@thebackstoryis/engineering-with-ai 0.2.9 → 0.3.0

package/src/runtime/provider-adapters.mjs

@@ -1,9 +1,15 @@
-import { accessSync, constants, createWriteStream, mkdirSync } from 'node:fs';
+import { accessSync, constants, createWriteStream, mkdirSync, existsSync, realpathSync, lstatSync, openSync, readSync, closeSync, fstatSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { delimiter, isAbsolute, resolve } from 'node:path';
-import { spawn } from 'node:child_process';
+import { spawn, spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { release, tmpdir } from 'node:os';
+import { createServer } from 'node:http';
 import { CONTEXT_ESTIMATE_METHOD, estimateContextTokens } from './context-assembly.mjs';
 
 export const AFK_PROVIDERS = Object.freeze(['codex', 'claude', 'antigravity']);
+// Retain owned child handles after an uncertain stop; do not turn a missing
+// close event into success or lose the ability to observe a later exit.
+const unsettledProcesses = new Set();
 
 export function measureProviderPrompt(prompt) {
   const measurement = estimateContextTokens(prompt);
@@ -62,6 +68,7 @@ function claudeTools(task, mode) {
 
 export function buildProviderInvocation(provider, input = {}) {
   if (!AFK_PROVIDERS.includes(provider)) throw new Error(`Unsupported AFK provider: ${provider}`);
+  assertAfkMode(input.mode);
   const mode = input.mode === 'review' ? 'review' : 'implementation';
   const cwd = resolve(input.cwd);
   const model = String(input.model ?? '').trim();
@@ -109,6 +116,11 @@ export function buildProviderInvocation(provider, input = {}) {
 }
 
 export function invokeProvider(invocation, options = {}) {
+  assertAfkMode(invocation.mode);
+  if (options.signal !== undefined && !(options.signal instanceof AbortSignal)) throw new Error('Invalid host cancellation signal.');
+  if (options.signal?.aborted) return Promise.resolve({ provider: invocation.provider, exitCode: -1,
+    signal: '', cancelled: true, timedOut: false, executionStopped: true, processGroupStopped: true,
+    durationMs: 0, output: '', logPath: invocation.logPath, providerUsage: null });
   mkdirSync(resolve(invocation.logPath, '..'), { recursive: true });
   const output = createWriteStream(invocation.logPath, { flags: 'a' });
   const startedAt = Date.now();
@@ -120,10 +132,29 @@ export function invokeProvider(invocation, options = {}) {
       env: options.env ?? process.env,
       stdio: ['pipe', 'pipe', 'pipe'],
       shell: false,
+      detached: process.platform !== 'win32',
     });
     options.onStart?.(child.pid);
     let captured = '';
     let timedOut = false;
+    let cancelled = false, killTimer, stopDeadline, settled = false;
+    const kill = signal => {
+      try { if (process.platform === 'win32') child.kill(signal); else process.kill(-child.pid, signal); } catch {}
+    };
+    const stop = () => {
+      if (settled) return;
+      kill('SIGTERM'); killTimer ??= setTimeout(() => kill('SIGKILL'), 250);
+      stopDeadline ??= setTimeout(() => {
+        if (settled) return; settled = true; clearTimeout(timeout); clearTimeout(killTimer);
+        options.signal?.removeEventListener('abort', cancel);
+        unsettledProcesses.add(child); child.once('close', () => unsettledProcesses.delete(child));
+        child.stdin.destroy(); child.stdout.destroy(); child.stderr.destroy(); child.unref(); output.end();
+        resolvePromise({ provider: invocation.provider, status: 'unknown', exitCode: -1, signal: '',
+          cancelled, timedOut, executionStopped: false, processGroupStopped: false, output: '',
+          durationMs: Date.now() - startedAt, logPath: invocation.logPath, providerUsage: null });
+      }, 1000);
+    };
+    const cancel = () => { cancelled = true; stop(); };
     const capture = (chunk) => {
       output.write(chunk);
       captured = `${captured}${chunk.toString('utf8')}`.slice(-maxCapture);
@@ -131,23 +162,34 @@ export function invokeProvider(invocation, options = {}) {
     child.stdout.on('data', capture);
     child.stderr.on('data', capture);
     child.once('error', (error) => {
+      settled = true; clearTimeout(timeout); clearTimeout(killTimer); clearTimeout(stopDeadline); options.signal?.removeEventListener('abort', cancel);
       output.end();
       reject(error);
     });
     const timeout = setTimeout(() => {
       timedOut = true;
-      child.kill('SIGTERM');
-      setTimeout(() => child.kill('SIGKILL'), 5_000).unref();
+      stop();
     }, invocation.timeoutMs);
     timeout.unref();
-    child.once('close', (exitCode, signal) => {
-      clearTimeout(timeout);
+    child.once('close', async (exitCode, signal) => {
+      if (settled) return;
+      settled = true; clearTimeout(timeout); clearTimeout(killTimer); clearTimeout(stopDeadline); options.signal?.removeEventListener('abort', cancel);
+      let processGroupStopped = false;
+      if (process.platform !== 'win32') {
+        try { process.kill(-child.pid, 0); kill('SIGKILL'); }
+        catch (error) { processGroupStopped = error.code === 'ESRCH'; }
+      }
       output.end();
       resolvePromise({
         provider: invocation.provider,
         exitCode: exitCode ?? -1,
         signal: signal ?? '',
         timedOut,
+        cancelled,
+        processGroupStopped,
+        // AFK tools can launch detached descendants. Group disappearance alone
+        // is not proof of full-tree termination after cancellation or timeout.
+        executionStopped: !cancelled && !timedOut && processGroupStopped,
         durationMs: Date.now() - startedAt,
         logPath: invocation.logPath,
         output: captured,
@@ -158,6 +200,322 @@ export function invokeProvider(invocation, options = {}) {
         ),
       });
     });
-    child.stdin.end(invocation.prompt);
+    options.signal?.addEventListener('abort', cancel, { once: true });
+    if (options.signal?.aborted) cancel();
+    child.stdin.on('error', () => {});
+    child.stdin.end(cancelled ? '' : invocation.prompt);
+  });
+}
+
+function assertAfkMode(mode) {
+  // Proposal workers have a different authority and output boundary. An
+  // unrecognised mode must never silently acquire implementation permissions.
+  if (mode === undefined || mode === 'implementation' || mode === 'review') return;
+  const error = new Error('This mode is unavailable through the AFK provider transport.');
+  error.code = 'phase-provider-mode-unavailable';
+  throw error;
+}
+
+// Separate from AFK: capabilities are host-created, process-local handles, not
+// serialisable worker/browser supplied executable paths or permission flags.
+const phaseCapabilities = new WeakMap();
+const unavailablePhase = code => ({ status: 'unavailable', code, requiresHuman: true });
+const phaseVersions = Object.freeze({ claude: '2.1.257 (Claude Code)', sandbox: 'macos-seatbelt-phase-v1' });
+const phaseEnv = () => ({ PATH: process.env.PATH ?? '', LANG: 'en_US.UTF-8' });
+
+function installedExecutable(command) {
+  for (const directory of (process.env.PATH ?? '').split(delimiter).filter(Boolean)) {
+    const path = resolve(directory, command);
+    try { accessSync(path, constants.X_OK); return realpathSync(path); } catch {}
+  }
+  throw new Error('phase-provider-missing');
+}
+
+function executableDigest(path) {
+  const before = lstatSync(path);
+  // Package managers may hard-link installed executables. They are trusted
+  // host code, unlike untrusted proposal files; bind their bytes and identity.
+  if (!before.isFile() || before.size > 512 * 1024 * 1024) throw new Error('phase-provider-identity-invalid');
+  const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW), hash = createHash('sha256'), buffer = Buffer.alloc(1024 * 1024);
+  try {
+    let bytes; while ((bytes = readSync(fd, buffer, 0, buffer.length, null))) hash.update(buffer.subarray(0, bytes));
+    const after = fstatSync(fd), current = lstatSync(path);
+    if (before.ino !== after.ino || before.dev !== after.dev || before.size !== after.size || before.mtimeMs !== after.mtimeMs
+      || after.nlink !== before.nlink || current.ino !== after.ino || current.mtimeMs !== after.mtimeMs) throw new Error('phase-provider-identity-changed');
+    return hash.digest('hex');
+  } finally { closeSync(fd); }
+}
+
+export function preparePhaseProvider(provider) {
+  // Additional providers/platforms stay unavailable until the same executable
+  // and configuration-isolation conformance has actually been demonstrated.
+  if (provider !== 'claude' || process.platform !== 'darwin') return unavailablePhase('phase-provider-mode-unavailable');
+  try {
+    const executable = installedExecutable('claude'), sandbox = realpathSync('/usr/bin/sandbox-exec');
+    const version = path => {
+      const result = spawnSync(path, ['--version'], { env: phaseEnv(), encoding: 'utf8', timeout: 5000, maxBuffer: 1024 });
+      if (result.status !== 0 || result.error) throw new Error('phase-provider-version-unavailable');
+      return result.stdout.trim();
+    };
+    if (version(executable) !== phaseVersions.claude) return unavailablePhase('phase-provider-version-unverified');
+    const hashes = [executableDigest(executable), executableDigest(sandbox)];
+    const handle = Object.freeze({ status: 'requires-conformance', provider, version: phaseVersions.claude,
+      sandboxVersion: phaseVersions.sandbox,
+      identityDigest: createHash('sha256').update(JSON.stringify([hashes, release(), process.arch, phaseVersions.sandbox])).digest('hex') });
+    phaseCapabilities.set(handle, { executable, sandbox, hashes, verified: false });
+    return handle;
+  } catch { return unavailablePhase('phase-provider-identity-unavailable'); }
+}
+
+function currentPhaseCapability(handle, requireVerified = true) {
+  const capability = phaseCapabilities.get(handle);
+  if (!capability || requireVerified && !capability.verified) throw new Error('phase-provider-conformance-required');
+  if (executableDigest(capability.executable) !== capability.hashes[0] || executableDigest(capability.sandbox) !== capability.hashes[1]) {
+    capability.verified = false; throw new Error('phase-provider-identity-changed');
+  }
+  return capability;
+}
+
+function restrictedPhaseArgs(runtime, command, args, fixture) {
+  // One kernel policy covers every restriction; nested Seatbelt initialisation
+  // is not supported. Denying fork also denies posix_spawn, so a child cannot
+  // detach into a new session and outlive the captured process.
+  const port = fixture?.url ? Number(new URL(fixture.url).port) : null;
+  const policy = `(version 1)(allow default)(deny file-write*)`
+    + `(allow file-write* (subpath ${JSON.stringify(runtime)}))(deny process-fork)`
+    + (fixture ? `(deny network*)${port ? `(allow network-outbound (remote ip "localhost:${port}"))` : ''}` : '');
+  return ['-p', policy, command, ...args];
+}
+
+const restrictedClaudeArgs = () => ['--safe-mode', '--bare', '--restricted', '--tools', '', '--strict-mcp-config',
+  '--mcp-config', '{"mcpServers":{}}', '--setting-sources', '', '--no-chrome', '--disable-slash-commands',
+  '--no-session-persistence', '--system-prompt-snapshot', 'off', '--permission-mode', 'dontAsk',
+  '--max-turns', '1', '--print', '--output-format', 'json'];
+
+async function captureRestrictedProcess(capability, input, fixture = null) {
+  const cancelledBeforeSpawn = () => ({ status: 'cancelled', exitCode: -1, signal: null,
+    executionStopped: true, spawned: false, output: '', bytes: 0 });
+  if (input.signal?.aborted) return cancelledBeforeSpawn();
+  const directory = realpathSync(mkdtempSync(resolve(tmpdir(), 'ewai-phase-process-')));
+  const identity = lstatSync(directory), runtime = resolve(directory, 'runtime');
+  mkdirSync(runtime, { mode: 0o700 });
+  if (fixture?.isolationProbe) {
+    // Deliberately hostile *fixture* configuration. A loaded hook/MCP server
+    // would contact the local observer; no real provider endpoint is involved.
+    const script = `require("node:http").get(${JSON.stringify(`${fixture.url}/forbidden-hook`)})`;
+    const hook = { hooks: { SessionStart: [{ hooks: [{ type: 'command', command: `${JSON.stringify(process.execPath)} -e '${script}'` }] }] } };
+    mkdirSync(resolve(directory, '.claude'));
+    for (const path of [resolve(directory, '.claude/settings.json'), resolve(runtime, 'settings.json')]) writeFileSync(path, JSON.stringify(hook), { mode: 0o600 });
+    writeFileSync(resolve(directory, '.mcp.json'), JSON.stringify({ mcpServers: { forbidden: { type: 'http', url: `${fixture.url}/forbidden-mcp` } } }), { mode: 0o600 });
+    writeFileSync(resolve(directory, 'CLAUDE.md'), 'EWAI_UNTRUSTED_INSTRUCTIONS_CANARY', { mode: 0o600 });
+  }
+  const env = { ...phaseEnv(), CLAUDE_CONFIG_DIR: runtime, CLAUDE_CODE_TMPDIR: runtime, TMPDIR: runtime,
+    CLAUDE_CODE_SKIP_PROMPT_HISTORY: '1', CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: '1',
+    DISABLE_TELEMETRY: '1', DISABLE_ERROR_REPORTING: '1',
+    ANTHROPIC_API_KEY: fixture ? 'ewai-fixture-not-a-real-key' : process.env.ANTHROPIC_API_KEY };
+  if (fixture?.url) env.ANTHROPIC_BASE_URL = fixture.url;
+  const command = fixture?.command ?? capability.executable, args = fixture?.args ?? restrictedClaudeArgs();
+  const launchCommand = capability.sandbox;
+  const launchArgs = restrictedPhaseArgs(runtime, command, args, fixture);
+  let stopped = false;
+  try {
+    const result = await new Promise(resolvePromise => {
+      let child, timer, killTimer, stopDeadline, terminal = null, bytes = 0, output = [], settled = false;
+      const kill = signal => { if (child?.pid) try { process.kill(-child.pid, signal); } catch {} };
+      const stop = status => {
+        if (settled) return;
+        terminal ??= status; kill('SIGTERM'); killTimer ??= setTimeout(() => kill('SIGKILL'), 250);
+        stopDeadline ??= setTimeout(() => {
+          if (settled) return; settled = true; clearTimeout(timer); clearTimeout(killTimer);
+          input.signal?.removeEventListener('abort', cancel);
+          unsettledProcesses.add(child); child.once('close', () => unsettledProcesses.delete(child));
+          child.stdin.destroy(); child.stdout.destroy(); child.stderr.destroy(); child.unref();
+          resolvePromise({ status: 'unknown', exitCode: -1, signal: null, executionStopped: false, output: '', bytes });
+        }, 1000);
+      };
+      const cancel = () => stop('cancelled');
+      const finish = async (exitCode, signal) => {
+        if (settled) return; settled = true; clearTimeout(timer); clearTimeout(killTimer); clearTimeout(stopDeadline);
+        input.signal?.removeEventListener('abort', cancel);
+        // A surviving process group is not a confirmed stop. Kill it and do
+        // not return a proposal; preserve its private workspace for recovery.
+        stopped = !child?.pid;
+        for (let attempt = 0; child?.pid && attempt < 20; attempt += 1) {
+          try { process.kill(-child.pid, 0); kill('SIGKILL'); }
+          catch (error) { stopped = error.code === 'ESRCH'; break; }
+          // macOS may retain a reparented zombie briefly. A zombie cannot
+          // execute or hold file descriptors; do not confuse it with a worker.
+          const processes = spawnSync('/bin/ps', ['-o', 'pgid=,stat=', '-g', String(child.pid)],
+            { encoding: 'utf8', timeout: 500, maxBuffer: 4096, env: phaseEnv() });
+          const rows = (processes.stdout ?? '').trim().split('\n').filter(Boolean);
+          if (!processes.error && rows.length && rows.every(row => {
+            const [group, state] = row.trim().split(/\s+/); return group === String(child.pid) && /^Z/.test(state ?? '');
+          })) { stopped = true; break; }
+          await new Promise(resolveWait => setTimeout(resolveWait, 25));
+        }
+        if (input.signal?.aborted) terminal ??= 'cancelled';
+        resolvePromise({ status: !stopped ? 'unknown' : terminal ?? (exitCode === 0 ? 'complete' : 'failed'),
+          exitCode: exitCode ?? -1, signal: signal ?? null, executionStopped: stopped,
+          output: !terminal && stopped ? Buffer.concat(output).toString('utf8') : '', bytes });
+      };
+      if (input.signal?.aborted) { stopped = true; resolvePromise(cancelledBeforeSpawn()); return; }
+      try { child = spawn(launchCommand, launchArgs, { cwd: directory, env, detached: true, shell: false, stdio: ['pipe', 'pipe', 'pipe'] }); }
+      catch { finish(-1, null); return; }
+      const capture = (chunk, stdout) => {
+        bytes += chunk.length;
+        if (bytes > input.maxBytes) { output = []; stop('truncated'); return; }
+        if (stdout && !terminal) output.push(chunk);
+      };
+      child.stdout.on('data', chunk => capture(chunk, true)); child.stderr.on('data', chunk => capture(chunk, false));
+      child.stdin.on('error', () => {});
+      child.once('error', () => finish(-1, null)); child.once('close', finish);
+      timer = setTimeout(() => stop('timed-out'), input.timeoutMs);
+      input.signal?.addEventListener('abort', cancel, { once: true });
+      if (input.signal?.aborted) cancel();
+      child.stdin.end(terminal ? '' : input.prompt);
+    });
+    return result;
+  } finally {
+    if (stopped && existsSync(directory)) {
+      const current = lstatSync(directory);
+      if (current.isDirectory() && current.ino === identity.ino && current.dev === identity.dev) rmSync(directory, { recursive: true });
+    }
+  }
+}
+
+export async function invokeRestrictedPhaseProvider(handle, input = {}) {
+  if (!input || typeof input !== 'object' || Array.isArray(input) || typeof input.prompt !== 'string' || Buffer.byteLength(input.prompt) > 256 * 1024
+    || !Number.isSafeInteger(input.timeoutMs) || input.timeoutMs < 100 || input.timeoutMs > 600000
+    || input.signal !== undefined && !(input.signal instanceof AbortSignal)) return unavailablePhase('phase-provider-input-invalid');
+  let capability;
+  try { capability = currentPhaseCapability(handle); } catch { return unavailablePhase('phase-provider-conformance-required'); }
+  if (!process.env.ANTHROPIC_API_KEY) return unavailablePhase('phase-provider-credential-unavailable');
+  const captured = await captureRestrictedProcess(capability, { ...input, maxBytes: 256 * 1024 });
+  if (captured.status !== 'complete') return { ...captured, output: '' };
+  let envelope;
+  try { envelope = JSON.parse(captured.output); } catch { return { status: 'malformed', executionStopped: true, exitCode: 0, output: '' }; }
+  if (envelope?.type !== 'result' || envelope.subtype !== 'success' || envelope.is_error !== false || typeof envelope.result !== 'string') {
+    return { status: 'failed', executionStopped: true, exitCode: captured.exitCode, output: '' };
+  }
+  return { status: 'complete', exitCode: 0, executionStopped: true, output: envelope.result,
+    providerUsage: normaliseProviderUsage('claude', envelope.usage) };
+}
+
+export async function verifyPhaseProviderConformance(handle, control = {}) {
+  if (!control || typeof control !== 'object' || Array.isArray(control)
+    || Object.getPrototypeOf(control) !== Object.prototype || Object.keys(control).some(key => !['signal', 'timeoutMs'].includes(key))
+    || control.signal !== undefined && !(control.signal instanceof AbortSignal)
+    || control.timeoutMs !== undefined && (!Number.isSafeInteger(control.timeoutMs) || control.timeoutMs < 100 || control.timeoutMs > 600000)) {
+    return { ...unavailablePhase('phase-provider-input-invalid'), executionStopped: true };
+  }
+  if (control.signal?.aborted) return { ...unavailablePhase('phase-cancelled'), executionStopped: true };
+  let capability;
+  try { capability = currentPhaseCapability(handle, false); } catch { return unavailablePhase('phase-provider-conformance-required'); }
+  capability.verified = false;
+  const controller = new AbortController(), cancel = () => controller.abort();
+  control.signal?.addEventListener('abort', cancel, { once: true });
+  const deadline = setTimeout(cancel, control.timeoutMs ?? 60000);
+  let executionStopped = true;
+  const capture = async (capability, input, fixture) => {
+    if (controller.signal.aborted) throw new Error('phase-cancelled');
+    const result = await captureRestrictedProcess(capability, { ...input, signal: controller.signal }, fixture);
+    executionStopped &&= result.executionStopped === true;
+    if (!executionStopped) throw new Error('phase-execution-unknown');
+    if (controller.signal.aborted) throw new Error('phase-cancelled');
+    return result;
+  };
+  const targetRoot = realpathSync(mkdtempSync(resolve(tmpdir(), 'ewai-phase-conformance-'))), target = resolve(targetRoot, 'approval.json');
+  const requests = [];
+  let forcedTool = false;
+  const server = createServer((request, response) => {
+    if (request.method === 'GET' && request.url === '/ewai-network-probe') { response.writeHead(204); response.end(); return; }
+    if (request.method === 'HEAD' && request.url === '/api/hello') {
+      requests.push({ path: '/api/hello', healthProbe: true }); response.writeHead(204); response.end(); return;
+    }
+    let body = '', bytes = 0;
+    request.on('data', chunk => { bytes += chunk.length; if (bytes > 2 * 1024 * 1024) request.destroy(); else body += chunk; });
+    request.on('end', () => {
+      let input; try { input = JSON.parse(body); } catch { requests.push({ path: request.url }); response.writeHead(400); response.end(); return; }
+      requests.push({ path: request.url, tools: (input.tools ?? []).map(tool => tool.name),
+        inheritedInstructions: body.includes('EWAI_UNTRUSTED_INSTRUCTIONS_CANARY') });
+      response.writeHead(200, { 'content-type': 'text/event-stream' });
+      const event = (type, value) => response.write(`event: ${type}\ndata: ${JSON.stringify({ type, ...value })}\n\n`);
+      event('message_start', { message: { id: 'msg_ewai_fixture', type: 'message', role: 'assistant', model: 'fixture-model',
+        content: [], stop_reason: null, stop_sequence: null, usage: { input_tokens: 1, output_tokens: 0 } } });
+      event('content_block_start', { index: 0, content_block: forcedTool
+        ? { type: 'tool_use', id: 'toolu_ewai_fixture', name: 'Write', input: {} } : { type: 'text', text: '' } });
+      event('content_block_delta', { index: 0, delta: forcedTool
+        ? { type: 'input_json_delta', partial_json: JSON.stringify({ file_path: target, content: 'forged approval' }) }
+        : { type: 'text_delta', text: 'EWAI_RESTRICTED_FIXTURE_ONLY' } });
+      event('content_block_stop', { index: 0 });
+      event('message_delta', { delta: { stop_reason: forcedTool ? 'tool_use' : 'end_turn', stop_sequence: null }, usage: { output_tokens: 1 } });
+      event('message_stop', {}); response.end();
+    });
   });
+  try {
+    await new Promise((resolvePromise, reject) => { server.once('error', reject); server.listen(0, '127.0.0.1', resolvePromise); });
+    const fixtureUrl = `http://127.0.0.1:${server.address().port}`;
+    const network = await capture(capability, { prompt: '', timeoutMs: 5000, maxBytes: 1024 }, {
+      url: fixtureUrl, command: process.execPath, args: ['-e',
+        'const http=require("node:http"),net=require("node:net");let a=null,b=null;const done=()=>{if(a!==null&&b!==null)process.stdout.write(JSON.stringify({allowed:a,denied:b}))};http.get(process.argv[1]+"/ewai-network-probe",r=>{a=r.statusCode===204;r.resume();done()}).on("error",()=>{a=false;done()});const s=net.connect({host:"127.0.0.2",port:Number(process.argv[2])});s.on("connect",()=>{b=false;s.destroy();done()});s.on("error",e=>{b=["EPERM","EACCES"].includes(e.code);done()});',
+        fixtureUrl, String(server.address().port)] });
+    if (network.status !== 'complete' || network.output !== '{"allowed":true,"denied":true}') {
+      let observed; try { observed = JSON.parse(network.output); } catch {}
+      return { ...unavailablePhase('phase-provider-network-confinement-failed'), checks: { networkIsolated: false,
+        allowedLoopback: observed?.allowed === true, deniedOtherAddress: observed?.denied === true,
+        processComplete: network.status === 'complete' } };
+    }
+    const denial = await capture(capability, { prompt: '', timeoutMs: 5000, maxBytes: 1024 }, {
+      command: process.execPath, args: ['-e', 'try{require("node:fs").writeFileSync(process.argv[1],"forged");process.stdout.write("UNSAFE")}catch(e){process.stdout.write(e.code)}', target] });
+    const overflow = await capture(capability, { prompt: '', timeoutMs: 5000, maxBytes: 1024 }, {
+      command: process.execPath, args: ['-e', 'process.stdout.write("x".repeat(65536))'] });
+    const timeout = await capture(capability, { prompt: '', timeoutMs: 100, maxBytes: 1024 }, {
+      command: process.execPath, args: ['-e', 'setTimeout(() => {}, 10000)'] });
+    const fork = await capture(capability, { prompt: '', timeoutMs: 5000, maxBytes: 1024 }, {
+      command: process.execPath, args: ['-e',
+        'try{const c=require("node:child_process").spawn(process.execPath,["-e","process.exit()"],{detached:true,stdio:"ignore"});c.on("error",e=>process.stdout.write(e.code));c.on("spawn",()=>process.stdout.write("UNSAFE"))}catch(e){process.stdout.write(e.code)}'] });
+    const primitiveChecks = {
+      networkIsolated: true,
+      canonicalWritePrevented: denial.status === 'complete' && ['EPERM', 'EACCES'].includes(denial.output) && !existsSync(target),
+      outputBoundEnforced: overflow.status === 'truncated' && overflow.output === '' && overflow.executionStopped,
+      timeoutEnforced: timeout.status === 'timed-out' && timeout.output === '' && timeout.executionStopped,
+      childProcessPrevented: fork.status === 'complete' && ['EPERM', 'EACCES'].includes(fork.output),
+    };
+    if (!Object.values(primitiveChecks).every(value => value === true)) {
+      return { ...unavailablePhase('phase-provider-confinement-failed'), checks: primitiveChecks };
+    }
+    const model = await capture(capability, { prompt: 'Return the fixture token only.', timeoutMs: 15000, maxBytes: 16384 },
+      { url: fixtureUrl, isolationProbe: true });
+    let envelope; try { envelope = JSON.parse(model.output); } catch {}
+    forcedTool = true;
+    const forged = await capture(capability, { prompt: 'No tools or approvals are authorised.', timeoutMs: 15000, maxBytes: 16384 },
+      { url: fixtureUrl, isolationProbe: true });
+    let refused; try { refused = JSON.parse(forged.output); } catch {}
+    const checks = {
+      ...primitiveChecks,
+      structuredDraft: model.status === 'complete' && envelope?.type === 'result' && envelope.subtype === 'success' && envelope.is_error === false
+        && envelope.result === 'EWAI_RESTRICTED_FIXTURE_ONLY',
+      inheritedCapabilitiesBlocked: requests.filter(request => request.path.startsWith('/v1/messages')).length === 2
+        && requests.every(request => request.healthProbe === true
+          || request.path.startsWith('/v1/messages') && request.tools?.length === 0 && !request.inheritedInstructions),
+      forgedToolRefused: forged.executionStopped && refused?.type === 'result' && refused.is_error === true && !existsSync(target),
+    };
+    capability.verified = Object.values(checks).every(value => value === true);
+    currentPhaseCapability(handle, false);
+    return capability.verified ? { status: 'verified', provider: 'claude', identityDigest: handle.identityDigest,
+      canonicalWritePrevented: true, outputBoundEnforced: true, timeoutEnforced: true, networkIsolated: true, childProcessPrevented: true, toolsExposed: 0, inheritedCapabilitiesBlocked: true,
+      forgedToolRefused: true, fixtureServiceOnly: true,
+      authority: 'none' } : { ...unavailablePhase('phase-provider-conformance-failed'), checks,
+        requests: requests.map(request => ({ route: request.healthProbe ? 'fixture-health' : request.path.startsWith('/v1/messages') ? 'fixture-model'
+          : request.path.includes('forbidden-hook') ? 'forbidden-hook' : request.path.includes('forbidden-mcp') ? 'forbidden-mcp' : 'other',
+        toolsExposed: request.tools?.length ?? null, inheritedInstructions: request.inheritedInstructions === true })) };
+  } catch (error) {
+    capability.verified = false;
+    return { ...unavailablePhase(['phase-cancelled', 'phase-execution-unknown'].includes(error.message)
+      ? error.message : 'phase-provider-conformance-failed'), executionStopped };
+  } finally {
+    clearTimeout(deadline); control.signal?.removeEventListener('abort', cancel);
+    server.closeAllConnections(); await new Promise(resolvePromise => server.close(resolvePromise));
+    if (executionStopped) rmSync(targetRoot, { recursive: true, force: true });
+  }
 }

package/src/runtime/work.mjs

@@ -5,6 +5,7 @@ import { validatePrototypeManifest } from '../delivery-artifacts.mjs';
 import { projectPaths } from '../paths.mjs';
 import { openRuntimeDatabase } from './database.mjs';
 import { readRuntimeIntent, syncIntentIndex } from './intents.mjs';
+import { withIntentMutation, assertIntentMutation } from './intent-ownership.mjs';
 
 const lanes = ['backlog', 'ready', 'active', 'qa', 'blocked', 'done'];
 
@@ -184,13 +185,17 @@ export function syncWorkItems(projectRoot, suppliedDatabase = null) {
         title = excluded.title, status = 'active'
     `);
 
+    // Evidence readers may open their own database connection. Derive before
+    // taking the projection writer, avoiding self-contention and false stale
+    // results. Canonical mutations revalidate under their intent ownership.
+    const derivedItems = intents.map(intent => deriveExecutionState(projectRoot, intentFromRow(intent), {
+      intentCatalog: execution.catalog,
+      leases: execution.leases.get(intent.id) ?? [],
+    }));
     database.exec('BEGIN IMMEDIATE;');
     try {
       intents.forEach((intent, index) => {
-        const derived = deriveExecutionState(projectRoot, intentFromRow(intent), {
-          intentCatalog: execution.catalog,
-          leases: execution.leases.get(intent.id) ?? [],
-        });
+        const derived = derivedItems[index];
         const defaults = derived.projection;
         insertItem.run(
           intent.id,
@@ -394,6 +399,10 @@ export function resolvePrototypeAsset(projectRoot, reference, artefactId, assetP
 }
 
 export function updateWorkItem(projectRoot, reference, input) {
+  return withIntentMutation(projectRoot, reference, { action: 'update-projection', input, ownership: input.ownership }, () => updateOwnedWorkItem(projectRoot, reference, input));
+}
+
+function updateOwnedWorkItem(projectRoot, reference, input) {
   return withDatabase(projectRoot, null, (database) => {
     syncWorkItems(projectRoot, database);
     const item = findItem(database, reference);
@@ -419,6 +428,7 @@ export function updateWorkItem(projectRoot, reference, input) {
         if (key === 'completionPercent') return Math.max(0, Math.min(100, Number(value)));
         return value;
       });
+      assertIntentMutation(projectRoot, reference);
       database.prepare(`UPDATE work_items SET ${entries.map(([key]) => `${allowed[key]} = ?`).join(', ')}, updated_at = CURRENT_TIMESTAMP WHERE id = ?`)
         .run(...values, item.id);
     }
@@ -427,6 +437,10 @@ export function updateWorkItem(projectRoot, reference, input) {
 }
 
 export function setPhase(projectRoot, reference, phaseKey, input = {}) {
+  return withIntentMutation(projectRoot, reference, { action: 'update-phase-projection', phase: phaseKey, input, ownership: input.ownership }, () => setOwnedPhase(projectRoot, reference, phaseKey, input));
+}
+
+function setOwnedPhase(projectRoot, reference, phaseKey, input) {
   return withDatabase(projectRoot, null, (database) => {
     syncWorkItems(projectRoot, database);
     const item = findItem(database, reference);
@@ -434,6 +448,7 @@ export function setPhase(projectRoot, reference, phaseKey, input = {}) {
     const existing = database.prepare(`
       SELECT status, iteration_count FROM pipeline_phases WHERE work_item_id = ? AND phase_key = ?
     `).get(item.id, phaseKey);
+    assertIntentMutation(projectRoot, reference);
     database.prepare(`
       INSERT INTO pipeline_phases (work_item_id, phase_key, status, started_at, completed_at, artefact_path, iteration_count, notes)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?)
@@ -525,6 +540,7 @@ function recordActivity(projectRoot, reference, input, mode) {
     database.exec('BEGIN IMMEDIATE;');
     try {
       const existingSession = database.prepare('SELECT * FROM active_sessions WHERE work_item_id = ?').get(item.id);
+      if (mode === 'start') assertIntentMutation(projectRoot, reference, database);
       if (mode === 'start' && existingSession && existingSession.ended_at === null) {
         const requestedOwner = String(input.ownerId ?? '').trim();
         const requestedTool = String(input.tool ?? '').trim();
@@ -606,7 +622,7 @@ function recordActivity(projectRoot, reference, input, mode) {
 }
 
 export function startActiveSession(projectRoot, reference, input = {}) {
-  return recordActivity(projectRoot, reference, input, 'start');
+  return withIntentMutation(projectRoot, reference, { action: 'start-session', input, ownership: input.ownership }, () => recordActivity(projectRoot, reference, input, 'start'));
 }
 
 export function addActivityEvent(projectRoot, reference, input = {}) {