@thebackstoryis/engineering-with-ai 0.3.1-beta.0 → 0.3.1

package/src/runtime/provider-adapters.mjs

@@ -1,12 +1,17 @@
-import { accessSync, constants, createWriteStream, mkdirSync, existsSync, realpathSync, lstatSync, openSync, readSync, closeSync, fstatSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { delimiter, isAbsolute, resolve } from 'node:path';
+import { accessSync, constants, createWriteStream, mkdirSync, existsSync, realpathSync, lstatSync, openSync, readSync, readFileSync, closeSync, fstatSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { delimiter, dirname, isAbsolute, resolve } from 'node:path';
 import { spawn, spawnSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import { release, tmpdir } from 'node:os';
 import { createServer } from 'node:http';
 import { CONTEXT_ESTIMATE_METHOD, estimateContextTokens } from './context-assembly.mjs';
+import {modelGuidance, readCodingPolicy, assertCodingPolicyFresh} from '../coding-providers.mjs';
+import {prepareGrokRuntime, parseGrokWorkerResult, prepareGrokTaskSnapshot, acceptGrokTaskSnapshot, assertGrokTaskEvidenceFresh} from './grok-provider.mjs';
+import {resolveGrokApiKey} from '../grok-credentials.mjs';
 
 export const AFK_PROVIDERS = Object.freeze(['codex', 'claude', 'antigravity']);
+export const SUPPORTED_AFK_PROVIDERS = Object.freeze([...AFK_PROVIDERS,'grok']);
+const grokInvocations = new WeakMap();
 // Retain owned child handles after an uncertain stop; do not turn a missing
 // close event into success or lose the ability to observe a later exit.
 const unsettledProcesses = new Set();
@@ -60,6 +65,15 @@ export function commandAvailable(command, env = process.env) {
   });
 }
 
+export function captureProviderIdentity(provider) {
+  if(!SUPPORTED_AFK_PROVIDERS.includes(provider))throw new Error('Provider identity is unavailable.');
+  const executable=installedExecutable(providerCommand(provider));
+  const version=spawnSync(executable,['--version'],{env:phaseEnv(),encoding:'utf8',timeout:5000,maxBuffer:1024});
+  if(version.status!==0||version.error)throw new Error('Provider version is unavailable.');
+  return {provider,identityDigest:'sha256:'+createHash('sha256').update(JSON.stringify([
+    executableDigest(executable),version.stdout.trim(),release(),process.arch])).digest('hex')};
+}
+
 function claudeTools(task, mode) {
   if (mode === 'review') return ['Read', 'Glob', 'Grep'];
   const commands = (task?.allowed_commands ?? []).map((command) => `Bash(${command})`);
@@ -67,7 +81,7 @@ function claudeTools(task, mode) {
 }
 
 export function buildProviderInvocation(provider, input = {}) {
-  if (!AFK_PROVIDERS.includes(provider)) throw new Error(`Unsupported AFK provider: ${provider}`);
+  if (!SUPPORTED_AFK_PROVIDERS.includes(provider)) throw new Error(`Unsupported AFK provider: ${provider}`);
   assertAfkMode(input.mode);
   const mode = input.mode === 'review' ? 'review' : 'implementation';
   const cwd = resolve(input.cwd);
@@ -76,16 +90,26 @@ export function buildProviderInvocation(provider, input = {}) {
     provider,
     command: providerCommand(provider),
     cwd,
-    prompt: String(input.prompt ?? ''),
+    prompt: String(input.prompt ?? '')+modelGuidance(provider,input.codingPolicy),
     timeoutMs: Number(input.timeoutMs ?? 45 * 60 * 1000),
     mode,
     task: input.task ?? null,
-    promptMeasurement: measureProviderPrompt(input.prompt ?? ''),
+    promptMeasurement: measureProviderPrompt(String(input.prompt ?? '')+modelGuidance(provider,input.codingPolicy)),
     providerUsage: normaliseProviderUsage(provider, input.providerUsage),
     args: [],
   };
 
-  if (provider === 'codex') {
+  if (provider === 'grok') {
+    if(model)throw new Error('Grok workers retain native model selection. Use an advisory model suggestion.');
+    assertGrokTaskEvidenceFresh(input.grokEvidence,mode,{...input,prompt:invocation.prompt});
+    const capability=prepareGrokBuildProvider(mode);
+    if(capability.status!=='requires-conformance')throw new Error('Grok coding/review mode is unavailable: '+capability.code);
+    const policyRoot=input.policyRoot??cwd,policyDigest=input.policyDigest??readCodingPolicy(policyRoot).policyDigest;
+    grokInvocations.set(invocation,{handle:capability,policyRoot,policyDigest,evidence:input.grokEvidence,mode,
+      input:{cwd,prompt:invocation.prompt,task:structuredClone(input.task),timeoutMs:invocation.timeoutMs}});
+    invocation.identityDigest=capability.identityDigest;
+    invocation.grokEvidence=input.grokEvidence;
+  } else if (provider === 'codex') {
     invocation.args = ['--ask-for-approval', 'never', 'exec', '--color', 'never', '--sandbox', mode === 'review' ? 'read-only' : 'workspace-write', '-C', cwd];
     if (mode === 'implementation') invocation.args.splice(3, 0, '--json');
     if (model) invocation.args.push('--model', model);
@@ -121,6 +145,7 @@ export function invokeProvider(invocation, options = {}) {
   if (options.signal?.aborted) return Promise.resolve({ provider: invocation.provider, exitCode: -1,
     signal: '', cancelled: true, timedOut: false, executionStopped: true, processGroupStopped: true,
     durationMs: 0, output: '', logPath: invocation.logPath, providerUsage: null });
+  if(invocation.provider==='grok')return invokeGrokBuild(invocation,options);
   mkdirSync(resolve(invocation.logPath, '..'), { recursive: true });
   const output = createWriteStream(invocation.logPath, { flags: 'a' });
   const startedAt = Date.now();
@@ -220,7 +245,7 @@ function assertAfkMode(mode) {
 // serialisable worker/browser supplied executable paths or permission flags.
 const phaseCapabilities = new WeakMap();
 const unavailablePhase = code => ({ status: 'unavailable', code, requiresHuman: true });
-const phaseVersions = Object.freeze({ claude: '2.1.257 (Claude Code)', sandbox: 'macos-seatbelt-phase-v1' });
+const phaseVersions = Object.freeze({ claude: '2.1.257 (Claude Code)', grok: 'grok 1.0.44 (5b807183dd79) [stable]', sandbox: 'macos-seatbelt-phase-v1' });
 const phaseEnv = () => ({ PATH: process.env.PATH ?? '', LANG: 'en_US.UTF-8' });
 
 function installedExecutable(command) {
@@ -249,41 +274,151 @@ function executableDigest(path) {
 export function preparePhaseProvider(provider) {
   // Additional providers/platforms stay unavailable until the same executable
   // and configuration-isolation conformance has actually been demonstrated.
-  if (provider !== 'claude' || process.platform !== 'darwin') return unavailablePhase('phase-provider-mode-unavailable');
+  if (!['claude', 'grok'].includes(provider) || process.platform !== 'darwin') return unavailablePhase('phase-provider-mode-unavailable');
   try {
-    const executable = installedExecutable('claude'), sandbox = realpathSync('/usr/bin/sandbox-exec');
+    if (provider === 'grok' && ['managed_config.toml', 'requirements.toml'].some(name => existsSync(resolve('/etc/grok', name)))) return unavailablePhase('phase-provider-system-config-unverified');
+    const executable = installedExecutable(provider), sandbox = realpathSync('/usr/bin/sandbox-exec');
     const version = path => {
       const result = spawnSync(path, ['--version'], { env: phaseEnv(), encoding: 'utf8', timeout: 5000, maxBuffer: 1024 });
       if (result.status !== 0 || result.error) throw new Error('phase-provider-version-unavailable');
       return result.stdout.trim();
     };
-    if (version(executable) !== phaseVersions.claude) return unavailablePhase('phase-provider-version-unverified');
+    if (version(executable) !== phaseVersions[provider]) return unavailablePhase('phase-provider-version-unverified');
     const hashes = [executableDigest(executable), executableDigest(sandbox)];
-    const handle = Object.freeze({ status: 'requires-conformance', provider, version: phaseVersions.claude,
+    const handle = Object.freeze({ status: 'requires-conformance', provider, version: phaseVersions[provider],
       sandboxVersion: phaseVersions.sandbox,
       identityDigest: createHash('sha256').update(JSON.stringify([hashes, release(), process.arch, phaseVersions.sandbox])).digest('hex') });
-    phaseCapabilities.set(handle, { executable, sandbox, hashes, verified: false });
+    phaseCapabilities.set(handle, { provider, mode:'phase', executable, sandbox, hashes, verified: false });
     return handle;
   } catch { return unavailablePhase('phase-provider-identity-unavailable'); }
 }
 
+export function prepareGrokBuildProvider(mode) {
+  if(!['implementation','review'].includes(mode))return unavailablePhase('phase-provider-mode-unavailable');
+  const phase=preparePhaseProvider('grok');if(phase.status!=='requires-conformance')return phase;
+  const handle=Object.freeze({...phase,mode,identityDigest:createHash('sha256').update(phase.identityDigest+':grok-task-snapshot-v1:'+mode).digest('hex')});
+  phaseCapabilities.set(handle,{...phaseCapabilities.get(phase),mode});return handle;
+}
+
+async function invokeGrokBuild(invocation,options) {
+  const captured=grokInvocations.get(invocation),startedAt=Date.now();
+  if(!captured)throw new Error('Grok invocation must be prepared by the host.');
+  const failure=(code,stopped=true)=>({provider:'grok',exitCode:-1,status:'unavailable',code,
+    executionStopped:stopped,output:'',logPath:invocation.logPath,durationMs:Date.now()-startedAt});
+  const fresh=()=>{if(options.signal?.aborted)throw new Error('phase-cancelled');
+    currentPhaseCapability(captured.handle);assertCodingPolicyFresh(captured.policyDigest,readCodingPolicy(captured.policyRoot).policyDigest);
+    assertGrokTaskEvidenceFresh(captured.evidence,captured.mode,{...captured.input,policyRoot:captured.policyRoot});
+    options.beforeAccept?.();};
+  try {
+    assertGrokTaskEvidenceFresh(captured.evidence,captured.mode,{...captured.input,policyRoot:captured.policyRoot});
+    const proof=await verifyGrokBuildProviderConformance(captured.handle,{signal:options.signal,timeoutMs:Math.min(60000,captured.input.timeoutMs)});
+    if(proof.status!=='verified')return failure(proof.code,proof.executionStopped!==false);
+    const grokApiKey=resolveGrokApiKey();
+    if(!grokApiKey)return failure('phase-provider-credential-unavailable');
+    fresh();
+    const capability=currentPhaseCapability(captured.handle);
+    const result=await captureRestrictedProcess(capability,{...captured.input,grokApiKey,signal:options.signal,maxBytes:1024*1024,beforeAccept:fresh});
+    if(result.status!=='complete')return {...failure('phase-provider-'+result.status,result.executionStopped),status:result.status,
+      cancelled:result.status==='cancelled',timedOut:result.status==='timed-out'};
+    fresh();const parsed=parseGrokWorkerResult(result.output,capability.mode);
+    mkdirSync(resolve(invocation.logPath,'..'),{recursive:true});writeFileSync(invocation.logPath,parsed.output,{mode:0o600});
+    return {provider:'grok',...parsed,exitCode:parsed.status==='complete'?0:-1,executionStopped:true,
+      changedFiles:result.changedFiles??[],promptMeasurement:invocation.promptMeasurement,
+      logPath:invocation.logPath,durationMs:Date.now()-startedAt};
+  }catch(error){return failure(error.code?.startsWith('grok-credential-')?error.code:error.message.startsWith('grok-task-evidence-')||['phase-cancelled','phase-provider-identity-changed'].includes(error.message)?error.message:'phase-provider-acceptance-failed');}
+}
+
+export async function verifyGrokBuildProviderConformance(handle, control={}) {
+  let capability;
+  try{capability=currentPhaseCapability(handle,false);}catch{return unavailablePhase('phase-provider-conformance-required');}
+  if(capability.provider!=='grok'||!['implementation','review'].includes(capability.mode))return unavailablePhase('phase-provider-mode-unavailable');
+  capability.verified=false;
+  const phaseHandle=Object.freeze({...handle,mode:'phase'});
+  phaseCapabilities.set(phaseHandle,{...capability,mode:'phase',verified:false});
+  const isolation=await verifyPhaseProviderConformance(phaseHandle,control);
+  if(isolation.status!=='verified')return isolation;
+  const root=realpathSync(mkdtempSync(resolve(tmpdir(),'ewai-grok-build-conformance-'))),project=resolve(root,'project');
+  mkdirSync(project);writeFileSync(resolve(project,'code.txt'),'before');
+  const outside=resolve(root,'canonical-approval.json'),requests=[];
+  let attack=false,executionStopped=true;
+  const server=createServer((request,response)=>{
+    if(request.method==='GET'){requests.push({health:['/','/v1','/v1/models'].includes(request.url)});
+      response.writeHead(200,{'content-type':'application/json'});response.end(JSON.stringify({data:[{id:'fixture',object:'model'}]}));return;}
+    let body='';request.on('data',chunk=>{body+=chunk;if(Buffer.byteLength(body)>2*1024*1024)request.destroy();});
+    request.on('end',()=>{
+      let value;try{value=JSON.parse(body);}catch{response.writeHead(400);response.end();return;}
+      const tools=(value.tools??[]).map(tool=>tool.function?.name??tool.name);
+      requests.push({health:false,route:request.url,tools,canary:body.includes('EWAI_UNTRUSTED_INSTRUCTIONS_CANARY'),
+        readObserved:!attack&&(value.messages??[]).some(message=>message.role==='tool'&&JSON.stringify(message.content).includes('before'))});
+      const title=tools.length===1&&tools[0]==='session_title';
+      const finished=(value.messages??[]).some(message=>message.role==='tool');
+      const call=!title&&!finished&&tools.length>1;
+      const read=capability.mode==='review'&&!attack;
+      const delta=call?{tool_calls:[{index:0,id:'fixture-tool',type:'function',function:{name:read?'read_file':'write',
+        arguments:JSON.stringify(read?{target_file:'code.txt'}:{file_path:attack?outside:'code.txt',content:'after'})}}]}:{role:'assistant',content:'EWAI_BUILD_FIXTURE_ONLY'};
+      response.writeHead(200,{'content-type':'text/event-stream'});
+      const event=data=>response.write('data: '+JSON.stringify(data)+'\n\n');
+      event({id:'fixture',object:'chat.completion.chunk',created:1,model:'fixture',choices:[{index:0,delta,finish_reason:null}]});
+      event({id:'fixture',object:'chat.completion.chunk',created:1,model:'fixture',choices:[{index:0,delta:{},finish_reason:call?'tool_calls':'stop'}],usage:{prompt_tokens:1,completion_tokens:1,total_tokens:2}});
+      response.end('data: [DONE]\n\n');
+    });
+  });
+  try{
+    await new Promise((ok,no)=>{server.once('error',no);server.listen(0,'127.0.0.1',ok);});
+    const fixture={url:'http://127.0.0.1:'+server.address().port,isolationProbe:true,
+      taskInput:{cwd:project,task:{read_set:['code.txt'],write_set:['code.txt']}}};
+    const input={prompt:'Use only declared task files. Return the fixture token.',timeoutMs:15000,maxBytes:256*1024,signal:control.signal};
+    const normal=await captureRestrictedProcess(capability,input,fixture);executionStopped&&=normal.executionStopped;
+    const after=readFileSync(resolve(project,'code.txt'),'utf8');
+    attack=true;
+    const forged=await captureRestrictedProcess(capability,input,fixture);executionStopped&&=forged.executionStopped;
+    const expected=capability.mode==='implementation'?['read_file','search_replace','list_dir','grep','write']:['read_file','list_dir','grep'];
+    const checks={
+      ...Object.fromEntries(['canonicalWritePrevented','outputBoundEnforced','timeoutEnforced','networkIsolated','childProcessPrevented'].map(key=>[key,isolation[key]===true])),
+      nativeResult:normal.status==='complete'&&parseGrokWorkerResult(normal.output,capability.mode).output==='EWAI_BUILD_FIXTURE_ONLY',
+      declaredWriteBoundary:capability.mode==='implementation'?after==='after'&&normal.changedFiles?.join(',')==='code.txt':after==='before'&&!normal.changedFiles?.length,
+      nativeReadBoundary:capability.mode!=='review'||requests.some(request=>request.readObserved),
+      inheritedCapabilitiesBlocked:requests.every(r=>r.health===true||r.route==='/v1/chat/completions'&&!r.canary
+        &&(r.tools.length===1&&r.tools[0]==='session_title'||r.tools.length===0||r.tools.length===expected.length&&r.tools.every(tool=>expected.includes(tool)))),
+      forbiddenWritePrevented:forged.executionStopped&&!existsSync(outside)&&readFileSync(resolve(project,'code.txt'),'utf8')===after,
+      executionStopped,
+    };
+    capability.verified=Object.values(checks).every(value=>value===true);currentPhaseCapability(handle,false);
+    return capability.verified?{status:'verified',provider:'grok',mode:capability.mode,identityDigest:handle.identityDigest,
+      checks,fixtureServiceOnly:true,authority:'none'}:{...unavailablePhase('phase-provider-build-conformance-failed'),checks,
+        requests:requests.map(r=>({route:r.health?'fixture-health':'fixture-model',tools:r.tools??[],inheritedInstructions:r.canary===true}))};
+  }catch(error){return {...unavailablePhase('phase-provider-build-conformance-failed'),executionStopped,
+    diagnosticCode:/^grok-task-[a-z-]+$/.test(error.message)?error.message:'native-fixture-failed'};}
+  finally{server.closeAllConnections();await new Promise(ok=>server.close(ok));if(executionStopped)rmSync(root,{recursive:true,force:true});}
+}
+
 function currentPhaseCapability(handle, requireVerified = true) {
   const capability = phaseCapabilities.get(handle);
   if (!capability || requireVerified && !capability.verified) throw new Error('phase-provider-conformance-required');
+  if (installedExecutable(capability.provider) !== capability.executable
+    || capability.provider === 'grok' && ['managed_config.toml', 'requirements.toml'].some(name => existsSync(resolve('/etc/grok', name)))) {
+    capability.verified = false; throw new Error('phase-provider-identity-changed');
+  }
   if (executableDigest(capability.executable) !== capability.hashes[0] || executableDigest(capability.sandbox) !== capability.hashes[1]) {
     capability.verified = false; throw new Error('phase-provider-identity-changed');
   }
   return capability;
 }
 
-function restrictedPhaseArgs(runtime, command, args, fixture) {
+function restrictedPhaseArgs(runtime, command, args, fixture, grok=null, mode='phase') {
   // One kernel policy covers every restriction; nested Seatbelt initialisation
   // is not supported. Denying fork also denies posix_spawn, so a child cannot
   // detach into a new session and outlive the captured process.
   const port = fixture?.url ? Number(new URL(fixture.url).port) : null;
+  const ancestorDirectories=[];
+  for(const start of [runtime,realpathSync(command)]) for(let path=dirname(start);path!==dirname(path);path=dirname(path))ancestorDirectories.push(path);
   const policy = `(version 1)(allow default)(deny file-write*)`
     + `(allow file-write* (subpath ${JSON.stringify(runtime)}))(deny process-fork)`
-    + (fixture ? `(deny network*)${port ? `(allow network-outbound (remote ip "localhost:${port}"))` : ''}` : '');
+    + (fixture ? `(deny network*)${port ? `(allow network-outbound (remote ip "localhost:${port}"))` : ''}` : '')
+    + (grok ? `(deny file-read-data)(allow file-read-data (literal "/") ${ancestorDirectories.map(path=>`(literal ${JSON.stringify(path)})`).join(' ')} (subpath "/System") (subpath "/usr") (subpath "/Library") (subpath "/dev") (subpath "/opt/homebrew/Cellar") (subpath "/opt/homebrew/lib") (subpath "/opt/homebrew/opt") (literal ${JSON.stringify(realpathSync(command))}) (subpath ${JSON.stringify(runtime)}))`
+      + `(deny file-write* (literal ${JSON.stringify(resolve(grok.home,'.grok/config.toml'))}) (literal ${JSON.stringify(resolve(grok.home,'.grok/managed_config.toml'))}) (literal ${JSON.stringify(resolve(grok.home,'.grok/requirements.toml'))}))`
+      + ['.grok','.claude','.cursor','.git','.ewai-pipeline'].map(name=>`(deny file-write* (subpath ${JSON.stringify(resolve(grok.cwd,name))}))`).join('')
+      + (mode==='review'?`(deny file-write* (subpath ${JSON.stringify(grok.cwd)}))`:'') : '');
   return ['-p', policy, command, ...args];
 }
 
@@ -298,6 +433,8 @@ async function captureRestrictedProcess(capability, input, fixture = null) {
   if (input.signal?.aborted) return cancelledBeforeSpawn();
   const directory = realpathSync(mkdtempSync(resolve(tmpdir(), 'ewai-phase-process-')));
   const identity = lstatSync(directory), runtime = resolve(directory, 'runtime');
+  let stopped = true;
+  try {
   mkdirSync(runtime, { mode: 0o700 });
   if (fixture?.isolationProbe) {
     // Deliberately hostile *fixture* configuration. A loaded hook/MCP server
@@ -309,16 +446,20 @@ async function captureRestrictedProcess(capability, input, fixture = null) {
     writeFileSync(resolve(directory, '.mcp.json'), JSON.stringify({ mcpServers: { forbidden: { type: 'http', url: `${fixture.url}/forbidden-mcp` } } }), { mode: 0o600 });
     writeFileSync(resolve(directory, 'CLAUDE.md'), 'EWAI_UNTRUSTED_INSTRUCTIONS_CANARY', { mode: 0o600 });
   }
-  const env = { ...phaseEnv(), CLAUDE_CONFIG_DIR: runtime, CLAUDE_CODE_TMPDIR: runtime, TMPDIR: runtime,
+  const mode=capability.mode??'phase';
+  const grok = capability.provider === 'grok' ? prepareGrokRuntime(directory, runtime, input.prompt, fixture, mode, {...process.env,XAI_API_KEY:input.grokApiKey}) : null;
+  const taskInput=fixture?.taskInput??input;
+  const snapshot=grok&&mode!=='phase'&&!fixture?.command
+    ?prepareGrokTaskSnapshot(taskInput.cwd,grok.cwd,taskInput.task):null;
+  const env = grok?.env ?? { ...phaseEnv(), CLAUDE_CONFIG_DIR: runtime, CLAUDE_CODE_TMPDIR: runtime, TMPDIR: runtime,
     CLAUDE_CODE_SKIP_PROMPT_HISTORY: '1', CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: '1',
     DISABLE_TELEMETRY: '1', DISABLE_ERROR_REPORTING: '1',
     ANTHROPIC_API_KEY: fixture ? 'ewai-fixture-not-a-real-key' : process.env.ANTHROPIC_API_KEY };
   if (fixture?.url) env.ANTHROPIC_BASE_URL = fixture.url;
-  const command = fixture?.command ?? capability.executable, args = fixture?.args ?? restrictedClaudeArgs();
+  if (grok && fixture?.command === process.execPath) env.OPENSSL_CONF = '/dev/null';
+  const command = fixture?.command ?? capability.executable, args = fixture?.args ?? grok?.args ?? restrictedClaudeArgs();
   const launchCommand = capability.sandbox;
-  const launchArgs = restrictedPhaseArgs(runtime, command, args, fixture);
-  let stopped = false;
-  try {
+  const launchArgs = restrictedPhaseArgs(runtime, command, args, fixture, grok, mode);
     const result = await new Promise(resolvePromise => {
       let child, timer, killTimer, stopDeadline, terminal = null, bytes = 0, output = [], settled = false;
       const kill = signal => { if (child?.pid) try { process.kill(-child.pid, signal); } catch {} };
@@ -359,7 +500,7 @@ async function captureRestrictedProcess(capability, input, fixture = null) {
           output: !terminal && stopped ? Buffer.concat(output).toString('utf8') : '', bytes });
       };
       if (input.signal?.aborted) { stopped = true; resolvePromise(cancelledBeforeSpawn()); return; }
-      try { child = spawn(launchCommand, launchArgs, { cwd: directory, env, detached: true, shell: false, stdio: ['pipe', 'pipe', 'pipe'] }); }
+      try { stopped=false; child = spawn(launchCommand, launchArgs, { cwd: grok?.cwd ?? directory, env, detached: true, shell: false, stdio: ['pipe', 'pipe', 'pipe'] }); }
       catch { finish(-1, null); return; }
       const capture = (chunk, stdout) => {
         bytes += chunk.length;
@@ -372,8 +513,11 @@ async function captureRestrictedProcess(capability, input, fixture = null) {
       timer = setTimeout(() => stop('timed-out'), input.timeoutMs);
       input.signal?.addEventListener('abort', cancel, { once: true });
       if (input.signal?.aborted) cancel();
-      child.stdin.end(terminal ? '' : input.prompt);
+      child.stdin.end(terminal || grok ? '' : input.prompt);
     });
+    if(snapshot&&result.status==='complete'&&parseGrokWorkerResult(result.output,mode).status==='complete'){
+      result.changedFiles=acceptGrokTaskSnapshot(snapshot,{readOnly:mode==='review',beforeAccept:input.beforeAccept});
+    }
     return result;
   } finally {
     if (stopped && existsSync(directory)) {
@@ -389,9 +533,15 @@ export async function invokeRestrictedPhaseProvider(handle, input = {}) {
     || input.signal !== undefined && !(input.signal instanceof AbortSignal)) return unavailablePhase('phase-provider-input-invalid');
   let capability;
   try { capability = currentPhaseCapability(handle); } catch { return unavailablePhase('phase-provider-conformance-required'); }
-  if (!process.env.ANTHROPIC_API_KEY) return unavailablePhase('phase-provider-credential-unavailable');
-  const captured = await captureRestrictedProcess(capability, { ...input, maxBytes: 256 * 1024 });
+  if(capability.mode!=='phase')return unavailablePhase('phase-provider-mode-unavailable');
+  if (input.signal?.aborted) return { status: 'cancelled', exitCode: -1, executionStopped: true, spawned: false, output: '' };
+  let apiKey;
+  try{apiKey=capability.provider==='grok'?resolveGrokApiKey():process.env.ANTHROPIC_API_KEY;}catch{return unavailablePhase('phase-provider-credential-unavailable');}
+  if(!apiKey)return unavailablePhase('phase-provider-credential-unavailable');
+  const captured = await captureRestrictedProcess(capability, { ...input, grokApiKey:capability.provider==='grok'?apiKey:undefined, maxBytes: 256 * 1024 });
   if (captured.status !== 'complete') return { ...captured, output: '' };
+  try { currentPhaseCapability(handle); } catch { return { ...unavailablePhase('phase-provider-identity-changed'), executionStopped: true, output: '' }; }
+  if (capability.provider === 'grok') return { ...parseGrokWorkerResult(captured.output), exitCode: captured.exitCode, executionStopped: true };
   let envelope;
   try { envelope = JSON.parse(captured.output); } catch { return { status: 'malformed', executionStopped: true, exitCode: 0, output: '' }; }
   if (envelope?.type !== 'result' || envelope.subtype !== 'success' || envelope.is_error !== false || typeof envelope.result !== 'string') {
@@ -429,6 +579,10 @@ export async function verifyPhaseProviderConformance(handle, control = {}) {
   let forcedTool = false;
   const server = createServer((request, response) => {
     if (request.method === 'GET' && request.url === '/ewai-network-probe') { response.writeHead(204); response.end(); return; }
+    if (capability.provider === 'grok' && request.method === 'GET' && ['/', '/v1', '/v1/models'].includes(request.url)) {
+      requests.push({ path: request.url, healthProbe: true }); response.writeHead(200, { 'content-type': 'application/json' });
+      response.end(JSON.stringify({ data: [{ id: 'fixture', object: 'model', owned_by: 'ewai' }] })); return;
+    }
     if (request.method === 'HEAD' && request.url === '/api/hello') {
       requests.push({ path: '/api/hello', healthProbe: true }); response.writeHead(204); response.end(); return;
     }
@@ -436,9 +590,24 @@ export async function verifyPhaseProviderConformance(handle, control = {}) {
     request.on('data', chunk => { bytes += chunk.length; if (bytes > 2 * 1024 * 1024) request.destroy(); else body += chunk; });
     request.on('end', () => {
       let input; try { input = JSON.parse(body); } catch { requests.push({ path: request.url }); response.writeHead(400); response.end(); return; }
-      requests.push({ path: request.url, tools: (input.tools ?? []).map(tool => tool.name),
+      requests.push({ path: request.url, tools: (input.tools ?? []).map(tool => tool.function?.name ?? tool.name),
+        toolFields: (input.tools ?? []).map(tool => Object.keys((tool.function ?? tool).parameters?.properties ?? {})),
+        titleOnly: capability.provider === 'grok' && input.tools?.length === 1
+          && input.tools[0].function?.name === 'session_title'
+          && Object.keys(input.tools[0].function.parameters?.properties ?? {}).join(',') === 'session_title'
+          && input.tools[0].function.parameters.properties.session_title.type === 'string',
         inheritedInstructions: body.includes('EWAI_UNTRUSTED_INSTRUCTIONS_CANARY') });
       response.writeHead(200, { 'content-type': 'text/event-stream' });
+      if (capability.provider === 'grok') {
+        const event = value => response.write('data: ' + JSON.stringify(value) + '\n\n');
+        const delta = forcedTool ? { tool_calls: [{ index: 0, id: 'ewai-forged', type: 'function', function: {
+          name: 'write_file', arguments: JSON.stringify({ file_path: target, content: 'forged approval' }) } }] }
+          : { role: 'assistant', content: 'EWAI_RESTRICTED_FIXTURE_ONLY' };
+        event({ id: 'ewai-fixture', object: 'chat.completion.chunk', created: 1, model: 'fixture', choices: [{ index: 0, delta, finish_reason: null }] });
+        event({ id: 'ewai-fixture', object: 'chat.completion.chunk', created: 1, model: 'fixture', choices: [{ index: 0, delta: {}, finish_reason: forcedTool ? 'tool_calls' : 'stop' }],
+          usage: { prompt_tokens: 1, completion_tokens: 1, total_tokens: 2 } });
+        response.end('data: [DONE]\n\n'); return;
+      }
       const event = (type, value) => response.write(`event: ${type}\ndata: ${JSON.stringify({ type, ...value })}\n\n`);
       event('message_start', { message: { id: 'msg_ewai_fixture', type: 'message', role: 'assistant', model: 'fixture-model',
         content: [], stop_reason: null, stop_sequence: null, usage: { input_tokens: 1, output_tokens: 0 } } });
@@ -491,24 +660,31 @@ export async function verifyPhaseProviderConformance(handle, control = {}) {
     const forged = await capture(capability, { prompt: 'No tools or approvals are authorised.', timeoutMs: 15000, maxBytes: 16384 },
       { url: fixtureUrl, isolationProbe: true });
     let refused; try { refused = JSON.parse(forged.output); } catch {}
+    const nativeGrok = capability.provider === 'grok';
+    const modelRoute = request => nativeGrok ? request.path === '/v1/chat/completions' : request.path.startsWith('/v1/messages');
     const checks = {
       ...primitiveChecks,
-      structuredDraft: model.status === 'complete' && envelope?.type === 'result' && envelope.subtype === 'success' && envelope.is_error === false
+      structuredDraft: nativeGrok ? model.status === 'complete' && parseGrokWorkerResult(model.output).output === 'EWAI_RESTRICTED_FIXTURE_ONLY'
+        : model.status === 'complete' && envelope?.type === 'result' && envelope.subtype === 'success' && envelope.is_error === false
         && envelope.result === 'EWAI_RESTRICTED_FIXTURE_ONLY',
-      inheritedCapabilitiesBlocked: requests.filter(request => request.path.startsWith('/v1/messages')).length === 2
+      inheritedCapabilitiesBlocked: (nativeGrok ? requests.filter(modelRoute).length >= 2 : requests.filter(modelRoute).length === 2)
         && requests.every(request => request.healthProbe === true
-          || request.path.startsWith('/v1/messages') && request.tools?.length === 0 && !request.inheritedInstructions),
-      forgedToolRefused: forged.executionStopped && refused?.type === 'result' && refused.is_error === true && !existsSync(target),
+          || modelRoute(request) && (request.tools?.length === 0 || request.titleOnly === true) && !request.inheritedInstructions)
+        && requests.filter(request => modelRoute(request) && request.tools?.length === 0).length >= 2,
+      forgedToolRefused: forged.executionStopped && !existsSync(target) && (nativeGrok
+        ? parseGrokWorkerResult(forged.output).status !== 'complete' : refused?.type === 'result' && refused.is_error === true),
     };
     capability.verified = Object.values(checks).every(value => value === true);
     currentPhaseCapability(handle, false);
-    return capability.verified ? { status: 'verified', provider: 'claude', identityDigest: handle.identityDigest,
+    return capability.verified ? { status: 'verified', provider: capability.provider, identityDigest: handle.identityDigest,
       canonicalWritePrevented: true, outputBoundEnforced: true, timeoutEnforced: true, networkIsolated: true, childProcessPrevented: true, toolsExposed: 0, inheritedCapabilitiesBlocked: true,
       forgedToolRefused: true, fixtureServiceOnly: true,
+      ...(nativeGrok ? { auxiliaryTools: requests.some(request => request.titleOnly) ? ['session_title'] : [],
+        toolsBoundary: 'zero worker tools; auxiliary title schema confined to private runtime' } : {}),
       authority: 'none' } : { ...unavailablePhase('phase-provider-conformance-failed'), checks,
-        requests: requests.map(request => ({ route: request.healthProbe ? 'fixture-health' : request.path.startsWith('/v1/messages') ? 'fixture-model'
+        requests: requests.map(request => ({ route: request.healthProbe ? 'fixture-health' : modelRoute(request) ? 'fixture-model'
           : request.path.includes('forbidden-hook') ? 'forbidden-hook' : request.path.includes('forbidden-mcp') ? 'forbidden-mcp' : 'other',
-        toolsExposed: request.tools?.length ?? null, inheritedInstructions: request.inheritedInstructions === true })) };
+        toolsExposed: request.tools?.length ?? null, toolFields: request.toolFields, toolNames: (request.tools ?? []).filter(name => /^[a-z_]{1,64}$/.test(name)), inheritedInstructions: request.inheritedInstructions === true })) };
   } catch (error) {
     capability.verified = false;
     return { ...unavailablePhase(['phase-cancelled', 'phase-execution-unknown'].includes(error.message)

package/src/validation-config.mjs

@@ -1,4 +1,7 @@
+import {resolveCodingProviders,codingPolicyDigest,assertModelPolicy} from './coding-providers.mjs';
+// Keep legacy discovery defaults stable; Grok is an explicit, additive choice.
 export const VALIDATION_PROVIDERS = Object.freeze(['claude', 'codex', 'antigravity']);
+export const SUPPORTED_VALIDATION_PROVIDERS = Object.freeze([...VALIDATION_PROVIDERS,'grok']);
 
 const LEGACY_PROVIDER_ALIASES = Object.freeze({
   gemini: 'antigravity',
@@ -104,7 +107,7 @@ function normaliseValidators(value, checkpoint) {
 
   const validators = [...new Set(value.map(canonicalValidationProvider))];
   for (const provider of validators) {
-    requireEnum(provider, VALIDATION_PROVIDERS, `validation checkpoint ${checkpoint} validator`);
+    requireEnum(provider, SUPPORTED_VALIDATION_PROVIDERS, `validation checkpoint ${checkpoint} validator`);
   }
   return validators;
 }
@@ -177,7 +180,7 @@ export function normaliseValidationConfig(value = {}) {
 
   const rawProviders = value?.external?.providers ?? {};
   const providers = Object.fromEntries(
-    VALIDATION_PROVIDERS.map((provider) => [
+    SUPPORTED_VALIDATION_PROVIDERS.filter(provider=>provider!=='grok'||Object.hasOwn(rawProviders,provider)).map((provider) => [
       provider,
       normaliseProvider(
         rawProviders[provider] ?? (provider === 'antigravity' ? rawProviders.gemini : undefined),
@@ -218,13 +221,13 @@ export function effectiveValidationConfig(configOrValidation, orchestrator = 'ma
     configOrValidation?.validation ?? configOrValidation,
   );
   const canonicalOrchestrator = canonicalValidationProvider(orchestrator);
-  const normalisedOrchestrator = VALIDATION_PROVIDERS.includes(canonicalOrchestrator)
+  const normalisedOrchestrator = SUPPORTED_VALIDATION_PROVIDERS.includes(canonicalOrchestrator)
     ? canonicalOrchestrator
     : 'manual';
 
-  const globallyEligible = VALIDATION_PROVIDERS.filter((provider) => {
+  const globallyEligible = SUPPORTED_VALIDATION_PROVIDERS.filter((provider) => {
     const setting = validation.external.providers[provider];
-    return setting.state === 'available' && setting.enabled;
+    return setting?.state === 'available' && setting.enabled;
   });
 
   const checkpoints = Object.fromEntries(
@@ -232,7 +235,14 @@ export function effectiveValidationConfig(configOrValidation, orchestrator = 'ma
       const requested = setting.validators === 'auto'
         ? globallyEligible
         : setting.validators.filter((provider) => globallyEligible.includes(provider));
-      const providers = requested.filter((provider) => provider !== normalisedOrchestrator);
+      let providers = requested.filter((provider) => provider !== normalisedOrchestrator);
+      if(setting.enabled && configOrValidation?.coding_providers){
+        providers=resolveCodingProviders(configOrValidation.coding_providers,{
+          orchestrator:normalisedOrchestrator,available:globallyEligible,reviewers:providers,
+          requiredReviewers:providers.length,
+        }).reviewers;
+        for(const provider of providers)assertModelPolicy(provider,configOrValidation.coding_providers);
+      }
 
       return [
         checkpoint,
@@ -255,11 +265,12 @@ export function effectiveValidationConfig(configOrValidation, orchestrator = 'ma
     orchestrator: normalisedOrchestrator,
     providers: clone(validation.external.providers),
     checkpoints,
+    ...(configOrValidation?.coding_providers ? {codingPolicy:clone(configOrValidation.coding_providers),codingPolicyDigest:codingPolicyDigest(configOrValidation.coding_providers)} : {}),
   };
 }
 
 export function setValidationProvider(config, provider, state, enabled = undefined) {
-  requireEnum(provider, VALIDATION_PROVIDERS, 'validation provider');
+  requireEnum(provider, SUPPORTED_VALIDATION_PROVIDERS, 'validation provider');
   requireEnum(state, ['available', 'unavailable'], 'validation provider state');
   const validation = normaliseValidationConfig(config.validation);
   validation.external.providers[provider] = {

package/templates/SPECS/pipeline.yaml

@@ -18,6 +18,9 @@ personas:
 approvals:
   build: required
   destructive_operations: required
+# Optional coding-provider roles are configured with `ewai providers` or the
+# dashboard. Absence preserves existing provider and native model selection.
+# Settings do not grant execution authority; unsupported model restrictions stop.
 validation:
   standards:
     required: true