@themoltnet/pi-runtime 0.3.0 → 0.5.0

package/dist/index.js

@@ -1,15 +1,15 @@
 import { createRequire } from "node:module";
 import { execFileSync } from "node:child_process";
 import { cpSync, createReadStream, createWriteStream, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, statSync } from "node:fs";
-import { readFile, realpath, stat } from "node:fs/promises";
+import { mkdir, readFile, realpath, stat } from "node:fs/promises";
 import path, { isAbsolute, join, relative, resolve, sep } from "node:path";
 import { pipeline } from "node:stream/promises";
-import { Type, getModel } from "@earendil-works/pi-ai";
-import { DEFAULT_MAX_BYTES, DefaultResourceLoader, SessionManager, createAgentSession, createBashToolDefinition, createEditToolDefinition, createFindToolDefinition, createGrepToolDefinition, createLsToolDefinition, createReadToolDefinition, createSyntheticSourceInfo, createWriteToolDefinition, defineTool, formatSize, parseFrontmatter, truncateHead, truncateLine } from "@earendil-works/pi-coding-agent";
+import { Type } from "@earendil-works/pi-ai";
+import { AuthStorage, DEFAULT_MAX_BYTES, DefaultResourceLoader, ModelRegistry, SessionManager, createAgentSession, createBashToolDefinition, createEditToolDefinition, createFindToolDefinition, createGrepToolDefinition, createLsToolDefinition, createReadToolDefinition, createSyntheticSourceInfo, createWriteToolDefinition, defineTool, formatSize, parseFrontmatter, truncateHead, truncateLine } from "@earendil-works/pi-coding-agent";
 import { SpanStatusCode, context, metrics, trace } from "@opentelemetry/api";
-import { homedir } from "node:os";
 import crypto, { createHash } from "crypto";
 import { createHash as createHash$1 } from "node:crypto";
+import { homedir } from "node:os";
 import { fileURLToPath } from "node:url";
 import { Readable } from "node:stream";
 import { MemoryProvider, RealFSProvider, ShadowProvider, VM, VmCheckpoint, createHttpHooks, createShadowPathPredicate, ensureImageSelector, isWriteFlag, loadGuestAssets } from "@earendil-works/gondolin";
@@ -43,6 +43,20 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __hasOwnProp.call(mod, "module.exports") ? mod["module.exports"] : __copyProps(__defProp$1({}, "__esModule", { value: true }), mod);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 //#endregion
+//#region src/path-containment.ts
+/**
+* Check containment for already-resolved lexical or real paths.
+*
+* Callers that accept untrusted paths must resolve/realpath at their I/O
+* boundary first; keeping the platform-specific relative-path rule here avoids
+* subtly different `..` and absolute-path handling across runtime cleanup,
+* session sync, and artifact staging.
+*/
+function isResolvedPathInsideRoot(path, root) {
+	const rel = relative(root, path);
+	return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+}
+//#endregion
 //#region src/moltnet/render-phase6.ts
 function slugToTitle(value) {
 	return value.split(/[:/_-]+/).filter(Boolean).map((part) => part[0]?.toUpperCase() + part.slice(1)).join(" ");
@@ -255,11 +269,32 @@ async function openWorkspaceArtifactInput(config, cwd, filePath) {
 }
 async function resolveWorkspaceOutputPath(cwd, filePath) {
 	const resolved = path.isAbsolute(filePath) ? path.resolve(filePath) : path.resolve(cwd, filePath);
-	const [realCwd, realParent] = await Promise.all([realpath(cwd), realpath(path.dirname(resolved))]);
-	const rel = path.relative(realCwd, realParent);
-	if (rel.startsWith("..") || path.isAbsolute(rel)) throw new Error(`task artifact output path escapes workspace: ${filePath}`);
+	const workspaceRoot = path.resolve(cwd);
+	const lexicalRel = path.relative(workspaceRoot, resolved);
+	if (lexicalRel === "" || lexicalRel.startsWith("..") || path.isAbsolute(lexicalRel)) throw new Error(`task artifact output path escapes workspace: ${filePath}`);
+	const realCwd = await realpath(cwd);
+	const parent = path.dirname(resolved);
+	assertPathInsideWorkspace(realCwd, await findExistingAncestor(parent), filePath);
+	await mkdir(parent, { recursive: true });
+	assertPathInsideWorkspace(realCwd, await realpath(parent), filePath);
 	return resolved;
 }
+async function findExistingAncestor(candidate) {
+	let current = candidate;
+	for (;;) {
+		try {
+			return await realpath(current);
+		} catch (err) {
+			if (!err || typeof err !== "object" || !("code" in err) || err.code !== "ENOENT") throw err;
+		}
+		const parent = path.dirname(current);
+		if (parent === current) throw new Error(`task artifact output has no existing ancestor: ${candidate}`);
+		current = parent;
+	}
+}
+function assertPathInsideWorkspace(realCwd, realPath, displayPath) {
+	if (!isResolvedPathInsideRoot(realPath, realCwd)) throw new Error(`task artifact output path escapes workspace: ${displayPath}`);
+}
 /**
 * Expand the `taskFilter` shorthand on the diary list/search tools into
 * the matching `task:*` provenance tags emitted by `moltnet_create_entry`
@@ -1258,6 +1293,7 @@ async function buildAgentSession(args) {
 		agentDir: args.piAuthDir,
 		cwd: args.cwdPath,
 		model: args.modelHandle,
+		...args.modelRegistry ? { modelRegistry: args.modelRegistry } : {},
 		thinkingLevel: args.thinkingLevel ?? void 0,
 		tools: args.tools,
 		customTools: args.customTools,
@@ -9377,6 +9413,11 @@ var RuntimeModel = _Object_({
 var RUNTIME_PROFILE_CONTEXT_CATALOGUE = {
 	version: 1,
 	fragments: {
+		"artifact-planner-v1": {
+			binding: "prompt_prefix",
+			content: "# Bounded artifact planner\n\n- The typed task facts, embedded bounded manifest, exact bound artifact references, registered tools, and runtime capability section are the complete contract. Do not search diaries, inspect a mounted repository, enumerate unrelated tasks or artifacts, use shell commands, modify files, commit, branch, push, or contact GitHub.\n- Read only the exact artifact CIDs named by the task, and only when the embedded manifest does not provide enough evidence. Never paginate or discover artifacts speculatively.\n- Perform semantic classification and planning from supplied content and producer/consumer evidence. Do not substitute filename, directory, language, ecosystem, or repository-specific exclusion rules for evidence.\n- Return exactly the requested versioned structured plan through the registered submit-output tool. Do not emit a second prose or JSON representation.",
+			slug: "artifact-planner-v1"
+		},
 		"accountable-delivery-v1": {
 			binding: "prompt_prefix",
 			content: "# Accountable delivery\n\n- Pair every commit made during this task with a signed diary entry created by the `moltnet_create_entry` custom tool. Put the returned id in a `MoltNet-Diary: <id>` commit trailer.\n- Keep commit signing enabled; do not bypass the agent git configuration.\n- Push a branch and open or update a pull request only when the task asks for it. For GitHub mutations, use the credential-bound `GH_TOKEN` command form required by the runtime kernel.\n- Keep changes, commits, and any requested pull request coherent enough to review independently.",
@@ -9409,6 +9450,10 @@ var RUNTIME_PROFILE_CONTEXT_CATALOGUE = {
 		}
 	},
 	recipes: {
+		"artifact-planner@v1": {
+			description: "Minimal artifact-only context for bounded semantic classification and planning.",
+			fragments: ["artifact-planner-v1"]
+		},
 		"run-eval-direct@v1": {
 			description: "Minimal direct context for a short, isolated evaluation run.",
 			fragments: ["run-eval-direct-v1"]
@@ -10046,7 +10091,11 @@ var ProblemDetailsSchema = _Object_({
 	}),
 	code: ProblemCodeSchema,
 	detail: Optional(String$1()),
-	instance: Optional(String$1())
+	instance: Optional(String$1()),
+	retryAfter: Optional(Integer({
+		minimum: 0,
+		description: "Non-negative delay in seconds before retrying, matching the Retry-After response header when present."
+	}))
 }, {
 	$id: "ProblemDetails",
 	additionalProperties: true
@@ -10892,7 +10941,7 @@ var VerificationResult = _Object_({
 var VerificationRecord = _Object_({
 	inputCid: String$1({ minLength: 1 }),
 	results: _Array_(VerificationResult),
-	passed: Boolean$1()
+	passed: Boolean$1({ description: "True iff every verification result has status \"pass\" or \"skip\"; false when any result has status \"fail\"." })
 }, {
 	$id: "VerificationRecord",
 	additionalProperties: false
@@ -14586,6 +14635,16 @@ function checkVerificationInputCid(value, runtime) {
 	}];
 	return [];
 }
+function checkVerificationPassedConsistency(value) {
+	const verification = value !== null && typeof value === "object" ? value.verification : void 0;
+	if (verification === void 0 || !Array.isArray(verification.results) || typeof verification.passed !== "boolean") return [];
+	const expectedPassed = verification.results.every((result) => result.status !== "fail");
+	if (verification.passed !== expectedPassed) return [{
+		field: "output/verification/passed",
+		message: "must be true iff no verification result has status \"fail\""
+	}];
+	return [];
+}
 function validateTaskResult(taskType, value, input, runtime, submission = false) {
 	const entry = getTaskTypeEntry(taskType);
 	if (!entry) return [{
@@ -14601,7 +14660,7 @@ function validateTaskResult(taskType, value, input, runtime, submission = false)
 			message: validationError
 		}];
 	}
-	return checkVerificationInputCid(value, runtime);
+	return [...checkVerificationInputCid(value, runtime), ...checkVerificationPassedConsistency(value)];
 }
 function validateTaskOutput(taskType, output, input, runtime) {
 	return validateTaskResult(taskType, output, input, runtime);
@@ -14991,6 +15050,10 @@ var TaskAttempt = _Object_({
 	taskId: Uuid,
 	attemptN: Number$1({ minimum: 1 }),
 	claimedByAgentId: Uuid,
+	leaseId: Union([Uuid, Null()]),
+	runtimeProfileId: Union([Uuid, Null()]),
+	runtimeProfileRevision: Union([Integer({ minimum: 1 }), Null()]),
+	policySnapshotHash: Union([String$1({ pattern: "^sha256:[0-9a-f]{64}$" }), Null()]),
 	runtimeId: Union([Uuid, Null()]),
 	claimedAt: IsoTimestamp,
 	startedAt: Union([IsoTimestamp, Null()]),
@@ -15147,69 +15210,6 @@ function assembleTaskPrompt(taskType, sections) {
 	};
 }
 //#endregion
-//#region ../agent-runtime/src/prompts/final-output.ts
-function buildFinalOutputBlock(opts) {
-	const { taskType, outputSchemaName, shapeSketch, extraNotes } = opts;
-	const submitTool = submitOutputToolName(taskType);
-	const lines = [
-		"## Final output (read this carefully)",
-		"",
-		`Your VERY LAST action in this conversation MUST report the structured`,
-		`output matching \`${outputSchemaName}\`.`,
-		"",
-		`Call \`${submitTool}\` exactly once with the payload.`,
-		`The runtime captures the validated arguments for attempt completion.`,
-		`Do NOT emit the output as plain assistant text. Do NOT rely on a`,
-		`JSON-in-message fallback. If you do not call \`${submitTool}\`, the`,
-		`attempt is recorded as failing the promised submit-output criterion`,
-		`even if the underlying work succeeded.`,
-		"",
-		`Your final assistant text before that tool call may explain your work,`,
-		`but the submit-tool call itself must be your VERY LAST action.`,
-		"",
-		`Task artifacts: when you produce large files, binary files, logs, reports,`,
-		`screenshots, traces, bundles, or datasets, save them in the task workspace`,
-		`and call \`moltnet_upload_task_artifact\` before the submit-output tool.`,
-		`Put the returned artifact CID in the structured output where the schema`,
-		`allows artifact metadata (for example \`artifacts[].cid\`). Do not paste`,
-		`large bytes into structured output.`,
-		"",
-		`Referenced inputs: if this task depends on prior task artifacts, call`,
-		`\`moltnet_list_task_artifacts\` for the referenced task and download the`,
-		`specific CID you need with \`moltnet_download_task_artifact\` before judging`,
-		`or continuing that work.`,
-		`For a bound input artifact, omit \`attemptN\` because it has no producing`,
-		`attempt. Pass \`attemptN\` only for an artifact from one exact task attempt.`,
-		"",
-		`Output shape:`,
-		"",
-		"```json",
-		shapeSketch,
-		"```"
-	];
-	if (extraNotes?.length) {
-		lines.push("");
-		for (const note of extraNotes) lines.push(note);
-	}
-	return lines.join("\n");
-}
-//#endregion
-//#region ../agent-runtime/src/prompts/proactive-memory.ts
-function buildProactiveMemoryWorkflowBlock() {
-	return [
-		"Before material work, apply the runtime instructor's proactive memory",
-		"rules instead of waiting for a human prompt. Start with constrained",
-		"diary context: inspect tags/list entries when task provenance or scope",
-		"tags are known, then use `moltnet_search_entries` with `taskFilter`,",
-		"`entryTypes`, and tags. Do not run broad unfiltered searches before",
-		"constrained searches miss.",
-		"",
-		"For incident capture, follow the runtime instructor exactly: search",
-		"for similar episodic/semantic entries first, reference close matches,",
-		"and create a recurrence entry only when the repeat is useful signal."
-	].join("\n");
-}
-//#endregion
 //#region ../agent-runtime/src/prompts/rubric-common.ts
 function renderRubricCriteriaList(rubric) {
 	return rubric.criteria.map((c, i) => `${i + 1}. **${c.id}** (weight ${c.weight}, scoring: \`${c.scoring}\`) — ${c.description}`).join("\n");
@@ -15289,9 +15289,7 @@ function buildAssessBriefUserPrompt(input, ctx) {
 	const scoring = [
 		"- `llm_score`: score 0..1 continuous. `rationale` REQUIRED (2–4 sentences).",
 		"- `boolean`: score exactly 0 or 1. `rationale` optional.",
-		"- `deterministic_signature_check`: run `moltnet entry verify` on every diary entry returned by step 3 above AND `git verify-commit` on every commit. Score 1 iff ALL signatures are valid; otherwise 0. Populate `evidence.commitsVerified`, `evidence.commitsTotal`, `evidence.signatureFailures`.",
-		"",
-		"Write a signed diary entry (tags: \"judgment\", \"assess_brief\") capturing the rationale before reporting structured output."
+		"- `deterministic_signature_check`: run `moltnet entry verify` on every diary entry returned by step 3 above AND `git verify-commit` on every commit. Score 1 iff ALL signatures are valid; otherwise 0. Populate `evidence.commitsVerified`, `evidence.commitsTotal`, `evidence.signatureFailures`."
 	].join("\n");
 	return assembleTaskPrompt("assess_brief", [
 		{
@@ -15311,12 +15309,6 @@ function buildAssessBriefUserPrompt(input, ctx) {
 			header: "Querying the producer's diary entries",
 			body: diaryQuery
 		},
-		{
-			id: "assess_brief.proactive_memory",
-			source: "discipline",
-			header: "Proactive memory use",
-			body: buildProactiveMemoryWorkflowBlock()
-		},
 		{
 			id: "assess_brief.workspace",
 			source: "workspace",
@@ -15339,88 +15331,10 @@ function buildAssessBriefUserPrompt(input, ctx) {
 			source: "rubric_judge",
 			header: "Scoring rules",
 			body: scoring
-		},
-		{
-			id: "assess_brief.final_output",
-			source: "final_output",
-			body: buildFinalOutputBlock({
-				taskType: "assess_brief",
-				outputSchemaName: "AssessBriefOutput",
-				shapeSketch: [
-					"{",
-					"  \"scores\": [",
-					"    { \"criterionId\": \"...\", \"score\": 0.0, \"rationale\": \"...\", \"evidence\": {} }",
-					"  ],",
-					"  \"composite\": <sum>,",
-					"  \"verdict\": \"<1-3 sentence overall>\",",
-					"  \"judgeModel\": \"<provider:model>\"",
-					"}"
-				].join("\n"),
-				extraNotes: ["`composite` = Σ(weight_i × score_i) recomputed. The runtime rejects a mismatch."]
-			})
 		}
 	]);
 }
 //#endregion
-//#region ../agent-runtime/src/prompts/self-verification.ts
-function buildSelfVerificationBlock(taskId, criteriaField = "successCriteria") {
-	return [
-		"## Self-verification",
-		"",
-		`If \`input.${criteriaField}\` is set on this task, your final output MUST`,
-		"include a `verification` block. Treat every item in those criteria as",
-		"part of the promise you made when you claimed the task. That includes",
-		"the built-in submit-output gate when present. Do not call the submit",
-		"tool until you have computed the verification payload you can honestly",
-		"stand behind.",
-		"",
-		`Call \`moltnet_get_task\` with task id \`${taskId}\` and read \`input.${criteriaField}\`.`,
-		"",
-		`- If \`input.${criteriaField}\` is **absent**, omit \`verification\` from your`,
-		"  final output entirely.",
-		`- If \`input.${criteriaField}\` is **present**, evaluate every applicable`,
-		"  item — `gates`, `assertions`, `rubric` criteria, `sideEffects` — against",
-		"  your produced work and emit one result per id. Be honest: a `fail` with",
-		"  a one-line reason is more useful than a false `pass`. Use `skip` (with a",
-		"  `detail`) when you genuinely could not determine a result. Compute",
-		"  `passed = results.every(r => r.status !== 'fail')`.",
-		"- `verification` MUST be a JSON object. Never send a string, markdown",
-		"  block, null, or an empty placeholder. The submit tool expects an object",
-		"  with `inputCid`, `results`, and `passed` fields.",
-		"",
-		"Verification shape:",
-		"",
-		"```json",
-		"{",
-		"  \"inputCid\": \"<the inputCid you saw on the task>\",",
-		"  \"results\": [",
-		"    { \"id\": \"<criterion id>\", \"kind\": \"assertion|gate|rubric|sideEffect\",",
-		"      \"status\": \"pass|fail|skip\", \"detail\": \"<optional one-liner>\" }",
-		"  ],",
-		"  \"passed\": <boolean>",
-		"}",
-		"```",
-		"",
-		"Minimal valid example:",
-		"",
-		"```json",
-		"{",
-		"  \"inputCid\": \"<task inputCid>\",",
-		"  \"results\": [",
-		"    {",
-		"      \"id\": \"<criterion id>\",",
-		"      \"kind\": \"rubric\",",
-		"      \"status\": \"pass\",",
-		"      \"detail\": \"one-line reason\"",
-		"    }",
-		"  ],",
-		"  \"passed\": true",
-		"}",
-		"```",
-		""
-	].join("\n");
-}
-//#endregion
 //#region ../agent-runtime/src/prompts/curate-pack.ts
 /**
 * Build the first user-message prompt for a `curate_pack` task.
@@ -15578,34 +15492,6 @@ function buildCuratePackUserPrompt(input, ctx) {
 			source: "static",
 			header: "Hard constraints",
 			body: hardConstraints
-		},
-		{
-			id: "curate_pack.verification",
-			source: "verification",
-			body: buildSelfVerificationBlock(ctx.taskId)
-		},
-		{
-			id: "curate_pack.final_output",
-			source: "final_output",
-			body: buildFinalOutputBlock({
-				taskType: "curate_pack",
-				outputSchemaName: "CuratePackOutput",
-				shapeSketch: [
-					"{",
-					"  \"packId\": \"<uuid>\",",
-					"  \"packCid\": \"<cid>\",",
-					"  \"entries\": [",
-					"    { \"entryId\": \"<uuid>\", \"rank\": 1, \"rationale\": \"<why>\" }",
-					"  ],",
-					"  \"recipeParams\": { \"recipe\": \"...\", \"prompt\": \"...\", ... },",
-					"  \"checkpoints\": [",
-					"    { \"phase\": \"recon\", \"candidateIds\": [...], \"droppedIds\": [...], \"notes\": \"...\" }",
-					"  ],",
-					"  \"summary\": \"<2-4 sentences: what you looked for, how you narrowed, what defines the final set>\",",
-					"  \"verification\": <required iff input.successCriteria; see Self-verification>",
-					"}"
-				].join("\n")
-			})
 		}
 	]);
 }
@@ -15642,16 +15528,13 @@ function buildFreeformUserPrompt(input, ctx) {
 	const expectedOutput = input.expectedOutput ?? "";
 	const constraints = input.constraints?.length ? input.constraints.map((constraint) => `- ${constraint}`).join("\n") : "";
 	const suggestedTaskType = input.suggestedTaskType ? [`The proposer suggested task type \`${input.suggestedTaskType}\`.`, "Use it as a hint, not as a contract."].join("\n") : "";
-	const workflow = [
-		"1. Clarify the real objective from the brief before acting.",
-		"2. Search MoltNet diary memory for prior decisions, incidents, and",
-		"   recurring traps relevant to the brief.",
-		"3. Gather enough context to avoid guessing.",
-		"4. Complete the requested work when it is safe and bounded.",
-		"5. If the request reveals a recurring task shape, include a",
-		"   `proposedTaskType` in the final output with a concise rationale.",
-		"6. If you changed code on a branch, include that branch in",
-		"   `branch` so future continuations can recover git context."
+	const outcomeHints = [
+		"Complete the brief using the supplied task facts, context, and effective",
+		"runtime capabilities.",
+		"If the request reveals a recurring task shape, populate the",
+		"`proposedTaskType` field exposed by the registered submit-output tool.",
+		"If you changed code on a branch, populate its `branch` field so a",
+		"continuation can recover that git context."
 	].join("\n");
 	const sections = [
 		{
@@ -15684,43 +15567,14 @@ function buildFreeformUserPrompt(input, ctx) {
 			body: suggestedTaskType
 		},
 		{
-			id: "freeform.workflow",
+			id: "freeform.outcome_hints",
 			source: "static",
-			header: "Workflow",
-			body: workflow
-		},
-		{
-			id: "freeform.proactive_memory",
-			source: "discipline",
-			header: "Proactive memory use",
-			body: buildProactiveMemoryWorkflowBlock()
-		},
-		{
-			id: "freeform.verification",
-			source: "verification",
-			body: buildSelfVerificationBlock(ctx.taskId)
-		},
-		{
-			id: "freeform.final_output",
-			source: "final_output",
-			body: buildFinalOutputBlock({
-				taskType: "freeform",
-				outputSchemaName: "FreeformOutput",
-				shapeSketch: [
-					"{",
-					"  \"summary\": \"<2-5 sentence result>\",",
-					"  \"branch\": \"<branch name when code changed; omit for prose-only work>\",",
-					"  \"artifacts\": [{ \"kind\": \"...\", \"title\": \"...\", \"description\": \"...\", \"body\": \"<inline content up to 64 KiB; preferred for textual output so it persists with the task>\", \"url\": \"...\", \"path\": \"<worktree-ephemeral; not persisted after completion>\" }],",
-					"  \"proposedTaskType\": { \"name\": \"...\", \"rationale\": \"...\", \"inputShape\": {}, \"outputShape\": {} },",
-					"  \"diaryEntryIds\": [\"...\"],",
-					"  \"verification\": <required iff input.successCriteria; see Self-verification>",
-					"}"
-				].join("\n")
-			})
+			header: "Outcome hints",
+			body: outcomeHints
 		}
 	];
 	const priorContextBody = buildPriorContextSection(ctx.priorContext);
-	if (priorContextBody) sections.splice(sections.findIndex((s) => s.id === "freeform.workflow") + 1, 0, {
+	if (priorContextBody) sections.push({
 		id: "freeform.prior_context",
 		source: "task_input",
 		body: priorContextBody
@@ -15737,22 +15591,18 @@ function buildFreeformUserPrompt(input, ctx) {
 * is told to inspect them itself.
 */
 function buildFulfillBriefUserPrompt(input, ctx) {
-	const { brief, seedFiles, scopeHint } = input;
+	const { brief, seedFiles } = input;
 	const header = [
 		"# Fulfill Brief Agent",
 		"",
 		"You are a software engineering agent working in a sandboxed environment.",
 		"Use the current working directory as the task workspace.",
-		"The MoltNet runtime instructor (above, in this system prompt) defines the",
-		"invariants for this task: identity, gh authentication, diary discipline,",
-		"and the accountable-commit shape. Follow it for every commit.",
 		"",
 		"## Task: Fulfill brief",
 		"",
 		`Task id: \`${ctx.taskId}\``
 	].join("\n");
 	const seedFilesBody = seedFiles?.length ? ["Start by reading these files to ground yourself:", ...seedFiles.map((f) => `- \`${f}\``)].join("\n") : "";
-	const branchSlug = ctx.correlationId ? `moltnet/${ctx.correlationId}/` : scopeHint ? `feat/${scopeHint}-` : "feat/";
 	const correlation = ctx.correlationId ? [
 		`This task carries correlationId \`${ctx.correlationId}\`. You MUST:`,
 		"",
@@ -15769,23 +15619,6 @@ function buildFulfillBriefUserPrompt(input, ctx) {
 		"for this task. Do not repurpose or switch the primary checkout.",
 		ctx.workspace.branch ? `The current branch is \`${ctx.workspace.branch}\`. Stay on this branch unless the runtime instructor explicitly tells you otherwise.` : "Stay on the branch that was pre-provisioned for this task."
 	].join("\n") : "";
-	const workflow = [
-		ctx.workspace?.mode === "dedicated_worktree" ? `1. Use the already-provisioned dedicated worktree branch${ctx.workspace.branch ? ` (\`${ctx.workspace.branch}\`)` : ""}; do not create or switch the primary checkout.` : `1. Create a feature branch (starting prefix suggestion: \`${branchSlug}<short-slug>\`).`,
-		"2. Search MoltNet diary memory for prior decisions, incidents, and",
-		"   recurring traps relevant to the brief before changing code.",
-		"3. Understand the problem — read relevant code; do not speculate.",
-		"4. Implement the change. Keep commits small and coherent.",
-		"5. Add tests if applicable.",
-		"6. For every commit, create a signed diary entry first via",
-		"   `moltnet_create_entry` and embed its id in the commit trailer",
-		"   `MoltNet-Diary: <id>` (per the runtime instructor).",
-		"7. Push the branch and open a PR — run `git push` and `gh pr create`",
-		"   IN the VM with your normal `bash` tool (use the",
-		"   `GH_TOKEN=$(moltnet github token …) gh …` form from the runtime",
-		"   instructor for writes; read-only `gh` commands may run bare). Do NOT",
-		"   use `moltnet_host_exec` for this; it needs human",
-		"   approval that is unavailable in a headless run."
-	].join("\n");
 	return assembleTaskPrompt("fulfill_brief", [
 		{
 			id: "fulfill_brief.header",
@@ -15815,41 +15648,6 @@ function buildFulfillBriefUserPrompt(input, ctx) {
 			source: "workspace",
 			header: "Workspace",
 			body: workspace
-		},
-		{
-			id: "fulfill_brief.workflow",
-			source: "static",
-			header: "Workflow",
-			body: workflow
-		},
-		{
-			id: "fulfill_brief.proactive_memory",
-			source: "discipline",
-			header: "Proactive memory use",
-			body: buildProactiveMemoryWorkflowBlock()
-		},
-		{
-			id: "fulfill_brief.verification",
-			source: "verification",
-			body: buildSelfVerificationBlock(ctx.taskId)
-		},
-		{
-			id: "fulfill_brief.final_output",
-			source: "final_output",
-			body: buildFinalOutputBlock({
-				taskType: "fulfill_brief",
-				outputSchemaName: "FulfillBriefOutput",
-				shapeSketch: [
-					"{",
-					"  \"branch\": \"<branch-name>\",",
-					"  \"commits\": [{ \"sha\": \"...\", \"message\": \"...\", \"diaryEntryId\": \"...\" }],",
-					"  \"pullRequestUrl\": \"<url-or-null>\",",
-					"  \"diaryEntryIds\": [\"...\"],",
-					"  \"summary\": \"<1-3 sentence recap>\",",
-					"  \"verification\": <required iff input.successCriteria; see Self-verification>",
-					"}"
-				].join("\n")
-			})
 		}
 	]);
 }
@@ -15926,26 +15724,6 @@ function buildJudgeEvalAttemptUserPrompt(input, ctx) {
 			source: "rubric_judge",
 			header: "Composite arithmetic",
 			body: composite
-		},
-		{
-			id: "judge_eval_attempt.final_output",
-			source: "final_output",
-			body: buildFinalOutputBlock({
-				taskType: "judge_eval_attempt",
-				outputSchemaName: "JudgeEvalAttemptOutput",
-				shapeSketch: [
-					"{",
-					`  "targetTaskId": "${input.targetTaskId}",`,
-					`  "targetAttemptN": ${input.targetAttemptN},`,
-					"  \"variantLabel\": \"<from producer input>\",",
-					"  \"scores\": [ { \"criterionId\": \"...\", \"score\": 0..1, \"rationale\": \"...\", \"assertions\": [...]?, \"evidence\": { \"text\": \"...\" } } ],",
-					"  \"composite\": <Σ(weight × score), 0..1>,",
-					"  \"verdict\": \"<1-3 sentences>\",",
-					"  \"judgeModel\": \"<id>\",  // optional",
-					"  \"traceparent\": \"<from claim>\"",
-					"}"
-				].join("\n")
-			})
 		}
 	]);
 }
@@ -16027,9 +15805,7 @@ function buildJudgePackUserPrompt(input, ctx) {
 		"- Do NOT call `moltnet_pack_create` or `moltnet_pack_render`.",
 		"- Do NOT fetch the curator's or renderer's task output directly — they",
 		"  may leak guidance that biases judgment.",
-		"- Keep the session focused on scoring; no speculative exploration.",
-		"",
-		`Write a signed diary entry (tags: \`judgment\`, \`judge_pack\`, \`rubric:${rubric.rubricId}\`) capturing the rationale before reporting structured output.`
+		"- Keep the session focused on scoring; no speculative exploration."
 	].join("\n");
 	return assembleTaskPrompt("judge_pack", [
 		{
@@ -16071,37 +15847,6 @@ function buildJudgePackUserPrompt(input, ctx) {
 			source: "static",
 			header: "Constraints",
 			body: constraints
-		},
-		{
-			id: "judge_pack.final_output",
-			source: "final_output",
-			body: buildFinalOutputBlock({
-				taskType: "judge_pack",
-				outputSchemaName: "JudgePackOutput",
-				shapeSketch: [
-					"{",
-					"  \"scores\": [",
-					"    { \"criterionId\": \"...\", \"score\": 0.0, \"rationale\": \"...\", \"evidence\": {} },",
-					"    {",
-					"      \"criterionId\": \"<llm_checklist criterion>\",",
-					"      \"score\": 0,                          // 1 iff every assertion passed",
-					"      \"assertions\": [",
-					"        { \"id\": \"claim-1\", \"text\": \"...\", \"passed\": false, \"evidence\": \"...\" }",
-					"      ]",
-					"    }",
-					"  ],",
-					"  \"composite\": <sum-of-weighted-scores>,",
-					"  \"verdict\": \"<1-3 sentence overall>\",",
-					"  \"judgeModel\": \"<provider:model>\",",
-					"  \"rendererBinaryCid\": \"<cid-string-only-if-available>\"",
-					"}"
-				].join("\n"),
-				extraNotes: [
-					"Omit `rendererBinaryCid` entirely when no binary CID is exposed by",
-					"`moltnet_rendered_pack_get`. Do NOT emit `null` — the field is",
-					"optional and absence is the correct representation when unavailable."
-				]
-			})
 		}
 	]);
 }
@@ -16144,20 +15889,6 @@ function buildPrReviewUserPrompt(input, ctx) {
 		"(for example publishing the judgment somewhere), perform that action as",
 		"part of the task before reporting structured output."
 	].join("\n");
-	const workflow = [
-		"1. Read the subject summary, resources, inspection hints, and any",
-		"   task-specific instructions before scoring.",
-		"2. Search MoltNet diary memory for prior decisions, incidents, and",
-		"   recurring review traps relevant to the subject.",
-		"3. Inspect the target artefact directly using the tools and resources the",
-		"   task makes available.",
-		"4. If you are in a dedicated disposable worktree and need the review target",
-		"   checked out locally, do that work inside this disposable workspace only.",
-		"5. Apply the rubric strictly. This task is about complexity and",
-		"   reviewability, not correctness or feature desirability.",
-		"6. Perform any required outward action before emitting the final",
-		"   structured output."
-	].join("\n");
 	const taskPromptSection = input.taskPrompt ?? "";
 	const preamble = renderRubricPreambleSection(rubric) ?? "";
 	const criteria = renderRubricCriteriaList(rubric);
@@ -16166,9 +15897,7 @@ function buildPrReviewUserPrompt(input, ctx) {
 		"- Score `1` when the subject clearly clears the criterion.",
 		"- Score `0` when it does not, or when the evidence is ambiguous.",
 		"- `rationale` is REQUIRED for every score. Keep it concrete and audit-friendly.",
-		"- Compute `composite = Σ(weight_i × score_i)` exactly; the runtime rejects mismatches.",
-		"",
-		"Write a signed diary entry (tags: `judgment`, `pr_review`) capturing the rationale before reporting structured output."
+		"- Compute `composite = Σ(weight_i × score_i)` exactly; the runtime rejects mismatches."
 	].join("\n");
 	return assembleTaskPrompt("pr_review", [
 		{
@@ -16206,18 +15935,6 @@ function buildPrReviewUserPrompt(input, ctx) {
 			header: "Execution contract",
 			body: executionContract
 		},
-		{
-			id: "pr_review.workflow",
-			source: "static",
-			header: "Review workflow",
-			body: workflow
-		},
-		{
-			id: "pr_review.proactive_memory",
-			source: "discipline",
-			header: "Proactive memory use",
-			body: buildProactiveMemoryWorkflowBlock()
-		},
 		{
 			id: "pr_review.task_prompt",
 			source: "task_input",
@@ -16240,24 +15957,6 @@ function buildPrReviewUserPrompt(input, ctx) {
 			source: "rubric_judge",
 			header: "Scoring rules",
 			body: scoring
-		},
-		{
-			id: "pr_review.final_output",
-			source: "final_output",
-			body: buildFinalOutputBlock({
-				taskType: "pr_review",
-				outputSchemaName: "PrReviewOutput",
-				shapeSketch: [
-					"{",
-					"  \"scores\": [",
-					"    { \"criterionId\": \"...\", \"score\": 0, \"rationale\": \"...\" }",
-					"  ],",
-					"  \"composite\": <sum-of-weighted-binary-scores>,",
-					"  \"verdict\": \"<1-3 sentence overall>\"",
-					"}"
-				].join("\n"),
-				extraNotes: ["`scores` MUST stay in the same order as the rubric criteria.", "`score` MUST be exactly `0` or `1` for every criterion."]
-			})
 		}
 	]);
 }
@@ -16350,30 +16049,6 @@ function buildRenderPackUserPrompt(input, ctx) {
 			source: "static",
 			header: "Fidelity Discipline",
 			body: fidelity
-		},
-		{
-			id: "render_pack.verification",
-			source: "verification",
-			body: buildSelfVerificationBlock(ctx.taskId)
-		},
-		{
-			id: "render_pack.final_output",
-			source: "final_output",
-			body: buildFinalOutputBlock({
-				taskType: "render_pack",
-				outputSchemaName: "RenderPackOutput",
-				shapeSketch: [
-					"{",
-					"  \"renderedPackId\": \"<uuid-or-null>\",",
-					"  \"renderedCid\": \"<cid>\",",
-					"  \"renderMethod\": \"<label>\",",
-					"  \"byteSize\": <int>,",
-					"  \"entriesRendered\": <int>,",
-					"  \"summary\": \"<1-3 sentence recap>\",",
-					"  \"verification\": <required iff input.successCriteria; see Self-verification>",
-					"}"
-				].join("\n")
-			})
 		}
 	]);
 }
@@ -16408,7 +16083,7 @@ function buildRenderPackUserPrompt(input, ctx) {
 *   field. Quoting the constraint back is not following the task.
 */
 function buildRunEvalUserPrompt(input, ctx) {
-	const { scenario, variantLabel, successCriteria } = input;
+	const { scenario, variantLabel } = input;
 	const effectiveRuntimeContext = ctx.effectiveRuntimeContext ?? input.context;
 	const hasContext = effectiveRuntimeContext.length > 0;
 	const hasInlineContext = effectiveRuntimeContext.some((entry) => entry.binding === "context_inline");
@@ -16429,27 +16104,6 @@ function buildRunEvalUserPrompt(input, ctx) {
 		"rules, those rules override your generic instincts."
 	].join("\n") : "";
 	const inputFiles = scenario.inputFiles?.length ? scenario.inputFiles.map((f) => `- \`${f}\``).join("\n") : "";
-	const verification = successCriteria ? buildSelfVerificationBlock(ctx.taskId) : "";
-	const finalOutput = buildFinalOutputBlock({
-		taskType: "run_eval",
-		outputSchemaName: "RunEvalOutput",
-		shapeSketch: [
-			"{",
-			"  \"response\": \"<your free-form answer>\",",
-			"  \"artifacts\": [{ \"path\": \"...\", \"cid\": \"...\" }],  // optional",
-			"  \"totalTokens\": <int>,",
-			"  \"durationMs\": <int>,",
-			"  \"traceparent\": \"<from claim>\",",
-			"  \"verification\": {",
-			"    \"inputCid\": \"<task inputCid>\",",
-			"    \"results\": [",
-			"      { \"id\": \"<criterion id>\", \"kind\": \"rubric\", \"status\": \"pass|fail|skip\", \"detail\": \"<optional one-liner>\" }",
-			"    ],",
-			"    \"passed\": <boolean>",
-			"  } // required iff input.successCriteria; must be an object, never a string",
-			"}"
-		].join("\n")
-	});
 	return assembleTaskPrompt("run_eval", [
 		{
 			id: "run_eval.header",
@@ -16473,16 +16127,6 @@ function buildRunEvalUserPrompt(input, ctx) {
 			source: "task_input",
 			header: "Input files",
 			body: inputFiles
-		},
-		{
-			id: "run_eval.verification",
-			source: "verification",
-			body: verification
-		},
-		{
-			id: "run_eval.final_output",
-			source: "final_output",
-			body: finalOutput
 		}
 	]);
 }
@@ -16497,14 +16141,17 @@ function submissionAcceptsVerification(taskType) {
 /**
 * Add only the dynamic contract facts that a producer cannot infer from its
 * task-specific prompt: the declared success criteria and the immutable input
-* CID its verification must cite. This is deliberately not a workflow block;
-* the submit tool owns the output shape and profiles own optional behavior.
+* provenance CID its verification must cite. The CID is not a task artifact,
+* so the prompt states that it cannot be downloaded. This is deliberately not
+* a workflow block; the submit tool owns the output shape and profiles own
+* optional behavior.
 */
 function appendTaskContractFacts(prompt, task) {
 	if (!hasSuccessCriteria(task.input) || !submissionAcceptsVerification(task.taskType)) return prompt;
 	const criteriaJson = JSON.stringify(task.input.successCriteria, null, 2);
 	const body = [
-		`Task input CID: \`${task.inputCid}\``,
+		"Task input verification CID (provenance only; this is not a task",
+		`artifact and cannot be downloaded): \`${task.inputCid}\``,
 		"",
 		"These typed criteria are task facts. Assess the completed work against",
 		"them before calling the submit-output tool. Its `verification` payload",
@@ -31076,6 +30723,12 @@ var ShellCommandAnalyzer = class ShellCommandAnalyzer {
 	}
 };
 //#endregion
+//#region src/config.ts
+/** Resolve Pi's host-side auth/config directory from process configuration. */
+function resolvePiCodingAgentDir() {
+	return process.env["PI_CODING_AGENT_DIR"] ?? path.join(homedir(), ".pi", "agent");
+}
+//#endregion
 //#region src/snapshot.ts
 /**
 * Snapshot builder with auto-build and caching.
@@ -31456,15 +31109,19 @@ function filterModelVisibleTools(tools, policy) {
 }
 function enabledPiToolNames(input) {
 	if (!input.policy || input.policy.enforcement !== "enforce") return void 0;
+	return modelVisiblePiToolNames(input);
+}
+/** Exact tool names the selected runtime and effective policy expose. */
+function modelVisiblePiToolNames(input) {
 	return [...new Set([...input.tools.map((tool) => tool.name), ...(input.extensions ?? []).flatMap((extension) => extension.declaredTools.filter((name) => isToolVisible(name, input.policy)))])].sort();
 }
 function isToolVisible(name, policy) {
 	if (!policy || policy.enforcement !== "enforce") return true;
-	if (name === "bash") return true;
+	if (name === "bash") return policy.allowedShellCommands === void 0 || policy.allowedShellCommands.length > 0;
 	return policy.allowedTools.has(name);
 }
 function isKernelTool(name) {
-	return name.startsWith("submit_");
+	return name.startsWith("submit_") || name === "subagent";
 }
 function wrapExtensionFactory(factory, contribution, policy) {
 	return (pi) => {
@@ -31482,7 +31139,7 @@ function wrapExtensionFactory(factory, contribution, policy) {
 	};
 }
 function claimToolName(names, name, owner) {
-	if (isKernelTool(name) || name === "subagent") throw new Error(`Pi tool name "${name}" is reserved by the runtime kernel`);
+	if (isKernelTool(name)) throw new Error(`Pi tool name "${name}" is reserved by the runtime kernel`);
 	const previous = names.get(name);
 	if (previous) throw new Error(`Pi tool name "${name}" is declared by ${previous} and ${owner}`);
 	names.set(name, owner);
@@ -31576,6 +31233,17 @@ async function delay(ms, signal, label) {
 *     investigation and the alternatives we rejected.
 */
 var GUEST_TASK_CONTEXT_MOUNT = "/moltnet-task-context";
+function resolveVfsShadowConfig(config) {
+	const patterns = config?.vfs?.shadow ?? [];
+	if (patterns.length === 0) return {
+		mode: "none",
+		patterns: []
+	};
+	return {
+		mode: config?.vfs?.shadowMode ?? "tmpfs",
+		patterns
+	};
+}
 function shouldRunResumeCommand(entry, ctx) {
 	if (typeof entry === "string") return true;
 	const workspaceModes = entry.when?.workspaceMode;
@@ -31648,7 +31316,7 @@ function resolveVmAgentDir(config) {
 function loadCredentials(agentDir) {
 	const moltnetJson = readFileSync(path.join(agentDir, "moltnet.json"), "utf8");
 	const agentEnvRaw = readFileSync(path.join(agentDir, "env"), "utf8");
-	const piAgentDir = process.env.PI_CODING_AGENT_DIR ?? path.join(process.env.HOME ?? "", ".pi", "agent");
+	const piAgentDir = resolvePiCodingAgentDir();
 	const piAuthPath = path.join(piAgentDir, "auth.json");
 	const piAuthJson = existsSync(piAuthPath) ? readFileSync(piAuthPath, "utf8") : null;
 	const gitconfigPath = path.join(agentDir, "gitconfig");
@@ -31803,7 +31471,7 @@ async function resumeVm(config) {
 		else vmAgentEnv[k] = v;
 	}
 	vmAgentEnv.MOLTNET_CREDENTIALS_PATH = `${vmAgentDir}/moltnet.json`;
-	const vfsConfig = config.sandboxConfig?.vfs;
+	const vfsConfig = resolveVfsShadowConfig(config.sandboxConfig);
 	let workspaceProvider = new RealFSProvider(config.mountPath);
 	workspaceProvider = new ShadowProvider(workspaceProvider, {
 		shouldShadow: ({ path: shadowPath }) => shouldShadowNodeModulesPath(shadowPath),
@@ -31811,11 +31479,11 @@ async function resumeVm(config) {
 		tmpfs: new AutoParentMemoryProvider(),
 		writeMode: "tmpfs"
 	});
-	if (vfsConfig?.shadow?.length) {
-		const predicate = createShadowPathPredicate(vfsConfig.shadow);
+	if (vfsConfig.mode !== "none") {
+		const predicate = createShadowPathPredicate(vfsConfig.patterns);
 		workspaceProvider = new ShadowProvider(workspaceProvider, {
 			shouldShadow: predicate,
-			writeMode: vfsConfig.shadowMode ?? "tmpfs"
+			writeMode: vfsConfig.mode
 		});
 	}
 	const forwardedEnv = {};
@@ -32275,7 +31943,7 @@ async function executeGondolinGrep(vm, localCwd, guestWorkspace, params, signal)
 	const onAbort = () => ac.abort();
 	signal?.addEventListener("abort", onAbort, { once: true });
 	try {
-		const proc = vm.exec(["/bin/rg", ...args], {
+		const proc = vm.exec(["rg", ...args], {
 			signal: ac.signal,
 			stdout: "pipe",
 			stderr: "pipe"
@@ -32428,6 +32096,7 @@ function createGondolinBashOps(vm, localCwd, guestWorkspace) {
 */
 function decideToolCall(input) {
 	if (input.enforcement === "off") return { allow: true };
+	if (input.toolName.startsWith("submit_") || input.toolName === "subagent") return { allow: true };
 	const resolved = resolveNames(input);
 	if (resolved.kind === "unresolvable") return fenced(input.enforcement, "shell command could not be statically authorized", "unresolvable shell command (watch)");
 	const arbitraryCode = [...new Set(resolved.tools.filter((tool) => tool.risk === "arbitrary-code").map((tool) => tool.name))];
@@ -32559,6 +32228,10 @@ async function resolveSessionToolPolicy(input) {
 	try {
 		const resolved = await withTimeout$1(input.agent.runtimeProfiles.allowedTools(input.profileId, { teamId: input.teamId }), timeoutMs);
 		const shellCommands = resolved.allowedShellCommands ?? [];
+		if (resolved.runtimeKind !== input.runtimeKind) throw new RuntimeKindMismatchError({
+			expectedRuntimeKind: input.runtimeKind,
+			receivedRuntimeKind: resolved.runtimeKind
+		});
 		return {
 			enforcement: resolved.enforcement,
 			allowedTools: new Set(resolved.allowedTools),
@@ -32592,6 +32265,12 @@ var ToolPolicyResolveTimeoutError = class extends Error {
 		this.name = "ToolPolicyResolveTimeoutError";
 	}
 };
+var RuntimeKindMismatchError = class extends Error {
+	constructor(input) {
+		super(`runtime kind mismatch: expected ${input.expectedRuntimeKind}, received ${input.receivedRuntimeKind}`);
+		this.name = "RuntimeKindMismatchError";
+	}
+};
 /**
 * Reject with {@link ToolPolicyResolveTimeoutError} if `promise` does not settle
 * within `timeoutMs`. A non-positive `timeoutMs` disables the deadline. The
@@ -32669,6 +32348,105 @@ function createToolPolicyExtension(deps) {
 	};
 }
 //#endregion
+//#region src/runtime/capability-discovery.ts
+var GuestExecutableProbeError = class extends Error {
+	code;
+	constructor(code, message, options) {
+		super(message, options);
+		this.name = "GuestExecutableProbeError";
+		this.code = code;
+	}
+};
+var DEFAULT_PROBE_TIMEOUT_MS = 5e3;
+var MAX_STDERR_DETAIL_LENGTH = 1e3;
+/**
+* Verify only executables relevant to the resolved session policy.
+* Candidate names are positional arguments, never interpolated shell source.
+*/
+async function discoverGuestExecutables(vm, candidates, options = {}) {
+	const unique = [...new Set(candidates)].sort();
+	if (unique.length === 0) return {
+		available: [],
+		unavailable: []
+	};
+	const timeoutMs = options.timeoutMs ?? DEFAULT_PROBE_TIMEOUT_MS;
+	const controller = new AbortController();
+	let timedOut = false;
+	const timeout = setTimeout(() => {
+		timedOut = true;
+		controller.abort();
+	}, timeoutMs);
+	const abortFromCaller = () => controller.abort(options.signal?.reason);
+	options.signal?.addEventListener("abort", abortFromCaller, { once: true });
+	if (options.signal?.aborted) abortFromCaller();
+	let result;
+	try {
+		result = await vm.exec([
+			"/bin/sh",
+			"-lc",
+			[
+				"index=0",
+				"for executable in \"$@\"; do",
+				"  if command -v \"$executable\" >/dev/null 2>&1; then",
+				"    printf \"%s\\n\" \"$index\"",
+				"  fi",
+				"  index=$((index + 1))",
+				"done"
+			].join("\n"),
+			"moltnet-capability-probe",
+			...unique
+		], { signal: controller.signal });
+	} catch (error) {
+		if (options.signal?.aborted) throw error;
+		if (timedOut) throw new GuestExecutableProbeError("capability_probe_timeout", `Guest executable capability probe timed out after ${timeoutMs}ms`, { cause: error });
+		throw error;
+	} finally {
+		clearTimeout(timeout);
+		options.signal?.removeEventListener("abort", abortFromCaller);
+	}
+	if (result.exitCode !== 0) {
+		const stderr = result.stderr.trim().slice(-MAX_STDERR_DETAIL_LENGTH);
+		throw new GuestExecutableProbeError("capability_probe_failed", `Guest executable capability probe failed (exit ${result.exitCode})${stderr ? `: ${stderr}` : ""}`);
+	}
+	const availableIndexes = new Set(result.stdout.split("\n").filter(Boolean).map((value) => Number.parseInt(value, 10)).filter((value) => Number.isSafeInteger(value) && value >= 0));
+	return {
+		available: unique.filter((_, index) => availableIndexes.has(index)),
+		unavailable: unique.filter((_, index) => !availableIndexes.has(index))
+	};
+}
+//#endregion
+//#region src/runtime/model-selection.ts
+var RuntimeProfileModelResolutionError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "RuntimeProfileModelResolutionError";
+	}
+};
+/**
+* Resolve the exact runtime-profile model through Pi's custom-model registry.
+*
+* `getModel()` from pi-ai only knows generated built-in models. Runtime
+* profiles commonly select providers declared in the active Pi directory's
+* models.json, so an unresolved lookup must fail closed rather than letting
+* createAgentSession silently choose the default from settings.json.
+*/
+function resolveRuntimeProfileModel(piAuthDir, provider, modelId, runtimeProfileId) {
+	const authStorage = AuthStorage.create(join(piAuthDir, "auth.json"));
+	const modelsPath = join(piAuthDir, "models.json");
+	const modelRegistry = ModelRegistry.create(authStorage, modelsPath);
+	const modelHandle = modelRegistry.find(provider, modelId);
+	if (!modelHandle) {
+		const registryError = modelRegistry.getError();
+		const detail = registryError ? ` Registry error: ${registryError}` : "";
+		const alternatives = modelRegistry.getAvailable().slice(0, 8).map((model) => `${model.provider}/${model.id}`);
+		throw new RuntimeProfileModelResolutionError(`${runtimeProfileId ? `Runtime profile "${runtimeProfileId}"` : "Runtime profile"} model "${provider}/${modelId}" was not found in ${modelsPath}; refusing Pi default-model fallback.` + (alternatives.length > 0 ? ` Available models include: ${alternatives.join(", ")}.` : "") + detail);
+	}
+	return {
+		modelHandle,
+		modelRegistry
+	};
+}
+//#endregion
 //#region src/runtime/resolve-prior-context.ts
 /**
 * Fetch the named attempt's output and project it into the prompt's
@@ -32855,6 +32633,40 @@ async function withTimeout(promise, timeoutMs, onTimeout) {
 	}
 }
 //#endregion
+//#region src/runtime/runtime-capability-projection.ts
+/**
+* Project trusted policy resolution and runtime inventory into the exact
+* model-visible policy plus host-side degradation diagnostics.
+*/
+function projectRuntimeCapabilities(input) {
+	const visibleOptionalTools = input.visibleToolNames.filter((name) => !name.startsWith("submit_"));
+	if (!input.policy) return {
+		instructorPolicy: {
+			enforcement: "off",
+			allowedTools: visibleOptionalTools,
+			allowedShellCommands: [],
+			degraded: false
+		},
+		unavailableTools: [],
+		unavailableExecutables: [],
+		droppedShellCommandCount: 0
+	};
+	const visible = new Set(input.visibleToolNames);
+	const unavailableTools = [...input.policy.allowedTools].filter((name) => !visible.has(name)).sort();
+	const unavailableShellCommands = input.unavailableShellCommands ?? [];
+	return {
+		instructorPolicy: {
+			enforcement: input.policy.enforcement,
+			allowedTools: visibleOptionalTools,
+			allowedShellCommands: input.policy.allowedShellCommands,
+			degraded: input.policy.degraded
+		},
+		unavailableTools,
+		unavailableExecutables: [...new Set(unavailableShellCommands.map(({ argvPrefix }) => argvPrefix[0]))].sort(),
+		droppedShellCommandCount: unavailableShellCommands.length
+	};
+}
+//#endregion
 //#region src/runtime/runtime-context.ts
 /**
 * Pi-specific runtime context handling.
@@ -32979,6 +32791,73 @@ function buildWorkspaceMountInstructions(guestWorkspace) {
 		"  non-existent checkout."
 	].join("\n");
 }
+function buildToolPolicyInstructions(policy) {
+	const lines = [
+		"## Effective runtime tool policy",
+		"",
+		"- The registered submit-output tool is always the completion protocol."
+	];
+	if (!policy || policy.enforcement === "off") {
+		lines.push("- Enforcement is off: runtime policy does not restrict visible tools or", "  shell commands. The live sandbox still determines what is installed.");
+		return lines.join("\n");
+	}
+	lines.push(`- Enforcement mode: \`${policy.enforcement}\`.`);
+	if (policy.degraded) lines.push("- Policy resolution degraded. Enforce mode is fail-closed; only the", "  kernel submit-output tool is available.");
+	lines.push(policy.allowedTools.length > 0 ? "- The visible structured-tool definitions are the authorized surface." : policy.enforcement === "enforce" ? "- No optional structured tools are authorized." : "- No optional structured tools are registered.");
+	if (policy.enforcement === "watch") lines.push("- Watch mode records policy decisions but does not block tool calls.");
+	else if (policy.allowedShellCommands.length === 0) lines.push("- No shell commands are authorized. `bash` is not available; do not", "  attempt shell, filesystem, git, GitHub CLI, or MoltNet CLI commands.");
+	else lines.push("- Shell commands are restricted to these authorized argv prefixes:", ...renderShellCommandPrefixes(policy.allowedShellCommands), "- A visible `bash` tool does not grant broader shell authority. Do not", "  attempt commands outside those prefixes.");
+	lines.push("- Tools and commands absent from this effective policy are unavailable,", "  even if advisory context mentions them.");
+	return lines.join("\n");
+}
+function renderShellCommandPrefixes(commands) {
+	const visible = commands.slice(0, 12).map(({ argvPrefix }) => `  - \`${argvPrefix.join(" ")}\``);
+	const omitted = commands.length - visible.length;
+	if (omitted > 0) visible.push(`  - …and ${omitted} more authorized prefixes.`);
+	return visible;
+}
+function buildSandboxCapabilityInstructions(sandbox, policy) {
+	if (!sandbox) return "";
+	const executableLines = !policy || policy.enforcement === "off" ? ["- Executables are discovered through the visible shell when needed."] : [sandbox.verifiedExecutables.length > 0 ? `- Session-verified policy executables: ${sandbox.verifiedExecutables.map((name) => `\`${name}\``).join(", ")}.` : "- No policy-relevant guest executables were verified for this session.", ...policy.enforcement === "watch" ? ["- Watch-mode probes are diagnostic, not an executable", "  allowlist; other installed commands remain policy-permitted."] : []];
+	const lines = [
+		"## Effective sandbox capabilities",
+		"",
+		`- Workspace mode: \`${sandbox.workspaceMode}\`.`,
+		`- VFS shadow mode: \`${sandbox.vfsShadowMode}\`${sandbox.vfsShadowPatterns.length > 0 ? ` for ${sandbox.vfsShadowPatterns.map((pattern) => `\`${pattern}\``).join(", ")}` : ""}.`,
+		...sandbox.nodeModulesWriteMode ? ["- `node_modules` writes use session-local tmpfs and do not persist", "  to the mounted workspace."] : [],
+		...executableLines
+	];
+	const externalHosts = [...sandbox.allowedHosts].sort();
+	const internalHosts = [...sandbox.allowedInternalHosts].sort();
+	lines.push(...externalHosts.length > 0 ? [`- Additional external egress hosts: ${externalHosts.map((host) => `\`${host}\``).join(", ")}.`] : [], ...internalHosts.length > 0 ? [`- Additional internal egress hosts: ${internalHosts.map((host) => `\`${host}\``).join(", ")}.`] : [], "- Runtime service endpoints required for task execution may be available", "  in addition to the operator-configured hosts above.");
+	return lines.join("\n");
+}
+function shellExecutableIsAvailable(policy, sandbox, executable) {
+	if (!policy || policy.enforcement === "off") return true;
+	if (sandbox && !sandbox.verifiedExecutables.includes(executable)) return false;
+	if (policy.enforcement !== "enforce") return true;
+	return policy.allowedShellCommands.some(({ argvPrefix }) => argvPrefix[0] === executable);
+}
+function buildCredentialInstructions(policy, sandbox) {
+	const lines = [
+		"## Identity & credentials",
+		"",
+		"- Your credentials live at `/home/agent/.moltnet/<agent>/moltnet.json`",
+		"  with the gitconfig and SSH key alongside. Do not move, copy, or expose",
+		"  these files outside the VM."
+	];
+	const moltnetAvailable = shellExecutableIsAvailable(policy, sandbox, "moltnet");
+	const ghAvailable = shellExecutableIsAvailable(policy, sandbox, "gh");
+	const gitAvailable = shellExecutableIsAvailable(policy, sandbox, "git");
+	if (moltnetAvailable) lines.push("- When authorized by the effective shell policy, use the installed", "  `moltnet` binary on `PATH`; never invoke a cached or `npx` copy.");
+	if (ghAvailable) {
+		lines.push("- This headless VM has no human GitHub token fallback. Every authorized", "  `gh` write must use an inline App token.");
+		if (moltnetAvailable) lines.push("", "  ```bash", "  CREDS=\"$(cd \"$(dirname \"$GIT_CONFIG_GLOBAL\")\" && pwd)/moltnet.json\"", "  GH_TOKEN=$(moltnet github token --credentials \"$CREDS\") gh <command>", "  ```");
+		else lines.push("- The effective policy does not authorize the `moltnet` token-minting", "  command, so do not attempt a GitHub write.");
+	}
+	if (gitAvailable) lines.push("- An authorized `git push` uses the injected credential helper and does", "  not need `GH_TOKEN`.");
+	return lines.join("\n");
+}
 /**
 * Build the minimal immutable system-prompt kernel. Runtime-profile context
 * carries operator-selected workflow guidance; this kernel stays last in the
@@ -33001,31 +32880,7 @@ function buildRuntimeKernel(ctx) {
 		`- Diary id (for this task): \`${ctx.diaryId}\``,
 		`- Agent name: \`${ctx.agentName}\``,
 		"",
-		"## Identity & credentials",
-		"",
-		"- Your credentials live at `/home/agent/.moltnet/<agent>/moltnet.json`",
-		"  with the gitconfig and SSH key alongside. Do not move, copy, or expose",
-		"  these files outside the VM.",
-		"- The `moltnet` CLI is installed in the VM and is the only supported way",
-		"  to mint short-lived tokens. Do not invoke `npx @themoltnet/cli` or any",
-		"  cached path — use the `moltnet` binary on `PATH`.",
-		"- Interactive sessions use the canonical `moltnet github guard` policy,",
-		"  documented in `docs/reference/agent-configuration.md`. This headless VM",
-		"  has no editor hook and no human GitHub token to fall back to: read-only",
-		"  `gh` commands may run bare, but every write must use the App token:",
-		"",
-		"  ```bash",
-		"  CREDS=\"$(cd \"$(dirname \"$GIT_CONFIG_GLOBAL\")\" && pwd)/moltnet.json\"",
-		"  GH_TOKEN=$(moltnet github token --credentials \"$CREDS\") gh <command>",
-		"  ```",
-		"",
-		"- `git push` uses the gitconfig-configured credential helper and is not",
-		"  a `gh` call — it does not need `GH_TOKEN`.",
-		"- Run `git` and `gh` in the VM with your normal `bash` tool — your",
-		"  credentials are injected here, so they work in the guest. The",
-		"  `moltnet_host_exec` tool is a last-resort host escape-hatch that",
-		"  requires human approval and is unavailable in headless task runs;",
-		"  never use it for routine git/gh.",
+		buildCredentialInstructions(ctx.toolPolicy, ctx.sandbox),
 		"",
 		"## Skill packs",
 		"",
@@ -33038,6 +32893,10 @@ function buildRuntimeKernel(ctx) {
 		"",
 		buildWorkspaceMountInstructions(ctx.guestWorkspace),
 		"",
+		buildSandboxCapabilityInstructions(ctx.sandbox, ctx.toolPolicy),
+		...ctx.sandbox ? [""] : [],
+		buildToolPolicyInstructions(ctx.toolPolicy),
+		"",
 		"## Structured completion",
 		"- The registered submit-output tool is the only completion wire protocol. Submit its typed payload when work is complete; prose is not a substitute."
 	].join("\n");
@@ -33149,6 +33008,7 @@ function createSubagentTool(args) {
 					cwdPath: args.cwdPath ?? args.mountPath,
 					piAuthDir: args.piAuthDir,
 					modelHandle: args.modelHandle,
+					modelRegistry: args.modelRegistry,
 					thinkingLevel: args.thinkingLevel,
 					temperature: args.temperature,
 					topP: args.topP,
@@ -33276,6 +33136,39 @@ function toolError(text, details = { captured: false }) {
 	};
 }
 //#endregion
+//#region src/runtime/submit-completion-coordinator.ts
+/**
+* Delay the post-submit session abort until every tool call in Pi's current
+* parallel batch has emitted `tool_execution_end`. A valid submit call can
+* finish before a sibling write or artifact upload; aborting immediately would
+* cancel that sibling after the runtime had already accepted the output.
+*/
+function createSubmitCompletionCoordinator(options) {
+	const activeToolCalls = /* @__PURE__ */ new Set();
+	let completionRequested = false;
+	let completionStarted = false;
+	const drain = () => {
+		if (!completionRequested || completionStarted || activeToolCalls.size > 0) return;
+		completionStarted = true;
+		Promise.resolve(options.onDrained()).catch(options.onError);
+	};
+	return {
+		extension: (pi) => {
+			pi.on("tool_execution_start", (event) => {
+				activeToolCalls.add(event.toolCallId);
+			});
+			pi.on("tool_execution_end", (event) => {
+				activeToolCalls.delete(event.toolCallId);
+				drain();
+			});
+		},
+		requestCompletion: () => {
+			completionRequested = true;
+			drain();
+		}
+	};
+}
+//#endregion
 //#region src/runtime/task-output.ts
 var METER_NAME = "@themoltnet/pi-extension/task-output";
 var parseResultCounter = null;
@@ -33445,7 +33338,8 @@ function submitOutputRepairHint(taskType, errors) {
 	const hints = ["Tool args must be the output object directly, not wrapped in { output: ... }."];
 	if (fields.has("output/artifacts")) hints.push("`artifacts` must be an array; omit it when there are no artifacts, use [], or use objects like { \"kind\": \"note\", \"title\": \"Result\", \"body\": \"...\" }.");
 	if (fields.has("output/verification")) hints.push("`verification` must be an object with inputCid, results[], and passed; do not send it as text or an array.");
-	if (taskType === "freeform" && (fields.has("output/artifacts") || fields.has("output/verification"))) hints.push("Minimal valid freeform retry: { \"summary\": \"completed\", \"artifacts\": [], \"verification\": { \"inputCid\": \"<task inputCid>\", \"results\": [{ \"id\": \"submit-output\", \"kind\": \"gate\", \"status\": \"pass\", \"detail\": \"submit_freeform_output accepted valid args\" }], \"passed\": true } }.");
+	if (fields.has("output/artifacts") || fields.has("output/verification")) if (taskType === "freeform") hints.push("Minimal valid freeform retry: { \"summary\": \"completed\", \"artifacts\": [], \"verification\": { \"inputCid\": \"<task inputCid>\", \"results\": [{ \"id\": \"submit-output\", \"kind\": \"gate\", \"status\": \"pass\", \"detail\": \"submit_freeform_output accepted valid args\" }], \"passed\": true } }.");
+	else hints.push(`\`verification\` is a stamp when the only gate is submit-output: { "inputCid": "<task inputCid>", "results": [{ "id": "submit-output", "kind": "gate", "status": "pass", "detail": "submit_${taskType}_output accepted valid args" }], "passed": true }.`);
 	if (hints.length === 1) hints.push("Fix every listed field before re-calling this same tool.");
 	return hints.join(" ");
 }
@@ -33463,7 +33357,18 @@ function onlySubmitOutputGate(input) {
 	if (Array.isArray(assertions) && assertions.length > 0) return false;
 	return criteria.rubric === void 0 && criteria.sideEffects === void 0 && criteria.minComposite === void 0;
 }
-function repairFreeformSubmitOutput(params, opts) {
+/**
+* Repair a producer submit-output payload when the task's ONLY success gate is
+* the auto-injected submit-output gate — i.e. there is nothing substantive to
+* self-assess, so the `verification` record is a mechanical stamp. Applies to
+* any producer task type (freeform, run_eval, …), not just freeform: weaker
+* models mis-type or omit the nested `verification` object identically across
+* types, and previously only freeform was repaired, so run_eval attempts failed
+* `output_validation_failed` on verification alone. The freeform-only field
+* coercions below are guarded by field presence, so they no-op for other types,
+* and the caller re-validates the repaired payload against the type's schema.
+*/
+function repairProducerSubmitOutput(taskType, params, opts) {
 	if (!isRecord(params) || !opts.inputCid || !onlySubmitOutputGate(opts.input)) return null;
 	const repaired = { ...params };
 	if ("artifacts" in repaired && !Array.isArray(repaired.artifacts)) if (isRecord(repaired.artifacts)) repaired.artifacts = [repaired.artifacts];
@@ -33479,15 +33384,14 @@ function repairFreeformSubmitOutput(params, opts) {
 			id: SUBMIT_OUTPUT_GATE_ID,
 			kind: "gate",
 			status: "pass",
-			detail: "submit_freeform_output accepted valid args"
+			detail: `submit_${taskType}_output accepted valid args`
 		}],
 		passed: true
 	};
 	return repaired;
 }
 function maybeRepairSubmitOutput(taskType, params, opts) {
-	if (taskType !== "freeform") return null;
-	const repaired = repairFreeformSubmitOutput(params, opts);
+	const repaired = repairProducerSubmitOutput(taskType, params, opts);
 	if (!repaired) return null;
 	return validateTaskSubmission(taskType, repaired, opts.input, { inputCid: opts.inputCid }).length === 0 ? repaired : null;
 }
@@ -33511,10 +33415,24 @@ Agent submission schema:\n\`\`\`json\n${contract.parametersSchemaJson}\n\`\`\``,
 			promptGuidelines: [
 				`Call \`${contract.toolName}\` with the exact ${taskType} agent submission shape shown above.`,
 				"The transport accepts malformed objects only so validation errors can be recovered in-session; the schema shown above is authoritative.",
-				"If the submit tool returns a validation error, fix every listed field and call the same tool again."
+				"If the submit tool returns a validation error, fix every listed field and call the same tool again.",
+				"The first valid submission is final and immediately ends the session."
 			],
 			parameters: RecoverableSubmitToolParameters,
 			async execute(_id, params) {
+				if (captured) return {
+					content: [{
+						type: "text",
+						text: "Output was already captured. The first valid payload remains final; this duplicate submission was ignored."
+					}],
+					details: {
+						captured: true,
+						callCount,
+						invalidCallCount,
+						maxSubmitValidationRetries,
+						error: null
+					}
+				};
 				if (exhaustedValidationFailure) return {
 					content: [{
 						type: "text",
@@ -33565,6 +33483,7 @@ Agent submission schema:\n\`\`\`json\n${contract.parametersSchemaJson}\n\`\`\``,
 				}
 				captured = candidateParams;
 				callCount += 1;
+				await opts.onValidCapture?.();
 				return {
 					content: [{
 						type: "text",
@@ -34005,7 +33924,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 	let subagentHandle = null;
 	const finalUsage = emptyUsage(opts.provider, opts.model);
 	let cancelListener = null;
-	const makeFailedOutput = (code, message, usage = finalUsage) => ({
+	const makeFailedOutput = (code, message, usage = finalUsage, retryable = false) => ({
 		taskId: task.id,
 		attemptN,
 		status: "failed",
@@ -34016,7 +33935,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 		error: {
 			code,
 			message,
-			retryable: false
+			retryable
 		}
 	});
 	const makeCancelledOutput = (message) => ({
@@ -34069,6 +33988,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 		reporterOpen = true;
 		let checkpointPath;
 		let resolvedVmTemplate = opts.resolvedVmTemplate;
+		let effectiveSandboxConfig;
 		try {
 			if (!resolvedVmTemplate && opts.runtimeDefinition) resolvedVmTemplate = opts.resolveVmTemplate ? await opts.resolveVmTemplate() : await opts.runtimeDefinition.vm.resolve({ onProgress: opts.onSnapshotProgress });
 			checkpointPath = resolvedVmTemplate?.checkpointPath ?? opts.checkpointPath ?? (opts.resolveCheckpointPath ? await opts.resolveCheckpointPath() : await ensureSnapshot({
@@ -34092,7 +34012,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 			return makeFailedOutput("worktree_setup_failed", message);
 		}
 		try {
-			const sandboxConfig = applyExecutionPlanSandboxOverrides(resolvedVmTemplate ? {
+			effectiveSandboxConfig = applyExecutionPlanSandboxOverrides(resolvedVmTemplate ? {
 				...opts.sandboxConfig,
 				snapshot: void 0,
 				resumeCommands: [...resolvedVmTemplate.resumeCommands]
@@ -34104,7 +34024,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 				mountPath,
 				workspaceMode: workspace.mode,
 				extraAllowedHosts: opts.extraAllowedHosts,
-				sandboxConfig,
+				sandboxConfig: effectiveSandboxConfig,
 				forwardEnv: opts.forwardEnv,
 				signal: reporter.cancelSignal
 			});
@@ -34234,11 +34154,20 @@ async function executePiTask(claimedTask, reporter, opts) {
 			cwdPath,
 			guestWorkspace: managed.guestWorkspace
 		});
+		const submitCompletion = createSubmitCompletionCoordinator({
+			onDrained: () => session?.abort(),
+			onError: async (err) => {
+				await emitError("submit_output_abort", err instanceof Error ? err.message : String(err), { event: "submit_output_abort_failed" });
+			}
+		});
 		const { handle: submitToolHandle, tools: submitToolDefs } = resolveSubmitTools(task.taskType, {
 			model: opts.model,
 			input: task.input,
 			inputCid: task.inputCid,
-			maxSubmitValidationRetries: opts.maxSubmitValidationRetries
+			maxSubmitValidationRetries: opts.maxSubmitValidationRetries,
+			onValidCapture: () => {
+				submitCompletion.requestCompletion();
+			}
 		});
 		const submitTools = submitToolDefs;
 		try {
@@ -34266,48 +34195,45 @@ async function executePiTask(claimedTask, reporter, opts) {
 					correlationId: task.correlationId ?? null
 				})
 			});
-			const piAuthDir = process.env.PI_CODING_AGENT_DIR ?? join(homedir(), ".pi", "agent");
-			const modelHandle = getModel(opts.provider, opts.model);
-			const runtimeKernel = buildRuntimeKernel({
-				taskId: task.id,
-				taskType: task.taskType,
-				attemptN,
-				diaryId,
-				agentName: opts.agentName,
-				guestWorkspace: managed.guestWorkspace,
-				correlationId: task.correlationId ?? null
-			});
-			const appendSystemPrompt = composeRuntimeSystemPrompt({
-				profilePromptPrefix: injectedContext.systemPromptPrefix,
-				kernel: runtimeKernel
-			});
+			const piAuthDir = resolvePiCodingAgentDir();
+			const { modelHandle, modelRegistry } = resolveRuntimeProfileModel(piAuthDir, opts.provider, opts.model, opts.runtimeProfileId);
 			const injectedSkills = injectedContext.skills;
 			const toolPolicyExtensions = [];
 			let resolvedToolPolicy;
+			let unavailableRuntimeShellCommands = [];
+			let verifiedGuestExecutables = [];
+			const toolPolicyLogger = opts.toolPolicyLogger ?? {
+				debug: () => {},
+				info: (obj, msg) => console.error(JSON.stringify({
+					level: "info",
+					msg,
+					...obj
+				})),
+				warn: (obj, msg) => console.error(JSON.stringify({
+					level: "warn",
+					msg,
+					...obj
+				}))
+			};
 			if (opts.runtimeProfileId && opts.toolEnforcement && opts.toolEnforcement !== "off") {
-				const toolPolicyLogger = opts.toolPolicyLogger ?? {
-					debug: () => {},
-					info: (obj, msg) => console.error(JSON.stringify({
-						level: "info",
-						msg,
-						...obj
-					})),
-					warn: (obj, msg) => console.error(JSON.stringify({
-						level: "warn",
-						msg,
-						...obj
-					}))
-				};
 				const [analyzer, policy] = await Promise.all([ShellCommandAnalyzer.create(), resolveSessionToolPolicy({
 					agent: moltnetAgent,
 					profileId: opts.runtimeProfileId,
 					teamId: taskTeamId,
+					runtimeKind: opts.runtimeDefinition?.runtimeKind ?? "gondolin_pi",
 					enforcement: opts.toolEnforcement,
 					logger: toolPolicyLogger
 				})]);
-				resolvedToolPolicy = policy;
+				verifiedGuestExecutables = (await discoverGuestExecutables(managed.vm, [...policy.allowedShellCommands.map(({ argvPrefix }) => argvPrefix[0]), ...policy.enforcement === "watch" ? resolvedVmTemplate?.executables ?? [] : []], { signal: reporter.cancelSignal })).available;
+				const availableExecutables = new Set(verifiedGuestExecutables);
+				const allowedShellCommands = policy.allowedShellCommands.filter(({ argvPrefix }) => availableExecutables.has(argvPrefix[0]));
+				unavailableRuntimeShellCommands = policy.allowedShellCommands.filter(({ argvPrefix }) => !availableExecutables.has(argvPrefix[0]));
+				resolvedToolPolicy = {
+					...policy,
+					allowedShellCommands
+				};
 				toolPolicyExtensions.push(createToolPolicyExtension({
-					policy,
+					policy: resolvedToolPolicy,
 					analyzer,
 					logger: toolPolicyLogger
 				}));
@@ -34345,13 +34271,67 @@ async function executePiTask(claimedTask, reporter, opts) {
 				policy: resolvedToolPolicy
 			}) : [];
 			const visibleBaseTools = filterModelVisibleTools([...gondolinCustomTools, ...moltnetTools], resolvedToolPolicy);
+			const taskHasSubagents = taskTypeUsesSubagents(task.taskType);
+			const visibleParentToolNames = modelVisiblePiToolNames({
+				tools: [
+					...visibleBaseTools,
+					...runtimeParentTools,
+					...submitTools,
+					...taskHasSubagents ? [{ name: "subagent" }] : []
+				],
+				extensions: opts.runtimeDefinition?.extensions,
+				policy: resolvedToolPolicy
+			});
+			const capabilityProjection = projectRuntimeCapabilities({
+				policy: resolvedToolPolicy,
+				visibleToolNames: visibleParentToolNames,
+				unavailableShellCommands: unavailableRuntimeShellCommands
+			});
+			if (capabilityProjection.unavailableTools.length > 0 || capabilityProjection.unavailableExecutables.length > 0) {
+				const diagnostics = {
+					runtimeProfileId: opts.runtimeProfileId,
+					unavailableTools: capabilityProjection.unavailableTools,
+					unavailableExecutables: capabilityProjection.unavailableExecutables,
+					droppedShellCommandCount: capabilityProjection.droppedShellCommandCount
+				};
+				toolPolicyLogger.warn(diagnostics, "Runtime policy grants unavailable capabilities");
+				await emit("info", {
+					event: "runtime_capabilities_unavailable",
+					...diagnostics
+				});
+			}
+			const vfsShadow = resolveVfsShadowConfig(effectiveSandboxConfig);
+			const runtimeKernel = buildRuntimeKernel({
+				taskId: task.id,
+				taskType: task.taskType,
+				attemptN,
+				diaryId,
+				agentName: opts.agentName,
+				guestWorkspace: managed.guestWorkspace,
+				correlationId: task.correlationId ?? null,
+				sandbox: {
+					workspaceMode: activeWorkspace.mode,
+					vfsShadowMode: vfsShadow.mode,
+					vfsShadowPatterns: vfsShadow.patterns,
+					nodeModulesWriteMode: "tmpfs",
+					verifiedExecutables: verifiedGuestExecutables,
+					allowedHosts: [...effectiveSandboxConfig?.network?.allowedHosts ?? [], ...opts.extraAllowedHosts ?? []],
+					allowedInternalHosts: effectiveSandboxConfig?.network?.allowedInternalHosts ?? []
+				},
+				toolPolicy: capabilityProjection.instructorPolicy
+			});
+			const appendSystemPrompt = composeRuntimeSystemPrompt({
+				profilePromptPrefix: injectedContext.systemPromptPrefix,
+				kernel: runtimeKernel
+			});
 			const parentSubagentTools = [];
-			if (taskTypeUsesSubagents(task.taskType)) {
+			if (taskHasSubagents) {
 				subagentHandle = createSubagentTool({
 					mountPath,
 					cwdPath,
 					piAuthDir,
 					modelHandle,
+					modelRegistry,
 					thinkingLevel: opts.thinkingLevel,
 					temperature: opts.temperature,
 					topP: opts.topP,
@@ -34385,6 +34365,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 				cwdPath,
 				piAuthDir,
 				modelHandle,
+				modelRegistry,
 				thinkingLevel: opts.thinkingLevel,
 				temperature: opts.temperature,
 				topP: opts.topP,
@@ -34408,7 +34389,11 @@ async function executePiTask(claimedTask, reporter, opts) {
 					"moltnet.task.type": task.taskType
 				},
 				sessionPersistence: executionPlan?.sessionPersistence ?? void 0,
-				extraExtensionFactories: [...runtimeParentExtensions, ...toolPolicyExtensions]
+				extraExtensionFactories: [
+					...runtimeParentExtensions,
+					...toolPolicyExtensions,
+					submitCompletion.extension
+				]
 			});
 		} catch (err) {
 			const message = err instanceof Error ? err.message : String(err);
@@ -34416,6 +34401,9 @@ async function executePiTask(claimedTask, reporter, opts) {
 				message,
 				phase: "session_setup"
 			});
+			if (reporter.cancelSignal.aborted) return makeCancelledOutput(reporter.cancelReason ?? "Task cancelled during session setup.");
+			if (err instanceof RuntimeProfileModelResolutionError) return makeFailedOutput("invalid_model", message);
+			if (err instanceof GuestExecutableProbeError) return makeFailedOutput(err.code, message, finalUsage, true);
 			return makeFailedOutput("session_setup_failed", message);
 		}
 		const turnState = createSessionTurnState();
@@ -35249,4 +35237,4 @@ function describeToolErrorMessage(result) {
 	}
 }
 //#endregion
-export { GONDOLIN_TOOL_NAMES, HOST_EXEC_DEFAULT_BASE_ENV, MOLTNET_TOOL_NAMES, PI_EXECUTOR_MANIFEST_VERSION, PI_RUNTIME_DEFINITION_VERSION, activateAgentEnv, buildAgentSession, buildPiExecutorManifest, buildRuntimeKernel, buildWorkspaceMountInstructions, createGondolinBashOps, createGondolinEditOps, createGondolinFindOps, createGondolinLsOps, createGondolinReadOps, createGondolinToolDefinitions, createGondolinWriteOps, createMoltNetTools, createPiOtelExtension, createPiRetryTriage, createPiTaskExecutor, createSubagentTool, createToolPolicyExtension, decideForEvent, decideToolCall, defineGondolinTemplate, definePiExtension, definePiRuntime, definePiTool, enabledPiToolNames, ensureSnapshot, executeGondolinGrep, executePiTask, filterModelVisibleTools, findMainWorktree, injectRuntimeContext as injectTaskContext, isKernelTool, isToolVisible, loadCredentials, materializePiExtensions, materializePiTools, normalizeRetryTriageResult, redactRetryTriageSecrets, resolveSessionToolPolicy, resolveTaskWorktreePath, resumeVm, toGuestPath };
+export { GONDOLIN_TOOL_NAMES, HOST_EXEC_DEFAULT_BASE_ENV, MOLTNET_TOOL_NAMES, PI_EXECUTOR_MANIFEST_VERSION, PI_RUNTIME_DEFINITION_VERSION, activateAgentEnv, buildAgentSession, buildPiExecutorManifest, buildRuntimeKernel, buildWorkspaceMountInstructions, createGondolinBashOps, createGondolinEditOps, createGondolinFindOps, createGondolinLsOps, createGondolinReadOps, createGondolinToolDefinitions, createGondolinWriteOps, createMoltNetTools, createPiOtelExtension, createPiRetryTriage, createPiTaskExecutor, createSubagentTool, createToolPolicyExtension, decideForEvent, decideToolCall, defineGondolinTemplate, definePiExtension, definePiRuntime, definePiTool, enabledPiToolNames, ensureSnapshot, executeGondolinGrep, executePiTask, filterModelVisibleTools, findMainWorktree, injectRuntimeContext as injectTaskContext, isKernelTool, isResolvedPathInsideRoot, isToolVisible, loadCredentials, materializePiExtensions, materializePiTools, normalizeRetryTriageResult, redactRetryTriageSecrets, resolveSessionToolPolicy, resolveTaskWorktreePath, resumeVm, toGuestPath };