@themoltnet/pi-runtime 0.10.0 → 0.11.0

package/dist/index.js

@@ -1,45 +1,23 @@
 import { execFileSync } from "node:child_process";
-import { cpSync, createReadStream, createWriteStream, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, statSync } from "node:fs";
+import { cpSync, createReadStream, createWriteStream, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync } from "node:fs";
 import { mkdir, realpath, stat } from "node:fs/promises";
 import path, { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { pipeline } from "node:stream/promises";
 import { Type } from "@earendil-works/pi-ai";
 import { AuthStorage, DEFAULT_MAX_BYTES, DefaultResourceLoader, ModelRegistry, SessionManager, createAgentSession, createBashToolDefinition, createEditToolDefinition, createFindToolDefinition, createGrepToolDefinition, createLsToolDefinition, createReadToolDefinition, createSyntheticSourceInfo, createWriteToolDefinition, defineTool, formatSize, parseFrontmatter, truncateHead, truncateLine } from "@earendil-works/pi-coding-agent";
+import { BrokeredHttpSecretBoundaryError, GONDOLIN_BASE_EXECUTABLES, GUEST_TASK_CONTEXT_MOUNT, GuestEnvironmentBoundaryError, activateAgentEnv, activateAgentEnv as activateAgentEnv$1, assertGuestEnvironmentBoundary, assertHostAuthenticatedGuestEnvironment, canonicalizeBrokeredHttpSecretDescriptor, ensureSnapshot, ensureSnapshot as ensureSnapshot$1, findMainWorktree, findMainWorktree as findMainWorktree$1, isResolvedPathInsideRoot, isResolvedPathInsideRoot as isResolvedPathInsideRoot$1, loadCredentials, prepareBrokeredHttpSecrets, resolveVfsShadowConfig, resumeVm as resumeVm$1 } from "@themoltnet/sandbox-gondolin";
 import { SpanStatusCode, context, metrics, trace } from "@opentelemetry/api";
 import { CID } from "multiformats/cid";
-import "multiformats/codecs/raw";
-import "multiformats/hashes/digest";
-import { sha256 } from "multiformats/hashes/sha2";
-import "@noble/hashes/sha2";
-import "multiformats/bases/base32";
-import "@noble/curves/ed25519.js";
-import * as ed from "@noble/ed25519";
-import { createHash } from "crypto";
-import { createHash as createHash$1 } from "node:crypto";
 import * as json from "multiformats/codecs/json";
-import "@ipld/dag-cbor";
-import { FREEFORM_TYPE, SUBMIT_OUTPUT_GATE_ID, TaskContext, buildTaskUserPrompt, getSubmitOutputContract, materializeTaskOutput, mergeRuntimeProfileContext, resolveTaskContext, taskTypeUsesSubagents, traceRuntimePhase, validateTaskOutput, validateTaskSubmission } from "@themoltnet/agent-runtime";
+import { sha256 } from "multiformats/hashes/sha2";
+import { FREEFORM_TYPE, SUBMIT_OUTPUT_GATE_ID, buildTaskUserPrompt, getSubmitOutputContract, materializeTaskOutput, mergeRuntimeProfileContext, resolveTaskContext, taskTypeUsesSubagents, traceRuntimePhase, validateTaskOutput, validateTaskSubmission } from "@themoltnet/agent-runtime";
 import { connect } from "@themoltnet/sdk/node";
 import { ShellCommandAnalyzer } from "@themoltnet/shell-command-analyzer";
 import { homedir } from "node:os";
-import { MemoryProvider, RealFSProvider, ShadowProvider, VM, VmCheckpoint, createHttpHooks, createShadowPathPredicate, ensureImageSelector, isWriteFlag, loadGuestAssets } from "@earendil-works/gondolin";
+import { VmCheckpoint } from "@earendil-works/gondolin";
 import { Type as Type$1 } from "typebox";
+import { createHash } from "node:crypto";
 import { Value } from "typebox/value";
-import { parseEnv } from "node:util";
-//#region src/path-containment.ts
-/**
-* Check containment for already-resolved lexical or real paths.
-*
-* Callers that accept untrusted paths must resolve/realpath at their I/O
-* boundary first; keeping the platform-specific relative-path rule here avoids
-* subtly different `..` and absolute-path handling across runtime cleanup,
-* session sync, and artifact staging.
-*/
-function isResolvedPathInsideRoot(path, root) {
-	const rel = relative(root, path);
-	return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
-}
-//#endregion
 //#region src/moltnet/render-phase6.ts
 function slugToTitle(value) {
 	return value.split(/[:/_-]+/).filter(Boolean).map((part) => part[0]?.toUpperCase() + part.slice(1)).join(" ");
@@ -276,7 +254,7 @@ async function findExistingAncestor(candidate) {
 	}
 }
 function assertPathInsideWorkspace(realCwd, realPath, displayPath) {
-	if (!isResolvedPathInsideRoot(realPath, realCwd)) throw new Error(`task artifact output path escapes workspace: ${displayPath}`);
+	if (!isResolvedPathInsideRoot$1(realPath, realCwd)) throw new Error(`task artifact output path escapes workspace: ${displayPath}`);
 }
 /**
 * Expand the `taskFilter` shorthand on the diary list/search tools into
@@ -964,11 +942,11 @@ function createMoltNetTools(config) {
 		defineTool({
 			name: "moltnet_host_exec",
 			label: "Run command on host (escape hatch — requires user approval)",
-			description: "Runs a command on the HOST machine, outside the sandbox VM. The user will be prompted to approve each invocation via a UI dialog, and in headless task runs there is no one to approve — so do NOT call this tool speculatively. Routine git and gh work — pushing branches, opening pull requests, etc. — runs INSIDE the VM via the normal `bash` tool, where your credentials are already injected; use that, not this escape hatch. Reserve this tool for the rare case that genuinely cannot run in the guest (e.g. reaching a host-only resource the VM has no path to).\n\nAllowed executables: git, gh, moltnet. Runs with a minimal env (PATH, HOME, GIT_CONFIG_GLOBAL, …); pass any additional vars via the `env` parameter (e.g. GH_TOKEN). Every invocation is logged as an auditable host execution.",
+			description: "Runs a command on the HOST machine, outside the sandbox VM. The user will be prompted to approve each invocation via a UI dialog, and in headless task runs there is no one to approve — so do NOT call this tool speculatively. Routine git and gh work — pushing branches, opening pull requests, etc. — runs INSIDE the VM via the normal `bash` tool; use that, not this escape hatch. Credentials are not generally injected into the guest. A runtime may expose an opaque HTTP placeholder that the host proxy can use only for declared destinations; otherwise authenticated operations are unavailable. Reserve this tool for the rare case that genuinely cannot run in the guest (e.g. reaching a host-only resource the VM has no path to).\n\nAllowed executables: git, gh, moltnet. Runs with a minimal env (PATH, HOME, GIT_CONFIG_GLOBAL, …); pass only non-secret additional vars via the `env` parameter. Every invocation is logged as an auditable host execution.",
 			parameters: Type.Object({
 				executable: Type.String({ description: "Executable to run (git | gh | moltnet)" }),
 				args: Type.Array(Type.String(), { description: "Arguments to pass to the executable" }),
-				env: Type.Optional(Type.Record(Type.String(), Type.String(), { description: "Additional environment variables for this invocation (e.g. { \"GH_TOKEN\": \"...\" }). Merged on top of the minimal base env." }))
+				env: Type.Optional(Type.Record(Type.String(), Type.String(), { description: "Additional non-secret environment variables for this invocation. Merged on top of the minimal base env." }))
 			}),
 			async execute(_id, params, _signal, _onUpdate, ctx) {
 				if (!HOST_EXEC_ALLOWED.has(params.executable)) throw new Error(`host_exec: '${params.executable}' is not in the allowed list (${[...HOST_EXEC_ALLOWED].join(", ")}). Extend HOST_EXEC_ALLOWED only after explicit security review.`);
@@ -1310,21 +1288,6 @@ async function resolvePersistentSessionManager(args) {
 	await SessionManager.list(args.cwd, args.sessionDir);
 	return SessionManager.continueRecent(args.cwd, args.sessionDir);
 }
-new TextEncoder();
-//#endregion
-//#region ../crypto-service/src/crypto.service.ts
-ed.etc.sha512Sync = (...m) => {
-	const hash = createHash("sha512");
-	m.forEach((msg) => hash.update(msg));
-	return hash.digest();
-};
-//#endregion
-//#region ../crypto-service/src/executor-attestation.ts
-ed.etc.sha512Sync = (...m) => {
-	const hash = createHash$1("sha512");
-	m.forEach((msg) => hash.update(msg));
-	return hash.digest();
-};
 //#endregion
 //#region ../crypto-service/src/json-cid.ts
 /**
@@ -1340,26 +1303,13 @@ async function computeJsonCid(value) {
 	return CID.create(1, json.code, hash).toString();
 }
 //#endregion
-//#region ../crypto-service/src/ssh.ts
-/**
-* SSH key format conversion for MoltNet Ed25519 keys
-*
-* Converts MoltNet agent keys (ed25519:<base64>) to OpenSSH format
-* for use with git commit signing and SSH authentication.
-*/
-if (!ed.etc.sha512Sync) ed.etc.sha512Sync = (...m) => {
-	const hash = createHash("sha512");
-	m.forEach((msg) => hash.update(msg));
-	return hash.digest();
-};
-//#endregion
 //#region src/config.ts
 /** Resolve Pi's host-side auth/config directory from process configuration. */
 function resolvePiCodingAgentDir() {
 	return process.env["PI_CODING_AGENT_DIR"] ?? path.join(homedir(), ".pi", "agent");
 }
 //#endregion
-//#region ../tasks/src/context.ts
+//#region ../runtime-profiles/src/context.ts
 /**
 * How an executor delivers a context entry to its underlying LLM.
 * V1 bindings only; Tier-2 (reference_file, mcp_resource, imported_file,
@@ -1412,99 +1362,12 @@ var ContextRef = Type$1.Object({
 	additionalProperties: false
 });
 /** Reusable input fragment for any task type. Soft cap at 5 items. */
-var TaskContext$1 = Type$1.Array(ContextRef, {
+var TaskContext = Type$1.Array(ContextRef, {
 	$id: "TaskContext",
 	maxItems: 5
 });
 //#endregion
-//#region ../tasks/src/rubric.ts
-/**
-* Rubric — structured acceptance criteria used by judgment tasks.
-*
-* Phase 1 (this PR): rubrics are embedded in task inputs. Their integrity
-* is pinned via the task's `input_cid` (which covers the whole input,
-* including the inline rubric). No separate storage, no CRUD.
-*
-* Phase 2 (see #881): rubrics become a first-class resource with their
-* own signed rows and CIDv1 lookup. The schema below is designed to
-* carry forward unchanged — only storage and addressing differ.
-*
-* Until Phase 2 lands, `rubricId` + `version` + `contentHash` are
-* informational fields the author fills in; no uniqueness is enforced.
-* `contentHash` is optional in Phase 1 because the *task*'s input_cid
-* is the authoritative commitment.
-*/
-/**
-* How a judge must score a single criterion.
-*
-* - `llm_score`: 0..1 continuous, `rationale` required. Smooths failures
-*   into the gradient — use `llm_checklist` instead for properties where
-*   a single failure is a real failure (grounding, faithfulness).
-* - `llm_checklist`: judge enumerates per-claim assertions with
-*   `{passed, evidence}`. The criterion's numeric `score` is derived:
-*   `1` iff every assertion passes, else `0`. Per-claim evidence is the
-*   dataset for cluster-analysis of failure modes. See #999.
-* - `boolean`: 0 or 1, `rationale` optional.
-* - `deterministic_signature_check`: judge runs a signature check;
-*   result is 0 or 1. No LLM discretion.
-* - `deterministic_coverage_check`: every referenced source entry
-*   appears in the rendered output; 0 or 1.
-*/
-var RubricScoringMode = Type$1.Union([
-	Type$1.Literal("llm_score"),
-	Type$1.Literal("llm_checklist"),
-	Type$1.Literal("boolean"),
-	Type$1.Literal("deterministic_signature_check"),
-	Type$1.Literal("deterministic_coverage_check")
-], { $id: "RubricScoringMode" });
-/**
-* One binary check produced by an `llm_checklist`-mode criterion.
-*
-* `evidence` is REQUIRED for both PASS and FAIL — agentskills.io grading
-* principle: \"Don't give the benefit of the doubt.\" A PASS without
-* concrete evidence (a quoted span, an entry id, a source location)
-* cannot be audited. A FAIL without evidence cannot be clustered into
-* structural fixes. The same shape is reused by `judge-eval-variant`
-* (#943) so tooling, dashboards, and analysis stay uniform.
-*/
-var AssertionResult = Type$1.Object({
-	id: Type$1.String({ minLength: 1 }),
-	text: Type$1.String({ minLength: 1 }),
-	passed: Type$1.Boolean(),
-	evidence: Type$1.String({ minLength: 1 })
-}, {
-	$id: "AssertionResult",
-	additionalProperties: false
-});
-var RubricCriterion = Type$1.Object({
-	id: Type$1.String({ minLength: 1 }),
-	description: Type$1.String({ minLength: 1 }),
-	weight: Type$1.Number({
-		minimum: 0,
-		maximum: 1
-	}),
-	scoring: RubricScoringMode
-}, {
-	$id: "RubricCriterion",
-	additionalProperties: false
-});
-/**
-* A complete rubric. Same shape used in Phase 1 (inline) and Phase 2
-* (stored row `body`); only the addressing mechanism differs.
-*/
-var Rubric = Type$1.Object({
-	rubricId: Type$1.String({ minLength: 1 }),
-	version: Type$1.String({ minLength: 1 }),
-	preamble: Type$1.Optional(Type$1.String()),
-	criteria: Type$1.Array(RubricCriterion, { minItems: 1 }),
-	scope: Type$1.Optional(Type$1.String()),
-	contentHash: Type$1.Optional(Type$1.String())
-}, {
-	$id: "Rubric",
-	additionalProperties: false
-});
-//#endregion
-//#region ../tasks/src/runtime-models.ts
+//#region ../runtime-profiles/src/runtime-models.ts
 /**
 * Runtime model catalog: a list of supported provider/model couples that
 * MoltNet daemons can target. Backed by the `runtime_models` table.
@@ -1552,7 +1415,7 @@ Type$1.Object({
 	additionalProperties: false
 });
 //#endregion
-//#region ../tasks/src/runtime-profile-context-recipes.ts
+//#region ../runtime-profiles/src/runtime-profile-context-recipes.ts
 var RUNTIME_PROFILE_CONTEXT_CATALOGUE = {
 	version: 1,
 	fragments: {
@@ -1563,12 +1426,12 @@ var RUNTIME_PROFILE_CONTEXT_CATALOGUE = {
 		},
 		"accountable-delivery-v1": {
 			binding: "prompt_prefix",
-			content: "# Accountable delivery\n\n- Pair every commit made during this task with a signed diary entry created by the `moltnet_create_entry` custom tool. Put the returned id in a `MoltNet-Diary: <id>` commit trailer.\n- Keep commit signing enabled; do not bypass the agent git configuration.\n- Push a branch and open or update a pull request only when the task asks for it. For GitHub mutations, use the credential-bound `GH_TOKEN` command form required by the runtime kernel.\n- Keep changes, commits, and any requested pull request coherent enough to review independently.",
+			content: "# Accountable delivery\n\n- Pair every commit made during this task with a task-provenance diary entry created by the `moltnet_create_entry` custom tool. Put the returned id in a `MoltNet-Diary: <id>` commit trailer. The tool does not currently promise a content signature; never describe an entry as signed unless the active runtime exposes and verifies a signing capability.\n- Do not disable commit signing when the active runtime provides it. A host-authenticated guest has no injected signing key, so do not recover one from host configuration or claim an unsigned commit is signed.\n- Push a branch and open or update a pull request only when the task asks for it. Use a host-brokered GitHub placeholder only when the runtime kernel declares one; if no GitHub credential is active, the authenticated operation is unavailable.\n- Keep changes, commits, and any requested pull request coherent enough to review independently.",
 			slug: "accountable-delivery-v1"
 		},
 		"judgment-diary-v1": {
 			binding: "prompt_prefix",
-			content: "# Judgment diary discipline\n\n- For an `assess_brief`, `judge_pack`, or `pr_review` task, create a signed diary entry with the `moltnet_create_entry` custom tool before submitting the structured judgment. Capture the rationale and evidence that support the verdict.\n- Add the `judgment` tag and the active task type tag (`assess_brief`, `judge_pack`, or `pr_review`). For `judge_pack`, also add `rubric:<rubricId>` from the task facts.\n- Do not use a shell `moltnet entry` command: task provenance is injected only by the custom tool.",
+			content: "# Judgment diary discipline\n\n- For an `assess_brief`, `judge_pack`, or `pr_review` task, create a diary entry with the `moltnet_create_entry` custom tool before submitting the structured judgment. Capture the rationale and evidence that support the verdict. Do not claim a content signature unless the active runtime exposes and verifies a signing capability.\n- Add the `judgment` tag and the active task type tag (`assess_brief`, `judge_pack`, or `pr_review`). For `judge_pack`, also add `rubric:<rubricId>` from the task facts.\n- Do not use a shell `moltnet entry` command: task provenance is injected only by the custom tool.",
 			slug: "judgment-diary-v1"
 		},
 		"proactive-memory-v1": {
@@ -1967,10 +1830,10 @@ Type$1.Object({
 		Type$1.Literal("completed"),
 		Type$1.Literal("failed")
 	]),
-	githubCode: Type$1.Optional(Type$1.String()),
+	githubCode: Type$1.Optional(Type$1.String({ description: "GitHub manifest code sealed to the onboarding agent public key." })),
 	identityId: Type$1.Optional(Type$1.String()),
 	clientId: Type$1.Optional(Type$1.String()),
-	clientSecret: Type$1.Optional(Type$1.String()),
+	clientSecret: Type$1.Optional(Type$1.String({ description: "OAuth2 client secret sealed to the onboarding agent public key." })),
 	installationId: Type$1.Optional(Type$1.String())
 });
 Type$1.Object({
@@ -2568,7 +2431,7 @@ var toolEnforcementLiterals = [
 ];
 var ToolEnforcementSchema = Type$1.Union(toolEnforcementLiterals, { description: "Runtime tool-policy enforcement mode: off (inert), watch (audit only), enforce (block disallowed tools, fail-closed)." });
 //#endregion
-//#region ../tasks/src/runtime-profiles.ts
+//#region ../runtime-profiles/src/runtime-profiles.ts
 var RuntimeProfileName = Type$1.String({
 	minLength: 1,
 	maxLength: 100,
@@ -2687,7 +2550,7 @@ var RuntimeProfileContext = Type$1.Object({
 	$id: "RuntimeProfileContext",
 	additionalProperties: false
 });
-var RuntimeProfileRef = Type$1.Object({ profileId: Type$1.String({ format: "uuid" }) }, {
+Type$1.Object({ profileId: Type$1.String({ format: "uuid" }) }, {
 	$id: "RuntimeProfileRef",
 	additionalProperties: false
 });
@@ -2767,7 +2630,7 @@ Type$1.Object({
 	additionalProperties: false
 });
 //#endregion
-//#region ../tasks/src/runtime-sessions.ts
+//#region ../runtime-profiles/src/runtime-sessions.ts
 var RuntimeSessionKind = Type$1.Union([
 	Type$1.Literal("root"),
 	Type$1.Literal("extend"),
@@ -2825,7 +2688,7 @@ Type$1.Object({
 	additionalProperties: false
 });
 //#endregion
-//#region ../tasks/src/runtime-slots.ts
+//#region ../runtime-profiles/src/runtime-slots.ts
 var RuntimeWorkspaceKind = Type$1.Union([
 	Type$1.Literal("origin"),
 	Type$1.Literal("fork"),
@@ -2954,1248 +2817,37 @@ Type$1.Object({
 	additionalProperties: false
 });
 //#endregion
-//#region ../tasks/src/success-criteria.ts
-/**
-* SuccessCriteria — proposer-stated acceptance criteria, evaluated in two
-* complementary places.
-*
-* Before this envelope existed, criteria were scattered: a vestigial
-* `criteriaCid` column nobody resolved, free-form prose on
-* `fulfill_brief.input`, and inline `rubric` / `criteria[]` fields on
-* judgment-task inputs. None of those were machine-verifiable
-* end-to-end.
-*
-* This module defines a single, content-addressable envelope a proposer
-* attaches to any task type. It has four orthogonal sections — pick
-* whichever apply per task type:
-*
-*   - `gates`        Promise-level structural/process checks
-*   - `assertions`   Declarative claims about output JSON
-*   - `rubric`       Weighted-criteria scoring instrument, reused
-*                    verbatim from `./rubric.ts`.
-*   - `sideEffects`  Required process side-effects (e.g. diary entry)
-*
-* ## Two roles, two task types
-*
-* **Producer self-assessment** (fulfillment tasks: `fulfill_brief`,
-* `curate_pack`, `render_pack`). The producer **LLM** evaluates the
-* criteria against its own output and emits a `VerificationRecord`
-* inside `output.verification`. The daemon is pure passthrough — it
-* does not run `evaluateAssertions`, does not inspect the verification
-* record. The REST API is dumb storage; it never re-runs assertions and
-* never runs LLMs. The cross-field rule
-* `requireVerificationWhenCriteriaPresent` enforces "verification
-* required iff successCriteria present" at task-output validation time
-* (server-side schema check). Self-assessment is a truthful self-rating,
-* NOT enforcement — `verification.passed=false` does not block /complete
-* and does not affect `acceptedAttemptN`. See
-* `docs/use/tasks-and-runtime.md` for the full producer/judge flow.
-*
-* **Binding evaluation** (judgment tasks: `assess_brief`, `judge_pack`).
-* A separate task whose IS the application of `successCriteria` to
-* someone else's output. Different agent (enforced at claim time), same
-* envelope. The judge's verdict is binding: this is the *gate* in the
-* MoltNet model. The rubric inside `successCriteria.rubric` IS the job
-* spec for the judge.
-*
-* The clean chain: producer task with `successCriteria` → producer
-* self-assesses honestly → proposer (or automation) creates a downstream
-* judgment task that references the same `successCriteria` (or a
-* stricter rubric) → judgment task delivers the binding verdict.
-*
-* Storage: SuccessCriteria lives inline at `task.input.successCriteria`,
-* pinned via the task's `inputCid`. No separate column or hash. When
-* #881 lands, the `rubric` field can graduate to `{ rubricCid }` lookup
-* without changing this envelope, and producer + judge tasks can pin
-* the SAME rubric across the chain for end-to-end auditability.
-*/
-var SchemaCheckSpec = Type$1.Object({ schemaCid: Type$1.String({ minLength: 1 }) }, { additionalProperties: false });
-var CidEqualsSpec = Type$1.Object({
-	path: Type$1.String({ minLength: 1 }),
-	expected: Type$1.String({ minLength: 1 })
-}, { additionalProperties: false });
-var SubmitToolCallGate = Type$1.Object({
-	id: Type$1.String({ minLength: 1 }),
-	kind: Type$1.Literal("submit-tool-call"),
-	description: Type$1.String({ minLength: 1 }),
-	required: Type$1.Boolean()
-}, { additionalProperties: false });
-var Gate = Type$1.Union([
-	SubmitToolCallGate,
-	Type$1.Object({
-		id: Type$1.String({ minLength: 1 }),
-		kind: Type$1.Literal("schema-check"),
-		spec: SchemaCheckSpec,
-		required: Type$1.Boolean()
-	}, { additionalProperties: false }),
-	Type$1.Object({
-		id: Type$1.String({ minLength: 1 }),
-		kind: Type$1.Literal("cid-equals"),
-		spec: CidEqualsSpec,
-		required: Type$1.Boolean()
-	}, { additionalProperties: false })
-], { $id: "Gate" });
-var AssertionOp = Type$1.Union([
-	Type$1.Literal("exists"),
-	Type$1.Literal("equals"),
-	Type$1.Literal("matches"),
-	Type$1.Literal("in-range"),
-	Type$1.Literal("min-length")
-], { $id: "AssertionOp" });
-var Assertion = Type$1.Object({
-	id: Type$1.String({ minLength: 1 }),
-	path: Type$1.String({ minLength: 1 }),
-	op: AssertionOp,
-	value: Type$1.Optional(Type$1.Unknown())
-}, {
-	$id: "Assertion",
-	additionalProperties: false
-});
-var SideEffectsSpec = Type$1.Object({
-	diaryEntryRequired: Type$1.Optional(Type$1.Boolean()),
-	diaryEntryTags: Type$1.Optional(Type$1.Array(Type$1.String({ minLength: 1 }))),
-	referencedEntries: Type$1.Optional(Type$1.Integer({ minimum: 0 }))
-}, {
-	$id: "SideEffectsSpec",
-	additionalProperties: false
-});
-var SuccessCriteria = Type$1.Object({
-	version: Type$1.Literal(1),
-	gates: Type$1.Optional(Type$1.Array(Gate)),
-	assertions: Type$1.Optional(Type$1.Array(Assertion)),
-	rubric: Type$1.Optional(Rubric),
-	minComposite: Type$1.Optional(Type$1.Number({
-		minimum: 0,
-		maximum: 1
-	})),
-	sideEffects: Type$1.Optional(SideEffectsSpec)
-}, {
-	$id: "SuccessCriteria",
-	additionalProperties: false
-});
-var VerificationResultStatus = Type$1.Union([
-	Type$1.Literal("pass"),
-	Type$1.Literal("fail"),
-	Type$1.Literal("skip")
-], { $id: "VerificationResultStatus" });
-var VerificationResultKind = Type$1.Union([
-	Type$1.Literal("gate"),
-	Type$1.Literal("assertion"),
-	Type$1.Literal("rubric"),
-	Type$1.Literal("sideEffect")
-], { $id: "VerificationResultKind" });
-var VerificationResult = Type$1.Object({
-	id: Type$1.String({ minLength: 1 }),
-	kind: VerificationResultKind,
-	status: VerificationResultStatus,
-	detail: Type$1.Optional(Type$1.String())
-}, {
-	$id: "VerificationResult",
-	additionalProperties: false
-});
-var VerificationRecord = Type$1.Object({
-	inputCid: Type$1.String({ minLength: 1 }),
-	results: Type$1.Array(VerificationResult),
-	passed: Type$1.Boolean({ description: "True iff every verification result has status \"pass\" or \"skip\"; false when any result has status \"fail\"." })
-}, {
-	$id: "VerificationRecord",
-	additionalProperties: false
-});
-//#endregion
-//#region ../tasks/src/task-artifacts.ts
-var TaskArtifact = Type$1.Object({
-	id: Type$1.String({ format: "uuid" }),
-	teamId: Type$1.String({ format: "uuid" }),
-	taskId: Type$1.String({ format: "uuid" }),
-	attemptN: Type$1.Union([Type$1.Integer({ minimum: 1 }), Type$1.Null()]),
-	kind: Type$1.String({
-		minLength: 1,
-		maxLength: 100
-	}),
-	title: Type$1.String({
-		minLength: 1,
-		maxLength: 255
-	}),
-	contentType: Type$1.String({
-		minLength: 1,
-		maxLength: 200
-	}),
-	contentEncoding: Type$1.Union([Type$1.String({
-		minLength: 1,
-		maxLength: 100
-	}), Type$1.Null()]),
-	sizeBytes: Type$1.Integer({ minimum: 0 }),
-	cid: Type$1.String({
-		minLength: 1,
-		maxLength: 100
-	}),
-	createdByAgentId: Type$1.Union([Type$1.String({ format: "uuid" }), Type$1.Null()]),
-	expiresAt: Type$1.Union([Type$1.String({ format: "date-time" }), Type$1.Null()]),
-	createdAt: Type$1.String({ format: "date-time" })
-}, { $id: "TaskArtifact" });
-Type$1.Object({
-	artifacts: Type$1.Array(TaskArtifact),
-	nextCursor: Type$1.Union([Type$1.String({ minLength: 1 }), Type$1.Null()])
-}, { $id: "TaskArtifactList" });
-Type$1.Object({
-	limit: Type$1.Optional(Type$1.Integer({
-		minimum: 1,
-		maximum: 100
-	})),
-	cursor: Type$1.Optional(Type$1.String({ minLength: 1 }))
-}, {
-	$id: "ListTaskArtifactsQuery",
-	additionalProperties: false
-});
-var HeaderSafeContentType = Type$1.String({
-	minLength: 1,
-	maxLength: 200,
-	pattern: "^[\\x21-\\x7e][\\x20-\\x7e]*$"
-});
-var HeaderSafeContentEncoding = Type$1.String({
-	minLength: 1,
-	maxLength: 100,
-	pattern: "^[\\x21-\\x7e][\\x20-\\x7e]*$"
-});
-Type$1.Object({
-	kind: Type$1.String({
-		minLength: 1,
-		maxLength: 100
-	}),
-	title: Type$1.String({
-		minLength: 1,
-		maxLength: 255
-	}),
-	contentType: Type$1.Optional(HeaderSafeContentType),
-	contentEncoding: Type$1.Optional(HeaderSafeContentEncoding)
-}, {
-	$id: "UploadTaskArtifactQuery",
-	additionalProperties: false
-});
-Type$1.String({
-	$id: "TaskArtifactContent",
-	description: "Task artifact content stream.",
-	format: "binary"
-});
-Type$1.Object({ taskId: Type$1.String({ format: "uuid" }) }, {
-	$id: "TaskArtifactTaskParams",
-	additionalProperties: false
-});
-Type$1.Object({
-	taskId: Type$1.String({ format: "uuid" }),
-	attemptN: Type$1.Integer({ minimum: 1 })
-}, {
-	$id: "TaskArtifactAttemptParams",
-	additionalProperties: false
-});
-Type$1.Object({
-	taskId: Type$1.String({ format: "uuid" }),
-	attemptN: Type$1.Integer({ minimum: 1 }),
-	cid: Type$1.String({
-		minLength: 1,
-		maxLength: 100
-	})
-}, {
-	$id: "TaskArtifactContentParams",
-	additionalProperties: false
-});
-Type$1.Object({
-	contentType: Type$1.Optional(HeaderSafeContentType),
-	contentEncoding: Type$1.Optional(HeaderSafeContentEncoding)
-}, {
-	$id: "StageTaskArtifactQuery",
-	additionalProperties: false
-});
-Type$1.Object({
-	cid: Type$1.String({
-		minLength: 1,
-		maxLength: 100
-	}),
-	sizeBytes: Type$1.Integer({ minimum: 0 }),
-	contentType: Type$1.String({
-		minLength: 1,
-		maxLength: 200
-	})
-}, { $id: "StagedTaskArtifact" });
-Type$1.Object({
-	taskId: Type$1.String({ format: "uuid" }),
-	cid: Type$1.String({
-		minLength: 1,
-		maxLength: 100
-	})
-}, {
-	$id: "TaskArtifactTaskContentParams",
-	additionalProperties: false
-});
-Type$1.Object({
-	targetTaskId: Type$1.String({ format: "uuid" }),
-	successCriteria: SuccessCriteria
-}, {
-	$id: "AssessBriefInput",
-	additionalProperties: false
-});
-/** One score line. */
-var AssessBriefScore = Type$1.Object({
-	criterionId: Type$1.String({ minLength: 1 }),
-	score: Type$1.Number({
-		minimum: 0,
-		maximum: 1
-	}),
-	rationale: Type$1.Optional(Type$1.String()),
-	evidence: Type$1.Optional(Type$1.Object({
-		commitsVerified: Type$1.Number(),
-		commitsTotal: Type$1.Number(),
-		signatureFailures: Type$1.Array(Type$1.String())
-	}, { additionalProperties: false }))
-}, {
-	$id: "AssessBriefScore",
-	additionalProperties: false
-});
-Type$1.Object({
-	scores: Type$1.Array(AssessBriefScore, { minItems: 1 }),
-	composite: Type$1.Number({
-		minimum: 0,
-		maximum: 1
-	}),
-	verdict: Type$1.String({ minLength: 1 }),
-	judgeModel: Type$1.Optional(Type$1.String())
-}, {
-	$id: "AssessBriefOutput",
-	additionalProperties: false
-});
-//#endregion
-//#region ../tasks/src/task-types/curate-pack.ts
+//#region src/runtime-definition.ts
+var PI_RUNTIME_DEFINITION_VERSION = "moltnet:pi-runtime:v1";
+var PI_EXECUTOR_MANIFEST_VERSION = "moltnet:executor-manifest:v1";
+var DEFAULT_BROKERED_HTTP_SECRET_RESOLUTION_TIMEOUT_MS = 3e4;
+var MAX_BROKERED_HTTP_SECRET_RESOLUTION_TIMEOUT_MS = 2147483647;
+var PiBrokeredHttpSecretResolutionError = class extends Error {
+	constructor(requirementId, message, retryable) {
+		super(message);
+		this.requirementId = requirementId;
+		this.retryable = retryable;
+		this.name = "PiBrokeredHttpSecretResolutionError";
+	}
+};
+function brokeredHttpSecretAbortError() {
+	const error = /* @__PURE__ */ new Error("Brokered HTTP secret resolution aborted");
+	error.name = "AbortError";
+	return error;
+}
 /**
-* `curate_pack` — select and rank diary entries into a context pack.
-*
-* output_kind: artifact
-* criteria: not required (rubric-less curation recipe)
-* references: optional (e.g. a prior rendered pack being re-curated)
-*
-* This is step 1 of the three-session attribution loop (#875). The agent
-* runs a structured exploration over a diary — tag inventory, hybrid
-* search, type/tag narrowing — and emits a ranked entry list via
-* `moltnet_pack_create`. The prompt is deterministic given the input
-* (no operator interaction), so two runs with the same input should
-* converge on similar packs.
-*
-* Related: `render_pack`, `judge_pack`.
+* Declare a value-free HTTP credential requirement in trusted runtime code.
+* The resolver runs per attempt on the daemon host; its return value is never
+* added to the runtime definition or executor manifest.
 */
-var EntryTypeFilter = Type$1.Union([
-	Type$1.Literal("episodic"),
-	Type$1.Literal("semantic"),
-	Type$1.Literal("procedural"),
-	Type$1.Literal("reflection")
-]);
-Type$1.Object({
-	diaryId: Type$1.String({ format: "uuid" }),
-	taskPrompt: Type$1.String({ minLength: 1 }),
-	entryTypes: Type$1.Optional(Type$1.Array(EntryTypeFilter, { minItems: 1 })),
-	tagFilters: Type$1.Optional(Type$1.Object({
-		include: Type$1.Optional(Type$1.Array(Type$1.String())),
-		exclude: Type$1.Optional(Type$1.Array(Type$1.String())),
-		prefix: Type$1.Optional(Type$1.String())
-	}, { additionalProperties: false })),
-	tokenBudget: Type$1.Optional(Type$1.Number({ minimum: 500 })),
-	recipe: Type$1.Optional(Type$1.Union([Type$1.Literal("topic-focused-v1"), Type$1.Literal("scope-inventory-v1")])),
-	successCriteria: Type$1.Optional(SuccessCriteria)
-}, {
-	$id: "CuratePackInput",
-	additionalProperties: false
-});
-Type$1.Object({
-	packId: Type$1.String({ format: "uuid" }),
-	packCid: Type$1.String({ minLength: 1 }),
-	entries: Type$1.Array(Type$1.Object({
-		entryId: Type$1.String({ format: "uuid" }),
-		rank: Type$1.Number({ minimum: 1 }),
-		rationale: Type$1.String({ minLength: 1 })
-	}, { additionalProperties: false }), { minItems: 1 }),
-	recipeParams: Type$1.Record(Type$1.String(), Type$1.Unknown()),
-	checkpoints: Type$1.Optional(Type$1.Array(Type$1.Object({
-		phase: Type$1.String({ minLength: 1 }),
-		candidateIds: Type$1.Array(Type$1.String({ format: "uuid" })),
-		droppedIds: Type$1.Optional(Type$1.Array(Type$1.String({ format: "uuid" }))),
-		notes: Type$1.String({ minLength: 1 })
-	}, { additionalProperties: false }))),
-	summary: Type$1.String({ minLength: 1 }),
-	verification: Type$1.Optional(VerificationRecord)
-}, {
-	$id: "CuratePackOutput",
-	additionalProperties: false
-});
-//#endregion
-//#region ../tasks/src/task-types/freeform.ts
-var FreeformExecutionOptions = Type$1.Object({
-	workspace: Type$1.Optional(Type$1.Union([
-		Type$1.Literal("none"),
-		Type$1.Literal("shared_mount"),
-		Type$1.Literal("dedicated_worktree")
-	])),
-	revision: Type$1.Optional(Type$1.String({ pattern: "^[0-9a-fA-F]{40}$" }))
-}, {
-	$id: "FreeformExecutionOptions",
-	additionalProperties: false
-});
-var FreeformContinueFrom = Type$1.Object({
-	taskId: Type$1.String({ format: "uuid" }),
-	attemptN: Type$1.Integer({ minimum: 1 }),
-	mode: Type$1.Optional(Type$1.Union([Type$1.Literal("extend"), Type$1.Literal("fork")]))
-}, {
-	$id: "FreeformContinueFrom",
-	additionalProperties: false
-});
-var FreeformTaskTypeProposal = Type$1.Object({
-	name: Type$1.String({ minLength: 1 }),
-	rationale: Type$1.String({ minLength: 1 }),
-	inputShape: Type$1.Optional(Type$1.Record(Type$1.String(), Type$1.Unknown())),
-	outputShape: Type$1.Optional(Type$1.Record(Type$1.String(), Type$1.Unknown()))
-}, {
-	$id: "FreeformTaskTypeProposal",
-	additionalProperties: false
-});
-Type$1.Object({
-	brief: Type$1.String({ minLength: 1 }),
-	expectedOutput: Type$1.Optional(Type$1.String({ minLength: 1 })),
-	constraints: Type$1.Optional(Type$1.Array(Type$1.String({ minLength: 1 }), { maxItems: 20 })),
-	suggestedTaskType: Type$1.Optional(Type$1.String({ minLength: 1 })),
-	successCriteria: Type$1.Optional(SuccessCriteria),
-	context: Type$1.Optional(TaskContext$1),
-	execution: Type$1.Optional(FreeformExecutionOptions),
-	continueFrom: Type$1.Optional(FreeformContinueFrom)
-}, {
-	$id: "FreeformInput",
-	additionalProperties: false
-});
-var FreeformArtifact = Type$1.Object({
-	kind: Type$1.String({ minLength: 1 }),
-	title: Type$1.String({ minLength: 1 }),
-	description: Type$1.Optional(Type$1.String({ minLength: 1 })),
-	url: Type$1.Optional(Type$1.String({ minLength: 1 })),
-	path: Type$1.Optional(Type$1.String({ minLength: 1 })),
-	cid: Type$1.Optional(Type$1.String({ minLength: 1 })),
-	contentType: Type$1.Optional(Type$1.String({ minLength: 1 })),
-	contentEncoding: Type$1.Optional(Type$1.String({ minLength: 1 })),
-	sizeBytes: Type$1.Optional(Type$1.Integer({ minimum: 0 })),
-	body: Type$1.Optional(Type$1.String({ maxLength: 65536 }))
-}, {
-	$id: "FreeformArtifact",
-	additionalProperties: false
-});
-Type$1.Object({
-	summary: Type$1.String({ minLength: 1 }),
-	branch: Type$1.Optional(Type$1.String({ minLength: 1 })),
-	artifacts: Type$1.Optional(Type$1.Array(FreeformArtifact, { maxItems: 20 })),
-	proposedTaskType: Type$1.Optional(FreeformTaskTypeProposal),
-	diaryEntryIds: Type$1.Optional(Type$1.Array(Type$1.String({ format: "uuid" }))),
-	verification: Type$1.Optional(VerificationRecord)
-}, {
-	$id: "FreeformOutput",
-	additionalProperties: false
-});
-Type$1.Object({
-	brief: Type$1.String({ minLength: 1 }),
-	successCriteria: Type$1.Optional(SuccessCriteria),
-	seedFiles: Type$1.Optional(Type$1.Array(Type$1.String())),
-	scopeHint: Type$1.Optional(Type$1.String())
-}, {
-	$id: "FulfillBriefInput",
-	additionalProperties: false
-});
-Type$1.Object({
-	branch: Type$1.String({ minLength: 1 }),
-	commits: Type$1.Array(Type$1.Object({
-		sha: Type$1.String({ minLength: 7 }),
-		message: Type$1.String(),
-		diaryEntryId: Type$1.Union([Type$1.String({ format: "uuid" }), Type$1.Null()])
-	}, { additionalProperties: false })),
-	pullRequestUrl: Type$1.Union([Type$1.String(), Type$1.Null()]),
-	diaryEntryIds: Type$1.Array(Type$1.String({ format: "uuid" })),
-	summary: Type$1.String({ minLength: 1 }),
-	verification: Type$1.Optional(VerificationRecord)
-}, {
-	$id: "FulfillBriefOutput",
-	additionalProperties: false
-});
-Type$1.Object({
-	renderedPackId: Type$1.String({ format: "uuid" }),
-	sourcePackId: Type$1.String({ format: "uuid" }),
-	successCriteria: SuccessCriteria
-}, {
-	$id: "JudgePackInput",
-	additionalProperties: false
-});
-/** One scored criterion. Mirrors `AssessBriefScore`. */
-var JudgePackScore = Type$1.Object({
-	criterionId: Type$1.String({ minLength: 1 }),
-	score: Type$1.Number({
-		minimum: 0,
-		maximum: 1
-	}),
-	rationale: Type$1.Optional(Type$1.String()),
-	assertions: Type$1.Optional(Type$1.Array(AssertionResult, { minItems: 1 })),
-	evidence: Type$1.Optional(Type$1.Record(Type$1.String(), Type$1.Unknown()))
-}, {
-	$id: "JudgePackScore",
-	additionalProperties: false
-});
-Type$1.Object({
-	scores: Type$1.Array(JudgePackScore, { minItems: 1 }),
-	composite: Type$1.Number({
-		minimum: 0,
-		maximum: 1
-	}),
-	verdict: Type$1.String({ minLength: 1 }),
-	judgeModel: Type$1.Optional(Type$1.String()),
-	rendererBinaryCid: Type$1.Optional(Type$1.Union([Type$1.String(), Type$1.Null()]))
-}, {
-	$id: "JudgePackOutput",
-	additionalProperties: false
-});
-Type$1.Object({
-	targetTaskId: Type$1.String({ format: "uuid" }),
-	targetAttemptN: Type$1.Integer({ minimum: 1 }),
-	successCriteria: SuccessCriteria
-}, {
-	$id: "JudgeEvalAttemptInput",
-	additionalProperties: false
-});
-Type$1.Object({
-	targetTaskId: Type$1.String({ format: "uuid" }),
-	targetAttemptN: Type$1.Integer({ minimum: 1 }),
-	variantLabel: Type$1.String({
-		minLength: 1,
-		maxLength: 64,
-		pattern: "^(?!.* - ).*$"
-	}),
-	scores: Type$1.Array(JudgePackScore, { minItems: 1 }),
-	composite: Type$1.Number({
-		minimum: 0,
-		maximum: 1
-	}),
-	verdict: Type$1.String({ minLength: 1 }),
-	judgeModel: Type$1.Optional(Type$1.String({ minLength: 1 }))
-}, {
-	$id: "JudgeEvalAttemptSubmission",
-	additionalProperties: false
-});
-Type$1.Object({
-	targetTaskId: Type$1.String({ format: "uuid" }),
-	targetAttemptN: Type$1.Integer({ minimum: 1 }),
-	variantLabel: Type$1.String({
-		minLength: 1,
-		maxLength: 64,
-		pattern: "^(?!.* - ).*$"
-	}),
-	scores: Type$1.Array(JudgePackScore, { minItems: 1 }),
-	composite: Type$1.Number({
-		minimum: 0,
-		maximum: 1
-	}),
-	verdict: Type$1.String({ minLength: 1 }),
-	judgeModel: Type$1.Optional(Type$1.String({ minLength: 1 })),
-	traceparent: Type$1.Optional(Type$1.String({ minLength: 1 }))
-}, {
-	$id: "JudgeEvalAttemptOutput",
-	additionalProperties: false
-});
-//#endregion
-//#region ../tasks/src/task-types/pr-review.ts
-var PrReviewSubject = Type$1.Object({
-	title: Type$1.String({ minLength: 1 }),
-	summary: Type$1.String({ minLength: 1 }),
-	resourceUrls: Type$1.Optional(Type$1.Array(Type$1.String({ minLength: 1 }))),
-	inspectionHints: Type$1.Optional(Type$1.Array(Type$1.String({ minLength: 1 })))
-}, {
-	$id: "PrReviewSubject",
-	additionalProperties: false
-});
-Type$1.Object({
-	subject: PrReviewSubject,
-	taskPrompt: Type$1.Optional(Type$1.String({ minLength: 1 })),
-	successCriteria: SuccessCriteria,
-	context: Type$1.Optional(TaskContext$1)
-}, {
-	$id: "PrReviewInput",
-	additionalProperties: false
-});
-var PrReviewScore = Type$1.Object({
-	criterionId: Type$1.String({ minLength: 1 }),
-	score: Type$1.Union([Type$1.Literal(0), Type$1.Literal(1)]),
-	rationale: Type$1.String({ minLength: 1 })
-}, {
-	$id: "PrReviewScore",
-	additionalProperties: false
-});
-Type$1.Object({
-	scores: Type$1.Array(PrReviewScore, { minItems: 1 }),
-	composite: Type$1.Number({
-		minimum: 0,
-		maximum: 1
-	}),
-	verdict: Type$1.String({ minLength: 1 })
-}, {
-	$id: "PrReviewOutput",
-	additionalProperties: false
-});
-Type$1.Object({
-	packId: Type$1.String({ format: "uuid" }),
-	persist: Type$1.Optional(Type$1.Boolean()),
-	pinned: Type$1.Optional(Type$1.Boolean()),
-	successCriteria: Type$1.Optional(SuccessCriteria)
-}, {
-	$id: "RenderPackInput",
-	additionalProperties: false
-});
-Type$1.Object({
-	renderedPackId: Type$1.Union([Type$1.String({ format: "uuid" }), Type$1.Null()]),
-	renderedCid: Type$1.String({ minLength: 1 }),
-	renderMethod: Type$1.String({ minLength: 1 }),
-	byteSize: Type$1.Number({ minimum: 0 }),
-	entriesRendered: Type$1.Number({ minimum: 0 }),
-	summary: Type$1.String({ minLength: 1 }),
-	verification: Type$1.Optional(VerificationRecord)
-}, {
-	$id: "RenderPackOutput",
-	additionalProperties: false
-});
-//#endregion
-//#region ../tasks/src/task-types/run-eval.ts
-/**
-* `run_eval` — execute a scenario prompt under a named variant for
-* later per-attempt grading by `judge_eval_attempt` tasks.
-*
-* output_kind: artifact
-* criteria: optional producer-only checks (when set,
-*   output.verification is required — the judge rubric remains hidden
-*   on downstream `judge_eval_attempt` tasks)
-* references: not required (scenario lives entirely in input)
-*/
-var RunEvalMode = Type$1.Union([Type$1.Literal("vitro"), Type$1.Literal("vivo")], { $id: "RunEvalMode" });
-var RunEvalWorkspace = Type$1.Union([
-	Type$1.Literal("none"),
-	Type$1.Literal("shared_mount"),
-	Type$1.Literal("dedicated_worktree")
-], { $id: "RunEvalWorkspace" });
-var RunEvalExecution = Type$1.Object({
-	mode: RunEvalMode,
-	workspace: RunEvalWorkspace
-}, {
-	$id: "RunEvalExecution",
-	additionalProperties: false
-});
-/**
-* Producer-visible checks for `run_eval`. Deliberately forbids `rubric`
-* so the variant runner cannot see the downstream judge's answer key.
-* Keep the rest of the SuccessCriteria envelope available for generic
-* process / structure checks (`gates`, `assertions`, `sideEffects`).
-*/
-var RunEvalSuccessCriteria = Type$1.Object({
-	version: Type$1.Literal(1),
-	gates: Type$1.Optional(SuccessCriteria.properties.gates),
-	assertions: Type$1.Optional(SuccessCriteria.properties.assertions),
-	sideEffects: Type$1.Optional(SuccessCriteria.properties.sideEffects)
-}, {
-	$id: "RunEvalSuccessCriteria",
-	additionalProperties: false
-});
-Type$1.Object({
-	scenario: Type$1.Object({
-		prompt: Type$1.String({ minLength: 1 }),
-		inputFiles: Type$1.Optional(Type$1.Array(Type$1.String({ minLength: 1 })))
-	}, { additionalProperties: false }),
-	variantLabel: Type$1.String({
-		minLength: 1,
-		maxLength: 64
-	}),
-	execution: RunEvalExecution,
-	context: TaskContext$1,
-	successCriteria: Type$1.Optional(RunEvalSuccessCriteria)
-}, {
-	$id: "RunEvalInput",
-	additionalProperties: false
-});
-var RunEvalArtifact = Type$1.Object({
-	path: Type$1.String({ minLength: 1 }),
-	cid: Type$1.String({ minLength: 1 })
-}, { additionalProperties: false });
-Type$1.Object({
-	response: Type$1.String({ minLength: 1 }),
-	artifacts: Type$1.Optional(Type$1.Array(RunEvalArtifact)),
-	verification: Type$1.Optional(VerificationRecord)
-}, {
-	$id: "RunEvalSubmission",
-	additionalProperties: false
-});
-Type$1.Object({
-	response: Type$1.String({ minLength: 1 }),
-	artifacts: Type$1.Optional(Type$1.Array(RunEvalArtifact)),
-	totalTokens: Type$1.Integer({ minimum: 0 }),
-	durationMs: Type$1.Integer({ minimum: 0 }),
-	traceparent: Type$1.Optional(Type$1.String({ minLength: 1 })),
-	verification: Type$1.Optional(VerificationRecord)
-}, {
-	$id: "RunEvalOutput",
-	additionalProperties: false
-});
-//#endregion
-//#region ../tasks/src/task-type-registry.ts
-var schemaCids = null;
-function getTaskTypeRegistry() {
-	if (!schemaCids) throw new Error("Task type registry not initialized. Call initTaskTypeRegistry() first.");
-	return schemaCids;
-}
-new Proxy({}, { get(_, prop) {
-	if (typeof prop !== "string") return void 0;
-	return getTaskTypeRegistry().get(prop);
-} });
-//#endregion
-//#region ../tasks/src/wire.ts
-/**
-* Wire-format types for the MoltNet Task model.
-*
-* These schemas are the single source of truth for:
-*   - `tasks`, `task_attempts`, `task_messages` DB columns (PR 1's Drizzle
-*     schema must match these verbatim)
-*   - REST request/response bodies (PR 4)
-*   - `TaskReporter` output records (PR 0)
-*
-* Invariant: every property on `Task` is type-neutral (applies to all
-* `taskType`s). Type-specific payloads live inside `input` / `output`
-* JSONB, validated against schemas registered under `task_types`.
-*
-* Identity rule:
-*   - claim/execute/sign → agent-only (`task_attempts.claimed_by_agent_id`)
-*   - propose/cancel → agent XOR human (dual nullable FK + XOR check)
-*
-* See GH issue #852 for the full design snapshot.
-*/
-var TaskStatus = Type$1.Union([
-	Type$1.Literal("waiting"),
-	Type$1.Literal("queued"),
-	Type$1.Literal("dispatched"),
-	Type$1.Literal("running"),
-	Type$1.Literal("completed"),
-	Type$1.Literal("failed"),
-	Type$1.Literal("cancelled"),
-	Type$1.Literal("expired")
-], { $id: "TaskStatus" });
-var TaskAttemptStatus = Type$1.Union([
-	Type$1.Literal("claimed"),
-	Type$1.Literal("running"),
-	Type$1.Literal("completed"),
-	Type$1.Literal("failed"),
-	Type$1.Literal("cancelled"),
-	Type$1.Literal("aborted"),
-	Type$1.Literal("timed_out")
-], { $id: "TaskAttemptStatus" });
-var ExecutorTrustLevel = Type$1.Union([
-	Type$1.Literal("selfDeclared"),
-	Type$1.Literal("agentSigned"),
-	Type$1.Literal("releaseVerifiedTool"),
-	Type$1.Literal("sandboxAttested")
-], { $id: "ExecutorTrustLevel" });
-var OutputKind = Type$1.Union([Type$1.Literal("artifact"), Type$1.Literal("judgment")], { $id: "OutputKind" });
-var TaskMessageKind = Type$1.Union([
-	Type$1.Literal("text_delta"),
-	Type$1.Literal("tool_call_start"),
-	Type$1.Literal("tool_call_end"),
-	Type$1.Literal("turn_end"),
-	Type$1.Literal("error"),
-	Type$1.Literal("info")
-], { $id: "TaskMessageKind" });
-var Uuid = Type$1.String({ format: "uuid" });
-var Cid = Type$1.String({ minLength: 1 });
-var IsoTimestamp = Type$1.String({ format: "date-time" });
-/**
-* Daemon-asserted runtime state stamped onto a `TaskAttemptSummary` at
-* attempt-completion time. The server persists this block verbatim and
-* exposes `slotResumableUntil` as a legacy/local warm-slot hint; task
-* continuation eligibility is based on the completed source attempt and
-* daemon-side claim-affinity/runtime-session recovery. The block carries
-* its own `reportedAt` so consumers can reason about staleness without
-* reading documentation. All daemon-asserted state lives here —
-* top-level attempt fields stay server-authoritative.
-*
-* Adding new fields requires explicit design review (intentional
-* boundary; see docs/superpowers/specs/2026-06-04-tasks-continue-design.md).
-*/
-var DaemonState = Type$1.Object({
-	reportedAt: IsoTimestamp,
-	slotResumableUntil: Type$1.Union([IsoTimestamp, Type$1.Null()])
-}, {
-	$id: "DaemonState",
-	additionalProperties: false
-});
-var ClaimConditionSchema = Type$1.Union([
-	Type$1.Object({
-		op: Type$1.Literal("all"),
-		conditions: Type$1.Array(Type$1.Ref("ClaimCondition"), {
-			minItems: 1,
-			maxItems: 8
-		})
-	}, { additionalProperties: false }),
-	Type$1.Object({
-		op: Type$1.Literal("any"),
-		conditions: Type$1.Array(Type$1.Ref("ClaimCondition"), {
-			minItems: 1,
-			maxItems: 8
-		})
-	}, { additionalProperties: false }),
-	Type$1.Object({
-		op: Type$1.Literal("task_status"),
-		taskId: Uuid,
-		statuses: Type$1.Array(Type$1.Ref("TaskStatus"), {
-			minItems: 1,
-			maxItems: 8
-		})
-	}, { additionalProperties: false }),
-	Type$1.Object({
-		op: Type$1.Literal("task_accepted"),
-		taskId: Uuid
-	}, { additionalProperties: false })
-], { $id: "ClaimCondition" });
-var ClaimConditionDefinition = Type$1.Unsafe(ClaimConditionSchema);
-Type$1.Unsafe(Type$1.Cyclic({ ClaimCondition: ClaimConditionDefinition }, "ClaimCondition", { $id: "ClaimCondition" }));
-/**
-* Reference to another task's output or an external artifact.
-* Embedded in `tasks.references` JSONB array.
-*/
-var TaskRef = Type$1.Object({
-	taskId: Type$1.Union([Uuid, Type$1.Null()]),
-	outputCid: Type$1.Optional(Cid),
-	role: Type$1.Union([
-		Type$1.Literal("judged_work"),
-		Type$1.Literal("reviewed_diff"),
-		Type$1.Literal("target_source"),
-		Type$1.Literal("context")
-	]),
-	external: Type$1.Optional(Type$1.Object({
-		kind: Type$1.Union([
-			Type$1.Literal("github_pr"),
-			Type$1.Literal("github_issue"),
-			Type$1.Literal("http_url")
-		]),
-		pr: Type$1.Optional(Type$1.Number()),
-		issue: Type$1.Optional(Type$1.Number()),
-		url: Type$1.Optional(Type$1.String()),
-		commit_sha: Type$1.Optional(Type$1.String()),
-		snapshot_cid: Type$1.Optional(Cid)
-	})),
-	artifact: Type$1.Optional(Type$1.Object({
-		cid: Cid,
-		attemptN: Type$1.Optional(Type$1.Integer({ minimum: 1 })),
-		kind: Type$1.Optional(Type$1.String({
-			minLength: 1,
-			maxLength: 100
-		})),
-		title: Type$1.Optional(Type$1.String({
-			minLength: 1,
-			maxLength: 255
-		})),
-		contentType: Type$1.Optional(Type$1.String({
-			minLength: 1,
-			maxLength: 200
-		}))
-	}, { additionalProperties: false }))
-}, {
-	$id: "TaskRef",
-	additionalProperties: false
-});
-/**
-* Token / cost accounting for one attempt.
-* Reported by the runtime; persisted per-attempt, also rolled up into
-* `TaskOutput.usage` for convenience.
-*/
-var TaskUsage = Type$1.Object({
-	inputTokens: Type$1.Integer({ minimum: 0 }),
-	outputTokens: Type$1.Integer({ minimum: 0 }),
-	cacheReadTokens: Type$1.Optional(Type$1.Integer({ minimum: 0 })),
-	cacheWriteTokens: Type$1.Optional(Type$1.Integer({ minimum: 0 })),
-	toolCalls: Type$1.Optional(Type$1.Integer({ minimum: 0 })),
-	model: Type$1.Optional(Type$1.String()),
-	provider: Type$1.Optional(Type$1.String())
-}, {
-	$id: "TaskUsage",
-	additionalProperties: false
-});
-var TaskRetryDecision = Type$1.Union([Type$1.Literal("retry"), Type$1.Literal("do_not_retry")]);
-var TaskRetryConfidence = Type$1.Union([
-	Type$1.Literal("low"),
-	Type$1.Literal("medium"),
-	Type$1.Literal("high")
-]);
-var TaskRetrySource = Type$1.Union([
-	Type$1.Literal("explicit"),
-	Type$1.Literal("deterministic"),
-	Type$1.Literal("attempts_exhausted"),
-	Type$1.Literal("triage"),
-	Type$1.Literal("triage_failed")
-]);
-var TaskRetryInfo = Type$1.Object({
-	source: TaskRetrySource,
-	decision: Type$1.Optional(TaskRetryDecision),
-	confidence: Type$1.Optional(TaskRetryConfidence),
-	reason: Type$1.Optional(Type$1.String())
-}, {
-	$id: "TaskRetryInfo",
-	additionalProperties: false
-});
-/**
-* Structured error returned from a failed attempt.
-*/
-var TaskError = Type$1.Object({
-	code: Type$1.String(),
-	message: Type$1.String(),
-	stack: Type$1.Optional(Type$1.String()),
-	retryable: Type$1.Optional(Type$1.Boolean()),
-	retry: Type$1.Optional(TaskRetryInfo)
-}, {
-	$id: "TaskError",
-	additionalProperties: false
-});
-Type$1.Object({
-	agentId: Type$1.Union([Uuid, Type$1.Null()]),
-	humanId: Type$1.Union([Uuid, Type$1.Null()])
-}, {
-	$id: "ActorPair",
-	additionalProperties: false
-});
-Type$1.Object({
-	id: Uuid,
-	taskType: Type$1.String({ minLength: 1 }),
-	title: Type$1.Union([Type$1.String(), Type$1.Null()]),
-	tags: Type$1.Array(Type$1.String()),
-	teamId: Uuid,
-	diaryId: Type$1.Union([Uuid, Type$1.Null()]),
-	outputKind: OutputKind,
-	input: Type$1.Record(Type$1.String(), Type$1.Unknown()),
-	inputSchemaCid: Cid,
-	inputCid: Cid,
-	references: Type$1.Array(TaskRef),
-	correlationId: Type$1.Union([Uuid, Type$1.Null()]),
-	proposedByAgentId: Type$1.Union([Uuid, Type$1.Null()]),
-	proposedByHumanId: Type$1.Union([Uuid, Type$1.Null()]),
-	acceptedAttemptN: Type$1.Union([Type$1.Number(), Type$1.Null()]),
-	claimCondition: Type$1.Union([Type$1.Unsafe(Type$1.Ref("ClaimCondition")), Type$1.Null()]),
-	requiredExecutorTrustLevel: ExecutorTrustLevel,
-	allowedProfiles: Type$1.Array(RuntimeProfileRef, { maxItems: 16 }),
-	status: TaskStatus,
-	queuedAt: IsoTimestamp,
-	completedAt: Type$1.Union([IsoTimestamp, Type$1.Null()]),
-	expiresAt: Type$1.Union([IsoTimestamp, Type$1.Null()]),
-	cancelledByAgentId: Type$1.Union([Uuid, Type$1.Null()]),
-	cancelledByHumanId: Type$1.Union([Uuid, Type$1.Null()]),
-	cancelReason: Type$1.Union([Type$1.String(), Type$1.Null()]),
-	maxAttempts: Type$1.Number({ minimum: 1 }),
-	dispatchTimeoutSec: Type$1.Union([Type$1.Integer({
-		minimum: 1,
-		maximum: 86400
-	}), Type$1.Null()]),
-	runningTimeoutSec: Type$1.Union([Type$1.Integer({
-		minimum: 1,
-		maximum: 86400
-	}), Type$1.Null()])
-}, {
-	$id: "Task",
-	additionalProperties: false
-});
-Type$1.Object({
-	taskId: Uuid,
-	attemptN: Type$1.Number({ minimum: 1 }),
-	claimedByAgentId: Uuid,
-	leaseId: Type$1.Union([Uuid, Type$1.Null()]),
-	runtimeProfileId: Type$1.Union([Uuid, Type$1.Null()]),
-	runtimeProfileRevision: Type$1.Union([Type$1.Integer({ minimum: 1 }), Type$1.Null()]),
-	policySnapshotHash: Type$1.Union([Type$1.String({ pattern: "^sha256:[0-9a-f]{64}$" }), Type$1.Null()]),
-	runtimeId: Type$1.Union([Uuid, Type$1.Null()]),
-	claimedAt: IsoTimestamp,
-	startedAt: Type$1.Union([IsoTimestamp, Type$1.Null()]),
-	completedAt: Type$1.Union([IsoTimestamp, Type$1.Null()]),
-	status: TaskAttemptStatus,
-	output: Type$1.Union([Type$1.Record(Type$1.String(), Type$1.Unknown()), Type$1.Null()]),
-	outputCid: Type$1.Union([Cid, Type$1.Null()]),
-	claimedExecutorFingerprint: Type$1.Union([Cid, Type$1.Null()]),
-	claimedExecutorManifest: Type$1.Union([Type$1.Record(Type$1.String(), Type$1.Unknown()), Type$1.Null()]),
-	completedExecutorFingerprint: Type$1.Union([Cid, Type$1.Null()]),
-	completedExecutorManifest: Type$1.Union([Type$1.Record(Type$1.String(), Type$1.Unknown()), Type$1.Null()]),
-	error: Type$1.Union([TaskError, Type$1.Null()]),
-	usage: Type$1.Union([TaskUsage, Type$1.Null()]),
-	contentSignature: Type$1.Union([Type$1.String(), Type$1.Null()]),
-	signedAt: Type$1.Union([IsoTimestamp, Type$1.Null()]),
-	daemonState: Type$1.Union([DaemonState, Type$1.Null()])
-}, {
-	$id: "TaskAttempt",
-	additionalProperties: true
-});
-Type$1.Object({
-	taskId: Uuid,
-	attemptN: Type$1.Number({ minimum: 1 }),
-	seq: Type$1.Number({
-		minimum: 0,
-		description: "Monotonically increasing integer assigned by the server. Use as the afterSeq cursor on the list-messages endpoint to poll for new messages without re-fetching earlier ones."
-	}),
-	timestamp: IsoTimestamp,
-	kind: TaskMessageKind,
-	payload: Type$1.Record(Type$1.String(), Type$1.Unknown())
-}, {
-	$id: "TaskMessage",
-	additionalProperties: false
-});
-Type$1.Object({
-	taskId: Uuid,
-	attemptN: Type$1.Number({ minimum: 1 }),
-	status: Type$1.Union([
-		Type$1.Literal("completed"),
-		Type$1.Literal("failed"),
-		Type$1.Literal("cancelled")
-	]),
-	output: Type$1.Union([Type$1.Record(Type$1.String(), Type$1.Unknown()), Type$1.Null()]),
-	outputCid: Type$1.Union([Cid, Type$1.Null()]),
-	usage: TaskUsage,
-	durationMs: Type$1.Number({ minimum: 0 }),
-	error: Type$1.Optional(TaskError),
-	contentSignature: Type$1.Optional(Type$1.String())
-}, {
-	$id: "TaskOutput",
-	additionalProperties: false
-});
-Type$1.Object({
-	runtimeId: Uuid,
-	agentId: Uuid,
-	timestamp: IsoTimestamp,
-	status: Type$1.Union([
-		Type$1.Literal("idle"),
-		Type$1.Literal("busy"),
-		Type$1.Literal("draining")
-	]),
-	activeTaskIds: Type$1.Array(Uuid),
-	supportedTaskTypes: Type$1.Array(Type$1.String())
-}, {
-	$id: "RuntimeHeartbeat",
-	additionalProperties: false
-});
-//#endregion
-//#region src/snapshot.ts
-/**
-* Snapshot builder with auto-build and caching.
-*
-* Builds a Gondolin VM snapshot in two layers:
-*   1. Base (always): Alpine essentials, git, gh CLI, MoltNet CLI, agent user
-*   2. User setup commands (optional): arbitrary shell commands on top of the base
-*
-* Consumers provide raw shell commands — no abstraction over package managers
-* or runtimes. The base provides curl, git, tar, jq; everything else is up to
-* the setup commands.
-*
-* Caches in a platform-appropriate directory:
-*   - macOS: ~/Library/Caches/moltnet/gondolin/
-*   - Linux: ~/.cache/moltnet/gondolin/
-*
-* The cache key is a hash of the full config. When any input changes,
-* a new snapshot is built automatically.
-*/
-/** Alpine packages whose commands are guaranteed in every snapshot. */
-var BASE_ALPINE_PACKAGE_EXECUTABLES = {
-	curl: "curl",
-	file: "file",
-	git: "git",
-	jq: "jq",
-	ripgrep: "rg",
-	tar: "tar",
-	xz: "xz"
-};
-/** Alpine packages required by every snapshot. */
-var BASE_ALPINE_PACKAGES = ["ca-certificates", ...Object.keys(BASE_ALPINE_PACKAGE_EXECUTABLES)];
-/** Commands guaranteed by the base Gondolin snapshot. */
-var GONDOLIN_BASE_EXECUTABLES = Object.freeze([
-	...Object.values(BASE_ALPINE_PACKAGE_EXECUTABLES),
-	"gh",
-	"moltnet"
-].sort());
-/** gh CLI version installed in every snapshot. */
-var GH_VERSION = "2.74.0";
-/** MoltNet CLI version — downloaded as a binary, no Node needed. */
-var MOLTNET_CLI_VERSION = "1.37.0";
-/**
-* Resolve guest architecture from host (Gondolin VMs match host arch).
-*
-* The two naming conventions are NOT interchangeable:
-*   - `gh`  — GitHub release-asset suffix (gh CLI ships `linux_amd64.tar.gz`,
-*             `linux_arm64.tar.gz`).
-*   - `npm` — npm optionalDependencies naming, which mirrors Node's
-*             `process.arch` values (`x64`, `arm64`). The MoltNet CLI is
-*             published as `@themoltnet/cli-linux-x64` and
-*             `@themoltnet/cli-linux-arm64`, NOT `cli-linux-amd64`.
-*/
-function getGuestArch() {
-	if (process.arch === "arm64") return {
-		gh: "linux_arm64",
-		npm: "linux-arm64"
-	};
-	return {
-		gh: "linux_amd64",
-		npm: "linux-x64"
-	};
-}
-/** Hosts reachable during snapshot build. */
-var SETUP_ALLOWED_HOSTS = [
-	"dl-cdn.alpinelinux.org",
-	"*.alpinelinux.org",
-	"registry.npmjs.org",
-	"*.npmjs.org",
-	"nodejs.org",
-	"*.nodejs.org",
-	"unofficial-builds.nodejs.org",
-	"github.com",
-	"*.github.com",
-	"*.githubusercontent.com",
-	"objects.githubusercontent.com"
-];
-var DEFAULT_CONFIG = {};
-function getCacheDir() {
-	if (process.platform === "darwin") return path.join(process.env.HOME ?? "/tmp", "Library", "Caches", "moltnet", "gondolin");
-	const base = process.env.XDG_CACHE_HOME ?? path.join(process.env.HOME ?? "/tmp", ".cache");
-	return path.join(base, "moltnet", "gondolin");
-}
-function computeConfigHash(config) {
-	const h = createHash$1("sha256");
-	h.update(JSON.stringify({
-		baseAlpine: BASE_ALPINE_PACKAGES,
-		ghVersion: GH_VERSION,
-		cliVersion: MOLTNET_CLI_VERSION,
-		config
-	}));
-	return h.digest("hex").slice(0, 12);
-}
-function getSnapshotPath(config) {
-	const hash = computeConfigHash(config);
-	const dir = path.join(getCacheDir(), `v2-${hash}`);
-	return path.join(dir, "snapshot.qcow2");
-}
-/**
-* Ensure a cached snapshot exists, building one if needed.
-* Returns the absolute path to the qcow2 checkpoint file.
-*/
-async function ensureSnapshot(options = {}) {
-	const config = options.config ?? DEFAULT_CONFIG;
-	const log = options.onProgress ?? (() => {});
-	const maxCached = options.maxCached ?? 1;
-	const snapshotPath = getSnapshotPath(config);
-	const snapshotDir = path.dirname(snapshotPath);
-	if (existsSync(snapshotPath)) {
-		log(`snapshot cache hit: ${snapshotPath}`);
-		return snapshotPath;
-	}
-	log("snapshot cache miss — building (this takes 1-3 minutes)...");
-	mkdirSync(snapshotDir, { recursive: true });
-	const overlayPath = path.join(snapshotDir, "build.overlay.qcow2");
-	if (existsSync(overlayPath)) rmSync(overlayPath);
-	if (existsSync(snapshotPath)) rmSync(snapshotPath);
-	log("resolving alpine-base image...");
-	const assets = loadGuestAssets((await ensureImageSelector("alpine-base")).assetDir);
-	const overlaySize = config.overlaySize ?? "3G";
-	log(`creating qcow2 overlay (${overlaySize})...`);
-	execFileSync("qemu-img", [
-		"create",
-		"-f",
-		"qcow2",
-		"-F",
-		"raw",
-		"-b",
-		assets.rootfsPath,
-		overlayPath,
-		overlaySize
-	], { stdio: "pipe" });
-	const { httpHooks } = createHttpHooks({ allowedHosts: [...SETUP_ALLOWED_HOSTS, ...config.allowedHosts ?? []] });
-	log("booting VM for setup...");
-	const vm = await VM.create({
-		httpHooks,
-		env: {
-			PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/lib/go/bin",
-			HOME: "/root",
-			GOROOT: "/usr/lib/go",
-			GOPATH: "/root/go"
-		},
-		sandbox: {
-			rootDiskPath: overlayPath,
-			rootDiskFormat: "qcow2",
-			rootDiskReadOnly: false,
-			rootDiskDeleteOnClose: false
-		}
-	});
-	try {
-		await buildSnapshot(vm, config, log);
-		log("creating checkpoint...");
-		await vm.checkpoint(snapshotPath);
-		log(`snapshot saved: ${snapshotPath}`);
-	} finally {
-		try {
-			await vm.close();
-		} catch {}
-		if (existsSync(overlayPath)) rmSync(overlayPath, { force: true });
-	}
-	pruneOldSnapshots(maxCached, snapshotDir);
-	return snapshotPath;
-}
-/** Helper: run a command in the VM, throw on failure. */
-async function run(vm, log, label, cmd) {
-	log(label);
-	const r = await vm.exec(cmd);
-	if (r.exitCode !== 0) {
-		const output = [r.stderr, r.stdout].filter(Boolean).join("\n").slice(0, 800);
-		throw new Error(`snapshot build "${label}" failed (exit ${r.exitCode}):\n${output}`);
-	}
-}
-async function buildSnapshot(vm, config, log) {
-	await run(vm, log, "resizing rootfs...", "apk add --no-cache e2fsprogs-extra >/dev/null 2>&1 && resize2fs /dev/vda 2>/dev/null");
-	await run(vm, log, `installing base packages: ${BASE_ALPINE_PACKAGES.join(" ")}`, `apk add --no-cache ${BASE_ALPINE_PACKAGES.join(" ")}`);
-	const arch = getGuestArch();
-	await run(vm, log, `installing gh ${GH_VERSION} (${arch.gh})...`, `sh -eu -c '
-      curl -fsSL "https://github.com/cli/cli/releases/download/v${GH_VERSION}/gh_${GH_VERSION}_${arch.gh}.tar.gz" -o /tmp/gh.tar.gz
-      tar -xzf /tmp/gh.tar.gz -C /tmp
-      mv /tmp/gh_${GH_VERSION}_${arch.gh}/bin/gh /usr/local/bin/gh
-      chmod +x /usr/local/bin/gh
-      rm -rf /tmp/gh.tar.gz /tmp/gh_${GH_VERSION}_${arch.gh}
-      gh --version
-    '`);
-	await run(vm, log, `installing moltnet CLI ${MOLTNET_CLI_VERSION} (${arch.npm})...`, `sh -eu -c '
-      curl -fsSL "https://registry.npmjs.org/@themoltnet/cli-${arch.npm}/-/cli-${arch.npm}-${MOLTNET_CLI_VERSION}.tgz" -o /tmp/moltnet.tgz
-      tar -xzf /tmp/moltnet.tgz -C /tmp
-      mv /tmp/package/bin/moltnet /usr/local/bin/moltnet
-      chmod +x /usr/local/bin/moltnet
-      rm -rf /tmp/moltnet.tgz /tmp/package
-    '`);
-	await run(vm, log, "creating agent user...", `sh -eu -c '
-      addgroup -g 501 agent 2>/dev/null || true
-      adduser -D -u 501 -G agent -h /home/agent -s /bin/sh agent 2>/dev/null || true
-      mkdir -p /home/agent/.moltnet /home/agent/.cache
-      chown -R agent:agent /home/agent
-      chmod 644 /etc/gondolin/mitm/ca.crt 2>/dev/null || true
-    '`);
-	await run(vm, log, "configuring DNS resolvers...", `sh -c 'echo "nameserver 8.8.8.8
-nameserver 1.1.1.1" > /etc/resolv.conf'`);
-	if (config.setupCommands?.length) for (let i = 0; i < config.setupCommands.length; i++) await run(vm, log, `setup [${i + 1}/${config.setupCommands.length}]...`, config.setupCommands[i]);
-}
-function pruneOldSnapshots(maxCached, currentDir) {
-	const cacheRoot = getCacheDir();
-	if (!existsSync(cacheRoot)) return;
-	const entries = readdirSync(cacheRoot, { withFileTypes: true }).filter((e) => e.isDirectory() && e.name.startsWith("v")).map((e) => {
-		const fullPath = path.join(cacheRoot, e.name);
-		return {
-			path: fullPath,
-			mtime: statSync(fullPath).mtimeMs
-		};
-	}).sort((a, b) => b.mtime - a.mtime);
-	for (const entry of entries.slice(maxCached + 1)) if (entry.path !== currentDir) rmSync(entry.path, {
-		recursive: true,
-		force: true
+function definePiBrokeredHttpSecret(options) {
+	const descriptor = canonicalizeBrokeredHttpSecretDescriptor(options);
+	return Object.freeze({
+		kind: "brokered_http_secret",
+		descriptor,
+		resolve: options.resolve
 	});
 }
-//#endregion
-//#region src/runtime-definition.ts
-var PI_RUNTIME_DEFINITION_VERSION = "moltnet:pi-runtime:v1";
-var PI_EXECUTOR_MANIFEST_VERSION = "moltnet:executor-manifest:v1";
 function definePiTool(input, options = {}) {
 	if ("descriptor" in input) {
 		assertToolName(input.descriptor.name);
@@ -4252,7 +2904,7 @@ function defineGondolinTemplate(options) {
 		executables,
 		resumeCommands,
 		async resolve(context = {}) {
-			const checkpointPath = options.resolveCheckpoint ? await options.resolveCheckpoint(context) : options.checkpointPath ?? await ensureSnapshot({
+			const checkpointPath = options.resolveCheckpoint ? await options.resolveCheckpoint(context) : options.checkpointPath ?? await ensureSnapshot$1({
 				config: options.snapshot,
 				onProgress: context.onProgress
 			});
@@ -4285,17 +2937,28 @@ function definePiRuntime(options) {
 	const names = /* @__PURE__ */ new Map();
 	for (const tool of options.tools ?? []) claimToolName(names, tool.descriptor.name, "tool contribution");
 	for (const extension of options.extensions ?? []) for (const name of extension.declaredTools) claimToolName(names, name, `extension "${extension.id}"`);
+	const secretIds = /* @__PURE__ */ new Set();
+	const secretEnvNames = /* @__PURE__ */ new Set();
+	for (const secret of options.brokeredHttpSecrets ?? []) {
+		const { id, guestEnv } = secret.descriptor;
+		if (secretIds.has(id)) throw new Error(`Duplicate brokered HTTP secret id "${id}"`);
+		if (secretEnvNames.has(guestEnv)) throw new Error(`Duplicate brokered HTTP secret guest env "${guestEnv}"`);
+		secretIds.add(id);
+		secretEnvNames.add(guestEnv);
+	}
 	return Object.freeze({
 		schemaVersion: PI_RUNTIME_DEFINITION_VERSION,
 		id: options.id,
 		version: options.version,
 		runtimeKind: options.runtimeKind ?? "gondolin_pi",
 		vm: options.vm,
+		brokeredHttpSecrets: Object.freeze([...options.brokeredHttpSecrets ?? []]),
 		tools: Object.freeze([...options.tools ?? []]),
 		extensions: Object.freeze([...options.extensions ?? []])
 	});
 }
 async function buildPiExecutorManifest(input) {
+	const brokeredHttpSecrets = input.runtime.brokeredHttpSecrets ?? [];
 	const descriptors = [...(input.builtInTools ?? []).map((descriptor) => ({
 		descriptor,
 		scope: "parent_and_subagents"
@@ -4335,6 +2998,14 @@ async function buildPiExecutorManifest(input) {
 			templateFingerprint: input.template.fingerprint,
 			guestAssetBuildId: input.template.guestAssetBuildId
 		},
+		...brokeredHttpSecrets.length > 0 && { brokeredHttpSecrets: brokeredHttpSecrets.map(({ descriptor }) => ({
+			id: descriptor.id,
+			guestEnv: descriptor.guestEnv,
+			hosts: [...descriptor.hosts],
+			protocol: descriptor.protocol ?? "https",
+			ports: [...descriptor.ports ?? [descriptor.protocol === "http" ? 80 : 443]],
+			required: descriptor.required !== false
+		})).sort((left, right) => left.id.localeCompare(right.id)) },
 		tools,
 		extensions: input.runtime.extensions.map((extension) => ({
 			id: extension.id,
@@ -4344,6 +3015,109 @@ async function buildPiExecutorManifest(input) {
 		executables: input.template.executables
 	};
 }
+async function materializePiBrokeredHttpSecrets(input) {
+	const timeoutMs = input.timeoutMs ?? 3e4;
+	if (!Number.isInteger(timeoutMs) || timeoutMs <= 0 || timeoutMs > MAX_BROKERED_HTTP_SECRET_RESOLUTION_TIMEOUT_MS) throw new Error(`Brokered HTTP secret resolution timeout must be an integer between 1 and ${MAX_BROKERED_HTTP_SECRET_RESOLUTION_TIMEOUT_MS}`);
+	if (input.signal?.aborted) throw brokeredHttpSecretAbortError();
+	const contributions = input.runtime.brokeredHttpSecrets ?? [];
+	const batchController = new AbortController();
+	const abortBatchFromAttempt = () => batchController.abort(input.signal?.reason);
+	input.signal?.addEventListener("abort", abortBatchFromAttempt, { once: true });
+	try {
+		const outcomes = await Promise.all(contributions.map((contribution, index) => materializeSinglePiBrokeredHttpSecret({
+			contribution,
+			context: input.context,
+			batchSignal: batchController.signal,
+			timeoutMs,
+			index
+		}).then((outcome) => {
+			if (outcome.kind === "failure" && !batchController.signal.aborted) batchController.abort(outcome.error);
+			return outcome;
+		})));
+		if (input.signal?.aborted) throw brokeredHttpSecretAbortError();
+		const failures = outcomes.filter((outcome) => outcome.kind === "failure").sort((left, right) => Number(left.error.retryable) - Number(right.error.retryable) || left.index - right.index);
+		if (failures[0]) throw failures[0].error;
+		return outcomes.filter((outcome) => outcome.kind === "success").sort((left, right) => left.index - right.index).map(({ binding }) => binding);
+	} finally {
+		input.signal?.removeEventListener("abort", abortBatchFromAttempt);
+	}
+}
+/** One auditable resolver lifecycle; the batch coordinator owns precedence. */
+async function materializeSinglePiBrokeredHttpSecret(input) {
+	const { descriptor, resolve } = input.contribution;
+	if (input.batchSignal.aborted) return {
+		kind: "batch-abort",
+		index: input.index
+	};
+	const controller = new AbortController();
+	let timedOut = false;
+	const abortFromBatch = () => controller.abort(input.batchSignal.reason);
+	input.batchSignal.addEventListener("abort", abortFromBatch, { once: true });
+	const timeout = setTimeout(() => {
+		timedOut = true;
+		controller.abort();
+	}, input.timeoutMs);
+	const abortOutcome = new Promise((resolveAbort) => {
+		const resolveFromAbort = () => resolveAbort({ kind: "abort" });
+		if (controller.signal.aborted) resolveFromAbort();
+		else controller.signal.addEventListener("abort", resolveFromAbort, { once: true });
+	});
+	try {
+		let resolverOutcome;
+		try {
+			resolverOutcome = Promise.resolve(resolve({
+				...input.context,
+				signal: controller.signal
+			})).then((value) => ({
+				kind: "value",
+				value
+			}), (error) => ({
+				kind: "error",
+				error
+			}));
+		} catch (error) {
+			resolverOutcome = Promise.resolve({
+				kind: "error",
+				error
+			});
+		}
+		const outcome = await Promise.race([resolverOutcome, abortOutcome]);
+		if (outcome.kind === "abort") {
+			if (!timedOut) return {
+				kind: "batch-abort",
+				index: input.index
+			};
+			return {
+				kind: "failure",
+				index: input.index,
+				error: new PiBrokeredHttpSecretResolutionError(descriptor.id, `Brokered HTTP secret "${descriptor.id}" resolution timed out`, true)
+			};
+		}
+		if (outcome.kind === "error") return {
+			kind: "failure",
+			index: input.index,
+			error: outcome.error instanceof PiBrokeredHttpSecretResolutionError ? outcome.error : new PiBrokeredHttpSecretResolutionError(descriptor.id, `Brokered HTTP secret "${descriptor.id}" resolution failed`, true)
+		};
+		if ((outcome.value === void 0 || outcome.value === "") && descriptor.required !== false) return {
+			kind: "failure",
+			index: input.index,
+			error: new PiBrokeredHttpSecretResolutionError(descriptor.id, `Required brokered HTTP secret "${descriptor.id}" is unavailable`, false)
+		};
+		return {
+			kind: "success",
+			index: input.index,
+			binding: {
+				...descriptor,
+				hosts: [...descriptor.hosts],
+				ports: descriptor.ports ? [...descriptor.ports] : void 0,
+				value: outcome.value
+			}
+		};
+	} finally {
+		clearTimeout(timeout);
+		input.batchSignal.removeEventListener("abort", abortFromBatch);
+	}
+}
 async function materializePiTools(input) {
 	const contributions = input.runtime.tools.filter((tool) => input.target === "parent" || tool.scope === "parent_and_subagents");
 	return (await Promise.all(contributions.map(async (contribution) => {
@@ -4408,633 +3182,6 @@ function assertRuntimeKind(value) {
 	if (!RUNTIME_PROFILE_RUNTIME_KIND_REGEXP.test(value)) throw new Error(`Invalid runtime kind "${value}"`);
 }
 //#endregion
-//#region src/abort-utils.ts
-function throwIfAborted(signal, label) {
-	if (!signal?.aborted) return;
-	throw abortError(label, signal);
-}
-function abortError(label, signal) {
-	const reason = signal.reason;
-	const suffix = reason instanceof Error ? reason.message : reason === void 0 ? "aborted" : String(reason);
-	const err = /* @__PURE__ */ new Error(`${label} aborted: ${suffix}`);
-	err.name = "AbortError";
-	return err;
-}
-function cleanupLateResource(resourcePromise, opts) {
-	resourcePromise.then(async (resource) => {
-		try {
-			await opts.cleanup(resource);
-		} catch (err) {
-			opts.onCleanupError?.(err);
-		}
-	}, () => {});
-}
-async function abortableResource(opts) {
-	const { signal } = opts;
-	if (!signal) return opts.promise;
-	throwIfAborted(signal, opts.label);
-	const resourcePromise = Promise.resolve(opts.promise);
-	const abortPromise = new Promise((_, reject) => {
-		const abort = () => {
-			cleanupLateResource(resourcePromise, opts);
-			reject(abortError(opts.label, signal));
-		};
-		signal.addEventListener("abort", abort, { once: true });
-		resourcePromise.then(() => signal.removeEventListener("abort", abort), () => signal.removeEventListener("abort", abort));
-	});
-	return Promise.race([resourcePromise, abortPromise]);
-}
-async function delay(ms, signal, label) {
-	if (!signal) {
-		await new Promise((resolve) => {
-			setTimeout(resolve, ms);
-		});
-		return;
-	}
-	throwIfAborted(signal, label);
-	await new Promise((resolve, reject) => {
-		const listener = () => {
-			clearTimeout(timeout);
-			reject(abortError(label, signal));
-		};
-		const timeout = setTimeout(() => {
-			signal.removeEventListener("abort", listener);
-			resolve();
-		}, ms);
-		signal.addEventListener("abort", listener, { once: true });
-	});
-}
-//#endregion
-//#region src/vm-manager.ts
-/**
-* Memory-backed VFS mount used by the daemon to inject task context
-* (#943 slice 1.5). This is a separate top-level mount because Gondolin
-* mounts can't nest. The agent's Gondolin-bound Read tool accepts paths
-* under this prefix (see toGuestPath in tool-operations.ts).
-*
-* Why MemoryProvider rather than a path under the workspace mount:
-*   - Injected task context is ephemeral by intent: per-task-attempt input
-*     scoped to the VM lifetime. MemoryProvider models that exactly —
-*     in-memory, per-VM-instance, zero host artefacts, automatic
-*     cleanup on VM close.
-*   - Writing under the workspace mount fails in worktrees because we symlink
-*     `.moltnet/` to the main repo (so credentials are reachable from
-*     worktrees), and Gondolin's RealFSProvider correctly refuses to
-*     create paths whose ancestors' realpath escapes the mount root.
-*     That refusal is a deliberate sandbox-escape protection, not a
-*     bug. See diary semantic entry cd27d9d3-efdc-4aec-ac0d-5fd8ce258d1f
-*     and episodic 7affbfeb-18a2-4963-aeac-c177eb2afa2d for the full
-*     investigation and the alternatives we rejected.
-*/
-var GUEST_TASK_CONTEXT_MOUNT = "/moltnet-task-context";
-function resolveVfsShadowConfig(config) {
-	const patterns = config?.vfs?.shadow ?? [];
-	if (patterns.length === 0) return {
-		mode: "none",
-		patterns: []
-	};
-	return {
-		mode: config?.vfs?.shadowMode ?? "tmpfs",
-		patterns
-	};
-}
-function shouldRunResumeCommand(entry, ctx) {
-	if (typeof entry === "string") return true;
-	const workspaceModes = entry.when?.workspaceMode;
-	if (workspaceModes && !workspaceModes.includes(ctx.workspaceMode)) return false;
-	return true;
-}
-function shouldShadowNodeModulesPath(pathname) {
-	const normalized = path.posix.normalize(pathname);
-	return normalized === "/node_modules" || normalized.startsWith("/node_modules/") || normalized.endsWith("/node_modules") || normalized.includes("/node_modules/");
-}
-function isNodeModulesBinPath(pathname) {
-	const normalized = path.posix.normalize(pathname);
-	return normalized.includes("/node_modules/.bin/") || normalized.startsWith("/node_modules/.bin/");
-}
-var AutoParentMemoryProvider = class extends MemoryProvider {
-	ensureParentDir(pathname) {
-		const parent = path.posix.dirname(path.posix.normalize(pathname));
-		if (!parent || parent === "/" || parent === ".") return;
-		this.mkdirSync(parent, { recursive: true });
-	}
-	async mkdir(pathname, options) {
-		this.ensureParentDir(pathname);
-		return super.mkdir(pathname, options);
-	}
-	mkdirSync(pathname, options) {
-		this.ensureParentDir(pathname);
-		return super.mkdirSync(pathname, options);
-	}
-	async open(pathname, flags, mode) {
-		if (isWriteFlag(flags)) this.ensureParentDir(pathname);
-		return super.open(pathname, flags, isWriteFlag(flags) && isNodeModulesBinPath(pathname) ? (mode ?? 493) | 73 : mode);
-	}
-	openSync(pathname, flags, mode) {
-		if (isWriteFlag(flags)) this.ensureParentDir(pathname);
-		return super.openSync(pathname, flags, isWriteFlag(flags) && isNodeModulesBinPath(pathname) ? (mode ?? 493) | 73 : mode);
-	}
-};
-/**
-* Resolve the main worktree root (where .moltnet/ lives — it's untracked,
-* only exists in the main worktree, not in git worktrees).
-*/
-function findMainWorktree(startPath = process.cwd()) {
-	let output;
-	try {
-		output = execFileSync("git", [
-			"-C",
-			startPath,
-			"worktree",
-			"list",
-			"--porcelain"
-		], {
-			encoding: "utf8",
-			stdio: "pipe"
-		});
-	} catch (err) {
-		const message = err instanceof Error ? err.message : String(err);
-		throw new Error(`Git worktree discovery requires a git repository: ${message}`);
-	}
-	for (const block of output.split("\n\n")) {
-		const lines = block.split("\n");
-		const wt = lines.find((l) => l.startsWith("worktree "));
-		if (wt && !lines.some((l) => l === "bare")) return wt.replace("worktree ", "");
-	}
-	throw new Error("Could not find main git worktree");
-}
-function resolveVmAgentDir(config) {
-	const rootDir = config.agentRootDir ?? findMainWorktree();
-	return path.join(rootDir, ".moltnet", config.agentName);
-}
-function loadCredentials(agentDir, mode = "guest-config", onDiagnostic) {
-	const moltnetPath = path.join(agentDir, "moltnet.json");
-	const agentEnvPath = path.join(agentDir, "env");
-	const piAgentDir = resolvePiCodingAgentDir();
-	const piAuthPath = path.join(piAgentDir, "auth.json");
-	const piAuthJson = existsSync(piAuthPath) ? readFileSync(piAuthPath, "utf8") : null;
-	if (mode === "host-authenticated") return {
-		moltnetJson: "",
-		agentEnvRaw: "",
-		piAuthJson,
-		agentEnv: {},
-		gitconfig: null,
-		sshPrivateKey: null,
-		sshPublicKey: null,
-		allowedSigners: null,
-		githubAppPem: null,
-		githubAppPemFilename: null
-	};
-	const hasMoltnetJson = existsSync(moltnetPath);
-	const hasAgentEnv = existsSync(agentEnvPath);
-	if (!hasMoltnetJson || !hasAgentEnv) throw new Error(`Guest credential mode requires both ${moltnetPath} and ${agentEnvPath}`);
-	const moltnetJson = readFileSync(moltnetPath, "utf8");
-	const agentEnvRaw = readFileSync(agentEnvPath, "utf8");
-	if (moltnetJson.trim() === "") throw new Error(`Agent configuration is empty: ${moltnetPath}`);
-	const gitconfigPath = path.join(agentDir, "gitconfig");
-	const gitconfig = existsSync(gitconfigPath) ? readFileSync(gitconfigPath, "utf8") : null;
-	const sshDir = path.join(agentDir, "ssh");
-	const sshPrivateKey = existsSync(path.join(sshDir, "id_ed25519")) ? readFileSync(path.join(sshDir, "id_ed25519"), "utf8") : null;
-	const sshPublicKey = existsSync(path.join(sshDir, "id_ed25519.pub")) ? readFileSync(path.join(sshDir, "id_ed25519.pub"), "utf8") : null;
-	const allowedSigners = existsSync(path.join(sshDir, "allowed_signers")) ? readFileSync(path.join(sshDir, "allowed_signers"), "utf8") : null;
-	let githubAppPem = null;
-	let githubAppPemFilename = null;
-	const pemPath = (moltnetJson ? JSON.parse(moltnetJson) : null)?.github?.private_key_path;
-	if (pemPath) if (!existsSync(pemPath)) onDiagnostic?.({
-		event: "vm.credentials.github_key_missing",
-		level: "warning",
-		credentialMode: mode,
-		message: `github.private_key_path not found at ${pemPath}; moltnet github token will fail inside the guest`
-	});
-	else {
-		githubAppPem = readFileSync(pemPath, "utf8");
-		githubAppPemFilename = path.basename(pemPath);
-	}
-	return {
-		moltnetJson,
-		agentEnvRaw,
-		piAuthJson,
-		agentEnv: parseEnv(agentEnvRaw),
-		gitconfig,
-		sshPrivateKey,
-		sshPublicKey,
-		allowedSigners,
-		githubAppPem,
-		githubAppPemFilename
-	};
-}
-/**
-* Apply agent env vars to the host process, mirroring `moltnet start`.
-* Resolves relative paths (e.g. GIT_CONFIG_GLOBAL) against the repo root.
-*/
-function activateAgentEnv(agentEnv, repoRoot) {
-	for (const [k, v] of Object.entries(agentEnv)) {
-		if (v === void 0 || v === null || v === "") continue;
-		let resolved = v;
-		if (k === "GIT_CONFIG_GLOBAL" && !path.isAbsolute(v)) resolved = path.join(repoRoot, v);
-		process.env[k] = resolved;
-	}
-}
-var BASE_ALLOWED_HOSTS = [
-	"api.openai.com",
-	"*.openai.com",
-	"chat.openai.com",
-	"chatgpt.com",
-	"*.chatgpt.com",
-	"registry.npmjs.org",
-	"github.com",
-	"*.github.com",
-	"*.githubusercontent.com",
-	"proxy.golang.org",
-	"sum.golang.org",
-	"golang.org",
-	"storage.googleapis.com",
-	"*.googlesource.com"
-];
-var DEFAULT_MOLTNET_API_URL = "https://api.themolt.net";
-/**
-* Host environment names that may intentionally cross into a
-* host-authenticated guest. This local list is the authority boundary;
-* server-supplied runtime-profile `requiredEnv` cannot widen it.
-*/
-var HOST_AUTHENTICATED_GUEST_ENV_ALLOWLIST = new Set([
-	"ANTHROPIC_API_KEY",
-	"OPENAI_API_KEY",
-	"OPENAI_BASE_URL",
-	"AZURE_OPENAI_API_KEY",
-	"AZURE_OPENAI_ENDPOINT",
-	"AZURE_OPENAI_API_VERSION",
-	"GOOGLE_API_KEY",
-	"GEMINI_API_KEY",
-	"MISTRAL_API_KEY",
-	"GROQ_API_KEY",
-	"OPENROUTER_API_KEY",
-	"XAI_API_KEY",
-	"CEREBRAS_API_KEY",
-	"DEEPSEEK_API_KEY",
-	"OLLAMA_API_KEY",
-	"OLLAMA_BASE_URL",
-	"AWS_ACCESS_KEY_ID",
-	"AWS_SECRET_ACCESS_KEY",
-	"AWS_SESSION_TOKEN",
-	"AWS_REGION",
-	"AWS_DEFAULT_REGION",
-	"GITHUB_TOKEN",
-	"GH_TOKEN",
-	"LINEAR_API_KEY"
-]);
-var RESERVED_GUEST_ENVIRONMENT_NAMES = new Set([
-	"PATH",
-	"HOME",
-	"NODE_EXTRA_CA_CERTS",
-	"MOLTNET_GUEST_WORKSPACE",
-	"GIT_SSH",
-	"GIT_SSH_COMMAND",
-	"SSH_AUTH_SOCK"
-]);
-function isReservedGuestEnvironmentName(name) {
-	return name.startsWith("MOLTNET_") || name.startsWith("GIT_CONFIG_") || RESERVED_GUEST_ENVIRONMENT_NAMES.has(name);
-}
-var GuestEnvironmentBoundaryError = class extends Error {
-	constructor(refusedNames) {
-		super(`Guest credential boundary refuses runtime-controlled environment variables: ${refusedNames.join(", ")}. Remove them from the runtime profile; MoltNet operations use the trusted host-side Agent.`);
-		this.refusedNames = refusedNames;
-		this.name = "GuestEnvironmentBoundaryError";
-	}
-};
-function assertGuestEnvironmentBoundary(options) {
-	const refusedForwardEnv = (options.forwardEnv ?? []).filter((name) => isReservedGuestEnvironmentName(name) || options.guestCredentialMode === "host-authenticated" && !HOST_AUTHENTICATED_GUEST_ENV_ALLOWLIST.has(name));
-	const refusedSandboxEnv = Object.keys(options.sandboxEnv ?? {}).filter(isReservedGuestEnvironmentName);
-	const refused = [...new Set([...refusedForwardEnv, ...refusedSandboxEnv])].sort();
-	if (refused.length > 0) throw new GuestEnvironmentBoundaryError(refused);
-}
-/** @deprecated Prefer assertGuestEnvironmentBoundary for mode-aware checks. */
-function assertHostAuthenticatedGuestEnvironment(options) {
-	assertGuestEnvironmentBoundary({
-		guestCredentialMode: "host-authenticated",
-		...options
-	});
-}
-/**
-* Return whether two Gondolin hostname globs can match at least one common
-* string. Each `*` is an arbitrary substring, so this walks the product of the
-* two small glob automata instead of relying on exact-string comparisons.
-*/
-function hostnamePatternsOverlap(left, right) {
-	const a = left.trim().toLowerCase();
-	const b = right.trim().toLowerCase();
-	if (!a || !b) return false;
-	const pending = [[0, 0]];
-	const visited = /* @__PURE__ */ new Set();
-	while (pending.length > 0) {
-		const next = pending.pop();
-		if (!next) continue;
-		const [aIndex, bIndex] = next;
-		const state = `${aIndex}:${bIndex}`;
-		if (visited.has(state)) continue;
-		visited.add(state);
-		if (aIndex === a.length && bIndex === b.length) return true;
-		const aChar = a[aIndex];
-		const bChar = b[bIndex];
-		if (aChar === "*") pending.push([aIndex + 1, bIndex]);
-		if (bChar === "*") pending.push([aIndex, bIndex + 1]);
-		if (aChar !== void 0 && bChar !== void 0 && (aChar === "*" || bChar === "*" || aChar === bChar)) pending.push([aChar === "*" ? aIndex : aIndex + 1, bChar === "*" ? bIndex : bIndex + 1]);
-	}
-	return false;
-}
-function assertInternalHostsDoNotOverlapProtectedHosts(internalHosts, protectedHosts) {
-	for (const internalHost of internalHosts) {
-		const protectedHost = protectedHosts.find((candidate) => hostnamePatternsOverlap(internalHost, candidate));
-		if (protectedHost) throw new Error(`sandbox.network.allowedInternalHosts pattern "${internalHost}" overlaps external-only host pattern "${protectedHost}"`);
-	}
-}
-/**
-* Run a shell command in the guest and throw if it fails. Mirror of
-* `run()` in `snapshot.ts` for the resume-side hook chain — every
-* setup step is essential to a healthy session, so a silent non-zero
-* exit (e.g. a mount that fails into the FUSE write path, or a
-* consumer-provided resume command that fails to install pnpm) must
-* surface immediately rather than fall through to cryptic agent
-* errors later.
-*/
-async function vmRun(vm, label, command, signal) {
-	const wrapped = `set -eu\nset -o pipefail\n${command}`;
-	throwIfAborted(signal, `resume step "${label}"`);
-	const r = await vm.exec([
-		"sh",
-		"-c",
-		wrapped
-	], { signal });
-	if (r.exitCode !== 0) {
-		const tail = [r.stderr, r.stdout].filter(Boolean).join("\n").slice(-800);
-		throw new Error(`resume step "${label}" failed (exit ${r.exitCode}):\n${tail}`);
-	}
-}
-function nonErrorMessage(err) {
-	if (typeof err === "string") return err;
-	try {
-		return JSON.stringify(err) ?? "unknown error";
-	} catch {
-		return "unknown error";
-	}
-}
-/**
-* Resume a VM from a checkpoint, inject credentials, configure egress +
-* TLS. Returns the managed VM handle.
-*/
-async function resumeVm(config) {
-	throwIfAborted(config.signal, "VM resume");
-	const agentDir = resolveVmAgentDir(config);
-	const guestWorkspace = path.resolve(config.mountPath);
-	const guestCredentialMode = config.guestCredentialMode ?? "guest-config";
-	if (guestCredentialMode === "guest-config" && !existsSync(agentDir)) throw new Error(`Agent directory not found: ${agentDir}. Run: moltnet register --name ${config.agentName}`);
-	assertGuestEnvironmentBoundary({
-		guestCredentialMode,
-		forwardEnv: config.forwardEnv,
-		sandboxEnv: config.sandboxConfig?.env
-	});
-	config.onDiagnostic?.({
-		event: "vm.credentials.mode",
-		level: "info",
-		credentialMode: guestCredentialMode,
-		message: guestCredentialMode === "host-authenticated" ? "MoltNet agent files and non-allowlisted host environment variables are withheld from the guest" : "The complete MoltNet agent configuration is available to the guest"
-	});
-	const creds = loadCredentials(agentDir, guestCredentialMode, config.onDiagnostic);
-	const configuredApiUrl = creds.moltnetJson ? JSON.parse(creds.moltnetJson).endpoints.api : void 0;
-	const apiHost = new URL(configuredApiUrl ?? process.env.MOLTNET_API_URL ?? DEFAULT_MOLTNET_API_URL).hostname;
-	const runtimeAllowedHosts = config.sandboxConfig?.network?.allowedHosts ?? [];
-	const runtimeAllowedInternalHosts = config.sandboxConfig?.network?.allowedInternalHosts ?? [];
-	const protectedExternalHosts = [...new Set([
-		...BASE_ALLOWED_HOSTS,
-		apiHost,
-		...config.extraAllowedHosts ?? []
-	])];
-	assertInternalHostsDoNotOverlapProtectedHosts(runtimeAllowedInternalHosts, protectedExternalHosts);
-	const { httpHooks, env: secretEnv } = createHttpHooks({
-		allowedHosts: [...new Set([...protectedExternalHosts, ...runtimeAllowedHosts])],
-		allowedInternalHosts: runtimeAllowedInternalHosts
-	});
-	const vmAgentDir = `/home/agent/.moltnet/${config.agentName}`;
-	const vmAgentEnv = {};
-	for (const [k, v] of Object.entries(creds.agentEnv)) {
-		if (v === void 0 || v === "") continue;
-		if (k === "GIT_CONFIG_GLOBAL") vmAgentEnv[k] = `${vmAgentDir}/gitconfig`;
-		else if (k.endsWith("_PRIVATE_KEY_PATH")) vmAgentEnv[k] = `${vmAgentDir}/${path.basename(v)}`;
-		else vmAgentEnv[k] = v;
-	}
-	if (creds.moltnetJson) vmAgentEnv.MOLTNET_CREDENTIALS_PATH = `${vmAgentDir}/moltnet.json`;
-	const vfsConfig = resolveVfsShadowConfig(config.sandboxConfig);
-	let workspaceProvider = new RealFSProvider(config.mountPath);
-	workspaceProvider = new ShadowProvider(workspaceProvider, {
-		shouldShadow: ({ path: shadowPath }) => shouldShadowNodeModulesPath(shadowPath),
-		denySymlinkBypass: false,
-		tmpfs: new AutoParentMemoryProvider(),
-		writeMode: "tmpfs"
-	});
-	if (vfsConfig.mode !== "none") {
-		const predicate = createShadowPathPredicate(vfsConfig.patterns);
-		workspaceProvider = new ShadowProvider(workspaceProvider, {
-			shouldShadow: predicate,
-			writeMode: vfsConfig.mode
-		});
-	}
-	if (guestCredentialMode === "host-authenticated") workspaceProvider = new ShadowProvider(workspaceProvider, {
-		shouldShadow: ({ path: shadowPath }) => shadowPath.split("/").includes(".moltnet"),
-		denySymlinkBypass: true,
-		writeMode: "deny"
-	});
-	const forwardedEnv = {};
-	for (const name of config.forwardEnv ?? []) {
-		const value = process.env[name];
-		if (value === void 0 || value === "") continue;
-		forwardedEnv[name] = value;
-	}
-	const envOverrides = config.sandboxConfig?.env ?? {};
-	const vmEnv = {
-		...secretEnv,
-		...vmAgentEnv,
-		...forwardedEnv,
-		PATH: "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/lib/go/bin",
-		HOME: "/home/agent",
-		NODE_NO_WARNINGS: "1",
-		NODE_EXTRA_CA_CERTS: "/etc/ssl/certs/ca-certificates.crt",
-		...envOverrides,
-		MOLTNET_GUEST_WORKSPACE: guestWorkspace
-	};
-	const resources = config.sandboxConfig?.resources;
-	const workspaceMode = config.workspaceMode ?? "shared_mount";
-	const vm = await abortableResource({
-		promise: VmCheckpoint.load(config.checkpointPath).resume({
-			httpHooks,
-			env: vmEnv,
-			...resources?.memory && { memory: resources.memory },
-			...resources?.cpus && { cpus: resources.cpus },
-			vfs: { mounts: {
-				[guestWorkspace]: workspaceProvider,
-				[GUEST_TASK_CONTEXT_MOUNT]: new MemoryProvider()
-			} }
-		}),
-		signal: config.signal,
-		label: "VM resume",
-		cleanup: (resumedVm) => resumedVm.close(),
-		onCleanupError: (err) => {
-			const message = err instanceof Error ? err.message : String(err);
-			process.stderr.write(`[vm] aborted resume late vm.close() failed: ${message}\n`);
-		}
-	});
-	try {
-		await vmRun(vm, "TLS certificates", `
-    cp /etc/gondolin/mitm/ca.crt /usr/local/share/ca-certificates/gondolin-mitm.crt
-    update-ca-certificates 2>/dev/null
-    cat /etc/gondolin/mitm/ca.crt >> /etc/ssl/certs/ca-certificates.crt
-  `, config.signal);
-		await vmRun(vm, "DNS resolvers", `printf 'nameserver 8.8.8.8\\nnameserver 1.1.1.1\\n' > /etc/resolv.conf`, config.signal);
-		await vmRun(vm, "git safe.directory", `git config --system --add safe.directory '*'`, config.signal);
-		for (const [i, entry] of (config.sandboxConfig?.resumeCommands ?? []).entries()) {
-			if (!shouldRunResumeCommand(entry, { workspaceMode })) continue;
-			const { run, retries, backoffMs } = typeof entry === "string" ? {
-				run: entry,
-				retries: 0,
-				backoffMs: 2e3
-			} : {
-				run: entry.run,
-				retries: entry.retries ?? 0,
-				backoffMs: entry.retryBackoffMs ?? 2e3
-			};
-			const label = `resumeCommands[${i}]`;
-			let lastErr;
-			for (let attempt = 0; attempt <= retries; attempt++) try {
-				await vmRun(vm, label, run, config.signal);
-				lastErr = void 0;
-				break;
-			} catch (err) {
-				lastErr = err;
-				if (attempt === retries) break;
-				await delay((attempt + 1) * backoffMs, config.signal, label);
-			}
-			if (lastErr) throw lastErr instanceof Error ? lastErr : new Error(nonErrorMessage(lastErr));
-		}
-		const vmSshDir = `${vmAgentDir}/ssh`;
-		const hasAgentFiles = guestCredentialMode === "guest-config";
-		await vm.exec(hasAgentFiles ? `mkdir -p ${vmAgentDir}/ssh /home/agent/.pi/agent` : "mkdir -p /home/agent/.pi/agent", { signal: config.signal });
-		if (creds.piAuthJson !== null) await vm.fs.writeFile("/home/agent/.pi/agent/auth.json", creds.piAuthJson, {
-			mode: 384,
-			signal: config.signal
-		});
-		if (hasAgentFiles) {
-			const vmMoltnetJson = rewriteMoltnetJsonPaths(creds.moltnetJson, vmAgentDir, vmSshDir, creds.githubAppPemFilename);
-			await vm.fs.writeFile(`${vmAgentDir}/moltnet.json`, vmMoltnetJson, {
-				mode: 384,
-				signal: config.signal
-			});
-			await vm.fs.writeFile(`${vmAgentDir}/env`, creds.agentEnvRaw, {
-				mode: 384,
-				signal: config.signal
-			});
-			if (creds.gitconfig) {
-				const vmGitconfig = rewriteGitconfigPaths(creds.gitconfig, vmSshDir, vmAgentDir);
-				await vm.fs.writeFile(`${vmAgentDir}/gitconfig`, vmGitconfig, {
-					mode: 420,
-					signal: config.signal
-				});
-			}
-			if (creds.sshPrivateKey) await vm.fs.writeFile(`${vmSshDir}/id_ed25519`, creds.sshPrivateKey, {
-				mode: 384,
-				signal: config.signal
-			});
-			if (creds.sshPublicKey) await vm.fs.writeFile(`${vmSshDir}/id_ed25519.pub`, creds.sshPublicKey, {
-				mode: 420,
-				signal: config.signal
-			});
-			if (creds.allowedSigners) await vm.fs.writeFile(`${vmSshDir}/allowed_signers`, creds.allowedSigners, {
-				mode: 420,
-				signal: config.signal
-			});
-			if (creds.githubAppPem && creds.githubAppPemFilename) await vm.fs.writeFile(`${vmAgentDir}/${creds.githubAppPemFilename}`, creds.githubAppPem, {
-				mode: 384,
-				signal: config.signal
-			});
-		}
-		await vm.exec(hasAgentFiles ? "chown -R agent:agent /home/agent/.pi /home/agent/.moltnet" : "chown -R agent:agent /home/agent/.pi", { signal: config.signal });
-		return {
-			vm,
-			credentials: creds,
-			mountPath: config.mountPath,
-			guestWorkspace,
-			agentDir
-		};
-	} catch (err) {
-		try {
-			await vm.close();
-		} catch (closeErr) {
-			const m = closeErr instanceof Error ? closeErr.message : String(closeErr);
-			process.stderr.write(`[vm] post-throw vm.close() failed: ${m}\n`);
-		}
-		throw err;
-	}
-}
-/**
-* Rewrite host-absolute paths inside an agent gitconfig to VM-local
-* equivalents before injecting it into the guest.
-*
-* Two rewrites:
-*   - `signingKey = <host path>`  → `<vmSshDir>/id_ed25519`
-*   - `... credential-helper --credentials <host moltnet.json>`
-*                                 → `<vmAgentDir>/moltnet.json`
-*
-* The credential-helper line is generated host-side by `moltnet github setup`
-* with a host-absolute `--credentials` path; inside the guest that path is
-* invalid, so it must point at the VM-side moltnet.json. The `insteadOf`
-* rewrite rule and every other line are workspace-independent and pass through
-* unchanged. A gitconfig without a credential helper is rewritten only for
-* `signingKey`.
-*
-* This is the single source of truth for git push auth in the guest: the
-* injected gitconfig carries the tokenless mint-on-demand helper, so the VM
-* no longer hand-rolls a credential-helper script or runs an imperative
-* `git config --global ... insteadOf` against the guest $HOME.
-*/
-function rewriteGitconfigPaths(gitconfig, vmSshDir, vmAgentDir) {
-	return gitconfig.replace(/signingKey\s*=\s*.+/g, `signingKey = ${vmSshDir}/id_ed25519`).replace(/(moltnet github credential-helper --credentials )\S+/g, `$1${vmAgentDir}/moltnet.json`);
-}
-/**
-* Rewrite host-absolute paths inside moltnet.json to VM-local equivalents.
-*
-* Fields rewritten:
-*   ssh.private_key_path  → <vmSshDir>/<basename of original>
-*   ssh.public_key_path   → <vmSshDir>/<basename of original>
-*   git.config_path       → <vmAgentDir>/gitconfig
-*   github.private_key_path → <vmAgentDir>/<pemFilename>  (if present)
-*
-* All other fields are passed through unchanged.
-* Throws if moltnetJson is not valid JSON — callers must not inject a broken
-* moltnet.json into the guest.
-*/
-function rewriteMoltnetJsonPaths(moltnetJson, vmAgentDir, vmSshDir, githubAppPemFilename) {
-	const config = JSON.parse(moltnetJson);
-	if (config.ssh && typeof config.ssh === "object") {
-		const ssh = config.ssh;
-		const origPrivate = typeof ssh.private_key_path === "string" ? ssh.private_key_path : null;
-		const origPublic = typeof ssh.public_key_path === "string" ? ssh.public_key_path : null;
-		config.ssh = {
-			...ssh,
-			...origPrivate !== null && { private_key_path: `${vmSshDir}/${path.basename(origPrivate)}` },
-			...origPublic !== null && { public_key_path: `${vmSshDir}/${path.basename(origPublic)}` }
-		};
-	}
-	if (config.git && typeof config.git === "object") {
-		const git = { ...config.git };
-		git.config_path = `${vmAgentDir}/gitconfig`;
-		config.git = git;
-	}
-	if (githubAppPemFilename && config.github && typeof config.github === "object") {
-		const github = { ...config.github };
-		github.private_key_path = `${vmAgentDir}/${githubAppPemFilename}`;
-		config.github = github;
-	}
-	return JSON.stringify(config);
-}
-//#endregion
 //#region src/tool-operations.ts
 /**
 * Gondolin tool operations: redirect pi's built-in tool operations
@@ -5501,7 +3648,7 @@ function decideToolCall(input) {
 	return fenced(input.enforcement, "tool_not_permitted", `not permitted by tool policy: ${missing.join(", ")}`, `would block (watch): ${missing.join(", ")}`, missing, missingShellCommands);
 }
 function fingerprintArgv(argv) {
-	return `sha256:${createHash$1("sha256").update(JSON.stringify(argv.map((token) => token === null ? { dynamic: true } : token))).digest("hex").slice(0, 16)}`;
+	return `sha256:${createHash("sha256").update(JSON.stringify(argv.map((token) => token === null ? { dynamic: true } : token))).digest("hex").slice(0, 16)}`;
 }
 function toMatchedShellCommand(executable, argvPrefix) {
 	return {
@@ -5737,6 +3884,34 @@ function decisionContext(deps) {
 	};
 }
 //#endregion
+//#region src/vm.ts
+/** Guest path where Pi expects its auth blob. */
+var PI_GUEST_AUTH_PATH = "/home/agent/.pi/agent/auth.json";
+/**
+* Pi's provider authentication as a sandbox `ProviderAuthSource`. CI writes
+* `auth.json` under `PI_CODING_AGENT_DIR`; local runs fall back to the
+* canonical `~/.pi/agent` dir when the override is unset.
+*/
+function piProviderAuth() {
+	return {
+		guestPath: PI_GUEST_AUTH_PATH,
+		load: () => {
+			const authPath = path.join(resolvePiCodingAgentDir(), "auth.json");
+			return existsSync(authPath) ? readFileSync(authPath, "utf8") : null;
+		}
+	};
+}
+/**
+* Resume a Gondolin VM for a Pi session. Identical to the sandbox package's
+* `resumeVm`, with Pi's provider auth supplied unless the caller overrides it.
+*/
+function resumeVm(config) {
+	return resumeVm$1({
+		providerAuth: piProviderAuth(),
+		...config
+	});
+}
+//#endregion
 //#region src/runtime/capability-discovery.ts
 var GuestExecutableProbeError = class extends Error {
 	code;
@@ -6219,7 +4394,12 @@ function buildSandboxCapabilityInstructions(sandbox, policy) {
 	];
 	const externalHosts = [...sandbox.allowedHosts].sort();
 	const internalHosts = [...sandbox.allowedInternalHosts].sort();
-	lines.push(...externalHosts.length > 0 ? [`- Additional external egress hosts: ${externalHosts.map((host) => `\`${host}\``).join(", ")}.`] : [], ...internalHosts.length > 0 ? [`- Additional internal egress hosts: ${internalHosts.map((host) => `\`${host}\``).join(", ")}.`] : [], "- Runtime service endpoints required for task execution may be available", "  in addition to the operator-configured hosts above.");
+	const brokeredSecretEnvNames = [...sandbox.brokeredSecretEnvNames ?? []].sort();
+	lines.push(...externalHosts.length > 0 ? [`- Additional external egress hosts: ${externalHosts.map((host) => `\`${host}\``).join(", ")}.`] : [], ...internalHosts.length > 0 ? [`- Additional internal egress hosts: ${internalHosts.map((host) => `\`${host}\``).join(", ")}.`] : [], ...brokeredSecretEnvNames.length > 0 ? [
+		"- Host-brokered HTTP credentials are available only as opaque",
+		`  placeholders in: ${brokeredSecretEnvNames.map((name) => `\`${name}\``).join(", ")}. The host proxy may substitute them only for their`,
+		"  declared destination hosts. Do not print, persist, or move them."
+	] : [], "- Runtime service endpoints required for task execution may be available", "  in addition to the operator-configured hosts above.");
 	return lines.join("\n");
 }
 function shellExecutableIsAvailable(policy, sandbox, executable) {
@@ -6232,20 +4412,27 @@ function buildCredentialInstructions(policy, sandbox) {
 	const lines = [
 		"## Identity & credentials",
 		"",
-		"- Your credentials live at `/home/agent/.moltnet/<agent>/moltnet.json`",
-		"  with the gitconfig and SSH key alongside. Do not move, copy, or expose",
-		"  these files outside the VM."
+		"- Long-lived MoltNet identity and signing credentials remain on the",
+		"  trusted daemon host. Guest credential files, SSH signing keys, GitHub",
+		"  App private keys, and credential helpers are not supported guest",
+		"  capabilities. Do not inspect or use them even if transitional",
+		"  compatibility plumbing makes one visible.",
+		"- Use structured `moltnet_*` tools for authenticated MoltNet operations.",
+		"  Do not try to recover host configuration through shell commands."
 	];
 	const moltnetAvailable = shellExecutableIsAvailable(policy, sandbox, "moltnet");
 	const ghAvailable = shellExecutableIsAvailable(policy, sandbox, "gh");
 	const gitAvailable = shellExecutableIsAvailable(policy, sandbox, "git");
-	if (moltnetAvailable) lines.push("- When authorized by the effective shell policy, use the installed", "  `moltnet` binary on `PATH`; never invoke a cached or `npx` copy.");
+	if (moltnetAvailable) lines.push("- The installed `moltnet` binary has no guest identity credentials;", "  do not use it for authenticated operations.");
 	if (ghAvailable) {
-		lines.push("- This headless VM has no human GitHub token fallback. Every authorized", "  `gh` write must use an inline App token.");
-		if (moltnetAvailable) lines.push("", "  ```bash", "  CREDS=\"$(cd \"$(dirname \"$GIT_CONFIG_GLOBAL\")\" && pwd)/moltnet.json\"", "  GH_TOKEN=$(moltnet github token --credentials \"$CREDS\") gh <command>", "  ```");
-		else lines.push("- The effective policy does not authorize the `moltnet` token-minting", "  command, so do not attempt a GitHub write.");
+		const githubPlaceholder = (sandbox?.brokeredSecretEnvNames ?? []).find((name) => name === "GH_TOKEN" || name === "GITHUB_TOKEN");
+		lines.push(...githubPlaceholder ? [
+			`- GitHub CLI authentication uses the host-brokered \`${githubPlaceholder}\``,
+			"  placeholder. Use it normally for policy-authorized HTTPS",
+			"  requests; it is not a reusable or inspectable token."
+		] : ["- No brokered GitHub credential is active. Authenticated `gh`", "  operations are unavailable; do not mint or recover a host token."]);
 	}
-	if (gitAvailable) lines.push("- An authorized `git push` uses the injected credential helper and does", "  not need `GH_TOKEN`.");
+	if (gitAvailable) lines.push("- Local Git commands run inside the guest. No signing key or Git", "  credential helper is injected; signing and authenticated push", "  require an explicitly provided capability.");
 	return lines.join("\n");
 }
 /**
@@ -7183,7 +5370,7 @@ function gitRefExists(mainRepo, ref) {
 }
 function findMainWorktreeForDedicatedTask(startPath) {
 	try {
-		return findMainWorktree(startPath);
+		return findMainWorktree$1(startPath);
 	} catch (err) {
 		const message = err instanceof Error ? err.message : String(err);
 		throw new Error(`Dedicated worktree tasks require a git repository: ${message}`);
@@ -7322,6 +5509,20 @@ function createGondolinToolDefinitions(config) {
 		}
 	];
 }
+/** Resolve one attempt's host-only HTTP credentials before VM resume. */
+async function resolveAttemptBrokeredHttpSecrets(input) {
+	if (!input.runtimeDefinition) return void 0;
+	return materializePiBrokeredHttpSecrets({
+		runtime: input.runtimeDefinition,
+		context: {
+			agentName: input.agentName,
+			claimedTask: input.claimedTask,
+			cwdPath: input.cwdPath
+		},
+		signal: input.signal,
+		timeoutMs: input.timeoutMs
+	});
+}
 function createMoltNetAgentResolver(input) {
 	let resolved;
 	return () => {
@@ -7353,7 +5554,7 @@ function createPiTaskExecutor(opts) {
 				if (!cachedCheckpoint) if (opts.runtimeDefinition) {
 					cachedTemplate = await opts.runtimeDefinition.vm.resolve({ onProgress: opts.onSnapshotProgress });
 					cachedCheckpoint = cachedTemplate.checkpointPath;
-				} else cachedCheckpoint = await ensureSnapshot({
+				} else cachedCheckpoint = await ensureSnapshot$1({
 					config: opts.sandboxConfig?.snapshot,
 					onProgress: opts.onSnapshotProgress ?? ((m) => {
 						process.stderr.write(`[snapshot] ${m}\n`);
@@ -7477,10 +5678,10 @@ async function executePiTask(claimedTask, reporter, opts) {
 		reporterOpen = true;
 		let checkpointPath;
 		let resolvedVmTemplate = opts.resolvedVmTemplate;
-		let effectiveSandboxConfig;
+		let brokeredSecretEnvNames = [];
 		try {
 			if (!resolvedVmTemplate && opts.runtimeDefinition) resolvedVmTemplate = opts.resolveVmTemplate ? await opts.resolveVmTemplate() : await opts.runtimeDefinition.vm.resolve({ onProgress: opts.onSnapshotProgress });
-			checkpointPath = await traceRuntimePhase("moltnet.execution.snapshot.prepare", { "moltnet.snapshot.source": resolvedVmTemplate ? "resolved_template" : opts.checkpointPath ? "configured_checkpoint" : opts.resolveCheckpointPath ? "resolver" : "build_or_cache" }, async () => resolvedVmTemplate?.checkpointPath ?? opts.checkpointPath ?? (opts.resolveCheckpointPath ? await opts.resolveCheckpointPath() : await ensureSnapshot({
+			checkpointPath = await traceRuntimePhase("moltnet.execution.snapshot.prepare", { "moltnet.snapshot.source": resolvedVmTemplate ? "resolved_template" : opts.checkpointPath ? "configured_checkpoint" : opts.resolveCheckpointPath ? "resolver" : "build_or_cache" }, async () => resolvedVmTemplate?.checkpointPath ?? opts.checkpointPath ?? (opts.resolveCheckpointPath ? await opts.resolveCheckpointPath() : await ensureSnapshot$1({
 				config: opts.sandboxConfig?.snapshot,
 				onProgress: opts.onSnapshotProgress ?? ((m) => {
 					process.stderr.write(`[snapshot] ${m}\n`);
@@ -7505,13 +5706,33 @@ async function executePiTask(claimedTask, reporter, opts) {
 		}
 		if (!workspace) throw new Error("task workspace not prepared");
 		const preparedWorkspace = workspace;
+		const effectiveSandboxConfig = applyExecutionPlanSandboxOverrides(resolvedVmTemplate ? {
+			...opts.sandboxConfig,
+			snapshot: void 0,
+			resumeCommands: [...resolvedVmTemplate.resumeCommands]
+		} : opts.sandboxConfig, executionPlan);
+		let brokeredSecrets;
+		try {
+			const runtimeDefinition = opts.runtimeDefinition;
+			brokeredSecrets = runtimeDefinition ? await traceRuntimePhase("moltnet.execution.credentials.resolve", { "moltnet.credentials.requirement_count": runtimeDefinition.brokeredHttpSecrets?.length ?? 0 }, () => resolveAttemptBrokeredHttpSecrets({
+				runtimeDefinition,
+				agentName: opts.agentName,
+				claimedTask,
+				cwdPath,
+				signal: reporter.cancelSignal
+			})) : void 0;
+		} catch (err) {
+			const message = err instanceof Error ? err.message : String(err);
+			if (reporter.cancelSignal.aborted || err?.name === "AbortError") {
+				await emitError("credential_resolution", message, { cancelled: true });
+				return makeCancelledOutput(reporter.cancelReason ?? "Task cancelled during credential resolution.");
+			}
+			await emitError("credential_resolution", message);
+			return makeFailedOutput("credential_resolution_failed", message, finalUsage, err instanceof PiBrokeredHttpSecretResolutionError ? err.retryable : false);
+		}
 		try {
-			effectiveSandboxConfig = applyExecutionPlanSandboxOverrides(resolvedVmTemplate ? {
-				...opts.sandboxConfig,
-				snapshot: void 0,
-				resumeCommands: [...resolvedVmTemplate.resumeCommands]
-			} : opts.sandboxConfig, executionPlan);
-			managed = await traceRuntimePhase("moltnet.execution.vm.resume", { "moltnet.workspace.mode": preparedWorkspace.mode }, () => resumeVm({
+			brokeredSecretEnvNames = (brokeredSecrets ?? []).filter(({ value }) => value !== void 0 && value !== "").map(({ guestEnv }) => guestEnv).sort();
+			managed = await traceRuntimePhase("moltnet.execution.vm.resume", { "moltnet.workspace.mode": preparedWorkspace.mode }, () => (opts.resumeVm ?? resumeVm)({
 				checkpointPath,
 				agentName: opts.agentName,
 				agentRootDir,
@@ -7521,6 +5742,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 				extraAllowedHosts: opts.extraAllowedHosts,
 				sandboxConfig: effectiveSandboxConfig,
 				forwardEnv: opts.forwardEnv,
+				brokeredSecrets,
 				onDiagnostic: opts.onVmDiagnostic,
 				signal: reporter.cancelSignal
 			}));
@@ -7535,7 +5757,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 		}
 		const diaryId = task.diaryId ?? "";
 		const taskTeamId = task.teamId ?? "";
-		activateAgentEnv(managed.credentials.agentEnv, agentRootDir);
+		activateAgentEnv$1(managed.credentials.agentEnv, agentRootDir);
 		const activeWorkspace = preparedWorkspace;
 		const activeManaged = managed;
 		const getMoltNetAgent = createMoltNetAgentResolver({
@@ -7828,7 +6050,8 @@ async function executePiTask(claimedTask, reporter, opts) {
 					nodeModulesWriteMode: "tmpfs",
 					verifiedExecutables: verifiedGuestExecutables,
 					allowedHosts: [...effectiveSandboxConfig?.network?.allowedHosts ?? [], ...opts.extraAllowedHosts ?? []],
-					allowedInternalHosts: effectiveSandboxConfig?.network?.allowedInternalHosts ?? []
+					allowedInternalHosts: effectiveSandboxConfig?.network?.allowedInternalHosts ?? [],
+					brokeredSecretEnvNames
 				},
 				toolPolicy: capabilityProjection.instructorPolicy
 			});
@@ -8801,4 +7024,4 @@ function describeToolErrorMessage(result) {
 	}
 }
 //#endregion
-export { GONDOLIN_BASE_EXECUTABLES, GONDOLIN_TOOL_NAMES, GuestEnvironmentBoundaryError, HOST_EXEC_DEFAULT_BASE_ENV, MOLTNET_TOOL_NAMES, PI_EXECUTOR_MANIFEST_VERSION, PI_RUNTIME_DEFINITION_VERSION, activateAgentEnv, assertGuestEnvironmentBoundary, assertHostAuthenticatedGuestEnvironment, buildAgentSession, buildPiExecutorManifest, buildRuntimeKernel, buildWorkspaceMountInstructions, createGondolinBashOps, createGondolinEditOps, createGondolinFindOps, createGondolinLsOps, createGondolinReadOps, createGondolinToolDefinitions, createGondolinWriteOps, createMoltNetTools, createPiOtelExtension, createPiRetryTriage, createPiTaskExecutor, createSubagentTool, createToolPolicyExtension, decideForEvent, decideToolCall, defineGondolinTemplate, definePiExtension, definePiRuntime, definePiTool, enabledPiToolNames, ensureSnapshot, executeGondolinGrep, executePiTask, filterModelVisibleTools, findMainWorktree, injectRuntimeContext as injectTaskContext, isKernelTool, isResolvedPathInsideRoot, isToolVisible, loadCredentials, materializePiExtensions, materializePiTools, normalizeRetryTriageResult, redactRetryTriageSecrets, resolveHostExecBaseEnv, resolveSessionToolPolicy, resolveTaskWorktreePath, resumeVm, toGuestPath };
+export { BrokeredHttpSecretBoundaryError, DEFAULT_BROKERED_HTTP_SECRET_RESOLUTION_TIMEOUT_MS, GONDOLIN_BASE_EXECUTABLES, GONDOLIN_TOOL_NAMES, GuestEnvironmentBoundaryError, HOST_EXEC_DEFAULT_BASE_ENV, MOLTNET_TOOL_NAMES, PI_EXECUTOR_MANIFEST_VERSION, PI_GUEST_AUTH_PATH, PI_RUNTIME_DEFINITION_VERSION, PiBrokeredHttpSecretResolutionError, activateAgentEnv, assertGuestEnvironmentBoundary, assertHostAuthenticatedGuestEnvironment, buildAgentSession, buildPiExecutorManifest, buildRuntimeKernel, buildWorkspaceMountInstructions, createGondolinBashOps, createGondolinEditOps, createGondolinFindOps, createGondolinLsOps, createGondolinReadOps, createGondolinToolDefinitions, createGondolinWriteOps, createMoltNetTools, createPiOtelExtension, createPiRetryTriage, createPiTaskExecutor, createSubagentTool, createToolPolicyExtension, decideForEvent, decideToolCall, defineGondolinTemplate, definePiBrokeredHttpSecret, definePiExtension, definePiRuntime, definePiTool, enabledPiToolNames, ensureSnapshot, executeGondolinGrep, executePiTask, filterModelVisibleTools, findMainWorktree, injectRuntimeContext as injectTaskContext, isKernelTool, isResolvedPathInsideRoot, isToolVisible, loadCredentials, materializePiBrokeredHttpSecrets, materializePiExtensions, materializePiTools, normalizeRetryTriageResult, piProviderAuth, prepareBrokeredHttpSecrets, redactRetryTriageSecrets, resolveHostExecBaseEnv, resolveSessionToolPolicy, resolveTaskWorktreePath, resumeVm, toGuestPath };