@wrenai/genbi 0.0.3 → 0.0.5

package/dist-server/server/runtime-host/types.d.ts

@@ -0,0 +1,52 @@
+/**
+ * The session runtime boundary is intentionally smaller than the existing
+ * native-session lifecycle.  This module describes what the browser may know
+ * about a backend; process details remain in the host-only diagnostic surface.
+ */
+export declare const RUNTIME_BACKEND_IDS: readonly ["local", "codex-app-server", "claude-sandbox-runtime"];
+export type RuntimeBackendId = (typeof RUNTIME_BACKEND_IDS)[number];
+export declare const RUNTIME_CAPABILITIES: readonly ["pty", "terminal_replay", "terminal_resize", "terminal_terminate", "app_server_rpc", "sandbox_policy", "filesystem_isolation", "network_isolation"];
+export type RuntimeCapability = (typeof RUNTIME_CAPABILITIES)[number];
+export type RuntimeReadinessState = "ready" | "unavailable" | "incompatible" | "unprovisioned";
+export declare const RUNTIME_BACKEND_REASON_CODES: {
+    readonly local: readonly ["local_runtime_disabled", "local_runtime_host_unavailable", "local_runtime_production_forbidden", "runtime_probe_failed"];
+    readonly "codex-app-server": readonly ["codex_app_server_unprovisioned", "codex_cli_missing", "codex_cli_version_malformed", "codex_cli_version_unsupported", "codex_identity_uncertified", "codex_dependencies_drifted", "codex_app_server_unreachable", "codex_app_server_cleanup_failed", "codex_app_server_protocol_incompatible", "codex_sandbox_policy_unavailable", "codex_permission_profile_unavailable", "codex_wren_manifest_missing", "codex_wren_manifest_invalid", "codex_wren_platform_unsupported", "codex_wren_runtime_unprovisioned", "codex_wren_provision_failed", "codex_wren_interpreter_mismatch", "codex_wren_launcher_mismatch", "codex_wren_package_mismatch", "codex_wren_closure_mismatch", "codex_wren_profile_unavailable", "codex_wren_secret_unavailable", "codex_wren_session_home_unavailable", "codex_wren_child_env_invalid", "runtime_platform_unsupported", "runtime_policy_unavailable", "runtime_probe_failed"];
+    readonly "claude-sandbox-runtime": readonly ["claude_sandbox_runtime_unprovisioned", "claude_cli_missing", "claude_cli_version_malformed", "claude_cli_version_unsupported", "claude_identity_uncertified", "claude_sandbox_runtime_missing", "claude_sandbox_runtime_version_malformed", "claude_sandbox_runtime_version_unsupported", "claude_sandbox_capability_missing", "runtime_platform_unsupported", "runtime_policy_unavailable", "runtime_probe_failed"];
+};
+export type RuntimeBackendReasonCode<B extends RuntimeBackendId = RuntimeBackendId> = (typeof RUNTIME_BACKEND_REASON_CODES)[B][number];
+export interface RuntimeBackendReady {
+    readonly state: "ready";
+    /** Certified or development-local version token; never command output. */
+    readonly version: string;
+    /** Public capability names only. */
+    readonly capabilities: readonly RuntimeCapability[];
+}
+export interface RuntimeBackendNotReady<B extends RuntimeBackendId = RuntimeBackendId> {
+    readonly state: "unavailable" | "incompatible" | "unprovisioned";
+    readonly code: RuntimeBackendReasonCode<B>;
+    /** Fixed text derived from `code`, never from a command, path, or environment. */
+    readonly message: string;
+}
+export type RuntimeBackendReadiness<B extends RuntimeBackendId = RuntimeBackendId> = RuntimeBackendReady | RuntimeBackendNotReady<B>;
+/** Browser/API-safe projection. The selected result is always this record's own member. */
+export interface RuntimeReadiness {
+    readonly selected: RuntimeBackendId;
+    readonly selectedReadiness: RuntimeBackendReadiness;
+    readonly backends: Readonly<Record<RuntimeBackendId, RuntimeBackendReadiness>>;
+}
+/**
+ * Host-only support evidence. Values are constrained to parsed tokens and
+ * declared capabilities; no raw command output, filesystem path, credential,
+ * or environment value belongs in this type.
+ */
+export interface RuntimeBackendDiagnostic {
+    readonly phase: "policy" | "platform" | "version" | "identity" | "capability" | "provisioning" | "probe";
+    readonly observedVersion?: string;
+    readonly requiredCapability?: RuntimeCapability;
+    readonly attestedIdentity?: `sha256:${string}`;
+}
+export type RuntimeDiagnostics = Readonly<Record<RuntimeBackendId, RuntimeBackendDiagnostic>>;
+export interface RuntimeBackendProbeResult<B extends RuntimeBackendId = RuntimeBackendId> {
+    readonly readiness: RuntimeBackendReadiness<B>;
+    readonly diagnostic: RuntimeBackendDiagnostic;
+}

package/dist-server/server/runtime-host/types.js

@@ -0,0 +1,62 @@
+/**
+ * The session runtime boundary is intentionally smaller than the existing
+ * native-session lifecycle.  This module describes what the browser may know
+ * about a backend; process details remain in the host-only diagnostic surface.
+ */
+export const RUNTIME_BACKEND_IDS = ["local", "codex-app-server", "claude-sandbox-runtime"];
+export const RUNTIME_CAPABILITIES = [
+    "pty",
+    "terminal_replay",
+    "terminal_resize",
+    "terminal_terminate",
+    "app_server_rpc",
+    "sandbox_policy",
+    "filesystem_isolation",
+    "network_isolation",
+];
+export const RUNTIME_BACKEND_REASON_CODES = {
+    local: ["local_runtime_disabled", "local_runtime_host_unavailable", "local_runtime_production_forbidden", "runtime_probe_failed"],
+    "codex-app-server": [
+        "codex_app_server_unprovisioned",
+        "codex_cli_missing",
+        "codex_cli_version_malformed",
+        "codex_cli_version_unsupported",
+        "codex_identity_uncertified",
+        "codex_dependencies_drifted",
+        "codex_app_server_unreachable",
+        "codex_app_server_cleanup_failed",
+        "codex_app_server_protocol_incompatible",
+        "codex_sandbox_policy_unavailable",
+        "codex_permission_profile_unavailable",
+        "codex_wren_manifest_missing",
+        "codex_wren_manifest_invalid",
+        "codex_wren_platform_unsupported",
+        "codex_wren_runtime_unprovisioned",
+        "codex_wren_provision_failed",
+        "codex_wren_interpreter_mismatch",
+        "codex_wren_launcher_mismatch",
+        "codex_wren_package_mismatch",
+        "codex_wren_closure_mismatch",
+        "codex_wren_profile_unavailable",
+        "codex_wren_secret_unavailable",
+        "codex_wren_session_home_unavailable",
+        "codex_wren_child_env_invalid",
+        "runtime_platform_unsupported",
+        "runtime_policy_unavailable",
+        "runtime_probe_failed",
+    ],
+    "claude-sandbox-runtime": [
+        "claude_sandbox_runtime_unprovisioned",
+        "claude_cli_missing",
+        "claude_cli_version_malformed",
+        "claude_cli_version_unsupported",
+        "claude_identity_uncertified",
+        "claude_sandbox_runtime_missing",
+        "claude_sandbox_runtime_version_malformed",
+        "claude_sandbox_runtime_version_unsupported",
+        "claude_sandbox_capability_missing",
+        "runtime_platform_unsupported",
+        "runtime_policy_unavailable",
+        "runtime_probe_failed",
+    ],
+};

package/dist-server/server/structured-query-evidence.d.ts

@@ -0,0 +1,7 @@
+import type { RenderEnvelope } from "../harness/render/envelope.js";
+/** Only call with returns from scoped host tools, never vendor messages or tool arguments.
+ * Keep every root in call order; mixed failure/success must not look wholly verified.
+ */
+export declare function structuredQueryEnvelope(roots: readonly unknown[], explanation: string): RenderEnvelope | undefined;
+/** Supply the clock explicitly. Historical datasets must never silently become 'recent'. */
+export declare function analyticalAskPrompt(question: string, now: Date): string;

package/dist-server/server/structured-query-evidence.js

@@ -0,0 +1,47 @@
+import { z } from "zod";
+const cell = z.union([z.string(), z.number().finite(), z.boolean(), z.null()]);
+const table = z.object({ columns: z.array(z.string()).min(1), rows: z.array(z.union([z.array(cell), z.record(z.string(), cell)])) });
+const definition = z.object({ sql: z.string().trim().min(1), source_tables: z.array(z.string()).optional(), filters: z.array(z.string()).optional() });
+const renderResult = z.object({ status: z.literal("ok"),
+    output: z.object({ kind: z.literal("render"), blocks: z.array(z.object({ type: z.string() }).passthrough()) }),
+    provenance: z.object({ verified: z.literal(true) }) });
+const result = z.object({ status: z.literal("ok"), output: z.object({ kind: z.literal("value"), value: table }),
+    provenance: z.object({ verified: z.literal(true), definition }) });
+/** Only call with returns from scoped host tools, never vendor messages or tool arguments.
+ * Keep every root in call order; mixed failure/success must not look wholly verified.
+ */
+export function structuredQueryEnvelope(roots, explanation) {
+    if (!roots.length)
+        return undefined;
+    const blocks = [];
+    for (const raw of roots) {
+        const parsed = result.safeParse(raw);
+        if (!parsed.success) {
+            const rendered = renderResult.safeParse(raw);
+            if (!rendered.success || !rendered.data.output.blocks.length)
+                return undefined;
+            blocks.push(...rendered.data.output.blocks);
+            continue;
+        }
+        const { columns, rows } = parsed.data.output.value;
+        if (new Set(columns).size !== columns.length || rows.some((row) => Array.isArray(row)
+            ? row.length !== columns.length : columns.some((name) => !Object.hasOwn(row, name))))
+            return undefined;
+        blocks.push({ type: "table", columns, rows }, { type: "definition", ...parsed.data.provenance.definition });
+    }
+    return { blocks, verified: true, verificationScope: "query-results", explanation };
+}
+/** Supply the clock explicitly. Historical datasets must never silently become 'recent'. */
+export function analyticalAskPrompt(question, now) {
+    return `Current reference time (UTC): ${now.toISOString()}.
+Use the selected analysis tool for data questions and pass the user's requested period and metric definitions faithfully.
+If no period was specified, use the full available data range and disclose this assumption; do not invent a recent N-week limit.
+For relative periods, distinguish the current calendar from the latest data date. Never silently re-anchor a calendar-relative request.
+The application displays successful query rows and SQL directly. Do not repeat the table or serialize an answer envelope in your final text.
+Instead explain in the user's language: exact date range and anchor, date field, week start, timezone (or unknown), partial periods,
+and the definition of each metric. Separate context-defined metrics from assumptions. Do not invent signup dates or duplicate synonymous metrics.
+If the result cannot establish a date bound or definition, state that it is unknown or ask for clarification. Do not invent evidence.
+
+User question:
+${question}`;
+}

package/dist-server/server/structured-runtime.d.ts

@@ -0,0 +1,52 @@
+import { type AuthChoice, type RouteOptions, type RouteResult, type SetupStepRunner, type SetupStepRunOptions, type SetupStepRunResult } from "../harness/index.js";
+import type { RuntimeBackendReadiness } from "./runtime-host/types.js";
+export type StructuredVendor = "codex" | "claude";
+export type StructuredBackend = "local" | "codex-app-server" | "claude-sandbox-runtime";
+export interface StructuredScope {
+    readonly sessionId: string;
+    readonly turnId: string;
+    readonly signal?: AbortSignal;
+    /** Captured host state, rechecked before/after preparation, tools, events and results. */
+    assertCurrent(): void;
+}
+export declare class StructuredRuntimeError extends Error {
+    readonly code: "unavailable" | "unsupported" | "stale" | "cancelled" | "failed" | "cleanup" | "timeout";
+    constructor(code: "unavailable" | "unsupported" | "stale" | "cancelled" | "failed" | "cleanup" | "timeout");
+}
+export interface StructuredAdapter {
+    readonly vendor: StructuredVendor;
+    readonly backend: Exclude<StructuredBackend, "local">;
+    probe(): Promise<RuntimeBackendReadiness>;
+    ask?(options: RouteOptions, scope: StructuredScope): Promise<RouteResult>;
+    setup?(options: SetupStepRunOptions, scope: StructuredScope): Promise<SetupStepRunResult>;
+}
+interface Options {
+    readonly selected: {
+        readonly codex: "local" | "codex-app-server";
+        readonly claude: "local" | "claude-sandbox-runtime";
+    };
+    /** Explicit compatibility opt-in, never proof of vendor sandboxing. */
+    readonly allowLocal: boolean;
+    readonly deployment?: RouteOptions["deployment"];
+    readonly localRoute: (options: RouteOptions) => Promise<RouteResult>;
+    readonly localSetupFor: (auth: AuthChoice) => SetupStepRunner | undefined;
+    readonly adapters?: Readonly<Partial<Record<StructuredVendor, StructuredAdapter>>>;
+}
+/** Server composition owns backend choice. No browser paths/configuration select a backend. */
+export declare class StructuredRuntime {
+    private readonly options;
+    private readonly lifetime;
+    private readonly controllers;
+    private readonly active;
+    private cleanupFailed;
+    constructor(options: Options);
+    private adapter;
+    readiness(): Promise<any>;
+    route(options: RouteOptions, scope: StructuredScope): Promise<RouteResult>;
+    setup(options: SetupStepRunOptions, scope: StructuredScope): Promise<SetupStepRunResult>;
+    private run;
+    assertActive(): void;
+    revoke(): void;
+    shutdown(): Promise<void>;
+}
+export {};

package/dist-server/server/structured-runtime.js

@@ -0,0 +1,130 @@
+import { enforceCompliance } from "../harness/index.js";
+export class StructuredRuntimeError extends Error {
+    code;
+    constructor(code) {
+        super(`Structured runtime ${code}.`);
+        this.code = code;
+    }
+}
+/** Server composition owns backend choice. No browser paths/configuration select a backend. */
+export class StructuredRuntime {
+    options;
+    lifetime = new AbortController();
+    controllers = new Set();
+    active = new Set();
+    cleanupFailed = false;
+    constructor(options) {
+        this.options = { ...options, selected: Object.freeze({ ...options.selected }), adapters: Object.freeze({ ...options.adapters }) };
+    }
+    adapter(vendor) {
+        const candidate = this.options.adapters?.[vendor];
+        return candidate?.vendor === vendor && candidate.backend === this.options.selected[vendor] ? candidate : undefined;
+    }
+    async readiness() {
+        const entries = await Promise.all(["codex", "claude"].map(async (vendor) => {
+            const backend = this.options.selected[vendor];
+            const localReady = this.options.allowLocal && !this.lifetime.signal.aborted;
+            if (backend === "local")
+                return [vendor, { backend, state: localReady ? "ready" : "unavailable", ask: localReady, setup: localReady && !!this.options.localSetupFor({ mode: "subscription", provider: vendor }), reason: this.options.allowLocal ? "Explicit local execution; vendor isolation is not claimed." : "Local execution is disabled." }];
+            const adapter = this.adapter(vendor);
+            let probe;
+            try {
+                probe = await adapter?.probe();
+            }
+            catch { /* fixed public failure below */ }
+            const ready = !this.lifetime.signal.aborted && probe?.state === "ready";
+            return [vendor, { backend, state: ready ? "ready" : "unavailable", ask: ready && !!adapter?.ask, setup: ready && !!adapter?.setup,
+                    reason: !adapter ? "Selected vendor backend is not configured." : !ready ? "Selected vendor backend is not ready." : "Only explicitly supported operations are available.",
+                    ...(probe && probe.state !== "ready" ? { code: probe.code } : {}) }];
+        }));
+        return Object.fromEntries(entries);
+    }
+    async route(options, scope) {
+        return this.run(options.authChoice, scope, async (adapter, guarded) => {
+            const request = { ...options, signal: guarded.signal, onEvent: (event) => { guarded.assertCurrent(); options.onEvent?.(event); } };
+            if (!adapter)
+                return this.options.localRoute(request);
+            if (!adapter.ask)
+                throw new StructuredRuntimeError("unsupported");
+            return adapter.ask(request, guarded);
+        }, options.deployment);
+    }
+    async setup(options, scope) {
+        return this.run(options.authChoice, scope, async (adapter, guarded) => {
+            const request = { ...options, signal: guarded.signal, onEvent: (event) => { guarded.assertCurrent(); options.onEvent?.(event); } };
+            if (!adapter) {
+                const runner = this.options.localSetupFor(options.authChoice);
+                if (!runner)
+                    throw new StructuredRuntimeError("unavailable");
+                return runner.run(request);
+            }
+            if (!adapter.setup || options.resumeSessionId !== undefined)
+                throw new StructuredRuntimeError("unsupported");
+            // Isolated runners must not mint legacy provider-resume anchors.
+            const result = await adapter.setup(request, guarded);
+            return { finalText: result.finalText };
+        });
+    }
+    run(auth, scope, operation, deployment = "personal") {
+        const controller = new AbortController();
+        this.controllers.add(controller);
+        const signal = AbortSignal.any([controller.signal, this.lifetime.signal, ...(scope.signal ? [scope.signal] : [])]);
+        const assertCurrent = () => {
+            if (signal.aborted)
+                throw new StructuredRuntimeError("cancelled");
+            try {
+                scope.assertCurrent();
+            }
+            catch {
+                throw new StructuredRuntimeError("stale");
+            }
+        };
+        const pending = (async () => {
+            assertCurrent();
+            enforceCompliance(auth, { deployment: this.options.deployment ?? deployment });
+            let adapter;
+            if (auth.mode === "subscription" && this.options.selected[auth.provider] !== "local") {
+                adapter = this.adapter(auth.provider);
+                if (!adapter)
+                    throw new StructuredRuntimeError("unavailable");
+                let ready;
+                try {
+                    ready = await adapter.probe();
+                }
+                catch {
+                    throw new StructuredRuntimeError("unavailable");
+                }
+                assertCurrent();
+                if (ready.state !== "ready")
+                    throw new StructuredRuntimeError("unavailable");
+            }
+            else if (auth.mode === "subscription" && !this.options.allowLocal)
+                throw new StructuredRuntimeError("unavailable");
+            let result;
+            try {
+                result = await operation(adapter, { sessionId: scope.sessionId, turnId: scope.turnId, signal, assertCurrent });
+            }
+            catch (error) {
+                if (adapter && !(error instanceof StructuredRuntimeError))
+                    throw new StructuredRuntimeError(signal.aborted ? "cancelled" : "failed");
+                throw error;
+            }
+            assertCurrent();
+            return result;
+        })();
+        this.active.add(pending);
+        void pending.catch((error) => { if (error instanceof StructuredRuntimeError && error.code === "cleanup")
+            this.cleanupFailed = true; }).finally(() => { this.active.delete(pending); this.controllers.delete(controller); });
+        return pending;
+    }
+    assertActive() { if (this.lifetime.signal.aborted)
+        throw new StructuredRuntimeError("cancelled"); }
+    revoke() { for (const controller of this.controllers)
+        controller.abort(); }
+    async shutdown() {
+        this.lifetime.abort();
+        await Promise.allSettled([...this.active]);
+        if (this.cleanupFailed)
+            throw new StructuredRuntimeError("cleanup");
+    }
+}

package/dist-server/server/structured-scope.d.ts

@@ -0,0 +1,4 @@
+import type { Store, TurnRow } from "./db.js";
+import { type StructuredScope } from "./structured-runtime.js";
+/** Captured host-only values are compared, never persisted or sent as model/browser authority. */
+export declare function captureStructuredScope(store: Store, turn: TurnRow, getProject: () => string | undefined, signal?: AbortSignal): StructuredScope;

package/dist-server/server/structured-scope.js

@@ -0,0 +1,12 @@
+import { StructuredRuntimeError } from "./structured-runtime.js";
+/** Captured host-only values are compared, never persisted or sent as model/browser authority. */
+export function captureStructuredScope(store, turn, getProject, signal) {
+    const snapshot = () => JSON.stringify({ runtime: store.getRuntimeSettings(), generation: store.getNativeRuntimeBinding().generation,
+        binding: store.getEnrichmentBinding(), project: getProject(), ...(turn.setupStepKey !== null ? { form: store.getSetupConnectForm() } : {}) });
+    const captured = snapshot();
+    return { sessionId: turn.sessionId, turnId: turn.id, ...(signal ? { signal } : {}), assertCurrent() {
+            const current = store.getTurn(turn.id);
+            if (signal?.aborted || snapshot() !== captured || !current || current.sessionId !== turn.sessionId || current.resultKind !== null)
+                throw new StructuredRuntimeError("stale");
+        } };
+}

package/dist-server/server/turn.d.ts

@@ -1,3 +1,5 @@
+import type { ProfileRegistry } from "./profile-registry.js";
+import type { StructuredRuntime } from "./structured-runtime.js";
 import type { AuthChoice, Bundle, LoginProbe, RouteOptions, RouteResult, SetupStepRunner } from "../harness/index.js";
 import type { SubscriptionModelCatalog, SubscriptionProvider } from "./wire-types.js";
 import { type Store } from "./db.js";
@@ -23,6 +25,7 @@ export declare class ArtifactNotFoundError extends Error {
 }
 export interface TurnDeps {
     readonly store: Store;
+    readonly structuredRuntime?: StructuredRuntime;
     readonly route: (options: RouteOptions) => Promise<RouteResult>;
     /** A native vendor TUI host, deliberately independent from Ask/SSE. */
     readonly startInteractiveTerminal?: (input: {
@@ -48,6 +51,8 @@ export interface TurnDeps {
     readonly nativeSessions?: NativeSessionService;
     /** Session-scoped MCP persistence service; never used by Ask publish routes. */
     readonly nativeArtifacts?: NativeArtifactService;
+    /** Server-held registry of conversation profiles; absent means `/api/profiles` answers 503. */
+    readonly profileRegistry?: ProfileRegistry;
     readonly baseRouteOptions: Omit<RouteOptions, "question" | "onEvent">;
     /**
      * Ask/compile-bind only: compiles+loads the analysis profile's bundle.
@@ -64,7 +69,7 @@ export interface TurnDeps {
      * dependency resolves the corresponding server-owned profile source. It is
      * intentionally distinct from native-session IR/launch wiring.
      */
-    readonly describeHarnessBundle?: (purpose: NativePurpose, options: Omit<RouteOptions, "question" | "onEvent">) => Promise<Bundle>;
+    readonly describeHarnessBundle?: (purpose: NativePurpose, options: Omit<RouteOptions, "question" | "onEvent">, profileSource?: string) => Promise<Bundle>;
     /**
      * Compiles the canonical post-bind profile without rebinding its context and
      * returns its declared tier names. Unlike `describeBundle`, this seam is

package/dist-server/server/turn.js

@@ -1,3 +1,4 @@
+import { captureStructuredScope } from "./structured-scope.js";
 /**
  * Orchestrates one turn end-to-end: clarify pre-flight, context
  * composition, invoking `route()`, folding its result/events into the UI's
@@ -16,7 +17,7 @@ import { assertRuntimeSettingsDispatchable, materializeRuntimeRouteOptions } fro
 import { classifyClarify } from "./clarify.js";
 import { classifyIntent } from "./route-intent.js";
 import { composeClarifyFollowUp, composeInput } from "./compose.js";
-import { clarifyDecisionStep, extractTrace, foldTrace, gateDecisionStep, gateFailureStep, hostContractRecoveryStep, LiveWorkLog, redactPublicSetupText, sanitizeLiveSetupWorklog, sanitizePublicSetupWorklog, routeDecisionStep, summarizeResult, toAnswerOrRefusalEvent, toArtifactEvent, } from "./fold.js";
+import { clarifyDecisionStep, extractTrace, foldTrace, gateDecisionStep, gateFailureStep, hostContractRecoveryStep, LiveWorkLog, redactPublicSetupText, sanitizeLiveSetupWorklog, sanitizePublicSetupWorklog, routeDecisionStep, summarizeResult, toAnswerOrRefusalEvent, toArtifactEvent, withHostVerification, } from "./fold.js";
 export class SessionNotFoundError extends Error {
     sessionId;
     constructor(sessionId) {
@@ -255,7 +256,7 @@ async function replayResolvedTurn(store, turn, emit) {
 }
 async function executeTurn(deps, session, turn, emit, signal) {
     if (turn.setupStepKey !== null) {
-        await executeSetupTurn(deps, session, turn, emit);
+        await executeSetupTurn(deps, session, turn, emit, signal);
         return;
     }
     const liveLog = new LiveWorkLog();
@@ -285,20 +286,9 @@ async function executeTurn(deps, session, turn, emit, signal) {
             chain = chain.then(() => emit({ event: "worklog", data: merged }));
         }
     };
-    let result;
-    try {
-        const routeOptions = {
-            ...effectiveRouteOptions(deps),
-            question: turn.composedInput ?? turn.question,
-            onEvent,
-            ...(signal !== undefined ? { signal } : {}),
-            // the turn's own persisted agent id (classified once at postTurn time), so a turn
-            // always resolves to the same agent whether executed live or (via a future replay path) re-run.
-            ...(turn.agentId !== null ? { agentId: turn.agentId } : {}),
-        };
-        result = await deps.route(routeOptions);
-    }
-    catch (err) {
+    const runtimeScope = deps.structuredRuntime ? captureStructuredScope(deps.store, turn, () => resolveUserProject(deps), signal) : undefined;
+    const assertCurrent = () => { deps.structuredRuntime?.assertActive(); runtimeScope?.assertCurrent(); };
+    const failTurn = async (err) => {
         await chain;
         const message = err instanceof Error ? err.message : String(err);
         // Persist the PARTIAL work log on failure — the Route/Clarify
@@ -312,7 +302,25 @@ async function executeTurn(deps, session, turn, emit, signal) {
         deps.store.resolveTurn(turn.id, { backend: null, resultKind: "error", answerSummary: null, traceJson: JSON.stringify(partialWorklog), errorMessage: message });
         deps.store.updateSessionStatus(session.id, "active", null);
         await emit({ event: "error", data: { message } });
-        return; // spec: on error emit ONLY the error frame, never a trailing done
+    };
+    let result;
+    try {
+        const routeOptions = {
+            ...effectiveRouteOptions(deps),
+            question: turn.composedInput ?? turn.question,
+            onEvent,
+            ...(signal !== undefined ? { signal } : {}),
+            // the turn's own persisted agent id (classified once at postTurn time), so a turn
+            // always resolves to the same agent whether executed live or (via a future replay path) re-run.
+            ...(turn.agentId !== null ? { agentId: turn.agentId } : {}),
+        };
+        result = deps.structuredRuntime
+            ? await deps.structuredRuntime.route(routeOptions, runtimeScope)
+            : await deps.route(routeOptions);
+    }
+    catch (err) {
+        await failTurn(err);
+        return;
     }
     await chain;
     // Prefer the live worklog snapshot (LLM step rows interleaved
@@ -339,7 +347,16 @@ async function executeTurn(deps, session, turn, emit, signal) {
     // artifact-producing component (`generate_dashboard`/`explain_change` —
     // NOT a plain `answer_query` table), persist it as a real artifact too, so
     // it's publishable regardless of which backend ran the turn.
-    const artifactEvent = await maybeCreateDispatchedArtifact(deps, session, turn, result, terminalEvent);
+    let artifactEvent;
+    try {
+        assertCurrent();
+        artifactEvent = await maybeCreateDispatchedArtifact(deps, session, turn, result, terminalEvent, assertCurrent);
+        assertCurrent();
+    }
+    catch (err) {
+        await failTurn(err);
+        return;
+    }
     // Persist the turn as fully resolved BEFORE emitting any terminal frames.
     // If a client disconnect makes an emit below throw, the turn is already
     // resolved, so the next stream deterministically REPLAYS these stored frames
@@ -384,11 +401,13 @@ async function executeTurn(deps, session, turn, emit, signal) {
  * verbatim as JSON to a session-scoped file under the same artifacts root
  * the in-process `write_artifact` tool uses (`resolveArtifactsDir`) — self-
  * contained from the envelope, no dependency on the dispatcher's `htmlPath`
- * (never present in the NDJSON stream today). `verified` comes straight from
- * the envelope's own `verified` field, never hardcoded.
+ * (never present in the NDJSON stream today). `verified` comes from the
+ * envelope after {@link withHostVerification}, so an artifact is stored as
+ * verified only when host evidence grounds it (a codex:local answer citing
+ * this turn's host-run queries), never on the model's own claim.
  */
-async function maybeCreateDispatchedArtifact(deps, session, turn, result, terminalEvent) {
-    if (result.backend !== "agent-sdk" && result.backend !== "codex-local")
+async function maybeCreateDispatchedArtifact(deps, session, turn, result, terminalEvent, assertCurrent) {
+    if (result.backend !== "agent-sdk" && result.backend !== "codex-local" && result.backend !== "codex-app-server")
         return undefined;
     if (terminalEvent.kind !== "answer" || terminalEvent.answer.form !== "rich")
         return undefined;
@@ -396,7 +415,8 @@ async function maybeCreateDispatchedArtifact(deps, session, turn, result, termin
         return undefined;
     if (!(await isArtifactProducerAgent(deps, turn.agentId)))
         return undefined;
-    const envelope = terminalEvent.answer.envelope;
+    assertCurrent();
+    const envelope = withHostVerification(result, terminalEvent.answer.envelope);
     const artifactKind = artifactKindForAgent(turn.agentId);
     const verified = envelope.verified === true;
     const sessionArtifactsDir = path.join(resolveArtifactsDir(effectiveRouteOptions(deps).outDir), session.id);
@@ -516,7 +536,7 @@ function turnRecoveryAnchor(turn, sessionId, authChoice) {
  * `status` field, which the frontend inspects (see the wire contract in the
  * final report). Only a parsed `error` persists as `resultKind: "error"`.
  */
-async function executeSetupTurn(deps, session, turn, emit) {
+async function executeSetupTurn(deps, session, turn, emit, signal) {
     // Provider session anchors are server-only. Keep every anchor that becomes
     // known during this turn so a host-contract continuation that rotates its
     // anchor still redacts both the original and replacement from the combined
@@ -645,7 +665,11 @@ async function executeSetupTurn(deps, session, turn, emit) {
         const data = initialAuthChoice.mode === "subscription" ? sanitizeLiveSetupWorklog(snapshot) : publicWorklog(snapshot);
         chain = chain.then(() => emit({ event: "worklog", data }));
     };
-    const runAttempt = (prompt, authChoice, resumeSessionId) => setupRunner.run({
+    const runtimeScope = captureStructuredScope(deps.store, turn, () => resolveUserProject(deps), signal);
+    const runSelected = (options) => deps.structuredRuntime
+        ? deps.structuredRuntime.setup(options, runtimeScope) : setupRunner.run(options);
+    const runAttempt = (prompt, authChoice, resumeSessionId) => runSelected({
+        ...(signal ? { signal } : {}),
         prompt,
         workspaceRoot,
         // The form was validated before persistence. Thread it to dispatched so
@@ -744,6 +768,16 @@ async function executeSetupTurn(deps, session, turn, emit) {
         return;
     }
     await chain.catch(() => { });
+    try {
+        if (deps.structuredRuntime) {
+            deps.structuredRuntime.assertActive();
+            runtimeScope.assertCurrent();
+        }
+    }
+    catch (error) {
+        await failWithError(error instanceof Error ? error.message : "Structured runtime stale.", liveLog.snapshot());
+        return;
+    }
     const worklog = liveLog.snapshot();
     let terminal = parseTerminalWithRetainedLifecycle(finalText, worklog);
     terminal = { ...terminal, message: redactPublicSetupText(terminal.message) };
@@ -816,6 +850,16 @@ async function executeSetupTurn(deps, session, turn, emit) {
             return;
         }
     }
+    try {
+        if (deps.structuredRuntime) {
+            deps.structuredRuntime.assertActive();
+            runtimeScope.assertCurrent();
+        }
+    }
+    catch (error) {
+        await failWithError(error instanceof Error ? error.message : "Structured runtime stale.", liveLog.snapshot());
+        return;
+    }
     // A completed runner result can introduce a new server-owned anchor after
     // the live frames have begun. Re-sanitize every normal terminal boundary
     // with that now-known identity before it reaches SSE or SQLite.
@@ -882,6 +926,8 @@ async function executeSetupTurn(deps, session, turn, emit) {
             if (temporarilyBoundForHealthcheck) {
                 deps.bindProject(path.join(workspaceRoot, form.projectName));
             }
+            // Refresh only after the host-owned bind, then fence the asynchronous healthcheck.
+            const healthcheckScope = captureStructuredScope(deps.store, turn, () => resolveUserProject(deps), signal);
             let compileHealthcheckFailure;
             if (!deps.describeBundle) {
                 compileHealthcheckFailure = "the profile compile healthcheck is not configured";
@@ -894,6 +940,17 @@ async function executeSetupTurn(deps, session, turn, emit) {
                     compileHealthcheckFailure = summarizeCompileHealthcheckFailure(err);
                 }
             }
+            try {
+                if (deps.structuredRuntime) {
+                    deps.structuredRuntime.assertActive();
+                    healthcheckScope.assertCurrent();
+                }
+            }
+            catch (error) {
+                // A newer binding belongs to its new owner; never roll it back here.
+                await failWithError(error instanceof Error ? error.message : "Structured runtime stale.", finalWorklog);
+                return;
+            }
             if (compileHealthcheckFailure !== undefined) {
                 if (temporarilyBoundForHealthcheck)
                     deps.unbindProject?.();