ai-runtime-engine 3.0.0 → 3.0.1

package/dist/runtime/runtime.d.ts

@@ -219,8 +219,9 @@ export declare class Runtime {
     /** Warnings from MCP wiring (id collisions) plus the manager's own (invalid store files, etc.). */
     mcpWarningsList(): string[];
     /**
-     * Release long-lived resources — today: MCP stdio child processes. A one-shot CLI command and the REPL
-     * both call this on completion/exit; without it a spawned server keeps the event loop alive.
+     * Release long-lived resources: MCP stdio child processes, and any batching telemetry sink (so a
+     * short-lived run does not drop OTLP events buffered below the batch threshold). A one-shot CLI command
+     * and the REPL both call this on completion/exit.
      */
     close(): Promise<void>;
     /** Skills whose required tools are all registered. */

package/dist/runtime/runtime.js

@@ -94,7 +94,7 @@ import { loadModelProfile, resolveModelDirective, directiveToOverrides } from '.
 import { HashEmbedder } from '../memory/embedders/hash.js';
 import { HttpEmbedder } from '../memory/embedders/http.js';
 import { Credential } from '../security/credentials.js';
-import { makeCodec, deriveKey } from '../store/crypto.js';
+import { makeCodec } from '../store/crypto.js';
 import { AIError } from '../core/fallback/errors.js';
 import { tokenize } from '../memory/bm25.js';
 let runCounter = 0;
@@ -214,7 +214,7 @@ export class Runtime {
         });
         this._modelProfile = loadModelProfile(root); // models.md (per-mode/task routing); undefined if absent
         this._memory = new MemoryStore(this._store, clock, this.buildEmbedder(options.ai?.fetchImpl));
-        this._conversations = new ConversationStore(this._store.conversations(), clock);
+        this._conversations = new ConversationStore(this._store.conversations(), clock, { withLock: (fn) => this._store.withLock(fn) });
         this._executions = new ExecutionStore(this._store.executions(), { clock });
         this._artifacts = new ArtifactStore(this._store.artifacts(), clock);
         this._learning = new LearningStore(this._store.learning());
@@ -291,7 +291,9 @@ export class Runtime {
         const key = new Credential(cfg.keyEnv, this.env).use();
         if (!key)
             throw new AIError(`storage encryption is enabled but the key env var ${cfg.keyEnv} is not set`, { category: 'CONFIG' });
-        return makeCodec(deriveKey(key));
+        // Pass the SECRET (not a pre-derived key) so the codec uses the v2 scrypt scheme; it still reads any
+        // legacy aienc1 records transparently and upgrades them to aienc2 as they are rewritten.
+        return makeCodec(key);
     }
     /** Build a Runtime from a workspace: load config (.ai-runtime/config.yaml > root fallback), detect workspace. */
     static async load(options = {}) {
@@ -624,11 +626,13 @@ export class Runtime {
         return [...this.mcpWarnings, ...this._mcp.warningsList()];
     }
     /**
-     * Release long-lived resources — today: MCP stdio child processes. A one-shot CLI command and the REPL
-     * both call this on completion/exit; without it a spawned server keeps the event loop alive.
+     * Release long-lived resources: MCP stdio child processes, and any batching telemetry sink (so a
+     * short-lived run does not drop OTLP events buffered below the batch threshold). A one-shot CLI command
+     * and the REPL both call this on completion/exit.
      */
     async close() {
         await this._mcp.close();
+        await this._ai.close();
     }
     /** Skills whose required tools are all registered. */
     skills() {
@@ -651,9 +655,9 @@ export class Runtime {
         if (!/^[a-z0-9][a-z0-9-]{0,63}$/.test(manifest.id))
             throw new AIError(`unsafe skill id: ${JSON.stringify(manifest.id)}`, { category: 'CONFIG' });
         const dir = join(this.workspaceRoot, '.ai-runtime', 'skills');
-        mkdirSync(dir, { recursive: true });
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
         const path = join(dir, `${manifest.id}.skill.yaml`);
-        writeFileSync(path, stringifyYaml(manifest));
+        writeFileSync(path, stringifyYaml(manifest), { mode: 0o600 });
         return path;
     }
     /** The ACTION-capability registry (Phase 3.1): what this runtime can DO, and who provides it. */
@@ -830,6 +834,12 @@ export class Runtime {
                 streamedText += chunk;
                 this.emitter.emit({ type: 'response.delta', runId, text: chunk });
             };
+            // A failed streamed attempt's partial text is discarded: reset the accumulator so the survivor's
+            // stream is what `streamed` is compared against, and tell the host to clear the abandoned segment.
+            runRequest.onStreamAbandoned = ({ providerId, model }) => {
+                streamedText = '';
+                this.emitter.emit({ type: 'response.stream_abandoned', runId, providerId, model });
+            };
         }
         const runResult = await this._ai.run(runRequest);
         this.calibrate(runRequest.system, text, runResult);

package/dist/runtime/types.d.ts

@@ -90,7 +90,8 @@ export interface RuntimeSettings {
         encrypt: boolean;
         keyEnv: string;
     };
-    /** Action capabilities (Phase 3.1/3.3). `catalog` enriches the planner catalog (default off);
+    /** Action capabilities (Phase 3.1/3.3). `catalog` enriches the planner catalog (default ON since 3.0.0;
+     *  set `catalog: false` to remove the block);
      *  `planning` (3.3, default OFF) derives the capabilities a goal needs BEFORE planning — offline BM25
      *  first, one model call only when that finds nothing AND no call budget is set AND this is not a dry
      *  run — resolves them against the run's permissions, and reports gaps. ADVISORY: it never blocks a

package/dist/store/area.d.ts

@@ -5,7 +5,7 @@
  */
 export interface IntegrityIssue {
     file: string;
-    problem: 'unreadable' | 'checksum-mismatch' | 'invalid-json';
+    problem: 'unreadable' | 'checksum-mismatch' | 'invalid-json' | 'decrypt-auth-failed' | 'unsupported-version';
     detail?: string;
 }
 /**

package/dist/store/area.js

@@ -6,8 +6,19 @@
 import { createHash } from 'node:crypto';
 import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync, appendFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { StoreDecryptError } from './errors.js';
 const STORE_VERSION = 1;
 const ID_RE = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/;
+/** Classify a caught read error into an IntegrityIssue problem code (decrypt errors are distinguished). */
+function classifyProblem(err) {
+    if (err instanceof StoreDecryptError) {
+        if (err.code === 'AUTH_FAILED')
+            return 'decrypt-auth-failed';
+        if (err.code === 'UNSUPPORTED_VERSION')
+            return 'unsupported-version';
+    }
+    return 'invalid-json';
+}
 /** Matches an orphaned atomic-write temp file: `<id>.json.tmp-<pid>-<n>` / `<id>.jsonl.tmp-…`. */
 const TEMP_RE = /\.(?:json|jsonl)\.tmp-/;
 function assertId(id) {
@@ -37,7 +48,9 @@ export class FileArea {
     }
     ensure() {
         if (!this.ensured) {
-            mkdirSync(this.dir, { recursive: true });
+            // 0700: store dirs hold conversation/memory/execution/agent records — owner-only on shared hosts.
+            // (mode applies only to dirs this call creates; POSIX-only, a no-op on Windows.)
+            mkdirSync(this.dir, { recursive: true, mode: 0o700 });
             this.ensured = true;
         }
     }
@@ -51,7 +64,8 @@ export class FileArea {
         this.ensure();
         this.counter += 1;
         const tmp = `${path}.tmp-${process.pid}-${this.counter}`;
-        writeFileSync(tmp, this.encode(contents));
+        // 0600: rename preserves the tmp file's mode, so the final record is owner-only too.
+        writeFileSync(tmp, this.encode(contents), { mode: 0o600 });
         renameSync(tmp, path);
     }
     readJson(id) {
@@ -68,8 +82,14 @@ export class FileArea {
         try {
             return this.readJson(id);
         }
-        catch {
-            return undefined; // a corrupt record must not brick bulk listing/search
+        catch (err) {
+            // A wrong key makes EVERY encrypted record fail — soft-skipping it would present the whole store as
+            // empty, a silent data-loss illusion. Rethrow AUTH_FAILED so the caller sees a real error; genuine
+            // per-record corruption (checksum/JSON/unsupported-version) still soft-skips so one bad record can't
+            // brick bulk listing/search.
+            if (err instanceof StoreDecryptError && err.code === 'AUTH_FAILED')
+                throw err;
+            return undefined;
         }
     }
     writeJson(id, data) {
@@ -96,7 +116,8 @@ export class FileArea {
         assertId(id);
         this.ensure();
         // Each JSONL line is encrypted independently (its own IV), so appends stay append-only.
-        appendFileSync(this.logPath(id), this.encode(JSON.stringify(obj)) + '\n');
+        // 0600 applies when the file is first created; an existing file keeps its mode (append doesn't chmod).
+        appendFileSync(this.logPath(id), this.encode(JSON.stringify(obj)) + '\n', { mode: 0o600 });
     }
     readLines(id) {
         assertId(id);
@@ -110,8 +131,11 @@ export class FileArea {
             try {
                 out.push(JSON.parse(this.decode(line)));
             }
-            catch {
-                /* skip a corrupt/undecryptable line rather than failing the whole log (surfaced by check()) */
+            catch (err) {
+                // Wrong key fails every line — surface it rather than returning a silently-empty log; a single
+                // corrupt line is still skipped (surfaced by check()).
+                if (err instanceof StoreDecryptError && err.code === 'AUTH_FAILED')
+                    throw err;
             }
         }
         return out;
@@ -133,7 +157,7 @@ export class FileArea {
                         issues.push({ file: path, problem: 'checksum-mismatch' });
                 }
                 catch (err) {
-                    issues.push({ file: path, problem: 'invalid-json', detail: err instanceof Error ? err.message : String(err) });
+                    issues.push({ file: path, problem: classifyProblem(err), detail: err instanceof Error ? err.message : String(err) });
                 }
             }
             else if (f.endsWith('.jsonl')) {
@@ -142,8 +166,8 @@ export class FileArea {
                     try {
                         JSON.parse(this.decode(line));
                     }
-                    catch {
-                        issues.push({ file: path, problem: 'invalid-json', detail: `line ${i + 1}` });
+                    catch (err) {
+                        issues.push({ file: path, problem: classifyProblem(err), detail: `line ${i + 1}` });
                     }
                 });
             }

package/dist/store/crypto.d.ts

@@ -1,21 +1,35 @@
 /**
- * Transparent encryption at rest (Phase 18) — AES-256-GCM via `node:crypto` (zero new deps). A `ContentCodec`
- * transforms the STORED STRING of a store file: `encode` wraps plaintext as a self-identifying envelope
- * `aienc1:<base64(iv|tag|ciphertext)>`; `decode` reverses it. `decode` is deliberately lenient on the way IN —
- * a string WITHOUT the `aienc1:` prefix is returned unchanged, so a store that predates encryption keeps
- * reading after it is enabled (new writes are always encrypted). A wrong key / tampered payload makes `decode`
- * THROW, which the store maps onto its existing corruption path (soft-skip in bulk reads, reported by check()).
+ * Transparent encryption at rest — AES-256-GCM via `node:crypto` (zero new deps). A `ContentCodec`
+ * transforms the STORED STRING of a store file: `encode` wraps plaintext as a self-identifying envelope,
+ * `decode` reverses it. `decode` is lenient on the way IN — a string WITHOUT a known envelope prefix is
+ * returned unchanged, so a store that predates encryption keeps reading after it is enabled.
  *
- * SECURITY: the derived key is a Buffer held only inside the codec closure; it is never serialized, logged, or
- * placed in an error. The AES key is sha256(secret), so the raw secret length is irrelevant.
+ * TWO envelope versions coexist:
+ *   - `aienc1:` (v1, legacy) — key = sha256(secret). Still READ transparently; never written by 3.0.1+.
+ *   - `aienc2:` (v2, current) — key = scrypt(secret, per-record salt). A proper KDF (memory-hard) so a
+ *     weak/passphrase secret is not brute-forceable at raw-hash speed. Records upgrade to v2 lazily as
+ *     they are rewritten (no bulk migration). The scrypt key is CACHED per salt inside the codec, so a
+ *     bulk read does not pay a fresh derivation per record.
+ *
+ * A decrypt failure throws a typed `StoreDecryptError` (AUTH_FAILED / UNSUPPORTED_VERSION / CORRUPT) —
+ * honest about the fact that a GCM auth failure is wrong-key OR tampering OR corruption, not certainly a
+ * wrong key. SECURITY: derived keys are Buffers held only inside the codec closure; never serialized,
+ * logged, or placed in an error.
  */
 import type { ContentCodec } from './area.js';
 export declare const ENVELOPE_PREFIX = "aienc1:";
-/** Derive the 32-byte AES-256 key from an arbitrary secret (sha256 → fixed length, secret length irrelevant). */
+export declare const ENVELOPE_PREFIX_V2 = "aienc2:";
+/** Derive the 32-byte v1 AES key (sha256 → fixed length). Retained for reading legacy `aienc1:` records. */
 export declare function deriveKey(secret: string): Buffer;
-/** Encrypt a UTF-8 string into the self-identifying `aienc1:` envelope. A fresh random IV per call. */
+/** v1 encrypt into the `aienc1:` envelope (legacy; retained for the exported API and Buffer-key codec). */
 export declare function encryptString(plain: string, key: Buffer): string;
-/** Decrypt an `aienc1:` envelope; a string without the prefix is returned unchanged (mixed/legacy store). */
+/** v1 decrypt of an `aienc1:` envelope; a non-envelope string passes through (mixed/legacy store). */
 export declare function decryptString(stored: string, key: Buffer): string;
-/** Build the codec `FileArea` uses to encrypt/decrypt its file contents. */
-export declare function makeCodec(key: Buffer): ContentCodec;
+/** v2 encrypt into the `aienc2:` envelope (salt‖iv‖tag‖ciphertext). */
+export declare function encryptStringV2(plain: string, key: Buffer, salt: Buffer): string;
+/**
+ * Build the codec `FileArea` uses. A **secret string** yields the current v2 codec (scrypt; writes
+ * `aienc2:`, reads every version). A **Buffer** yields the legacy v1 codec (sha256; writes `aienc1:`) —
+ * retained so existing `makeCodec(deriveKey(secret))` callers behave exactly as before.
+ */
+export declare function makeCodec(keyOrSecret: Buffer | string): ContentCodec;

package/dist/store/crypto.js

@@ -1,23 +1,53 @@
 /**
- * Transparent encryption at rest (Phase 18) — AES-256-GCM via `node:crypto` (zero new deps). A `ContentCodec`
- * transforms the STORED STRING of a store file: `encode` wraps plaintext as a self-identifying envelope
- * `aienc1:<base64(iv|tag|ciphertext)>`; `decode` reverses it. `decode` is deliberately lenient on the way IN —
- * a string WITHOUT the `aienc1:` prefix is returned unchanged, so a store that predates encryption keeps
- * reading after it is enabled (new writes are always encrypted). A wrong key / tampered payload makes `decode`
- * THROW, which the store maps onto its existing corruption path (soft-skip in bulk reads, reported by check()).
+ * Transparent encryption at rest — AES-256-GCM via `node:crypto` (zero new deps). A `ContentCodec`
+ * transforms the STORED STRING of a store file: `encode` wraps plaintext as a self-identifying envelope,
+ * `decode` reverses it. `decode` is lenient on the way IN — a string WITHOUT a known envelope prefix is
+ * returned unchanged, so a store that predates encryption keeps reading after it is enabled.
  *
- * SECURITY: the derived key is a Buffer held only inside the codec closure; it is never serialized, logged, or
- * placed in an error. The AES key is sha256(secret), so the raw secret length is irrelevant.
+ * TWO envelope versions coexist:
+ *   - `aienc1:` (v1, legacy) — key = sha256(secret). Still READ transparently; never written by 3.0.1+.
+ *   - `aienc2:` (v2, current) — key = scrypt(secret, per-record salt). A proper KDF (memory-hard) so a
+ *     weak/passphrase secret is not brute-forceable at raw-hash speed. Records upgrade to v2 lazily as
+ *     they are rewritten (no bulk migration). The scrypt key is CACHED per salt inside the codec, so a
+ *     bulk read does not pay a fresh derivation per record.
+ *
+ * A decrypt failure throws a typed `StoreDecryptError` (AUTH_FAILED / UNSUPPORTED_VERSION / CORRUPT) —
+ * honest about the fact that a GCM auth failure is wrong-key OR tampering OR corruption, not certainly a
+ * wrong key. SECURITY: derived keys are Buffers held only inside the codec closure; never serialized,
+ * logged, or placed in an error.
  */
-import { createHash, randomBytes, createCipheriv, createDecipheriv } from 'node:crypto';
-export const ENVELOPE_PREFIX = 'aienc1:';
+import { createHash, randomBytes, createCipheriv, createDecipheriv, scryptSync } from 'node:crypto';
+import { StoreDecryptError } from './errors.js';
+export const ENVELOPE_PREFIX = 'aienc1:'; // v1 (legacy)
+export const ENVELOPE_PREFIX_V2 = 'aienc2:'; // v2 (current)
 const IV_LEN = 12; // GCM standard nonce
 const TAG_LEN = 16; // GCM auth tag
-/** Derive the 32-byte AES-256 key from an arbitrary secret (sha256 → fixed length, secret length irrelevant). */
+const SALT_LEN = 16; // per-record scrypt salt (v2)
+const KEY_LEN = 32; // AES-256
+// scrypt cost: N=2^14, r=8, p=1 → ~16 MiB working set (under node's 32 MiB default maxmem), ~tens of ms.
+// A change to these parameters requires a new envelope version (aienc3), since the salt alone does not
+// record them.
+const SCRYPT_PARAMS = { N: 16384, r: 8, p: 1 };
+/** Derive the 32-byte v1 AES key (sha256 → fixed length). Retained for reading legacy `aienc1:` records. */
 export function deriveKey(secret) {
     return createHash('sha256').update(secret).digest();
 }
-/** Encrypt a UTF-8 string into the self-identifying `aienc1:` envelope. A fresh random IV per call. */
+/** Derive the 32-byte v2 AES key via scrypt over (secret, salt). Memory-hard — resists brute force. */
+function deriveKeyScrypt(secret, salt) {
+    return scryptSync(secret, salt, KEY_LEN, SCRYPT_PARAMS);
+}
+/** GCM-decrypt; a failed auth tag becomes a typed AUTH_FAILED (wrong key OR tampering OR corruption). */
+function gcmDecrypt(key, iv, tag, ct) {
+    const decipher = createDecipheriv('aes-256-gcm', key, iv);
+    decipher.setAuthTag(tag);
+    try {
+        return Buffer.concat([decipher.update(ct), decipher.final()]).toString('utf8');
+    }
+    catch {
+        throw new StoreDecryptError('AUTH_FAILED', 'store record failed authentication (wrong key, tampering, or corruption)');
+    }
+}
+/** v1 encrypt into the `aienc1:` envelope (legacy; retained for the exported API and Buffer-key codec). */
 export function encryptString(plain, key) {
     const iv = randomBytes(IV_LEN);
     const cipher = createCipheriv('aes-256-gcm', key, iv);
@@ -25,25 +55,73 @@ export function encryptString(plain, key) {
     const tag = cipher.getAuthTag();
     return ENVELOPE_PREFIX + Buffer.concat([iv, tag, ct]).toString('base64');
 }
-/** Decrypt an `aienc1:` envelope; a string without the prefix is returned unchanged (mixed/legacy store). */
+/** v1 decrypt of an `aienc1:` envelope; a non-envelope string passes through (mixed/legacy store). */
 export function decryptString(stored, key) {
     if (!stored.startsWith(ENVELOPE_PREFIX))
-        return stored; // plaintext (pre-encryption) record — read as-is
+        return stored;
     const buf = Buffer.from(stored.slice(ENVELOPE_PREFIX.length), 'base64');
     if (buf.length < IV_LEN + TAG_LEN)
-        throw new Error('encrypted record is truncated');
+        throw new StoreDecryptError('CORRUPT', 'encrypted record is truncated');
     const iv = buf.subarray(0, IV_LEN);
     const tag = buf.subarray(IV_LEN, IV_LEN + TAG_LEN);
     const ct = buf.subarray(IV_LEN + TAG_LEN);
-    const decipher = createDecipheriv('aes-256-gcm', key, iv);
-    decipher.setAuthTag(tag);
-    // GCM `final()` throws on a wrong key or tampered ciphertext — surfaces as store corruption to the caller.
-    return Buffer.concat([decipher.update(ct), decipher.final()]).toString('utf8');
+    return gcmDecrypt(key, iv, tag, ct);
+}
+/** v2 encrypt into the `aienc2:` envelope (salt‖iv‖tag‖ciphertext). */
+export function encryptStringV2(plain, key, salt) {
+    const iv = randomBytes(IV_LEN);
+    const cipher = createCipheriv('aes-256-gcm', key, iv);
+    const ct = Buffer.concat([cipher.update(plain, 'utf8'), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return ENVELOPE_PREFIX_V2 + Buffer.concat([salt, iv, tag, ct]).toString('base64');
 }
-/** Build the codec `FileArea` uses to encrypt/decrypt its file contents. */
-export function makeCodec(key) {
+/**
+ * Decrypt ANY known envelope with the given secret: v2 (scrypt per embedded salt), v1 (sha256), or
+ * plaintext passthrough. An `aiencN:` prefix this build does not know is UNSUPPORTED_VERSION. `keyFor`
+ * supplies (and caches) the scrypt key for a v2 salt.
+ */
+function decryptEnvelope(stored, secret, keyFor) {
+    if (stored.startsWith(ENVELOPE_PREFIX_V2)) {
+        const buf = Buffer.from(stored.slice(ENVELOPE_PREFIX_V2.length), 'base64');
+        if (buf.length < SALT_LEN + IV_LEN + TAG_LEN)
+            throw new StoreDecryptError('CORRUPT', 'encrypted record is truncated');
+        const salt = buf.subarray(0, SALT_LEN);
+        const iv = buf.subarray(SALT_LEN, SALT_LEN + IV_LEN);
+        const tag = buf.subarray(SALT_LEN + IV_LEN, SALT_LEN + IV_LEN + TAG_LEN);
+        const ct = buf.subarray(SALT_LEN + IV_LEN + TAG_LEN);
+        return gcmDecrypt(keyFor(salt), iv, tag, ct);
+    }
+    if (stored.startsWith(ENVELOPE_PREFIX))
+        return decryptString(stored, deriveKey(secret)); // v1 legacy
+    const m = stored.match(/^aienc(\d+):/);
+    if (m)
+        throw new StoreDecryptError('UNSUPPORTED_VERSION', `store record uses an unsupported envelope version 'aienc${m[1]}'`);
+    return stored; // plaintext (pre-encryption) record — read as-is
+}
+/**
+ * Build the codec `FileArea` uses. A **secret string** yields the current v2 codec (scrypt; writes
+ * `aienc2:`, reads every version). A **Buffer** yields the legacy v1 codec (sha256; writes `aienc1:`) —
+ * retained so existing `makeCodec(deriveKey(secret))` callers behave exactly as before.
+ */
+export function makeCodec(keyOrSecret) {
+    if (Buffer.isBuffer(keyOrSecret)) {
+        const key = keyOrSecret;
+        return { encode: (plain) => encryptString(plain, key), decode: (stored) => decryptString(stored, key) };
+    }
+    const secret = keyOrSecret;
+    const encodeSalt = randomBytes(SALT_LEN); // one salt per codec instance → writes share one derivation
+    const keyCache = new Map();
+    const keyFor = (salt) => {
+        const h = salt.toString('hex');
+        let k = keyCache.get(h);
+        if (!k) {
+            k = deriveKeyScrypt(secret, salt);
+            keyCache.set(h, k);
+        }
+        return k;
+    };
     return {
-        encode: (plain) => encryptString(plain, key),
-        decode: (stored) => decryptString(stored, key),
+        encode: (plain) => encryptStringV2(plain, keyFor(encodeSalt), encodeSalt),
+        decode: (stored) => decryptEnvelope(stored, secret, keyFor),
     };
 }

package/dist/store/errors.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Typed store-layer errors. Decryption failures carry an HONEST code: an AEAD (GCM) authentication
+ * failure does NOT prove the key is wrong — it means wrong key OR tampering OR corruption, and the code
+ * says exactly that. Higher layers may infer "likely key mismatch" only from AGGREGATE evidence (most/
+ * all encrypted records failing at once), never from a single record.
+ */
+export type StoreDecryptCode = 'AUTH_FAILED' | 'UNSUPPORTED_VERSION' | 'CORRUPT';
+export declare class StoreDecryptError extends Error {
+    readonly code: StoreDecryptCode;
+    constructor(code: StoreDecryptCode, message: string);
+}

package/dist/store/errors.js

@@ -0,0 +1,14 @@
+/**
+ * Typed store-layer errors. Decryption failures carry an HONEST code: an AEAD (GCM) authentication
+ * failure does NOT prove the key is wrong — it means wrong key OR tampering OR corruption, and the code
+ * says exactly that. Higher layers may infer "likely key mismatch" only from AGGREGATE evidence (most/
+ * all encrypted records failing at once), never from a single record.
+ */
+export class StoreDecryptError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'StoreDecryptError';
+        this.code = code;
+    }
+}

package/dist/store/store.d.ts

@@ -64,8 +64,28 @@ export declare class RuntimeStore {
     /**
      * Advisory per-project lock. Best-effort: acquires an exclusive lock file, steals a stale one, and
      * otherwise proceeds anyway (advisory). Hard mutual exclusion for executions is a Phase 7 lease.
+     *
+     * The lock carries an ownership TOKEN so stealing a stale lock is atomic (unlink + exclusive re-create —
+     * exactly one racer wins) and release only removes a lock we still hold, never a stealer's.
      */
     withLock<T>(fn: () => T, staleMs?: number): T;
-    /** Aggregate integrity check across the project areas (plus the org area when configured). */
+    /**
+     * @internal Acquire the lock file exclusively, stealing it only if stale. Returns whether WE hold it
+     * (a live foreign lock ⇒ false ⇒ the caller proceeds advisory, unlocked). Exposed for deterministic
+     * concurrency tests; `hooks.afterStaleUnlink` runs between removing a stale lock and re-creating it,
+     * letting a test interleave a competing stealer in that exact window.
+     */
+    acquireLock(lockPath: string, token: string, staleMs?: number, hooks?: {
+        afterStaleUnlink?: () => void;
+    }): boolean;
+    /** @internal Release a lock ONLY if its on-disk token matches ours — never delete a stealer's lock. */
+    releaseLock(lockPath: string, token: string): void;
+    /**
+     * Aggregate integrity check across the project's DURABLE areas (plus the org area when configured).
+     * Covers memory (all scopes), conversations, indexes, and the record stores that hold real state —
+     * mcp, executions, artifacts. `cache` is intentionally excluded (disposable — `cleanup` clears it
+     * wholesale, so a checksum issue there is noise); `learning`/`preferences` are store/user-wide rather
+     * than project-scoped and are left to a future store-wide check.
+     */
     check(): IntegrityIssue[];
 }

package/dist/store/store.js

@@ -4,6 +4,7 @@
  * per-project lock, and an aggregate integrity check. In stateless mode every area is a NullArea.
  */
 import { existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { randomBytes } from 'node:crypto';
 import { join } from 'node:path';
 import { systemClock } from '../util/clock.js';
 import { FileArea, NullArea } from './area.js';
@@ -98,10 +99,10 @@ export class RuntimeStore {
     stampMeta() {
         if (!this.enabled || this.metaStamped)
             return;
-        mkdirSync(this.projectDir, { recursive: true });
+        mkdirSync(this.projectDir, { recursive: true, mode: 0o700 });
         const metaPath = join(this.projectDir, 'meta.json');
         if (!existsSync(metaPath))
-            writeFileSync(metaPath, JSON.stringify({ version: STORE_VERSION, projectId: this.projectId }));
+            writeFileSync(metaPath, JSON.stringify({ version: STORE_VERSION, projectId: this.projectId }), { mode: 0o600 });
         this.metaStamped = true;
     }
     /** The stored version, or undefined when absent — a migration hook seam for future versions. */
@@ -119,43 +120,97 @@ export class RuntimeStore {
     /**
      * Advisory per-project lock. Best-effort: acquires an exclusive lock file, steals a stale one, and
      * otherwise proceeds anyway (advisory). Hard mutual exclusion for executions is a Phase 7 lease.
+     *
+     * The lock carries an ownership TOKEN so stealing a stale lock is atomic (unlink + exclusive re-create —
+     * exactly one racer wins) and release only removes a lock we still hold, never a stealer's.
      */
     withLock(fn, staleMs = 30_000) {
         if (!this.enabled)
             return fn();
-        mkdirSync(this.projectDir, { recursive: true });
+        mkdirSync(this.projectDir, { recursive: true, mode: 0o700 });
         const lockPath = join(this.projectDir, '.lock');
-        let held = false;
+        const token = randomBytes(16).toString('hex');
+        const held = this.acquireLock(lockPath, token, staleMs);
         try {
-            writeFileSync(lockPath, String(process.pid), { flag: 'wx' });
-            held = true;
+            return fn();
+        }
+        finally {
+            if (held)
+                this.releaseLock(lockPath, token);
+        }
+    }
+    /**
+     * @internal Acquire the lock file exclusively, stealing it only if stale. Returns whether WE hold it
+     * (a live foreign lock ⇒ false ⇒ the caller proceeds advisory, unlocked). Exposed for deterministic
+     * concurrency tests; `hooks.afterStaleUnlink` runs between removing a stale lock and re-creating it,
+     * letting a test interleave a competing stealer in that exact window.
+     */
+    acquireLock(lockPath, token, staleMs = 30_000, hooks) {
+        const content = JSON.stringify({ pid: process.pid, token, acquiredAt: this.clock.now() });
+        try {
+            writeFileSync(lockPath, content, { flag: 'wx', mode: 0o600 }); // exclusive create — no lock held
+            return true;
         }
         catch {
-            // Held already — steal if stale.
+            // A lock exists. Steal ONLY if stale, and atomically: remove it, then race an exclusive re-create —
+            // exactly one concurrent stealer's `wx` can succeed.
+            let stale;
+            try {
+                stale = this.clock.now() - statSync(lockPath).mtimeMs > staleMs;
+            }
+            catch {
+                return false; // vanished/unreadable mid-check — proceed advisory, unlocked
+            }
+            if (!stale)
+                return false; // a live lock — do not steal; proceed advisory, unlocked
             try {
-                const age = this.clock.now() - statSync(lockPath).mtimeMs;
-                if (age > staleMs) {
-                    writeFileSync(lockPath, String(process.pid));
-                    held = true;
-                }
+                rmSync(lockPath); // drop the stale lock (a competing stealer may have already removed it)
             }
             catch {
-                /* proceed advisory */
+                /* already gone — still race the exclusive create below */
+            }
+            hooks?.afterStaleUnlink?.();
+            try {
+                writeFileSync(lockPath, content, { flag: 'wx', mode: 0o600 });
+                return true; // won the steal
+            }
+            catch {
+                return false; // a competing stealer won the race — proceed advisory, unlocked
             }
         }
+    }
+    /** @internal Release a lock ONLY if its on-disk token matches ours — never delete a stealer's lock. */
+    releaseLock(lockPath, token) {
         try {
-            return fn();
-        }
-        finally {
-            if (held && existsSync(lockPath))
+            const cur = JSON.parse(readFileSync(lockPath, 'utf8'));
+            if (cur.token === token)
                 rmSync(lockPath);
         }
+        catch {
+            /* lock gone or unreadable — nothing of ours to release */
+        }
     }
-    /** Aggregate integrity check across the project areas (plus the org area when configured). */
+    /**
+     * Aggregate integrity check across the project's DURABLE areas (plus the org area when configured).
+     * Covers memory (all scopes), conversations, indexes, and the record stores that hold real state —
+     * mcp, executions, artifacts. `cache` is intentionally excluded (disposable — `cleanup` clears it
+     * wholesale, so a checksum issue there is noise); `learning`/`preferences` are store/user-wide rather
+     * than project-scoped and are left to a future store-wide check.
+     */
     check() {
         if (!this.enabled)
             return [];
         const org = this.orgDir ? this.memory('organization').check() : [];
-        return [...this.memory('project').check(), ...this.memory('user').check(), ...this.memory('repository').check(), ...org, ...this.conversations().check(), ...this.indexes().check()];
+        return [
+            ...this.memory('project').check(),
+            ...this.memory('user').check(),
+            ...this.memory('repository').check(),
+            ...org,
+            ...this.conversations().check(),
+            ...this.indexes().check(),
+            ...this.mcp().check(),
+            ...this.executions().check(),
+            ...this.artifacts().check(),
+        ];
     }
 }

package/dist/telemetry/sinks/file.js

@@ -11,7 +11,9 @@ export class FileSink {
     constructor(path) {
         this.path = path;
         try {
-            mkdirSync(dirname(path), { recursive: true });
+            // Owner-only by default (0700 dir / 0600 file): the spool commonly lives under `.ai-runtime/` and
+            // carries routing/perf metadata. Mode applies only on creation; POSIX-only, a no-op on Windows.
+            mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
         }
         catch {
             /* ignore — a telemetry setup failure must not break the router */
@@ -19,7 +21,7 @@ export class FileSink {
     }
     emit(event) {
         try {
-            appendFileSync(this.path, `${JSON.stringify(redact(event))}\n`);
+            appendFileSync(this.path, `${JSON.stringify(redact(event))}\n`, { mode: 0o600 });
         }
         catch {
             /* a telemetry write must never fail a run */