagingPathForOwnership(root, ownership) {
+  const owner = ownership.owner ?? {};
+  const persistedOwnerIdentity = JSON.stringify([
+    ownership.partitionId,
+    ownership.ownerUid ?? null,
+    ownership.storageRootIdentity?.device ?? null,
+    ownership.storageRootIdentity?.inode ?? null,
+    ownership.partitionIdentity?.device ?? null,
+    ownership.partitionIdentity?.inode ?? null,
+    owner.kind ?? null,
+    owner.clusterId ?? null,
+    owner.agentId ?? null,
+    owner.taskId ?? null,
+  ]);
+  const digest = createHash('sha256').update(persistedOwnerIdentity).digest('hex');
+  return path.join(root, `${DELETING_PREFIX}${ownership.partitionId}-${digest}`);
+}
+
 /**
  * Phase 1 of deletion: validate the owner record against what is actually on disk and move the
  * partition out of its canonical name.
  *
  * The check/use race (CodeQL js/file-system-race) is closed by *moving before deleting*: the
- * partition is renamed, within its own parent, to an unguessable `.zeroshot-deleting-<uuid>` name
- * and only then re-pinned. `rename(2)` is atomic, so after it succeeds the object under that fresh
- * name can no longer be swapped by racing the original path; the post-rename identity comparison
- * proves it is still the same directory that passed validation, and any mismatch aborts with the
- * directory parked under its clearly-marked name rather than recursively deleting an unknown tree.
+ * partition is renamed, within its own parent, to a deterministic staging name bound to its
+ * partition id and exact persisted owner identity, and only then re-pinned. A retry can therefore
+ * recover the staged directory after a crash or failed recursive removal. `rename(2)` is atomic,
+ * and the post-rename identity comparison proves it is still the same directory that passed
+ * validation. A canonical/staged conflict or identity mismatch leaves both names untouched.
  *
  * Splitting the rename from the recursive removal is what lets a caller hold a *task-store* write
  * fence across "no other row claims this partition" -> "the partition no longer answers to its
@@ -178,28 +196,100 @@ function stageOmpSessionPartitionForDeletion(ownership) {
     };
   }
   if (String(storagePin.uid) !== currentUid()) {
-    return { staged: false, deleted: false, reason: `${storageRoot} is not owned by the current user` };
+    return {
+      staged: false,
+      deleted: false,
+      reason: `${storageRoot} is not owned by the current user`,
+    };
+  }
+
+  let stagingPath;
+  try {
+    stagingPath = stagingPathForOwnership(root, ownership);
+  } catch (error) {
+    return {
+      staged: false,
+      deleted: false,
+      reason: `could not derive a staging name from the persisted owner identity: ${error.message}`,
+    };
   }
 
   let before;
   try {
     before = pinDirectoryIdentity(expectedPartitionPath);
   } catch (error) {
-    if (error.code === 'ENOENT') return { staged: false, deleted: true, reason: 'already absent' };
-    if (error.code === 'ELOOP' || error.code === 'EMLINK') {
-      return { staged: false, deleted: false, reason: `${expectedPartitionPath} is a symlink; refusing to delete` };
+    if (error.code !== 'ENOENT') {
+      if (error.code === 'ELOOP' || error.code === 'EMLINK') {
+        return {
+          staged: false,
+          deleted: false,
+          reason: `${expectedPartitionPath} is a symlink; refusing to delete`,
+        };
+      }
+      if (error.code === 'ENOTDIR') {
+        return {
+          staged: false,
+          deleted: false,
+          reason: `${expectedPartitionPath} is not a real directory; refusing to delete`,
+        };
+      }
+      return { staged: false, deleted: false, reason: error.message };
     }
-    if (error.code === 'ENOTDIR') {
+
+    let recovered;
+    try {
+      recovered = pinDirectoryIdentity(stagingPath);
+    } catch (stagedError) {
+      if (stagedError.code === 'ENOENT') {
+        return { staged: false, deleted: true, reason: 'already absent' };
+      }
       return {
         staged: false,
         deleted: false,
-        reason: `${expectedPartitionPath} is not a real directory; refusing to delete`,
+        reason: `canonical partition is absent, but staged ${stagingPath} is unsafe: ${stagedError.message}`,
+      };
+    }
+    if (String(recovered.uid) !== currentUid()) {
+      return {
+        staged: false,
+        deleted: false,
+        reason: `staged ${stagingPath} is not owned by the current user`,
+      };
+    }
+    if (
+      ownership.partitionIdentity &&
+      !sameIdentity(recovered.identity, ownership.partitionIdentity)
+    ) {
+      return {
+        staged: false,
+        deleted: false,
+        reason: `staged ${stagingPath} identity ${recovered.identity.device}:${recovered.identity.inode} does not match the recorded ${ownership.partitionIdentity.device}:${ownership.partitionIdentity.inode}`,
+      };
+    }
+    return { staged: true, stagingPath };
+  }
+  try {
+    pinDirectoryIdentity(stagingPath);
+    return {
+      staged: false,
+      deleted: false,
+      reason: `both canonical ${expectedPartitionPath} and staged ${stagingPath} exist; refusing to choose one`,
+    };
+  } catch (error) {
+    if (error.code !== 'ENOENT') {
+      return {
+        staged: false,
+        deleted: false,
+        reason: `staging conflict at ${stagingPath}: ${error.message}`,
       };
     }
-    return { staged: false, deleted: false, reason: error.message };
   }
   if (String(before.uid) !== currentUid()) {
-    return { staged: false, deleted: false, reason: `${expectedPartitionPath} is not owned by the current user` };
+    return {
+      staged: false,
+      deleted: false,
+      reason: `${expectedPartitionPath} is not owned by the current user`,
+    };
   }
   if (ownership.partitionIdentity && !sameIdentity(before.identity, ownership.partitionIdentity)) {
     return {
@@ -209,12 +299,14 @@ function stageOmpSessionPartitionForDeletion(ownership) {
     };
   }
 
-  const stagingPath = path.join(root, `${DELETING_PREFIX}${randomUUID()}`);
   try {
     fs.renameSync(expectedPartitionPath, stagingPath);
   } catch (error) {
-    if (error.code === 'ENOENT') return { staged: false, deleted: true, reason: 'already absent' };
-    return { staged: false, deleted: false, reason: `could not stage ${expectedPartitionPath}: ${error.message}` };
+    return {
+      staged: false,
+      deleted: false,
+      reason: `could not stage ${expectedPartitionPath}: ${error.message}`,
+    };
   }
 
   let after;
@@ -224,7 +316,7 @@ function stageOmpSessionPartitionForDeletion(ownership) {
     return {
       staged: false,
       deleted: false,
-      reason: `staged ${stagingPath} could not be pinned (${error.message}); left in place for inspection`,
+      reason: `staged ${stagingPath} could not be pinned (${error.message}); left in place for retry or inspection`,
     };
   }
   if (!sameIdentity(after.identity, before.identity)) {
@@ -239,26 +331,61 @@ function stageOmpSessionPartitionForDeletion(ownership) {
 }
 
 /**
- * Phase 2: remove a directory that {@link stageOmpSessionPartitionForDeletion} already parked under
- * its unguessable staging name. Safe to run outside any lock — the tree no longer answers to a name
- * anything else knows.
+ * Phase 2: remove a directory that {@link stageOmpSessionPartitionForDeletion} parked under its
+ * deterministic, owner-bound staging name. Safe to run outside the task-store lock after
+ * revalidating that exact staged name and its persisted partition identity.
  */
-function removeStagedOmpSessionPartition(stagingPath) {
-  // This is an exported recursive delete, so it re-derives that its argument really is a staging
-  // name this module minted — a direct `.zeroshot-deleting-*` child of an `omp-sessions/` root —
-  // rather than trusting the caller to have got it from stageOmpSessionPartitionForDeletion.
-  if (typeof stagingPath !== 'string' || !path.isAbsolute(stagingPath)) {
-    return { deleted: false, reason: `${stagingPath} is not an absolute staged partition path` };
+function removeStagedOmpSessionPartition(stagingPath, ownership) {
+  if (!ownership || typeof ownership !== 'object') {
+    return { deleted: false, reason: 'no ownership record for staged partition removal' };
   }
-  if (!path.basename(stagingPath).startsWith(DELETING_PREFIX)) {
-    return { deleted: false, reason: `${stagingPath} is not a staged partition directory` };
+
+  let expectedPartitionPath;
+  try {
+    expectedPartitionPath = partitionPathFor(ownership.storageRoot, ownership.partitionId);
+  } catch (error) {
+    return { deleted: false, reason: error.message };
   }
-  if (path.basename(path.dirname(stagingPath)) !== OMP_SESSIONS_SUBDIR) {
+  if (expectedPartitionPath !== ownership.partitionPath) {
     return {
       deleted: false,
-      reason: `${stagingPath} does not live directly under an ${OMP_SESSIONS_SUBDIR}/ root`,
+      reason: `${ownership.partitionPath} is not the canonical partition path for ${ownership.partitionId}`,
     };
   }
+  const root = ompSessionsRoot(ownership.storageRoot);
+  let expectedStagingPath;
+  try {
+    expectedStagingPath = stagingPathForOwnership(root, ownership);
+  } catch (error) {
+    return {
+      deleted: false,
+      reason: `could not derive a staging name from the persisted owner identity: ${error.message}`,
+    };
+  }
+  if (stagingPath !== expectedStagingPath) {
+    return {
+      deleted: false,
+      reason: `${stagingPath} is not the staged path bound to partition ${ownership.partitionId} and its persisted owner identity`,
+    };
+  }
+
+  let staged;
+  try {
+    staged = pinDirectoryIdentity(stagingPath);
+  } catch (error) {
+    if (error.code === 'ENOENT') return { deleted: true, reason: 'already absent' };
+    return { deleted: false, reason: `${stagingPath}: ${error.message}` };
+  }
+  if (String(staged.uid) !== currentUid()) {
+    return { deleted: false, reason: `${stagingPath} is not owned by the current user` };
+  }
+  if (ownership.partitionIdentity && !sameIdentity(staged.identity, ownership.partitionIdentity)) {
+    return {
+      deleted: false,
+      reason: `${stagingPath} identity ${staged.identity.device}:${staged.identity.inode} does not match the recorded ${ownership.partitionIdentity.device}:${ownership.partitionIdentity.inode}`,
+    };
+  }
+
   try {
     fs.rmSync(stagingPath, { recursive: true, force: true });
   } catch (error) {
@@ -279,7 +406,7 @@ function removeStagedOmpSessionPartition(stagingPath) {
 function deleteOmpSessionPartition(ownership) {
   const staged = stageOmpSessionPartitionForDeletion(ownership);
   if (!staged.staged) return { deleted: staged.deleted === true, reason: staged.reason };
-  return removeStagedOmpSessionPartition(staged.stagingPath);
+  return removeStagedOmpSessionPartition(staged.stagingPath, ownership);
 }
 
 module.exports = {