@zq-silk/yui 0.15.0 → 0.15.2

package/dist/controller/jobControl.js

@@ -12,7 +12,10 @@ import { createHash } from "node:crypto";
 import { resolve, sep } from "node:path";
 import { acknowledgeUnknownDurableJob, createDurableJob, durableJobIdempotencyKey, isDurableJobTerminal, requestDurableJobCancel, retryDurableJobIdempotencyKey } from "../job/durableJob.js";
 import { activeLiveRoleAgentSession } from "../executor/agentExecutor.js";
+import { CallAuthority } from "../kernel/callAuthority.js";
+import { redactLaunchText } from "../runtime/launchDiagnostics.js";
 export function createDurableJobControl(store) {
+    const authority = createJobCallAuthority(store);
     return {
         startJob(params, now) {
             // rr4/finding-3: The entire create path — validation, idempotency
@@ -20,7 +23,8 @@ export function createDurableJobControl(store) {
             // between the idempotency check and the save lets a concurrent
             // startJob with the same key create a duplicate job.
             return store.transaction((tx) => {
-                validateStartParams(tx, params);
+                const context = authority.authenticate(Object.freeze({ ...params.caller }), params.taskId);
+                assertNonSecretJobInput(params);
                 const baseKey = durableJobIdempotencyKey({
                     owner: params.owner,
                     projectId: params.projectId,
@@ -29,12 +33,48 @@ export function createDurableJobControl(store) {
                     workspace: params.workspace,
                     env: params.env
                 });
-                const key = params.retryOf === undefined
+                const inputDigest = params.retryOf === undefined
                     ? baseKey
                     : retryDurableJobIdempotencyKey(baseKey, params.retryOf);
+                const requestId = params.requestId === undefined ? inputDigest
+                    : requiredId(params.requestId, "job.start requestId");
+                // An IntegrationAttempt already is a durable operation identity.
+                // Recovery by another authorized Role must find its original Job,
+                // including the window before Integration persisted the returned id.
+                if (params.owner.kind === "integration-attempt") {
+                    const integrationId = params.owner.integrationAttemptId;
+                    const owned = tx.listDurableJobs(params.taskId).filter((job) => (job.owner.kind === "integration-attempt"
+                        && job.owner.integrationAttemptId === integrationId));
+                    if (owned.length > 1) {
+                        throw jobDomainError("IntegrationAttempt has multiple Jobs; inspect its existing records.");
+                    }
+                    const original = owned[0];
+                    if (original !== undefined) {
+                        if (original.operation.inputDigest !== inputDigest
+                            || original.operation.targetId !== params.workspace) {
+                            throw jobDomainError(`Integration Job input conflicts with its original request: ${original.id}.`);
+                        }
+                        return { job: original, created: false };
+                    }
+                }
+                const key = createHash("sha256").update(JSON.stringify([
+                    context.actorId, requestId
+                ])).digest("hex");
                 const existing = tx.findDurableJobByIdempotencyKey(params.taskId, key);
-                if (existing !== null)
+                if (existing !== null) {
+                    if (existing.operation.inputDigest !== inputDigest || existing.operation.targetId !== params.workspace) {
+                        throw jobDomainError(`Job request identity conflicts with its original input: ${existing.id}.`);
+                    }
                     return { job: existing, created: false };
+                }
+                // A historical content-addressed request has no attributable caller.
+                // Do not silently execute it again under a newly attributed identity.
+                const historical = tx.findDurableJobByIdempotencyKey(params.taskId, inputDigest);
+                if (params.requestId === undefined && historical !== null) {
+                    throw jobDomainError(`Historical request already exists: ${historical.id}; inspect it or select an explicit new requestId.`);
+                }
+                authority.authorize(context, params.taskId);
+                validateStartParams(tx, params);
                 const id = tx.nextDurableJobId(params.taskId);
                 const job = createDurableJob({
                     id,
@@ -45,6 +85,10 @@ export function createDurableJobControl(store) {
                     workspace: params.workspace,
                     env: params.env,
                     steps: params.steps,
+                    operation: {
+                        requestId, inputDigest, actorId: context.actorId,
+                        authorityRef: jobAuthorityBinding(tx, params.caller.scope, params.caller.role, params.taskId)
+                    },
                     artifactsLocator: `artifacts/jobs/${params.taskId}/${id}`,
                     ...(params.retryOf === undefined ? {} : { retryOf: params.retryOf })
                 }, now);
@@ -83,6 +127,78 @@ export function createDurableJobControl(store) {
         }
     };
 }
+/** T02 ingress adapter. The existing Job boundary remains the authority and
+ * semantic writer; this does not authorize arbitrary plugin or resource work.
+ */
+export function createJobCallAuthority(store) {
+    return new CallAuthority((caller, taskId) => {
+        assertCallerAuthorized(store, caller, taskId);
+        return caller.scope === "task"
+            ? `task:${taskId}/role:${caller.role}`
+            : `global:${caller.role}`;
+    });
+}
+/** The collector does not use this gate: late results belong to the original
+ * Job even when its management binding is revoked. Only a new spawn checks it.
+ */
+export function authorizeJobStart(store, job) {
+    const taskPrefix = `task:${job.taskId}/role:`;
+    const actor = job.operation.actorId;
+    const scope = actor.startsWith(taskPrefix) ? "task" : actor.startsWith("global:") ? "global" : undefined;
+    if (scope === undefined)
+        throw jobDomainError("Job caller binding is unavailable; no execution was started.");
+    const role = actor.slice(scope === "task" ? taskPrefix.length : "global:".length);
+    if (jobAuthorityBinding(store, scope, role, job.taskId) !== job.operation.authorityRef) {
+        throw jobDomainError("Job caller binding was revoked; no execution was started.");
+    }
+    validateJobTarget(store, job);
+}
+function jobAuthorityBinding(store, scope, roleName, taskId) {
+    // A Host detach/reattach preserves the native Session and its queued work.
+    // Authenticate the live launch at ingress, but bind accepted Jobs to the
+    // caller's durable Session identity, not its disposable Host generation.
+    if (scope === "task") {
+        const role = store.getRole(taskId, roleName);
+        const sessions = store.getTaskRoleSessionSet(taskId, roleName);
+        const session = activeLiveRoleAgentSession(sessions);
+        const hash = role === null ? null : store.getJobCallerKeyHash(taskId, roleName, role.activeAgentId);
+        if (hash === null || role === null || sessions?.activeAgentId !== role.activeAgentId
+            || session === null || session.agentId !== role.activeAgentId) {
+            throw jobDomainError("Current Job caller Session is unavailable.");
+        }
+        return createHash("sha256").update(JSON.stringify([
+            hash, session.agentId, session.adapterId, session.nativeSessionId
+        ])).digest("hex");
+    }
+    const role = store.getGlobalRole(roleName);
+    const session = activeLiveRoleAgentSession(store.getGlobalRoleSessionSet(roleName));
+    if (role === null || session === null)
+        throw jobDomainError("Current Job caller binding is unavailable.");
+    return createHash("sha256").update(JSON.stringify([
+        role.activeAgentId, session.agentId, session.nativeSessionId
+    ])).digest("hex");
+}
+function assertNonSecretJobInput(params) {
+    // Existing Jobs persist commands and environments. This boundary accepts
+    // non-secret executable specifications only; credential resolution is not a
+    // Job feature. Never hash a known secret then call the digest sanitized.
+    const secretKey = /api[_-]?key|private[_-]?key|token|secret|password|passwd|cookie|credential|authorization/i;
+    for (const env of [params.env, ...params.steps.map((step) => step.env ?? {})]) {
+        if (Object.keys(env).some((key) => secretKey.test(key))) {
+            throw jobDomainError("Job input cannot persist credentials; use a non-secret specification.");
+        }
+    }
+    const input = JSON.stringify({
+        env: params.env, steps: params.steps, requestId: params.requestId
+    });
+    // Reject recognizable key material regardless of the parameter name, and
+    // URL userinfo before either hashing or persisting the specification.
+    const privateKey = /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY-----/;
+    const urlCredential = /[a-z][a-z0-9+.-]*:\/\/[^\s/"<>]+:[^\s/"<>]*@/i;
+    if (privateKey.test(input) || urlCredential.test(input) || redactLaunchText(input) !== input) {
+        throw jobDomainError("Job input cannot persist credentials; use a non-secret specification.");
+    }
+}
 /**
  * Persisted-boundary validation for `job.start`. The owner must resolve to a
  * live Task record, the Task must be active, the workspace must be the exact
@@ -94,6 +210,10 @@ export function createDurableJobControl(store) {
  * managed workspace, verifies write access, and requires an active Task.
  */
 function validateStartParams(store, params) {
+    validateJobTarget(store, params);
+    assertCallerAuthorized(store, params.caller, params.taskId);
+}
+function validateJobTarget(store, params) {
     // The Task must be active — a terminal Task cannot run jobs.
     const task = store.getTask(params.taskId);
     if (task === null) {
@@ -179,10 +299,6 @@ function validateStartParams(store, params) {
             throw jobDomainError(`Retry original job must be terminal: ${params.retryOf} is ${original.status}.`);
         }
     }
-    // rr8: Bind the declared owner to the caller's managed identity. A
-    // Role is not an authorization boundary. Scope and exact managed Session
-    // identity are verified independently below.
-    assertCallerAuthorized(store, params.caller, params.taskId);
 }
 /**
  * rr8/rr12: Bind the declared job owner to the caller's managed identity. The
@@ -262,9 +378,17 @@ function assertCallerAuthorized(store, caller, taskId) {
     // frozen environment, and its own claim would add nothing the store does
     // not already own.
     const run = caller.role === undefined ? null : store.getActiveTurn(taskId, caller.role);
-    if (run === null || run.status !== "active") {
+    const currentRole = caller.role === undefined ? null : store.getRole(taskId, caller.role);
+    if (run === null || run.status !== "active" || currentRole === null
+        || currentRole.activeAgentId !== run.effective.agentId) {
         throw jobControlError("UNAUTHORIZED", "A managed Task Session's Role is not bound to an active Turn.");
     }
+    const sessions = store.getTaskRoleSessionSet(taskId, currentRole.name);
+    const session = activeLiveRoleAgentSession(sessions);
+    if (sessions?.activeAgentId !== currentRole.activeAgentId || session === null
+        || session.agentId !== run.effective.agentId || session.adapterId !== run.effective.adapterId) {
+        throw jobControlError("UNAUTHORIZED", "DurableJob control requires the current live Task Session.");
+    }
     // rr13: Verify the non-replayable per-Session caller key. The key is injected
     // at native Session launch and never persisted in plaintext; only its SHA-256
     // hash is durable. A client with database read access can see the hash but cannot
@@ -272,7 +396,7 @@ function assertCallerAuthorized(store, caller, taskId) {
     if (caller.callerKey === undefined) {
         throw jobControlError("UNAUTHORIZED", "job.start/job.cancel requires a managed Session caller key.");
     }
-    const expectedHash = store.getJobCallerKeyHash(taskId, caller.role ?? "", run.effective.agentId);
+    const expectedHash = store.getJobCallerKeyHash(taskId, caller.role ?? "", currentRole.activeAgentId);
     if (expectedHash === null) {
         throw jobControlError("UNAUTHORIZED", "The managed Session has no durable caller key; it must be relaunched.");
     }
@@ -337,7 +461,7 @@ export function parseDurableJobStartParams(value) {
     const record = value;
     const allowed = new Set([
         "taskId", "owner", "projectId", "head", "workspace", "env", "steps",
-        "retryOf", "caller"
+        "retryOf", "caller", "requestId"
     ]);
     for (const key of Object.keys(record)) {
         if (!allowed.has(key)) {
@@ -367,6 +491,9 @@ export function parseDurableJobStartParams(value) {
         env,
         steps,
         caller,
+        ...(record.requestId === undefined ? {} : {
+            requestId: requiredId(record.requestId, "job.start requestId")
+        }),
         ...(retryOf === undefined ? {} : { retryOf })
     };
 }

package/dist/controller/jobSupervisor.js

@@ -16,9 +16,10 @@ import { chmodSync, existsSync, mkdirSync, openSync, closeSync, readFileSync, st
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { writeTextFileAtomically } from "../storage/durableFile.js";
-import { cancelQueuedDurableJob, completeDurableJob, isDurableJobTerminal, markDurableJobUnknown, markDurableJobWakeupNotified, startDurableJob, touchDurableJobHeartbeat } from "../job/durableJob.js";
+import { cancelQueuedDurableJob, completeDurableJob, isDurableJobTerminal, markDurableJobUnknown, markDurableJobWakeupNotified, rejectQueuedDurableJob, startDurableJob, touchDurableJobHeartbeat } from "../job/durableJob.js";
 import { readLinuxProcessStartIdentity } from "./domainIdentity.js";
 import { wakeReason } from "../scheduler/wakeReason.js";
+import { recordOperationEvidence } from "../kernel/operationFacts.js";
 const DEFAULT_STEP_TIMEOUT_MS = 30 * 60_000;
 const HEARTBEAT_STALE_MS = 2 * 60_000;
 const SIGKILL_GRACE_MS = 30_000;
@@ -29,6 +30,7 @@ export class DurableJobSupervisor {
     #terminalEvents;
     #wake;
     #onError;
+    #authorizeStart;
     // f5: Composite key (taskId/jobId) because job IDs are Task-local — every
     // Task has a job-1, so a Task-local key would cross-kill healthy runners.
     #sigkillAt = new Map();
@@ -39,6 +41,7 @@ export class DurableJobSupervisor {
         this.#terminalEvents = options.terminalEvents;
         this.#wake = options.wake ?? (() => undefined);
         this.#onError = options.onError ?? (() => undefined);
+        this.#authorizeStart = options.authorizeStart;
     }
     reconcile(now) {
         const jobs = this.#store.listActiveDurableJobs();
@@ -67,90 +70,42 @@ export class DurableJobSupervisor {
     #sigkillKey(job) {
         return `${job.taskId}/${job.id}`;
     }
-    /**
-     * Reconcile a queued job.
-     *
-     * f4: A queued job with a cancel request converges to `cancelled` without
-     * spawning a runner — but only if no runner was already spawned. If a
-     * start marker proves a runner exists (real pid, or pending marker +
-     * ready.json), the job is adopted to running first; the running-cancel
-     * path then fences and signals it. Cancelling a spawned job from queued
-     * would orphan the runner.
-     *
-     * f3: The normal path writes a pending start marker, spawns the runner, and
-     * lets the runner's own `ready.json` handshake prove it started before any
-     * side effect. On recovery the supervisor adopts queued→running first
-     * (harvest/unknown require `running`), then harvests exit or handles a
-     * dead process — never calling complete/unknown directly from `queued`.
-     */
+    /** Adopt observed execution, preserve unknown, or start an unattempted request. */
     #reconcileQueued(job, now) {
         const marker = this.#artifacts.readStartMarker(job.taskId, job.id);
-        // f1/rr5: A cancel request on a queued job must not orphan an already-
-        // spawned runner. Check spawn evidence before converging to cancelled.
+        const spawned = this.#spawnedProcessFromEvidence(job, marker);
         if (job.cancelRequestedAt !== undefined) {
             this.#artifacts.writeCancelFence(job.taskId, job.id);
-            const spawnedProcess = this.#spawnedProcessFromEvidence(job, marker);
-            if (spawnedProcess !== null) {
-                // f1/rr5: A runner was spawned. Signal it in THIS reconcile pass —
-                // not adopt to running and wait for the next pass. The signal is
-                // sent before the adoption so the runner begins draining
-                // immediately; the adoption preserves evidence (exit.json / dead-
-                // process handling converges the job on this or the next pass).
-                this.#process.signalIfOwned(spawnedProcess.pid, spawnedProcess.startIdentity, "SIGTERM");
-                this.#adoptAndContinue(job, spawnedProcess, now);
-                return;
+            if (spawned !== null) {
+                this.#process.signalIfOwned(spawned.pid, spawned.startIdentity, "SIGTERM");
             }
-            if (marker !== null) {
-                // f1/rr5: Ambiguous spawn — a pending marker exists but ready.json
-                // does not. The runner may be starting (slow to write ready.json)
-                // or may never have started. Do NOT terminalize without signaling.
-                // Re-spawn: the new runner writes ready.json, observes the cancel
-                // fence, and exits as cancelled without side effects. The next
-                // pass harvests the cancelled exit.json.
-                this.#startJob(job, now);
-                return;
-            }
-            // No spawn attempted — safe to cancel from queued.
-            // f6/rr5: The terminal transition and the Leader wakeup must be
-            // atomic (same transaction). Compose cancel + wakeupNotified and
-            // pass the wakeup param so the adapter enqueues the Leader mailbox
-            // entry in the same transaction.
-            const terminal = this.#store.transitionDurableJob(job.taskId, job.id, (current) => markDurableJobWakeupNotified(cancelQueuedDurableJob(current, now), now), now, { reason: wakeReason("job-finished"), refs: wakeupRefs(job) });
-            this.#deliverTerminalEvent(terminal);
+        }
+        if (spawned !== null) {
+            this.#adoptAndContinue(job, spawned, now);
             return;
         }
-        if (marker === null) {
-            this.#startJob(job, now);
+        if (job.operation.effect !== "none") {
+            // A send intent was committed but no acceptance can be proved. Absence
+            // of a file is not proof of no external effect. Never respawn unknown.
+            const terminal = this.#store.transitionDurableJob(job.taskId, job.id, (current) => markDurableJobWakeupNotified(markDurableJobUnknown(current, "runner acceptance is unknown; inspect the original request", current.checkpoint?.completedSteps ?? [], now), now), now, { reason: wakeReason("job-finished"), refs: wakeupRefs(job) });
+            this.#deliverTerminalEvent(terminal);
             return;
         }
-        // f3: A pending marker means the Controller died after writing the marker
-        // but before the runner proved it started. Check the runner's ready file.
-        if (marker.startIdentity === "pending") {
-            const ready = this.#artifacts.readReadyFile(job.taskId, job.id);
-            if (ready === null) {
-                // The runner either never started or died before writing ready.
-                // No side effects could have occurred — re-spawn safely.
-                this.#startJob(job, now);
-                return;
-            }
-            // Runner proved it started: adopt and continue from evidence.
-            // rr4/finding-4: Use the runner's own startIdentity from ready.json,
-            // not a fresh /proc read (which could return a reused PID's identity).
-            this.#adoptAndContinue(job, { pid: ready.pid, startIdentity: ready.startIdentity }, now);
+        if (job.cancelRequestedAt !== undefined) {
+            // No effect attempted. Cancellation and its wake commit atomically.
+            const terminal = this.#store.transitionDurableJob(job.taskId, job.id, (current) => markDurableJobWakeupNotified(cancelQueuedDurableJob(current, now), now), now, { reason: wakeReason("job-finished"), refs: wakeupRefs(job) });
+            this.#deliverTerminalEvent(terminal);
             return;
         }
-        // Marker with a real pid (already spawned). Adopt and continue.
-        // f3/rr5: ready.json is authoritative when both exist.
-        const spawned = this.#spawnedProcessFromEvidence(job, marker);
-        this.#adoptAndContinue(job, spawned ?? { pid: marker.pid, startIdentity: marker.startIdentity }, now);
+        if (marker !== null)
+            throw new Error("Job start marker contradicts its unattempted operation.");
+        this.#startJob(job, now);
     }
     /**
      * Determine whether a runner was spawned for this job, based on durable
      * evidence. Returns the process identity if spawned, null otherwise.
      */
     #spawnedProcessFromEvidence(job, marker) {
-        if (marker === null)
-            return null;
         // f3/rr5: ready.json is the runner's own record of its actual OS start.
         // When both the start marker and ready.json exist, ready.json is
         // authoritative: the marker is the Controller's declared intent (written
@@ -161,7 +116,7 @@ export class DurableJobSupervisor {
         if (ready !== null) {
             return { pid: ready.pid, startIdentity: ready.startIdentity };
         }
-        if (marker.startIdentity !== "pending") {
+        if (marker !== null && marker.startIdentity !== "pending") {
             // Real start marker with a pid — the runner was spawned.
             return { pid: marker.pid, startIdentity: marker.startIdentity };
         }
@@ -170,8 +125,7 @@ export class DurableJobSupervisor {
     }
     /**
      * f3: Adopt a queued job to running, then harvest exit or handle a dead
-     * process. This is the only legal path from queued to a terminal state —
-     * complete/unknown require `running`.
+     * process. A request with unobserved acceptance instead stays unknown.
      */
     #adoptAndContinue(job, process, now) {
         this.#store.transitionDurableJob(job.taskId, job.id, (current) => startDurableJob(current, process, now), now);
@@ -190,6 +144,13 @@ export class DurableJobSupervisor {
         }
     }
     #startJob(job, now) {
+        try {
+            this.#authorizeStart(job);
+        }
+        catch (error) {
+            this.#rejectStart(job, error, now);
+            return;
+        }
         const spec = {
             jobId: job.id,
             taskId: job.taskId,
@@ -201,9 +162,28 @@ export class DurableJobSupervisor {
             head: job.head
         };
         const specPath = this.#artifacts.writeSpec(job.taskId, job.id, spec);
-        // f3: Write a pending start marker BEFORE spawning. If the Controller dies
-        // between this write and the spawn, the next pass sees the pending marker
-        // and re-spawns safely (no side effects without a ready file).
+        let attempted;
+        try {
+            attempted = this.#store.transitionDurableJob(job.taskId, job.id, (current) => {
+                if (current.status !== "queued" || current.operation.effect !== "none") {
+                    throw new Error("Job already attempted; inspect the original request.");
+                }
+                this.#authorizeStart(current);
+                return {
+                    ...current,
+                    operation: recordOperationEvidence(current.operation, { effect: "possible" }),
+                    updatedAt: now.toISOString()
+                };
+            }, now);
+        }
+        catch (error) {
+            this.#rejectStart(job, error, now);
+            return;
+        }
+        if (attempted === null)
+            return;
+        // Both the request and possible-effect boundary precede spawn. A missing
+        // acceptance after this point is unknown, never permission to respawn.
         this.#artifacts.writeStartMarker(job.taskId, job.id, {
             pid: 0,
             startIdentity: "pending",
@@ -229,6 +209,14 @@ export class DurableJobSupervisor {
         spawned.onExit?.(() => this.#wake(job.taskId));
         this.#wake(job.taskId);
     }
+    #rejectStart(job, error, now) {
+        // Only an explicit domain refusal is a known failure. Storage/CAS/runtime
+        // errors still propagate; never infer rejection from an unavailable read.
+        if (!(error instanceof Error) || error.name !== "CoreJobError")
+            throw error;
+        const terminal = this.#store.transitionDurableJob(job.taskId, job.id, (current) => markDurableJobWakeupNotified(rejectQueuedDurableJob(current, error.message, now), now), now, { reason: wakeReason("job-finished"), refs: wakeupRefs(job) });
+        this.#deliverTerminalEvent(terminal);
+    }
     #superviseRunning(job, now) {
         // 1. Harvest exit.json if present.
         const exit = this.#artifacts.readExitJson(job.taskId, job.id);
@@ -278,6 +266,19 @@ export class DurableJobSupervisor {
         }
     }
     #harvestExit(job, exit, now) {
+        // Persist the original receipt locator before interpreting its output.
+        // A bad schema cannot erase evidence of an already executed runner.
+        this.#store.transitionDurableJob(job.taskId, job.id, (current) => ({
+            ...current,
+            operation: recordOperationEvidence(current.operation, {
+                effect: "confirmed",
+                receiptRefs: [`${current.artifactsLocator}/exit.json`],
+                partialResultRefs: Array.isArray(exit.steps)
+                    ? exit.steps.flatMap((step) => typeof step?.logPath === "string" && step.logPath.trim()
+                        ? [step.logPath] : []) : []
+            }),
+            updatedAt: now.toISOString()
+        }), now);
         const result = {
             outcome: exit.outcome,
             exitCode: exit.exitCode,
@@ -291,7 +292,20 @@ export class DurableJobSupervisor {
         // the adapter enqueues the Leader mailbox entry in the same transaction.
         // A separate #notifyWakeup pass would lose the wakeup if the Controller
         // died between the terminal write and the flag flip.
-        const terminal = this.#store.transitionDurableJob(job.taskId, job.id, (current) => markDurableJobWakeupNotified(completeDurableJob(current, result, now), now), now, { reason: wakeReason("job-finished"), refs: wakeupRefs(job) });
+        const terminal = this.#store.transitionDurableJob(job.taskId, job.id, (current) => {
+            let completed;
+            try {
+                completed = completeDurableJob(current, result, now);
+            }
+            catch {
+                completed = completeDurableJob(current, {
+                    outcome: "failed", exitCode: null, signal: null,
+                    unknownReason: "runner output is invalid; original receipt is retained",
+                    steps: []
+                }, now);
+            }
+            return markDurableJobWakeupNotified(completed, now);
+        }, now, { reason: wakeReason("job-finished"), refs: wakeupRefs(job) });
         this.#deliverTerminalEvent(terminal);
         this.#sigkillAt.delete(this.#sigkillKey(job));
     }

package/dist/controller/runtime.js

@@ -1,5 +1,4 @@
 import { reconciliationIntervalMilliseconds, resolveAgentLaunchInactivityTimeoutSeconds, resolveControllerTaskConcurrency, resolveDeliveryTimeoutSeconds, resolveRuntimeHealth, resolveTmuxBin, resolveTmuxHistoryLimit } from "../config/yuiConfig.js";
-import { createHash } from "node:crypto";
 import { resolve } from "node:path";
 import { isDeepStrictEqual } from "node:util";
 import { controllerSocketPath } from "../core/controllerEndpoint.js";
@@ -7,9 +6,9 @@ import { AGENT_OPERATIONAL_ENVIRONMENT_NAMES, nativeAgentEnvironmentNames, YUI_M
 import { hasRuntimeCleanupObligation, runtimeLifecycleSignalKey, runtimeLifecycleTarget } from "../runtime/lifecycleReservation.js";
 import { agentProcessReadinessProbe, ExecutorRegistry } from "../executor/executorRegistry.js";
 import { activeLiveRoleAgentSession, roleAgentSessionResumeMode } from "../executor/agentExecutor.js";
-import { effectiveLaunchSnapshotsCompatible, effectiveLaunchSnapshotsCompatibleForTaskSession, effectiveLaunchConfig, resolveEffectiveLaunch } from "../executor/effectiveLaunch.js";
+import { roleSessionMayContinue, effectiveLaunchConfig, resolveEffectiveLaunch } from "../executor/effectiveLaunch.js";
 import { AgentConfigurationCatalogService, validateAgentLaunchConfiguration } from "../executor/agentConfigurationCatalog.js";
-import { isTaskOwnedWorkspace, managedWorkspaceIdentity, sameManagedWorkspaceIdentity } from "../worktree/managedWorkspace.js";
+import { isTaskOwnedWorkspace, sameManagedWorkspaceIdentity } from "../worktree/managedWorkspace.js";
 import { FileRoleLaunchPlanner } from "../executor/fileRoleLaunchPlanner.js";
 import { openCurrentTaskStore } from "../storage/currentTaskStore.js";
 import { SqliteTaskStore } from "../storage/sqliteStore.js";
@@ -22,7 +21,8 @@ import { startFileTaskController } from "./controller.js";
 import { AgentHostProviderTurnFenceError, FileSchedulerStoreAdapter } from "./fileSchedulerStoreAdapter.js";
 import { openSchedulerTelemetry } from "../telemetry/telemetryWiring.js";
 import { createFileArtifactPort, createLinuxProcessPort, DurableJobSupervisor } from "./jobSupervisor.js";
-import { createDurableJobControl } from "./jobControl.js";
+import { authorizeJobStart } from "./jobControl.js";
+import { createKernelPorts } from "../kernel/kernelPorts.js";
 import { FileRuntimeEventInbox } from "./runtimeEventInbox.js";
 import { AgentRuntimeObserver } from "./agentRuntimeObserver.js";
 import { AsyncRuntimeEventProcessor, FileRuntimeEventProcessor, createAsyncRuntimeObserver, } from "./runtimeEventProcessor.js";
@@ -216,7 +216,6 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
         assertCurrent: (request) => {
             assertRuntimeLaunchRequestCurrent(store, request);
         },
-        launchFingerprint: (request) => (runtimeLaunchFingerprint(store, request)),
         onCleanupRequired: signalRuntimeCleanup,
         runtimeIsolation
     });
@@ -357,10 +356,12 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
     // supervisor enqueues a durable-job-terminal event; the processor drains it
     // on the next pass, waking the Controller immediately instead of waiting for
     // the poll interval.
+    const kernel = createKernelPorts(store, createLinuxProcessPort());
     const jobSupervisor = new DurableJobSupervisor({
         store: schedulerStore,
-        process: createLinuxProcessPort(),
+        process: kernel.runner,
         artifacts: createFileArtifactPort(home),
+        authorizeStart: (job) => authorizeJobStart(store, job),
         // rr6/f1: Bounded supervision wake. The supervisor signals the Controller
         // after spawning a runner (queued→running adoption) and when a runner
         // exits (terminal harvest), so a quick job converges without waiting for
@@ -395,7 +396,7 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
         },
         onError: options.onError
     });
-    const jobControl = createDurableJobControl(store);
+    const jobControl = kernel.jobs;
     const continuationReconciler = options.continuationMetadata === undefined
         ? undefined
         : new ProviderContinuationReconciliationService(store, schedulerStore, options.continuationMetadata);
@@ -464,6 +465,7 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
     let resourceClose;
     const closeResources = () => {
         resourceClose ??= Promise.all([
+            kernel.close(),
             asyncStoreClient?.close() ?? Promise.resolve(),
             inventoryClient?.close() ?? Promise.resolve()
         ]).then(() => undefined);
@@ -472,6 +474,7 @@ export async function startFileTaskControllerRuntime(home, options = {}) {
     const closed = running.closed.then(closeResources);
     return {
         ...running,
+        kernel,
         closed,
         close: async () => {
             try {
@@ -501,7 +504,6 @@ export function createRuntimeLifecycleDispatcher(store, schedulerStore, sessionH
             assertCurrent: (request) => {
                 assertRuntimeLaunchRequestCurrent(store, request);
             },
-            launchFingerprint: (request) => (runtimeLaunchFingerprint(store, request)),
             onCleanupRequired
         });
     const lifecycleTails = new Map();
@@ -862,11 +864,15 @@ function assertRuntimeLaunchRequestCurrent(store, request) {
             || session.nativeSessionId !== request.nativeSessionId) {
             throw new Error(`Native session changed: ${request.owner.roleName}.`);
         }
-        const sessionEffectiveCompatible = request.owner.scope === "task"
-            ? effectiveLaunchSnapshotsCompatibleForTaskSession(session.effective, request.effective)
-            : effectiveLaunchSnapshotsCompatible(session.effective, request.effective);
-        if (!sessionEffectiveCompatible) {
-            throw new Error(`Native session effective launch changed: ${request.owner.roleName}.`);
+        // The Role's durable Session record is the only authority for which Host
+        // activation may be restored. Targeting anything else would revive a
+        // historical activation.
+        if (request.hostActivationId !== undefined
+            && session.runtimeGenerationId !== request.hostActivationId) {
+            throw new Error(`Session restore does not target the Role's current Host activation: ${request.owner.roleName}.`);
+        }
+        if (!roleSessionMayContinue(session.effective, request.effective)) {
+            throw new Error(`Native session cannot continue under this launch: ${request.owner.roleName}.`);
         }
     }
 }
@@ -888,21 +894,6 @@ function currentDesiredEffective(store, request, role) {
         ...(item === null ? {} : { workItemWriteProjectIds: item.writeProjectIds })
     });
 }
-function runtimeLaunchFingerprint(store, request) {
-    const agent = store.getConfiguredAgent(request.effective.agentId);
-    if (agent === null) {
-        throw new Error(`Agent no longer exists: ${request.effective.agentId}.`);
-    }
-    return createHash("sha256").update(JSON.stringify([
-        request.owner,
-        request.effective,
-        request.managedWorkspace === undefined
-            ? undefined
-            : managedWorkspaceIdentity(request.managedWorkspace),
-        request.runtimePolicy,
-        agent
-    ])).digest("hex");
-}
 function currentDesiredManagedWorkspace(store, taskId, roleName) {
     const item = store.listWorkItems(taskId).find((candidate) => (candidate.assignee === roleName
         && !["completed", "failed", "retired"].includes(candidate.status))) ?? null;