@uchibeke/gallivant 0.2.0 → 0.3.0

package/lib/execution.mjs

@@ -1,7 +1,8 @@
 // Versioned durable transport boundary. No transport implements a review loop.
 import { join } from "node:path";
-import { existsSync, rmSync } from "node:fs";
+import { existsSync, readdirSync, rmSync } from "node:fs";
 import { randomUUID, createHash } from "node:crypto";
+import { isDeepStrictEqual } from "node:util";
 import { ensureDir, readJson, writeJsonAtomic } from "./fs.mjs";
 import { acquireProcessLock } from "./daemon.mjs";
 import { capabilitiesFor, adapterFor, preparationReceipt, isPreparationReceipt } from "./harness.mjs";
@@ -11,6 +12,7 @@ import { prepareLocalExecution } from "./execution_preparation.mjs";
 import { EXECUTION_LIMITS, boundedCall, nextAttempt, executionError, assertExecutionCursor, ownsProviderSession, assertTerminalOutcome, redact, redactResultMetadata } from "./execution_io.mjs";
 import { journalFor } from "./execution_journal.mjs";
 import { requestRunCancellation } from "./run.mjs";
+import { verifyReviewImageCopy } from "./review_image.mjs";
 
 export const EXECUTION_VERSION = 1;
 const exactIdentity = id => typeof id === "string" && !!id.trim();
@@ -29,8 +31,92 @@ const preparationFingerprint = input => {
   const { receipt: _receipt, ...prepared } = input.prepared || {};
   return digest({ environment: input.environment, ...(input.spec ? { spec: input.spec } : { prompt: input.prompt, prepared }) });
 };
+function verifyPreparedReviewImage(input, transport) {
+  const spec = input.spec, args = spec?.args, image = spec?.imageAttachment;
+  if (!Array.isArray(args)) return;
+  const flags = args.slice(0, -1).filter(arg => arg === "--image" || arg === "-i" || typeof arg === "string" && (arg.startsWith("--image=") || arg.startsWith("-i=")));
+  if (!image && flags.length === 0) return;
+  if (transport || input.kind !== "intake" || input.preparation?.boundary !== "codex-draft-sandbox-v1" || flags.length !== 1 || args.at(-4) !== "--image" || args.at(-3) !== image?.file || args.at(-2) !== "--" || !spec.options?.cwd) throw executionError("TASK_PREPARATION_BOUNDARY", "image attachment does not match the restricted prepared input");
+  verifyReviewImageCopy(spec.options.cwd, image.file, image.expected);
+}
 export const executionRunner = (ctx, id, provider = ctx.state.get(id)?.harness) => ctx.executionFor && provider ? ctx.executionFor(id, provider) : ctx.runnerFor(id);
 
+const epochFile = (root, epoch) => join(root, epoch ? `execution-${epoch}.json` : "execution.json");
+const validEpoch = epoch => Number.isSafeInteger(epoch) && epoch >= 0 && epoch <= 1000;
+const latestLedger = root => {
+  const epochs = readdirSync(root, { withFileTypes: true }).filter(file => file.isFile() && /^execution-[1-9][0-9]*\.json$/.test(file.name))
+    .map(file => Number(file.name.slice(10, -5)));
+  if (!epochs.length) return null;
+  const epoch = Math.max(...epochs);
+  if (!validEpoch(epoch)) throw executionError("EXECUTION_VERSION", "invalid execution handoff epoch; restore its matching ledger backup");
+  return { epoch, ledger: readJson(epochFile(root, epoch)) };
+};
+
+// Reserve a new provider epoch before changing the registry or starting a run.
+// Its empty ledger is also the durable route recovered after state.json loss.
+export function reserveExecutionEpoch({ root, taskId, provider, account, epoch, pr = null }) {
+  if (!validEpoch(epoch) || epoch === 0) throw executionError("EXECUTION_VERSION", "invalid execution handoff epoch");
+  const file = epochFile(root, epoch);
+  if (existsSync(file)) {
+    const saved = readJson(file);
+    if (saved?.version !== EXECUTION_VERSION || saved.taskId !== taskId || saved.provider !== provider || saved.account !== account ||
+        saved.handoff && (saved.handoff.epoch !== epoch || pr != null && saved.handoff.pr !== pr)) {
+      throw executionError("EXECUTION_OWNERSHIP", "reserved handoff ledger belongs to a different execution; restore its matching backup");
+    }
+    return;
+  }
+  writeJsonAtomic(file, { version: EXECUTION_VERSION, taskId, provider, account, operations: {}, current: null, stopped: null,
+    ...(pr != null ? { handoff: { epoch, pr } } : {}) });
+}
+
+// A registered PR may change local harnesses only after its previous run has
+// settled. Keep that provider's execution.json intact and give the new harness
+// a separate ledger while run directories remain under the same task root.
+// The legacy inference repairs registrations made before the epoch was saved:
+// it is deliberately limited to the exact settled reset, not an arbitrary
+// provider mismatch or a remote task whose ownership remains unresolved.
+export function executionEpoch({ root, taskId, entry, provider, account, runner }) {
+  if (entry?.execution_epoch != null) {
+    if (!validEpoch(entry.execution_epoch)) throw executionError("EXECUTION_VERSION", "invalid execution handoff epoch; restore its matching registry backup");
+  }
+  const latest = existsSync(root) ? latestLedger(root) : null;
+  if (latest) {
+    const pending = entry?.handoff_pending;
+    const oldEpoch = entry?.execution_epoch ?? 0;
+    // A reset interrupted after reserving its new empty ledger keeps the old
+    // registry entry fenced. Let a retry inspect that exact old ledger, while
+    // `dispatch_stopped` prevents a daemon from launching the old provider.
+    if (entry?.dispatch_stopped === "harness-handoff-pending" && pending?.from === provider &&
+        pending.to === latest.ledger?.provider && pending.epoch === latest.epoch && pending.pr === entry.pr &&
+        oldEpoch === latest.epoch - 1 && latest.ledger?.taskId === taskId && latest.ledger.handoff?.pr === entry.pr &&
+        latest.ledger.current === null && !latest.ledger.stopped && Object.keys(latest.ledger.operations ?? {}).length === 0) {
+      return oldEpoch;
+    }
+    if (entry?.execution_epoch != null && entry.execution_epoch !== latest.epoch) throw executionError("EXECUTION_OWNERSHIP", "registry and latest handoff ledger disagree; reconcile the interrupted reset before dispatch");
+    if (latest.ledger?.version !== EXECUTION_VERSION || latest.ledger.taskId !== taskId || latest.ledger.provider !== provider || latest.ledger.account !== account ||
+        latest.ledger.handoff && (latest.ledger.handoff.epoch !== latest.epoch || latest.ledger.handoff.pr !== entry?.pr)) {
+      throw executionError("EXECUTION_OWNERSHIP", "latest handoff ledger belongs to another provider/account; do not reopen an older session");
+    }
+    return latest.epoch;
+  }
+  if (entry?.execution_epoch != null) {
+    if (entry.execution_epoch > 0) throw executionError("EXECUTION_OWNERSHIP", "recorded handoff ledger is missing; restore its matching backup before dispatch");
+    return 0;
+  }
+  const old = readJson(epochFile(root, 0));
+  if (!old || old.provider === provider && old.account === account) return 0;
+  const prior = old.current?.execution;
+  const current = runner?.current();
+  const exactReset = entry?.pr && entry.session === null &&
+    entry.last?.run === old.current?.id && entry.last?.exit === old.current?.exit &&
+    entry.execution?.provider === old.provider && entry.execution?.account === old.account &&
+    old.taskId === taskId && old.account === "operator" && account === "operator" &&
+    prior?.transport === "cli" && prior.provider === old.provider && prior.collected === true &&
+    ["succeeded", "failed"].includes(prior.providerState) && !old.stopped &&
+    current?.id === old.current.id && current.running === false;
+  return exactReset ? 1 : 0;
+}
+
 // A sessionless resume is allowed only for an owned, proven unsubmitted first
 // launch. Older refusal entries can recover from the private transport proof;
 // a registry reason or an absent session alone never authorizes a new session.
@@ -53,9 +139,9 @@ export function assertExecutionDependency(taskService) {
  * Methods accept scoped immutable input plus AbortSignal and return bounded JSON.
  * A remote adapter never needs a local command, PID, or inherited environment.
  */
-export function makeExecution({ root, taskId, provider, account = "operator", transport = null, runner = null, legacySessionId = null, capabilities = capabilitiesFor(provider), clock = Date, limits = {}, secrets = [], jitter = Math.random }) {
+export function makeExecution({ root, taskId, provider, account = "operator", transport = null, runner = null, legacySessionId = null, ledgerFile = join(root, "execution.json"), ledgerEpoch = 0, capabilities = capabilitiesFor(provider), clock = Date, limits = {}, secrets = [], jitter = Math.random }) {
   const bounds = { ...EXECUTION_LIMITS, ...limits };
-  const file = join(root, "execution.json");
+  const file = ledgerFile;
   const collectionRejection = s => {
     const job = s.current, ex = job?.execution;
     if (!transport || !ownedRemote(ex) || !["succeeded", "failed"].includes(ex.terminalState)) return null;
@@ -243,10 +329,11 @@ export function makeExecution({ root, taskId, provider, account = "operator", tr
       if (prior.acceptance !== "accepted" || (transport && !ownedRemote(prior.job?.execution))) throw executionError("EXECUTION_UNKNOWN", `submission ${prior.runId} acceptance is unknown; reconcile its recorded idempotency key; no new dispatch`);
       return { ...prior.job };
     }
+    if (input.kind === "intake") verifyPreparedReviewImage(input, transport);
     if (s.learningContinuity?.pending && (method !== "submit" || input.sessionId)) throw executionError("EXECUTION_CONTINUATION", "retired advice requires a new provider session, not continuation");
     if (s.stopped) throw executionError("EXECUTION_STOPPED", `dispatch stopped: ${s.stopped}; late results remain quarantined`);
     if (s.current && executionLive(s.current)) throw executionError("BUSY", "previous provider work is not settled");
-    const legacy = !transport && !s.current ? runner.current() : null;
+    const legacy = !transport && !s.current && ledgerEpoch === 0 ? runner.current() : null;
     if (legacy?.running) throw executionError("BUSY", "legacy local writer is still running");
     const ownedSession = transport ? s.current?.execution.sessionId : s.current
       ? localSession(s, s.current.id, s.current.execution.sessionId)
@@ -280,6 +367,7 @@ export function makeExecution({ root, taskId, provider, account = "operator", tr
     if (transport) project(s);
     let accepted;
     try {
+      if (!transport && input.kind === "intake") verifyPreparedReviewImage(input, transport);
       accepted = transport ? await call(method, { ...input, taskId, provider, account, runId: id, idempotencyKey: intent.idempotencyKey })
         : await runner.start(input.name, input.spec.cmd, input.spec.args, { ...input.spec.options, runId: id, privateOutput: { taskId, runId: id, provider } });
     } catch (e) {
@@ -313,9 +401,9 @@ export function makeExecution({ root, taskId, provider, account = "operator", tr
     const s = read();
     if (!transport) {
       const job = runner.current();
-      if (job && (!s.current || s.current.id === job.id)) return { ...job, ...(s.current ? { execution: s.current.execution,
+      if (job && ((ledgerEpoch === 0 && !s.current) || s.current?.id === job.id)) return { ...job, ...(s.current ? { execution: s.current.execution,
         ...(s.current.execution.quarantined ? { exit: s.current.exit, endedAt: s.current.endedAt } : {}) } : {}) };
-      if (!s.current) return job; // Legacy local runs retain their exact identity.
+      if (!s.current) return ledgerEpoch === 0 ? job : null; // Only the original epoch may adopt a legacy local run.
     }
     return s.current ? { ...s.current, running: executionLive(s.current) } : null;
   };
@@ -324,6 +412,7 @@ export function makeExecution({ root, taskId, provider, account = "operator", tr
       if (!transport) runner.observe?.();
       if (!s.current) return current();
       if (!transport) {
+        const before = structuredClone(s);
         let job = runner.current();
         if (!job || job.id !== s.current.id) return current();
         if (s.current.execution.acceptance === "unknown") {
@@ -342,11 +431,23 @@ export function makeExecution({ root, taskId, provider, account = "operator", tr
           catch (error) { s.current.execution.recoveryAction = error.code || "local shutdown remains unverified"; }
           if (!job || job.id !== s.current.id) { save(s); return current(); }
         }
-        Object.assign(s.current.execution, { providerState: job.running ? s.stopped || job.killed ? "cancellation-requested" : "running" : s.current.execution.collected ? s.current.execution.providerState : "retrieving-results", observedAt: clock.now(), reconciledAt: clock.now() });
+        Object.assign(s.current.execution, { providerState: job.running ? s.stopped || job.killed ? "cancellation-requested" : "running" : s.current.execution.collected ? s.current.execution.providerState : "retrieving-results" });
         if (s.stopped && !job.running) confirmLocalStop(s, job);
         const { running: _running, ...record } = job;
         s.current = { ...record, ...(s.current.execution.quarantined ? { exit: s.current.exit, endedAt: s.current.endedAt } : {}), execution: s.current.execution };
-        save(s); runner.annotate?.(s.current.id, { execution: s.current.execution }); return current();
+        // Still observe liveness/output every tick. Persist real changes at
+        // once, but coalesce unchanged live observations to one per minute.
+        // Settled runs need no heartbeat. Never defer a launch or stop intent.
+        const ex = s.current.execution;
+        if (!isDeepStrictEqual(before, s) || job.running &&
+            (ex.reconciledAt == null || clock.now() - ex.reconciledAt >= 60_000)) {
+          Object.assign(ex, { observedAt: clock.now(), reconciledAt: clock.now() });
+          save(s);
+        }
+        // Repair a projection after an interrupted write without rewriting an
+        // already matching job.json on every poll.
+        if (!isDeepStrictEqual(job.execution, ex)) runner.annotate?.(s.current.id, { execution: ex });
+        return current();
       }
       const ex = s.current.execution;
       if (ex.collected && terminal(ex.providerState)) return current();
@@ -470,7 +571,7 @@ export function makeExecution({ root, taskId, provider, account = "operator", tr
       if (!s.stopped || reason !== "timeout") s.stopped = reason;
       // An upgrade may have an owned local writer but no boundary submission.
       // Preserve its identity for stop recovery without inventing a paid intent.
-      if (!s.current && !transport) {
+      if (!s.current && !transport && ledgerEpoch === 0) {
         const job = runner.current();
         // Completed pre-boundary runs need only the future-dispatch fence.
         // Adopt live/unfinished writers for the existing shutdown recovery.
@@ -519,7 +620,7 @@ export function makeExecution({ root, taskId, provider, account = "operator", tr
     });
   }
   return {
-    root, provider, account, capabilities, state: read, current, reconcile, collect, cancel,
+    root, provider, account, ledgerEpoch, capabilities, state: read, current, reconcile, collect, cancel,
     recover: async ({ operationId, authorized = false } = {}) => {
       const pending=await locked(async s => {
       const job=s.current,ex=job?.execution;
@@ -550,6 +651,7 @@ export function makeExecution({ root, taskId, provider, account = "operator", tr
     sanitize: (value, id, extraSecrets = []) => redact(value, [...secrets, ...(readJson(join(dirOf(id), "sensitive-redactions.json"))?.secrets || []), ...extraSecrets]),
     prepare: async (input, { build } = {}) => {
       authorize(input);
+      if (input.reviewImage != null && (transport || input.kind !== "intake" || provider !== "codex")) throw executionError("TASK_PREPARATION_BOUNDARY", "image review requires the restricted local reviewer; no fallback is available");
       if (input.kind !== "intake") return transport ? call("prepare", input) : input;
       authorizePreparation(read());
       const receipt = preparationReceipt(provider, capabilities, account);
@@ -625,7 +727,26 @@ export function makeExecution({ root, taskId, provider, account = "operator", tr
         return job;
       } finally { lock.release(); }
     },
-    kill: id => { if (transport) throw executionError("EXECUTION_CONTROL", "remote cancellation must be requested and confirmed by the coordinator"); return runner.kill(id); },
+    kill: id => {
+      if (transport) throw executionError("EXECUTION_CONTROL", "remote cancellation must be requested and confirmed by the coordinator");
+      ensureDir(root);
+      const lock = acquireProcessLock(join(root, "execution.lock"), "execution");
+      try {
+        const s = read();
+        if (s.current) {
+          if (s.current.id !== id) throw executionError("EXECUTION_OWNERSHIP", "interrupt does not own the current local run");
+          // First-turn sessions can be discovered in the stream before their
+          // terminal result. Retain that verified identity BEFORE stopping and
+          // quarantining the run; continuation must not depend on late output.
+          const sessionId = localSession(s, id, adapterFor(provider).sessionFrom(runner.lines(id)));
+          if (sessionId !== s.current.execution.sessionId) {
+            s.current.execution.sessionId = sessionId;
+            save(s); runner.annotate?.(id, { execution: s.current.execution });
+          }
+        }
+        return runner.kill(id);
+      } finally { lock.release(); }
+    },
     waitForKill: id => runner?.waitForKill(id), dirOf,
   };
 }

package/lib/execution_preparation.mjs

@@ -8,6 +8,7 @@ import { ensureDir } from "./fs.mjs";
 import { MAX_PREPARATION_PROMPT_BYTES } from "./task_contract.mjs";
 import { taskError } from "./task_store.mjs";
 import { boundedCall } from "./execution_io.mjs";
+import { copyReviewImage, REVIEW_IMAGE_LIMITS } from "./review_image.mjs";
 
 export async function prepareLocalExecution(provider, capabilities, account, input, build = buildPreparationRun, limits = {}) {
   const receipt = preparationReceipt(provider, capabilities, account);
@@ -25,5 +26,19 @@ export async function prepareLocalExecution(provider, capabilities, account, inp
   if (spec.configure) spec = await boundedCall(signal => spec.configure(spec, { cwd: input.cwd, env, signal }), limits);
   check(); // An adapter's final configuration cannot replace its authority.
   assertSafeEnv(env);
-  return { receipt, environment: input.environment, spec: { cmd: spec.cmd, args: spec.args, options: { cwd: input.cwd, env, inheritEnv: false } } };
+  let copy, imageAttachment;
+  try {
+    if (input.reviewImage != null) {
+      if (provider !== "codex" || spec.reviewImageBoundary !== "coordinator-copy-v1" || spec.boundary !== "codex-draft-sandbox-v1") throw taskError("TASK_PREPARATION_BOUNDARY", "image attachment requires the restricted reviewer boundary");
+      const { content, ...expected } = input.reviewImage;
+      if (typeof content !== "string" || !Number.isSafeInteger(expected.bytes) || expected.bytes < 1 || expected.bytes > REVIEW_IMAGE_LIMITS.individualBytes || content.length !== Math.ceil(expected.bytes / 3) * 4 || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(content)) throw taskError("TASK_PREPARATION_BOUNDARY", "image attachment bytes are incomplete");
+      const bytes = Buffer.from(content, "base64");
+      if (bytes.length !== expected.bytes || bytes.toString("base64") !== content) throw taskError("TASK_PREPARATION_BOUNDARY", "image attachment bytes differ");
+      copy = copyReviewImage(input.cwd, bytes, expected);
+      spec.args = [...spec.args.slice(0, -1), "--image", copy.file, "--", spec.args.at(-1)];
+      imageAttachment = { file: copy.file, expected };
+      check();
+    }
+    return { receipt, environment: input.environment, spec: { cmd: spec.cmd, args: spec.args, options: { cwd: input.cwd, env, inheritEnv: false }, ...(imageAttachment ? { imageAttachment } : {}) } };
+  } catch (error) { copy?.cleanup(); throw error; }
 }

package/lib/execution_result.mjs

@@ -1,3 +1,6 @@
+import { publicationPolicyOf, assertPublicationPaths, workArtifactReason } from "./work_artifacts.mjs";
+import { assertAgentsCheckout } from "./openai_agents_sources.mjs";
+import { hostApi } from "./hosts.mjs";
 // Result transport ends here. Git/gh own the one publication path; the existing
 // tick still owns readiness, receipts, review rounds, conflicts and human merge.
 import { createHash } from "node:crypto";
@@ -7,7 +10,8 @@ import { unlinkSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { repositoryPath, repositoryRelativePath, assertRepositoryTargets, readRepositoryText, writeRepositoryText } from "./repository_files.mjs";
 import { isOurBranch, runEnv } from "./git.mjs";
 import { ensureDir, readJson, writeJsonAtomic } from "./fs.mjs";
-import { execFileAsync, remoteMatches } from "./gh.mjs";
+import { execFileAsync } from "./process.mjs";
+import { remoteMatches } from "./repository.mjs";
 import { parsePrd, verifyCommands } from "./prd.mjs";
 import { normalizePublicBody } from "./block.mjs";
 import { assertPublicText, assertNoNul } from "./public_output.mjs";
@@ -103,6 +107,8 @@ async function applyExecutionResult(ctx, { id, entry, result, dir, verify = exec
   // input requires an explicit corrective run, with no repeated application.
   const fail = (message, retryable = false) => { throw Object.assign(executionError("EXECUTION_RESULT", message), { publicationValidation: !retryable }); };
   const validate = fn => { try { return fn(); } catch (error) { if (error.code) throw error; fail(error.message); } };
+  const approvedBrief = ctx.readPrd(id) || "";
+  const publicationPolicy = validate(() => publicationPolicyOf(parsePrd(approvedBrief, `${id}.md`), { sources: entry.sources || [] }));
   const execution = ctx.executionFor?.(id, entry.harness);
   const assertNotStopped = () => {
     const current = ctx.state?.get(id) || entry;
@@ -149,7 +155,7 @@ async function applyExecutionResult(ctx, { id, entry, result, dir, verify = exec
     catch (error) { fail(error.message); }
   };
   if (result.pushedHead) {
-    if (result.files?.length || await ctx.gh.refSha(entry.repo, entry.branch) !== result.pushedHead || !await ctx.gh.containsCommit(entry.repo, entry.branch, result.inputHead)) fail("pushed result revision or input ancestry cannot be verified");
+    if (result.files?.length || await hostApi(ctx).refSha(entry.repo, entry.branch) !== result.pushedHead || !await hostApi(ctx).containsCommit(entry.repo, entry.branch, result.inputHead)) fail("pushed result revision or input ancestry cannot be verified");
     if (head !== result.pushedHead) fail("reconcile the exact pushed provider branch into its isolated checkout before collection");
     await validateTargets();
   } else {
@@ -161,6 +167,7 @@ async function applyExecutionResult(ctx, { id, entry, result, dir, verify = exec
       paths.add(path);
       changes.push({ ...file, path });
     }
+    validate(() => assertPublicationPaths(changes.filter(file => file.text !== null).map(file => file.path), publicationPolicy));
     await validateTargets(changes.map(file => file.path));
     let modesMatch;
     try { modesMatch = await ctx.git.resultModesMatch(entry.worktree, result.inputHead, [...paths]); }
@@ -191,6 +198,15 @@ async function applyExecutionResult(ctx, { id, entry, result, dir, verify = exec
     }
   }
   const appliedHead = verified ? prior.appliedHead : await ctx.git.head(entry.worktree);
+  // A provider may return an already-pushed branch or a resumed publication may
+  // contain earlier commits. Check the full branch, not only this turn's manifest.
+  let publicationPaths;
+  try { publicationPaths = await ctx.git.publicationPaths(entry.worktree, entry.base); }
+  catch { fail("complete branch publication paths unavailable; retrieve Git base metadata before publication", true); }
+  validate(() => assertPublicationPaths(publicationPaths, publicationPolicy));
+  const privateInputPaths = [...new Set([...publicationPolicy.inputFiles, ...(entry.prd ? [entry.prd] : [])])]
+    .filter(path => workArtifactReason(path, publicationPolicy));
+  const privateInputs = privateInputPaths.map(path => ({ path, text: path === entry.prd ? approvedBrief : ctx.readSource?.(id, path) }));
   const assertVerifiedTree = async () => {
     let revision, tree;
     try {
@@ -199,7 +215,12 @@ async function applyExecutionResult(ctx, { id, entry, result, dir, verify = exec
     } catch { block("verification-state-unavailable", "cannot verify the checkout revision and clean index/worktree", appliedHead); }
     if (revision !== appliedHead) block("verification-head-changed", "verification changed the input head; review that change before publishing", appliedHead);
     if (!tree || ![tree.modified, tree.untracked].every(count => Number.isInteger(count) && count >= 0)) block("verification-state-unavailable", "cannot verify clean index/worktree status", appliedHead);
-    if (tree.modified || tree.untracked) block("verification-dirty", "verification requires a clean index/worktree; preserve uncommitted files before correction", appliedHead);
+    if (privateInputs.length) {
+      try {
+        await assertAgentsCheckout({ worktree: entry.worktree, overlays: privateInputs, immutableOverlays: true });
+        if (await ctx.git.resultModesMatch(entry.worktree, result.inputHead, privateInputPaths) !== true) throw new Error("private input modes changed");
+      } catch { block("verification-dirty", "verification requires a clean index/worktree apart from unchanged approved private inputs; preserve uncommitted files before correction", appliedHead); }
+    } else if (tree.modified || tree.untracked) block("verification-dirty", "verification requires a clean index/worktree; preserve uncommitted files before correction", appliedHead);
   };
   await assertVerifiedTree();
   const evidenceFile = join(dir, "verification.json");
@@ -256,10 +277,10 @@ async function applyExecutionResult(ctx, { id, entry, result, dir, verify = exec
   try {
     assertNotStopped();
     if (execution?.current && execution.current()?.id !== result.runId) fail("publication root changed; reconcile the exact owned result before publishing", true);
-    await ctx.git.pushResult(entry.worktree, entry.branch);
+    await ctx.git.pushResult(entry.worktree, entry.branch, entry.repo);
     await assertVerifiedTree();
     assertNotStopped();
-    const pr = await ctx.gh.publishResultPr({ repo: entry.repo, branch: entry.branch, base: entry.base, title: result.pr.title, body });
+    const pr = await hostApi(ctx).publishResultPr({ repo: entry.repo, branch: entry.branch, base: entry.base, title: result.pr.title, body });
     writeJsonAtomic(checkpoint, { fingerprint, phase: "published", appliedHead, pr: pr.number, url: pr.url });
     return { head: appliedHead, pr, evidence };
   } finally { exclusion.release(); }