carthagent 1.0.7 → 1.1.0-beta.1

package/tools/test-owned-visual-clear.py

@@ -0,0 +1,373 @@
+#!/usr/bin/env python3
+"""Behavioral proof for native TUI /clear on a trusted owned runtime (Linux PTY)."""
+import argparse
+import importlib.util
+import json
+import os
+from pathlib import Path
+import signal
+import sys
+import time
+
+
+_env_spec = importlib.util.spec_from_file_location(
+    'owned_visual_clear_env', Path(__file__).with_name('owned-visual-clear-env.py'))
+_env_module = importlib.util.module_from_spec(_env_spec)
+_env_spec.loader.exec_module(_env_module)
+SAFE_PARENT_ENV = _env_module.SAFE_PARENT_ENV
+TUI_ENV_KEYS = _env_module.TUI_ENV_KEYS
+FIXTURE_ENV_KEYS = _env_module.FIXTURE_ENV_KEYS
+fixture_environment = _env_module.fixture_environment
+assert_clean_child_environment = _env_module.assert_clean_child_environment
+_model_spec = importlib.util.spec_from_file_location(
+    'owned_visual_clear_model', Path(__file__).with_name('owned-visual-clear-model.py'))
+_model_module = importlib.util.module_from_spec(_model_spec)
+_model_spec.loader.exec_module(_model_module)
+canonical_conversation = _model_module.canonical_conversation
+latest_message = _model_module.latest_message
+
+
+def preflight(binary, owned_root, manifest, env):
+    import subprocess
+
+    helper = Path(__file__).with_name('native-runtime-identity.mjs')
+    script = r'''
+import { readFile } from 'node:fs/promises';
+const {loadNativeTestRuntime}=await import(process.argv[1]);
+const expectedManifest=JSON.parse(await readFile(process.argv[4],'utf8'));
+const identity=await loadNativeTestRuntime({binary:process.argv[2],ownedRoot:process.argv[3],expectedManifest,env:process.env});
+process.stdout.write(JSON.stringify(identity));
+'''
+    result = subprocess.run(['node', '--input-type=module', '-e', script,
+                             str(helper), str(Path(binary).resolve()),
+                             str(Path(owned_root).resolve()), str(Path(manifest).resolve())],
+                            capture_output=True, text=True, env=env)
+    if result.returncode:
+        raise RuntimeError(f'trusted owned-runtime preflight failed: {result.stderr.strip()}')
+    return json.loads(result.stdout)
+
+
+class Tui:
+    active = set()
+
+    def __init__(self, binary, fixture, session_id, env):
+        import subprocess
+
+        self.master, slave = pty.openpty()
+        rows, columns = 60, 140
+        fcntl.ioctl(slave, termios.TIOCSWINSZ, struct.pack('HHHH', rows, columns, 0, 0))
+        child_env = {**env, 'TERM': 'xterm-256color', 'COLORTERM': 'truecolor',
+                     'OPENCODE_PASSWORD': fixture['password']}
+        assert_clean_child_environment(child_env)
+        self.child = subprocess.Popen([binary, '--server', fixture['baseUrl'],
+                                       '--session', session_id], cwd=fixture['cwd'],
+                                      env=child_env, stdin=slave, stdout=slave,
+                                      stderr=slave, start_new_session=True)
+        os.close(slave)
+        self.screen = Screen(rows=rows, columns=columns)
+        self.active.add(self)
+
+    def drain(self, seconds=.2):
+        end = time.monotonic() + seconds
+        while time.monotonic() < end:
+            ready, _, _ = select.select([self.master], [], [], .05)
+            if ready:
+                try:
+                    data = os.read(self.master, 65536)
+                except OSError:
+                    return
+                if not data:
+                    return
+                self.screen.feed(data)
+            elif self.child.poll() is not None:
+                raise AssertionError(f'TUI exited early: {self.child.returncode}')
+
+    def wait_for(self, predicate, what, timeout=20):
+        end = time.monotonic() + timeout
+        while time.monotonic() < end:
+            self.drain(.1)
+            if predicate():
+                self.drain(.2)
+                return
+        raise AssertionError(f'timed out waiting for {what}:\n{self.screen.visible()}')
+
+    def submit(self, text):
+        os.write(self.master, text.encode())
+        os.write(self.master, b'\r')
+
+    def submit_slash(self, text):
+        os.write(self.master, text.encode())
+        self.drain(.5)  # native slash autocomplete
+        os.write(self.master, b'\r')  # select registered command
+        self.drain(.3)
+        os.write(self.master, b'\r')  # dispatch
+
+    def stop(self):
+        import subprocess
+
+        if self not in self.active:
+            return
+        if self.child.poll() is None:
+            os.killpg(self.child.pid, signal.SIGTERM)
+            try:
+                self.child.wait(timeout=5)
+            except subprocess.TimeoutExpired:
+                os.killpg(self.child.pid, signal.SIGKILL)
+                self.child.wait(timeout=5)
+        os.close(self.master)
+        self.active.remove(self)
+
+
+def main():
+    # PTY and terminal semantics are POSIX-only; importing this runner is safe
+    # on platforms that only execute its child-environment unit tests.
+    global pty, fcntl, select, struct, termios, Screen
+    import pty
+    import fcntl
+    import select
+    import struct
+    import termios
+    import subprocess
+
+    _spec = importlib.util.spec_from_file_location(
+        'terminal_semantics', Path(__file__).with_name('native-terminal-semantics.py'))
+    _module = importlib.util.module_from_spec(_spec)
+    _spec.loader.exec_module(_module)
+    Screen = _module.Screen
+
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--binary', required=True)
+    parser.add_argument('--owned-root', required=True)
+    parser.add_argument('--release-manifest', required=True)
+    parser.add_argument('--artifact')
+    args = parser.parse_args()
+
+    binary = str(Path(args.binary).resolve())
+    owned_root = str(Path(args.owned_root).resolve())
+    root = Path(__file__).resolve().parents[1]
+    work = Path(args.artifact).resolve().parent if args.artifact else Path('/tmp')
+    resolver_env = fixture_environment(os.environ, work / 'ctg-visual-clear-runner',
+                                       owned_root, Path(args.release_manifest).resolve())
+    assert_clean_child_environment(resolver_env, FIXTURE_ENV_KEYS)
+    # This test selects a local artifact and performs no download. No runtime
+    # token is needed by preflight or any child, so the allowlist excludes it.
+    if any(key.casefold() == 'ctg_runtime_github_token' for key in resolver_env):
+        raise AssertionError('resolver environment retains a reserved runtime token')
+    preflight_env = dict(resolver_env)
+    print('Preflighting pinned executable...', file=sys.stderr, flush=True)
+    identity = preflight(binary, owned_root, args.release_manifest, preflight_env)
+
+    # Make the trusted resolver invocation and launch arguments explicit. The
+    # fixture will repeat identity checks before its host process is started.
+    fixture_script = r'''
+const {nativeFixture}=await import((await import('node:url')).pathToFileURL(process.argv[1]));
+const host=await nativeFixture({plugin:null,verifyInventory:false,preserveTemp:true,
+ respond(body,res){res.writeHead(200,{'content-type':'text/event-stream','connection':'close'});
+  const latestUser=[...(body.messages??[])].reverse().find(message=>message.role==='user');
+  const prompt=typeof latestUser?.content==='string'?latestUser.content:
+   (latestUser?.content??[]).map(part=>part.text??'').join(' ');
+  const reply=prompt.includes('VISUAL_CLEAR_CONTINUED_PROMPT')?
+   'CLEAR_FOLLOWUP_ASSISTANT_REPLY':
+   prompt.includes('CLEAR_SESSION_A_UNIQUE_MARKER')?'CLEAR_A_INITIAL_ASSISTANT_REPLY':
+   prompt.includes('UNCLEARED_CONTROL_OLD_MARKER')?'CLEAR_CONTROL_INITIAL_ASSISTANT_REPLY':
+   'CLEAR_NEIGHBOR_ASSISTANT_REPLY';
+  const chunk=(delta,finish_reason=null)=>`data: ${JSON.stringify({id:'offline-clear',object:'chat.completion.chunk',created:1,model:'fixture',choices:[{index:0,delta,finish_reason}]})}\n\n`;
+  res.end(chunk({role:'assistant',content:reply})+chunk({},'stop')+'data: [DONE]\n\n');}});
+try {
+ const sessions={};
+ for(const [key,marker] of [['a','CLEAR_SESSION_A_UNIQUE_MARKER'],['b','NEIGHBOR_SESSION_B_UNIQUE_MARKER'],['control','UNCLEARED_CONTROL_OLD_MARKER']]){
+  const s=await host.client.session.create({location:host.location,model:host.model,title:`clear ${key}`},host.request());
+  await host.client.session.prompt({sessionID:s.id,text:`Remember this visible marker: ${marker}`},host.request());
+   await host.client.session.wait({sessionID:s.id},host.request()); sessions[key]={id:s.id,marker}; }
+ await host.client.session.prompt({sessionID:sessions.control.id,text:'VISUAL_CLEAR_CONTINUED_PROMPT'},host.request());
+ await host.client.session.wait({sessionID:sessions.control.id},host.request());
+ process.stdout.write(JSON.stringify({baseUrl:host.baseUrl,password:host.password,temp:host.temp,cwd:host.cwd,sessions})+'\n');
+ process.once('SIGTERM',async()=>{await host.close({preserveTemp:false});process.exit(0)});
+ await new Promise(()=>{});
+} catch(e){await host.close({preserveTemp:false});throw e}
+'''
+    child = subprocess.Popen(['node', '--input-type=module', '-e', fixture_script,
+                               str(root / 'tools/native-fixture.mjs')], cwd=root,
+                              env=resolver_env, stdout=subprocess.PIPE,
+                              stderr=subprocess.PIPE, text=True)
+    tui = None
+    try:
+        line = child.stdout.readline()
+        if not line:
+            raise RuntimeError(f'fixture failed: {child.stderr.read()}')
+        fixture = json.loads(line)
+        bridge = r'''
+import {OpenCode} from '@opencode/client';
+const [url,password,id]=process.argv.slice(1);const c=OpenCode.make({baseUrl:url,headers:{authorization:`Basic ${Buffer.from(`opencode:${password}`).toString('base64')}`}});
+process.stdout.write(JSON.stringify(await c.message.list({sessionID:id},{signal:AbortSignal.timeout(10000)})));
+'''
+        def durable(session_id):
+            return json.loads(subprocess.run(['node','--input-type=module','-e',bridge,
+                fixture['baseUrl'],fixture['password'],session_id],cwd=root,check=True,
+                capture_output=True,text=True,env=resolver_env).stdout)
+        def conversation(value):
+            return [x for x in value.get('data',[]) if x.get('type') in ('user','assistant','tool')]
+        def stable(session_id):
+            previous=durable(session_id); same=0; end=time.monotonic()+10
+            while time.monotonic()<end:
+                time.sleep(.25); current=durable(session_id)
+                if current==previous:
+                    same+=1
+                    if same==2:return current
+                else:previous=current;same=0
+            raise AssertionError('durable message projection did not settle')
+
+        def durable_messages(session_id):
+            return stable(session_id)
+
+        def durable_snapshot(session_id):
+            return canonical_conversation(conversation(durable_messages(session_id)))
+
+        def wait_for_file_value(path, predicate, description, timeout=10):
+            end = time.monotonic() + timeout
+            last_value = None
+            while time.monotonic() < end:
+                try:
+                    value = json.loads(path.read_text())
+                except (OSError, json.JSONDecodeError):
+                    value = None
+                last_value = value
+                if value is not None and predicate(value):
+                    return value
+                time.sleep(.05)
+            raise AssertionError(
+                f'timed out waiting for persisted {description}; '
+                f'last state was {json.dumps(last_value, sort_keys=True)}')
+
+        a,b,control=(fixture['sessions'][key] for key in ('a','b','control'))
+        before_b=durable_snapshot(b['id'])
+        before_control=durable_snapshot(control['id'])
+        if not any(x.get('text') == 'Remember this visible marker: UNCLEARED_CONTROL_OLD_MARKER'
+                   for x in before_control if x.get('type') == 'user') or not any(
+                   x.get('text') == 'VISUAL_CLEAR_CONTINUED_PROMPT'
+                   for x in before_control if x.get('type') == 'user'):
+            raise AssertionError('positive-control transcript was not seeded with both user turns')
+        profile_script="import {runtimeEnvironment} from './lib/opencode/runtime.mjs';process.stdout.write(JSON.stringify(runtimeEnvironment({root:process.argv[1],env:process.env})))"
+        env=json.loads(subprocess.run(['node','--input-type=module','-e',profile_script,fixture['temp']],
+            cwd=root,env=resolver_env,check=True,capture_output=True,text=True).stdout)
+        env={key:value for key,value in env.items() if key in TUI_ENV_KEYS}
+        env.update({key:value for key,value in resolver_env.items() if key in SAFE_PARENT_ENV})
+        env['OPENCODE_PASSWORD']=fixture['password']
+        assert_clean_child_environment(env)
+
+        for key, value in env.items():
+            if key.casefold() in ('opencode_password', 'opencode_server_password'):
+                continue
+            if value in (fixture['password'], fixture['baseUrl']):
+                raise AssertionError(f'synthetic fixture credential unexpectedly occupies allowlisted variable {key}')
+        env['OPENCODE_SERVER_PASSWORD'] = fixture['password']
+        env['OPENCODE_SERVER_USERNAME'] = 'opencode'
+        assert_clean_child_environment(env)
+
+        tui=Tui(binary,fixture,a['id'],env)
+        tui.wait_for(lambda:a['marker'] in tui.screen.visible(),'A marker')
+        tui.wait_for(lambda:'CLEAR_A_INITIAL_ASSISTANT_REPLY' in tui.screen.visible(),'A initial assistant reply')
+        before_a_response=durable_messages(a['id'])
+        before_a=canonical_conversation(conversation(before_a_response))
+        cutoff_message=latest_message(before_a_response)
+        tui.submit_slash('/clear')
+        tui.wait_for(lambda:a['marker'] not in tui.screen.visible() and
+                     'CLEAR_A_INITIAL_ASSISTANT_REPLY' not in tui.screen.visible(),
+                     '/clear visual removal')
+        after_clear_durable = durable_snapshot(a['id'])
+        if after_clear_durable != before_a:
+            raise AssertionError('/clear changed durable conversational messages')
+        storage_matches = list((Path(fixture['temp']) / 'state').rglob('transcript-presentation.json'))
+        if len(storage_matches) != 1:
+            raise AssertionError(f'expected one isolated transcript-presentation store, found {len(storage_matches)}')
+        storage_path = storage_matches[0]
+        state_after_clear = wait_for_file_value(storage_path,
+            lambda state: state.get(a['id'], {}).get('before') == cutoff_message['id'],
+            f'A transcript cutoff for session {a["id"]} at message {cutoff_message["id"]}')
+        tui.submit('VISUAL_CLEAR_CONTINUED_PROMPT')
+        tui.wait_for(lambda:'CLEAR_FOLLOWUP_ASSISTANT_REPLY' in tui.screen.visible(),
+                     'follow-up assistant reply')
+        after_followup=durable_snapshot(a['id'])
+        if len(after_followup)<=len(before_a) or not any(x.get('type')=='user' and x.get('text')=='VISUAL_CLEAR_CONTINUED_PROMPT' for x in after_followup):
+            raise AssertionError('follow-up prompt was not durably submitted')
+        state_after_followup = wait_for_file_value(storage_path,
+            lambda state: state.get(a['id'], {}).get('before') == cutoff_message['id'],
+            'cutoff unchanged after follow-up')
+        if state_after_followup.get(a['id'], {}).get('before') != cutoff_message['id']:
+            raise AssertionError('follow-up turn changed the persisted transcript cutoff')
+        tui.stop();tui=None
+
+        neighbor=Tui(binary,fixture,b['id'],env)
+        neighbor.wait_for(lambda:b['marker'] in neighbor.screen.visible(),'B marker')
+        if a['marker'] in neighbor.screen.visible() or durable_snapshot(b['id']) != before_b:
+            raise AssertionError('neighbor session B was affected by clearing A')
+        neighbor.stop()
+
+        # Positive control: same short two-turn transcript, no clear command.
+        # At the same terminal dimensions and initial tail position, both old
+        # and new markers must remain visible without the presentation cutoff.
+        control_tui=Tui(binary,fixture,control['id'],env)
+        control_tui.wait_for(lambda:control['marker'] in control_tui.screen.visible(),
+                             'uncleared positive-control initial marker')
+        control_tui.wait_for(lambda:'VISUAL_CLEAR_CONTINUED_PROMPT' in control_tui.screen.visible(),
+                             'uncleared positive-control follow-up marker')
+        control_tui.wait_for(lambda:'CLEAR_FOLLOWUP_ASSISTANT_REPLY' in control_tui.screen.visible(),
+                             'uncleared positive-control follow-up assistant reply')
+        control_visible = control_tui.screen.visible()
+        if (control['marker'] not in control_visible or
+                'VISUAL_CLEAR_CONTINUED_PROMPT' not in control_visible or
+                'CLEAR_FOLLOWUP_ASSISTANT_REPLY' not in control_visible):
+            raise AssertionError('uncleared control old marker, new marker and assistant reply must all be visible')
+        control_tui.stop()
+
+        reopened=Tui(binary,fixture,a['id'],env)
+        reopened.wait_for(lambda:'VISUAL_CLEAR_CONTINUED_PROMPT' in reopened.screen.visible(),
+                          'post-clear marker visible after reopening A')
+        reopened.wait_for(lambda:'CLEAR_FOLLOWUP_ASSISTANT_REPLY' in reopened.screen.visible(),
+                          'post-clear assistant reply visible after reopening A')
+        reopened_visible = reopened.screen.visible()
+        if a['marker'] in reopened_visible:
+            raise AssertionError('old A marker remains visible; transcript presentation cutoff was not restored')
+        if ('VISUAL_CLEAR_CONTINUED_PROMPT' not in reopened_visible or
+                'CLEAR_FOLLOWUP_ASSISTANT_REPLY' not in reopened_visible):
+            raise AssertionError('reopened A must show both the post-clear user prompt and assistant reply')
+        if (control['marker'] not in control_visible or
+                'VISUAL_CLEAR_CONTINUED_PROMPT' not in control_visible or
+                'CLEAR_FOLLOWUP_ASSISTANT_REPLY' not in control_visible):
+            raise AssertionError('positive control did not show old and post-turn content at tested PTY position')
+        reopened_durable = durable_snapshot(a['id'])
+        if reopened_durable != after_followup:
+            raise AssertionError('durable A conversation changed on reopening')
+        reopened_state = wait_for_file_value(storage_path,
+            lambda state: state.get(a['id'], {}).get('before') == cutoff_message['id'],
+            'cutoff restored on reopen')
+        if reopened_state.get(a['id'], {}).get('before') != cutoff_message['id']:
+            raise AssertionError('reopened TUI lost the persisted presentation cutoff')
+        reopened.stop()
+        tui=None
+        result={'status':'PASS','scope':'Linux POSIX PTY; explicit trusted-preflighted owned staging artifact; offline loopback provider',
+          'runtimeIdentity':identity,'sessionIDs':{'a':a['id'],'b':b['id']},
+          'command':'native slash autocomplete selected /clear; Enter dispatched it',
+          'checks':{'A initial user and assistant markers disappeared from parsed PTY screen':True,
+           'A conversational message IDs/content unchanged by clear':True,
+           'follow-up prompt submitted and unique assistant reply visibly rendered':True,
+           'neighbor B unaffected':True,
+           'A old marker hidden while post-clear user and assistant markers are visible on reopen':True,
+           'uncleared same-length positive control visibly shows old user, follow-up user, and follow-up assistant reply at same PTY size':True,
+           'presentation cutoff ID persisted and unchanged across follow-up/reopen':True,
+           'session.revert.clear used':False,
+           'ambient credentials excluded by child environment allowlists':True},
+          'binarySha256':identity['binarySha256'],'cutoffMessageID':cutoff_message['id'],
+          'messagesBeforeClear':len(before_a),'messagesAfterFollowup':len(after_followup)}
+        rendered=json.dumps(result,indent=2)+'\n';print(rendered,end='')
+        if args.artifact:Path(args.artifact).write_text(rendered)
+    finally:
+        for running_tui in list(Tui.active):
+            running_tui.stop()
+        child.terminate()
+        try:child.wait(timeout=5)
+        except subprocess.TimeoutExpired:child.kill();child.wait()
+
+
+if __name__=='__main__':
+    main()

package/tools/verify-draft-runtime-gate.mjs

@@ -0,0 +1,138 @@
+import { readFile } from 'node:fs/promises';
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+export const REQUIRED_RUNTIME_ASSETS = Object.freeze([
+  'opencode-linux-x64.tar.gz',
+  'opencode-linux-arm64.tar.gz',
+  'opencode-darwin-x64.tar.gz',
+  'opencode-darwin-arm64.tar.gz',
+  'opencode-windows-x64.tar.gz',
+]);
+export const REQUIRED_RELEASE_ASSETS = Object.freeze([
+  ...REQUIRED_RUNTIME_ASSETS,
+  'runtime-release.json',
+  'runtime-release-SHA256SUMS.txt',
+]);
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const apiRepository = 'B-icy/Carthagent';
+
+if (process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) {
+  await main(process.argv.slice(2));
+}
+
+/** Check the exact remote draft/tag and local checkout before or after acceptance. */
+export async function verifyDraftRuntimeGate({
+  phase,
+  releaseTag,
+  expectedSha,
+  expectedReleaseId,
+  repo = apiRepository,
+  cwd = process.cwd(),
+  env = process.env,
+  run = runCommand,
+}) {
+  if (!['before', 'recheck', 'after'].includes(phase)) throw new Error('phase must be before, recheck, or after');
+  if (repo !== apiRepository) throw new Error(`Draft runtime gate is restricted to ${apiRepository}.`);
+  const packageJson = JSON.parse(await readFile(path.join(root, 'package.json'), 'utf8'));
+  if (releaseTag !== `v${packageJson.version}`) {
+    throw new Error(`Release tag must be exactly v${packageJson.version}, received ${JSON.stringify(releaseTag)}.`);
+  }
+  const version = packageJson.version;
+  const releases = await listReleases({ repo, env, run });
+  const matches = releases.filter((release) => release?.tag_name === releaseTag);
+  if (matches.length !== 1) throw new Error(matches.length ? 'GitHub returned duplicate exact-tag releases.' : `No release exists for ${releaseTag}.`);
+  const release = matches[0];
+  if (release.draft !== true) throw new Error(`Release ${releaseTag} must remain a draft during installed acceptance.`);
+  if (!Number.isSafeInteger(release.id) || release.id <= 0) throw new Error('GitHub returned invalid draft release identity.');
+  if (expectedReleaseId !== undefined && String(release.id) !== String(expectedReleaseId)) {
+    throw new Error(`Draft release identity changed during acceptance (expected ${expectedReleaseId}, found ${release.id}).`);
+  }
+  assertRuntimeAssets(release.assets, releaseTag);
+
+  const remoteSha = await resolveRemoteTag({ repo, releaseTag, env, run });
+  const checkoutSha = run('git', ['rev-parse', 'HEAD'], { cwd, env }).trim().toLowerCase();
+  if (!/^[a-f0-9]{40}$/.test(checkoutSha)) throw new Error('Could not identify the checked-out release commit.');
+  if (remoteSha !== checkoutSha) throw new Error(`Release tag ${releaseTag} resolves to ${remoteSha}, but this checkout is ${checkoutSha}.`);
+  if (phase === 'recheck' || phase === 'after') {
+    if (!/^[a-f0-9]{40}$/.test(expectedSha ?? '')) throw new Error(`${phase} check requires the pre-acceptance tested SHA.`);
+    if (remoteSha !== expectedSha.toLowerCase()) throw new Error(`Release tag changed during acceptance: expected ${expectedSha}, found ${remoteSha}.`);
+    if (!/^[1-9][0-9]*$/.test(String(expectedReleaseId ?? ''))) throw new Error(`${phase} check requires the pre-acceptance draft release ID.`);
+  }
+  return Object.freeze({ releaseId: release.id, sha: remoteSha, version });
+}
+
+function assertRuntimeAssets(assets, tag) {
+  if (!Array.isArray(assets)) throw new Error(`Draft release ${tag} has no asset list.`);
+  const names = assets.map((asset) => asset?.name);
+  for (const name of REQUIRED_RELEASE_ASSETS) {
+    const count = names.filter((candidate) => candidate === name).length;
+    if (count !== 1) throw new Error(`Draft release ${tag} must contain exactly one ${name} asset.`);
+  }
+  const unexpected = names.filter((name) => !REQUIRED_RELEASE_ASSETS.includes(name));
+  if (unexpected.length) throw new Error(`Draft release ${tag} contains unexpected assets: ${unexpected.join(', ')}.`);
+  if (names.length !== REQUIRED_RELEASE_ASSETS.length) {
+    throw new Error(`Draft release ${tag} must contain exactly the seven reviewed runtime release assets.`);
+  }
+}
+
+async function listReleases({ repo, env, run }) {
+  const output = run('gh', ['api', '--paginate', '--slurp', `repos/${repo}/releases?per_page=100`], { env });
+  let pages;
+  try { pages = JSON.parse(output); }
+  catch { throw new Error('GitHub returned invalid release-list JSON.'); }
+  if (!Array.isArray(pages) || pages.some((page) => !Array.isArray(page))) throw new Error('GitHub returned invalid paginated release metadata.');
+  return pages.flat();
+}
+
+async function resolveRemoteTag({ repo, releaseTag, env, run }) {
+  let ref;
+  try { ref = JSON.parse(run('gh', ['api', `repos/${repo}/git/ref/tags/${releaseTag}`], { env })); }
+  catch (error) { throw new Error(`Could not resolve remote tag ${releaseTag}: ${error.message}`); }
+  let type = ref?.object?.type;
+  let sha = ref?.object?.sha;
+  for (let depth = 0; type === 'tag'; depth++) {
+    if (depth >= 5) throw new Error(`Release tag ${releaseTag} has excessive nested annotated tags.`);
+    if (!/^[a-f0-9]{40}$/i.test(sha ?? '')) throw new Error(`Release tag ${releaseTag} has an invalid annotated tag object.`);
+    let annotated;
+    try { annotated = JSON.parse(run('gh', ['api', `repos/${repo}/git/tags/${sha}`], { env })); }
+    catch (error) { throw new Error(`Could not resolve annotated tag object for ${releaseTag}: ${error.message}`); }
+    type = annotated?.object?.type;
+    sha = annotated?.object?.sha;
+  }
+  if (type !== 'commit' || !/^[a-f0-9]{40}$/i.test(sha ?? '')) {
+    throw new Error(`Release tag ${releaseTag} must resolve to a commit.`);
+  }
+  return sha.toLowerCase();
+}
+
+async function main(args) {
+  const [phase, releaseTag] = args;
+  if (!['before', 'recheck', 'after'].includes(phase) || !releaseTag) {
+    console.error('Usage: node tools/verify-draft-runtime-gate.mjs <before|recheck|after> <release-tag>');
+    process.exit(2);
+  }
+  const result = await verifyDraftRuntimeGate({
+    phase,
+    releaseTag,
+    expectedSha: process.env.EXPECTED_SHA,
+    expectedReleaseId: process.env.EXPECTED_RELEASE_ID,
+    repo: process.env.GITHUB_REPOSITORY,
+    cwd: process.cwd(),
+  });
+  if (phase === 'before') {
+    if (!process.env.GITHUB_OUTPUT) throw new Error('GITHUB_OUTPUT is required for the pre-acceptance gate.');
+    const { appendFile } = await import('node:fs/promises');
+    await appendFile(process.env.GITHUB_OUTPUT, `tested_sha=${result.sha}\nrelease_id=${result.releaseId}\n`);
+  }
+  console.log(`Verified draft release ${releaseTag} at ${result.sha} (${phase} installed acceptance).`);
+}
+
+function runCommand(command, args, { cwd, env } = {}) {
+  const result = spawnSync(command, args, { cwd, env, encoding: 'utf8', maxBuffer: 8 * 1024 * 1024 });
+  if (result.error) throw result.error;
+  if (result.status !== 0) throw new Error(`${command} exited ${result.status}: ${(result.stderr || result.stdout).trim().slice(-2000)}`);
+  return result.stdout;
+}

package/tools/verify-owned-runtime-release.mjs

@@ -0,0 +1,114 @@
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { createRuntimeGithubFetch } from '../lib/opencode/runtime-github-transport.mjs';
+import { readPinnedOwnedRuntimeInputs } from './pinned-owned-runtime-inputs.mjs';
+
+export const REQUIRED_RUNTIME_TARGETS = Object.freeze({
+  'linux-x64': ['linux', 'x64', 'opencode-linux-x64.tar.gz'],
+  'linux-arm64': ['linux', 'arm64', 'opencode-linux-arm64.tar.gz'],
+  'darwin-x64': ['darwin', 'x64', 'opencode-darwin-x64.tar.gz'],
+  'darwin-arm64': ['darwin', 'arm64', 'opencode-darwin-arm64.tar.gz'],
+  'windows-x64': ['windows', 'x64', 'opencode-windows-x64.tar.gz'],
+});
+
+const HEX_40 = /^[a-f0-9]{40}$/i;
+const HEX_64 = /^[a-f0-9]{64}$/i;
+
+if (process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) {
+  const [releaseVersion, manifestPath, assetsBaseUrl] = process.argv.slice(2);
+  if (!releaseVersion || !manifestPath || !assetsBaseUrl) {
+    console.error('Usage: node tools/verify-owned-runtime-release.mjs <version> <trusted-manifest.json> <release-assets-base-url>');
+    process.exit(2);
+  }
+  await verifyOwnedRuntimeRelease({ releaseVersion, manifestPath, assetsBaseUrl, repoRoot: process.cwd() });
+}
+
+/** Validate the packaged trusted outer manifest and acquire/verify each exact asset. */
+export async function verifyOwnedRuntimeRelease({
+  releaseVersion,
+  manifestPath,
+  assetsBaseUrl,
+  repoRoot,
+  acquireRuntime,
+  cacheRoot,
+  fetchImpl,
+  runtimeToken = process.env.CTG_RUNTIME_GITHUB_TOKEN,
+}) {
+  const manifest = JSON.parse(await readFile(manifestPath, 'utf8'));
+  validateRuntimeReleaseManifest(manifest, releaseVersion);
+  await validateRuntimeBuildInputs(manifest, path.resolve(repoRoot ?? process.cwd()));
+  const acquireOwnedRuntime = acquireRuntime ?? (await import('../lib/opencode/runtime-artifact.mjs')).acquireOwnedRuntime;
+  const runtimeFetch = runtimeToken
+    ? createRuntimeGithubFetch({ token: runtimeToken, fetchImpl: fetchImpl ?? globalThis.fetch })
+    : fetchImpl;
+
+  for (const [key, [platform, arch, name]] of Object.entries(REQUIRED_RUNTIME_TARGETS)) {
+    const asset = manifest.assets[key];
+    const installed = await acquireOwnedRuntime({
+      releaseVersion,
+      platform,
+      arch,
+      baseUrl: assetsBaseUrl,
+      expectedArchiveSha256: asset.archiveSha256,
+      expectedExecutableSha256: asset.executableSha256,
+      expectedSourceRevision: manifest.sourceRevision,
+      expectedPatchSha256: manifest.patchSha256,
+      expectedLockSha256: manifest.lockSha256,
+      expectedCompatibilityVersion: manifest.compatibilityVersion,
+      expectedRuntimeVersion: manifest.runtimeVersion,
+      expectedChannel: `ctg.${manifest.compatibilityVersion}`,
+      ...(cacheRoot ? { cacheRoot } : {}),
+      ...(runtimeFetch ? { fetchImpl: runtimeFetch } : {}),
+    });
+    if (typeof installed !== 'string' || !installed) throw new Error(`Acquisition did not verify ${name}`);
+  }
+  return manifest;
+}
+
+export function validateRuntimeReleaseManifest(value, releaseVersion) {
+  if (value?.version !== 1 || value.releaseVersion !== releaseVersion) {
+    throw new Error('Trusted runtime release manifest version does not match the release tag');
+  }
+  if (typeof value.compatibilityVersion !== 'string' || !value.compatibilityVersion.trim()) {
+    throw new Error('Runtime compatibilityVersion is required');
+  }
+  if (typeof value.runtimeVersion !== 'string' || !value.runtimeVersion.trim()) {
+    throw new Error('Runtime runtimeVersion is required');
+  }
+  if (typeof value.sourceRevision !== 'string' || !HEX_40.test(value.sourceRevision)) {
+    throw new Error('Runtime sourceRevision must be a 40-character commit SHA');
+  }
+  for (const field of ['patchSha256', 'lockSha256']) {
+    if (typeof value[field] !== 'string' || !HEX_64.test(value[field])) {
+      throw new Error(`Runtime ${field} must be a 64-character SHA-256 digest`);
+    }
+  }
+  if (!value.assets || typeof value.assets !== 'object' || Array.isArray(value.assets)) {
+    throw new Error('Runtime assets must be a platform map');
+  }
+  const actual = Object.keys(value.assets).sort();
+  const required = Object.keys(REQUIRED_RUNTIME_TARGETS).sort();
+  if (JSON.stringify(actual) !== JSON.stringify(required)) {
+    throw new Error(`Trusted runtime manifest must contain exactly: ${required.join(', ')}`);
+  }
+  for (const [key, [, , name]] of Object.entries(REQUIRED_RUNTIME_TARGETS)) {
+    const asset = value.assets[key];
+    if (asset?.name !== name) throw new Error(`Runtime manifest asset name for ${key} must be ${name}`);
+    for (const field of ['archiveSha256', 'executableSha256']) {
+      if (typeof asset[field] !== 'string' || !HEX_64.test(asset[field])) {
+        throw new Error(`${key}.${field} must be a 64-character SHA-256 digest`);
+      }
+    }
+  }
+}
+
+/** Bind trusted artifact provenance to the exact recipe and patch in the tagged tree. */
+export async function validateRuntimeBuildInputs(value, repoRoot) {
+  const pinnedInputs = await readPinnedOwnedRuntimeInputs(repoRoot);
+  for (const field of ['sourceRevision', 'patchSha256', 'lockSha256']) {
+    if (pinnedInputs[field] !== value[field].toLowerCase()) {
+      throw new Error(`Runtime ${field} does not match the tagged build recipe`);
+    }
+  }
+}

package/tools/verify-release-version.mjs

@@ -34,4 +34,24 @@ if (packInfo.length !== 1 || packInfo[0].name !== packageJson.name || packInfo[0
   throw new Error(`Packed npm manifest must be ${packageJson.name}@${version}`);
 }
 
-console.log(`Verified release tag ${tag}, lockfile, and packed package ${packageJson.name}@${version}`);
+// npm publish silently drops bin entries it considers invalid (npm 11 rejects
+// "./bin/ctg.mjs"), so a published version could ship without the ctg command.
+// Check the publish-time manifest npm itself would upload, not package.json.
+const published = spawnSync('npm', ['publish', '--dry-run', '--json', '--tag', 'next'], { encoding: 'utf8' });
+if (published.status !== 0) {
+  process.stderr.write(published.stderr);
+  process.exit(published.status ?? 1);
+}
+const corrections = published.stderr.split('\n').filter(line => /auto-corrected|was invalid and removed/.test(line));
+if (corrections.length) {
+  throw new Error(`npm publish would rewrite package.json; fix it before releasing:\n${published.stderr}`);
+}
+const binPath = packageJson.bin?.ctg;
+if (typeof binPath !== 'string' || binPath.startsWith('./')) {
+  throw new Error(`package.json bin.ctg must be a plain relative path npm publish keeps (got ${JSON.stringify(binPath)})`);
+}
+if (!packInfo[0].files.some(file => file.path === binPath && (file.mode & 0o111))) {
+  throw new Error(`Packed npm package must contain executable ${binPath} for the ctg command`);
+}
+
+console.log(`Verified release tag ${tag}, lockfile, and packed package ${packageJson.name}@${version} with ctg -> ${binPath}`);