carthagent 1.0.7 → 1.1.0-beta.2

package/tools/benchmark/guard.test.mjs

@@ -50,12 +50,12 @@ test('parallel per-session admissions reserve the final slot once, replay IDs id
     // A duplicate delivery of the admitted call ID is idempotent, including
     // after a plugin restart which discards in-memory state.
     const admittedID=state.storage.get(key('session-a')).find(row=>row.id.startsWith('call-')&&row.admitted).id;
-    await assert.rejects(before({id:admittedID,tool:'read',sessionID:'session-a'}),/budget exhausted/);
+    await assert.rejects(before({id:admittedID,tool:'read',sessionID:'session-a'}),/invocation ID was already reserved/);
     assert.equal(state.storage.get(key('session-a')).filter(row=>row.admitted).length,2);
     await dispose();
     const other=harness(state.storage);
     dispose=await guard(other.ctx);
-    await assert.rejects(other.hooks.get('tool:execute.before')({id:admittedID,tool:'read',sessionID:'session-a'}),/budget exhausted/);
+    await assert.rejects(other.hooks.get('tool:execute.before')({id:admittedID,tool:'read',sessionID:'session-a'}),/invocation ID was already reserved/);
     await other.hooks.get('tool:execute.before')({id:'neighbor',tool:'read',sessionID:'session-b'});
     assert.equal(other.storage.get(key('session-b')).filter(row=>row.admitted).length,1);
     await assert.rejects(other.hooks.get('tool:execute.before')({id:'new-after-restart',tool:'read',sessionID:'session-a'}),/budget exhausted/);
@@ -73,6 +73,39 @@ test('parallel per-session admissions reserve the final slot once, replay IDs id
   }
 });
 
+test('Code Mode same-tool calls sharing an execute ID fail closed as ambiguous, not exhausted',async()=>{
+  const temp=mkdtempSync(join(tmpdir(),'benchmark-guard-codemode-'));
+  const old={limit:process.env.BENCH_TOOL_LIMIT,log:process.env.BENCH_GUARD_LOG,home:process.env.CTG_OPENCODE_HOME};
+  process.env.BENCH_TOOL_LIMIT='3';process.env.BENCH_GUARD_LOG=join(temp,'guard.jsonl');process.env.CTG_OPENCODE_HOME=temp;
+  const state=harness();let dispose=await guard(state.ctx);
+  try{
+    const before=state.hooks.get('tool:execute.before');
+    const invoke=(tool,id='execute-1')=>before({id,tool,sessionID:'codemode-session'});
+    await invoke('execute');await invoke('carthagent.delivery_plan');
+    let nestedExecutions=0;
+    const executeNested=async()=>{await invoke('carthagent.delivery_plan');nestedExecutions++;};
+    const repeated=await Promise.allSettled([executeNested(),executeNested()]);
+    assert.equal(repeated.filter(result=>result.status==='rejected').length,2);
+    for(const result of repeated)if(result.status==='rejected'){
+      assert.match(result.reason.message,/attribution unavailable/);
+      assert.doesNotMatch(result.reason.message,/exhausted/);
+    }
+    assert.equal(nestedExecutions,0,'ambiguous calls must be rejected at the pre-execution hook boundary');
+    assert.equal(state.storage.get(key('codemode-session')).filter(row=>row.admitted).length,2,'ambiguous repeated calls must not consume or appear admitted against the remaining slot');
+    assert.equal(state.storage.get(key('codemode-session')).length,2,'ambiguous calls do not create inferred reservations');
+    await invoke('carthagent.delivery_check','execute-2');
+    assert.deepEqual(state.storage.get(key('codemode-session')).map(row=>({tool:row.tool,admitted:row.admitted})),[
+      {tool:'execute',admitted:true},{tool:'carthagent.delivery_plan',admitted:true},{tool:'carthagent.delivery_check',admitted:true},
+    ]);
+    const log=readFileSync(process.env.BENCH_GUARD_LOG,'utf8').trim().split('\n').map(JSON.parse);
+    assert.deepEqual(log.map(row=>row.tool),['execute','carthagent.delivery_plan','carthagent.delivery_check']);
+  }finally{
+    await dispose();
+    for(const[name,value]of Object.entries({BENCH_TOOL_LIMIT:old.limit,BENCH_GUARD_LOG:old.log,CTG_OPENCODE_HOME:old.home}))if(value===undefined)delete process.env[name];else process.env[name]=value;
+    rmSync(temp,{recursive:true,force:true});
+  }
+});
+
 test('failed durable reservation is fail-closed and a cancelled queued call consumes no slot',async()=>{
   const temp=mkdtempSync(join(tmpdir(),'benchmark-guard-fail-'));
   const old={limit:process.env.BENCH_TOOL_LIMIT,log:process.env.BENCH_GUARD_LOG,home:process.env.CTG_OPENCODE_HOME};

package/tools/benchmark/guard.ts

@@ -92,17 +92,30 @@ export default async function guard(ctx: any): Promise<() => Promise<void>> {
     }));
     await register(ctx.tool.hook('execute.before', async (event: any) => {
       let blocked = false;
+      let rejectionReason: string | undefined;
       let attempts = 0;
       await serializeSession(event.sessionID, async () => {
         if (disposed || !cancellationEventsAvailable || cancelledSessions.has(event.sessionID)) throw Error('Benchmark tool admission cancelled before reservation.');
-        const currentCallKey = callKey(event.sessionID, event.id);
+        const currentCallKey = callKey(event.sessionID, `${event.id}:${event.tool}`);
         const previous = await ctx.storage.get(guardLedger(event.sessionID));
         const rows = Array.isArray(previous) ? previous : [];
-        const existing = rows.find(row => row && typeof row === 'object' && row.id === event.id);
+        // OpenCode Code Mode dispatches nested namespace tools using the parent
+        // execute call ID. Include the actual tool name so the outer execute
+        // reservation cannot collide with its nested Carthagent invocation.
+        const reservationKey = event.tool === 'execute' ? event.id : `${event.id}:${event.tool}`;
+        const existing = rows.find(row => row && typeof row === 'object' && (row.reservationKey === reservationKey || (!row.reservationKey && row.id === event.id && row.tool === event.tool)));
         if (existing) {
           if (existing.tool !== event.tool || typeof existing.admitted !== 'boolean') throw Error('Conflicting benchmark tool reservation ID.');
           attempts = rows.filter(row => row && typeof row === 'object' && row.admitted === true).length;
-          blocked = true; // Duplicate invocation never executes twice.
+          blocked = true;
+          // The pinned Code Mode hook contract reuses the parent execute ID
+          // for nested calls and provides no distinct invocation ID. A second
+          // call to the same nested tool is therefore ambiguous, not proof of
+          // a replay and not evidence that the budget is exhausted.
+          const parentExecute = rows.some(row => row && typeof row === 'object' && row.id === event.id && row.tool === 'execute');
+          rejectionReason = parentExecute && event.tool !== 'execute'
+            ? 'Benchmark tool invocation attribution unavailable: nested Code Mode calls share the parent execute ID; refusing ambiguous execution.'
+            : 'Benchmark tool invocation ID was already reserved; refusing duplicate execution.';
         } else {
           attempts = rows.filter(row => row && typeof row === 'object' && row.admitted === true).length;
           blocked = attempts >= limit;
@@ -110,16 +123,16 @@ export default async function guard(ctx: any): Promise<() => Promise<void>> {
           // Persist a reservation (or rejection) while holding both the
           // per-session queue and inter-process file lock. No tool is admitted
           // until this durable write has succeeded.
-          await ctx.storage.set(guardLedger(event.sessionID), [...rows, { id:event.id, tool:event.tool, admitted:!blocked, at:Date.now() }]);
+          await ctx.storage.set(guardLedger(event.sessionID), [...rows, { id:event.id, tool:event.tool, reservationKey, admitted:!blocked, at:Date.now() }]);
           attempts += Number(!blocked);
           appendFileSync(process.env.BENCH_GUARD_LOG!, JSON.stringify({ type:'tool-attempt', sessionID:event.sessionID, callID:event.id, tool:event.tool, attempts, blocked })+'\n');
         }
-        if (!existing) admitted.set(currentCallKey, !blocked);
+        admitted.set(currentCallKey, !blocked);
       });
-      if (blocked) throw Error('Benchmark tool budget exhausted before execution.');
+      if (blocked) throw Error(rejectionReason ?? 'Benchmark tool budget exhausted before execution.');
     }));
     await register(ctx.tool.hook('execute.after', async (event: any) => {
-      const currentCallKey=callKey(event.sessionID,event.id);
+      const currentCallKey=callKey(event.sessionID,`${event.id}:${event.tool}`);
       if (admitted.get(currentCallKey) === false) return;
       if (event.status !== 'completed' || event.tool !== 'delivery_finish') return;
       const raw = event.result.content.filter((item: any) => item.type === 'text').map((item: any) => item.text).join('\n');

package/tools/benchmark/planning-startup.test.mjs

@@ -1,4 +1,4 @@
-// Offline scripted provider: exercises actual installed pi plumbing, not model efficacy.
+// Offline scripted provider: exercises the installed native OpenCode engine, not model efficacy.
 import test from 'node:test';
 import assert from 'node:assert/strict';
 import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
@@ -7,41 +7,37 @@ import { join } from 'node:path';
 import { runCandidate } from './runner.mjs';
 import { initializeCampaign } from './campaign.mjs';
 import { MODEL } from './gateway.mjs';
-import { fixtureDesign, fixtureReview } from '../../tests/helpers/tested-design.mjs';
 
 test('installed engine traverses discovery guide and full delivery with offline scripted responses', async t => {
- const root=mkdtempSync(join(tmpdir(),'ctg-startup-engine-'));t.after(()=>rmSync(root,{recursive:true,force:true}));
- const campaignPath=join(root,'campaign.json');initializeCampaign(campaignPath,{historicalCandidate:0,historicalSmoke:0});
- const requirement='Writes the exact expected file';
- const plan={goal:'Implement fixture output',assumptions:[],artifacts:['.'],outputs:['output.txt'],steps:[{id:'build',title:'Write and verify',checks:['output']}],acceptance:[{requirement,checks:['output']}],checks:[{id:'output',kind:'test',argv:[process.execPath,'-e',"require('node:assert/strict').equal(require('node:fs').readFileSync('output.txt','utf8'),'ok')"],timeoutSeconds:5}]};plan.design=fixtureDesign(plan);
- const lastTool=payload=>{
-  const raw=payload.messages.filter(m=>m.role==='tool').at(-1)?.content;
-  return JSON.parse(typeof raw==='string'?raw:raw.map(b=>b.text||'').join('\n'));
- };
- const sequence=[...Array.from({length:8},()=>()=>({name:'read',args:{path:'TASK.md'}})),
- ()=>({name:'delivery_design',args:{action:'guide'}}),
- ()=>({name:'delivery_plan',args:plan}),
- ()=>({name:'delivery_design',args:{action:'validate'}}),
- ()=>({name:'delivery_design',args:{action:'inspect'}}),
- p=>({name:'delivery_design',args:{action:'review',review:{...fixtureReview(plan),captureId:lastTool(p).result.id}}}),
- ()=>({name:'delivery_design',args:{action:'approve'}}),
- ()=>({name:'write',args:{path:'output.txt',content:'ok'}}),
- ()=>({name:'delivery_check',args:{id:'all'}}),
- ()=>({name:'delivery_progress',args:{step:'build',status:'done'}}),
- ()=>({name:'delivery_review',args:{action:'inspect'}}),
- p=>({name:'delivery_review',args:{action:'record',captureId:lastTool(p).id,coverage:[{requirement,assertions:'Exact file content asserted by Node strict equality'}],probes:['Declared output check exited zero'],findings:[],limitations:['Scripted fixture; no semantic review claim']}}),
- ()=>({name:'delivery_finish',args:{status:'verified',review:'Reviewed fixture evidence',launch:'n/a',limitations:['Offline scripted provider']}}),
+  const root=mkdtempSync(join(tmpdir(),'ctg-startup-engine-'));t.after(()=>{if(process.env.CTG_KEEP_BENCHMARK_FAILURES!=='1')rmSync(root,{recursive:true,force:true});});
+ const campaignPath=join(root,'campaign.json');initializeCampaign(campaignPath,{historicalCandidate:0,historicalSmoke:0,smokeLimit:1});
+  const requirement='Writes the exact expected file';
+ const plan={goal:'Implement fixture output',assumptions:[],artifacts:['.'],outputs:['output.txt'],steps:[{id:'build',title:'Write and verify',checks:['output']}],acceptance:[{requirement,checks:['output']}],checks:[{id:'output',kind:'test',argv:[process.execPath,'-e',"require('node:assert/strict').equal(require('node:fs').readFileSync('output.txt','utf8'),'ok')"],timeoutSeconds:5}]};
+  const sequence=[...Array.from({length:8},()=>()=>({name:'read',args:{path:'TASK.md'}})),
+    ()=>({name:'delivery_design',args:{action:'guide'}}),
+    ()=>({name:'delivery_plan',args:plan}),
+    ()=>({name:'shell',args:{command:"printf 'ok' > output.txt"}}),
+   ()=>({name:'delivery_check',args:{id:'all'}}),
+   ()=>({name:'delivery_progress',args:{step:'build',status:'done'}}),
+   ()=>({name:'delivery_review',args:{action:'inspect'}}),
+    p=>{const reviewed=JSON.parse(p.messages.filter(message=>message.role==='tool').at(-1).content);return {name:'delivery_review',args:{action:'record',captureId:reviewed.id,coverage:[{requirement,assertions:'Declared Node strict-equality check verified exact output content'}],probes:['Declared output check completed successfully'],findings:[],limitations:['Offline scripted fixture; not model efficacy']}};},
+   ()=>({name:'delivery_finish',args:{status:'verified',change:'Completed the scripted fixture task.',review:'Reviewed fixture evidence',launch:'n/a',limitations:['Offline scripted provider']}}),
  ];
- let i=0,sawCheckpoint=false;
- const r=await runCandidate('smoke','harness',{smoke:true,key:'dummy',root,campaignPath,promptOverride:'Implement a fixture output.txt containing exactly ok. Use the delivery contract and finish verified.',fetchImpl:async(_url,options)=>{
-  const payload=JSON.parse(options.body);sawCheckpoint ||= JSON.stringify(payload.messages).includes('Pre-plan checkpoint: 8 discovery');
-  const call=i<sequence.length?sequence[i++](payload):null;
-  return new Response('data: '+JSON.stringify({id:'offline',model:MODEL,choices:[{index:0,delta:{role:'assistant',content:call?'':'SMOKE_OK',...(call?{tool_calls:[{index:0,id:'call'+i,type:'function',function:{name:call.name,arguments:JSON.stringify(call.args)}}]}:{})},finish_reason:call?'tool_calls':'stop'}],usage:{cost:0,prompt_tokens:1,completion_tokens:1}})+'\n\ndata: [DONE]\n\n');
- }});
- assert.equal(r.smokePassed,true);assert.equal(i,sequence.length);assert.ok(sawCheckpoint);
+  let i=0,sawCheckpoint=false,advertised=[],requestTrace=[];
+  const r=await runCandidate('smoke','harness',{smoke:true,key:'dummy',root,campaignPath,promptOverride:'Implement a fixture output.txt containing exactly ok. Use the delivery contract and finish verified.',fetchImpl:async(_url,options)=>{
+    const payload=JSON.parse(options.body);advertised=payload.tools.map(tool=>tool.function?.name).filter(Boolean);requestTrace.push({turn:i,tools:advertised,messages:payload.messages.map(message=>({role:message.role,tool_calls:message.tool_calls?.map(call=>call.function?.name),tool_call_id:message.tool_call_id,content:typeof message.content==='string'?message.content.slice(-120):undefined}))});sawCheckpoint ||= JSON.stringify(payload.messages).includes('Pre-plan checkpoint: 8 discovery');
+    const call=i<sequence.length?sequence[i++](payload):null;
+    if(call&&call.name!=='read'&&call.name!=='shell'&&call.name!=='execute'){call.args={code:`return await tools.carthagent[${JSON.stringify(call.name)}](${JSON.stringify(call.args)})`};call.name='execute';}
+    if(call){const name=advertised.find(candidate=>candidate===call.name||candidate.endsWith(`_${call.name}`)||candidate.endsWith(`.${call.name}`));if(!name)throw Error(`Scripted tool ${call.name} is not advertised: ${advertised.join(', ')}`);call.name=name;}
+    return new Response('data: '+JSON.stringify({id:'offline',model:MODEL,choices:[{index:0,delta:{role:'assistant',content:call?'':'SMOKE_OK',...(call?{tool_calls:[{index:0,id:'call'+i,type:'function',function:{name:call.name,arguments:JSON.stringify(call.args)}}]}:{})},finish_reason:call?'tool_calls':'stop'}],usage:{cost:i<=8?0:.001,prompt_tokens:1,completion_tokens:1}})+'\n\ndata: [DONE]\n\n');
+  }});
  const events=readFileSync(join(root,'smoke-harness/events.jsonl'),'utf8').trim().split('\n').map(JSON.parse);
- assert.deepEqual(events.filter(e=>e.type==='tool_execution_end'&&e.isError),[]);
- assert.equal(readFileSync(join(root,'smoke-harness/workspace/output.txt'),'utf8'),'ok');
- const finish=events.findLast(e=>e.type==='tool_execution_end'&&e.toolName==='delivery_finish');
- assert.match(JSON.stringify(finish.result),/verified/);
+  assert.equal(r.smokePassed,true,JSON.stringify({result:r,providerCalls:i,sawCheckpoint,requestTrace,events}));assert.equal(i,sequence.length);assert.ok(sawCheckpoint);
+    const failures=events.filter(e=>e.type==='session.tool.success'&&e.data?.metadata?.error);
+    assert.deepEqual(failures,[],JSON.stringify(failures));
+    const completedTools=events.flatMap(e=>e.type==='session.tool.success'?(e.data?.metadata?.toolCalls||[]).filter(call=>call.status==='completed'):[ ]);
+   assert.ok(completedTools.some(call=>call.tool==='carthagent.delivery_finish'), 'native delivery_finish did not complete');
+   assert.equal(readFileSync(join(root,'smoke-harness/workspace/output.txt'),'utf8'),'ok');
+   const finish=events.findLast(e=>e.type==='session.tool.success'&&e.data?.metadata?.toolCalls?.some(call=>call.tool==='carthagent.delivery_finish'&&call.status==='completed'));
+   assert.match(JSON.stringify(finish.data.content),/verified/);
 });

package/tools/benchmark/runner.mjs

@@ -25,10 +25,10 @@ export function childEnv(config, gateway, log) {
   const home = isolatedHome(config);
   return safeEnv({ CTG_OPENCODE_HOME: home, CTG_OPENCODE_URL: process.env.CTG_OPENCODE_URL || '', BENCH_GATEWAY: gateway, BENCH_ADVISOR_LOG: log, BENCH_GUARD_LOG: join(dirname(config),'guard.jsonl') }, home);
 }
-async function waitForService(url, { timeoutMs = 30000, signal } = {}) {
+async function waitForService(url, { timeoutMs = 30000, signal, headers = {} } = {}) {
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline && !signal?.aborted) {
-    try { const response = await fetch(`${url}/api/info`, { signal: AbortSignal.timeout(1000) }); if (response.ok) return; } catch {}
+    try { const response = await fetch(`${url}/api/info`, { headers, signal: AbortSignal.timeout(1000) }); if (response.ok) return; } catch {}
     await new Promise(resolve => setTimeout(resolve, 150));
   }
   throw Error('Isolated OpenCode 2 service readiness timeout');
@@ -48,9 +48,10 @@ async function startNativeService({ workspace, config, mode, arm, smoke, toolLim
   const provider = arm === 'plain' ? 'benchmark-fixture' : 'benchmark';
   const model = arm === 'plain' ? 'fixture' : MODEL;
   const plugins = [join(REPO,'lib/opencode/evaluation-budget-plugin'), ...(arm === 'plain' ? [] : [join(REPO,'tools/benchmark/native-plugin')])];
+  if (smoke && arm !== 'plain') plugins.push({ package:join(REPO,'plugins/carthagent'), options:{deliveryOptions:{workflow:'standard'}} });
   const configJson = {
     '$schema':'https://opencode.ai/config.json', update:'disable', model:`${provider}/${model}`,
-    plugins:plugins.filter((_,index)=>mode!=='smoke' || index===0),
+    plugins,
     providers:{[provider]:{
       package:'@opencode/ai/providers/openai-compatible',
       settings:{baseURL:`${gateway}/v1`,apiKey:apiKey || 'fixture-no-key'},
@@ -72,7 +73,7 @@ async function startNativeService({ workspace, config, mode, arm, smoke, toolLim
     const deadline=Date.now()+15000;
     while(Date.now()<deadline){
       const loaded=await listPlugins(service,request).catch(()=>null);
-      const expected = ['ctg.evaluation-budget', ...(arm === 'plain' ? [] : ['ctg.benchmark'])];
+       const expected = ['ctg.evaluation-budget', ...(plugins.includes(join(REPO,'tools/benchmark/native-plugin')) ? ['ctg.benchmark'] : []), ...(plugins.some(plugin => typeof plugin === 'object' && plugin.package === join(REPO,'plugins/carthagent')) ? ['carthagent'] : [])];
       const active = expected.every(id=>loaded?.some(plugin=>plugin.id===id&&plugin.state?.status==='active'));
       const failure=loaded?.find(plugin=>expected.includes(plugin.id)&&plugin.state?.status==='failed');
       if(active) break;
@@ -98,7 +99,11 @@ export async function runCandidate(task, arm, { smoke = false, key, root = ROOT,
   mkdirSync(root, { recursive: true }); mkdirSync(run); mkdirSync(workspace); mkdirSync(config);
   if (!Number.isInteger(toolLimit) || toolLimit < 1 || toolLimit > 120) throw Error('Invalid tool limit');
   const toolsReceipt = provisionTools(config);
-  const gateway = await startGateway({ key: apiKey || 'fixture-only-no-upstream', limit: smoke ? 0.08 : 2.79, allowJev: arm === 'jev', receiptPath: join(run, 'gateway.jsonl'), fetchImpl, account: campaignAccount(campaignPath, smoke ? 'smoke' : 'candidate', run) });
+  // Scripted offline smoke transcripts may need many zero-cost turns. Give only
+  // that injected fixture enough reservation headroom; production smoke remains
+  // under its normal $0.08 gateway ceiling and native session cost ceiling.
+  const gatewayLimit = smoke ? (fetchImpl ? 3.1 : 0.08) : 2.79;
+  const gateway = await startGateway({ key: apiKey || 'fixture-only-no-upstream', limit:gatewayLimit, allowJev: arm === 'jev', receiptPath: join(run, 'gateway.jsonl'), fetchImpl, account: campaignAccount(campaignPath, smoke ? 'smoke' : 'candidate', run) });
   let fixtureService, nativeService;
   try {
     const env = childEnv(config, gateway.url, join(run,'advisor.jsonl'));
@@ -112,13 +117,13 @@ export async function runCandidate(task, arm, { smoke = false, key, root = ROOT,
     else if (!process.env.CTG_OPENCODE_URL) nativeService = await startNativeService({workspace,config,mode:arm,arm,smoke,toolLimit,gateway:gateway.url,apiKey,serviceManager});
     env.CTG_OPENCODE_URL = process.env.CTG_OPENCODE_URL || nativeService?.endpoint || fixtureService?.url;
     env.CTG_OPENCODE_AUTHORIZATION = nativeService ? nativeService.auth.authorization : '';
-    const args = { task, arm, smoke, runtime: ENGINE_RUNTIME, openCodeService: nativeService ? 'dedicated-isolated-service' : process.env.CTG_OPENCODE_URL ? 'explicit-isolated-endpoint' : 'injected-fixture', toolsReceipt, harnessCommit: spawnSync('git',['rev-parse','HEAD'],{cwd:REPO,encoding:'utf8'}).stdout.trim(), ceilings: { seconds: smoke ? 180 : 900, tools:toolLimit, usd:smoke ? .08 : 2.79 }, startedAt:new Date().toISOString() };
+    const args = { task, arm, smoke, runtime: ENGINE_RUNTIME, openCodeService: nativeService ? 'dedicated-isolated-service' : process.env.CTG_OPENCODE_URL ? 'explicit-isolated-endpoint' : 'injected-fixture', toolsReceipt, harnessCommit: spawnSync('git',['rev-parse','HEAD'],{cwd:REPO,encoding:'utf8'}).stdout.trim(), ceilings: { seconds: smoke ? 180 : 900, tools:toolLimit, usd:gatewayLimit }, startedAt:new Date().toISOString() };
     writeFileSync(join(run,'invocation.json'), JSON.stringify(args,null,2));
     let stopReason = null; const events = [], started = Date.now();
     const controller = new AbortController();
     const timer = setTimeout(() => { stopReason = 'wall-time'; controller.abort(); }, (smoke ? 180 : 900) * 1000);
     let result;
-    try { await waitForService(env.CTG_OPENCODE_URL,{signal:controller.signal}); result = await nativeRunner({ directory: workspace, prompt, systemPrompt: arm === 'plain' ? '' : `Use the Carthagent delivery workflow. Required checks: ${JSON.stringify({ toolLimit })}.`, provider:arm === 'plain' ? 'benchmark-fixture' : 'benchmark', model:arm === 'plain' ? 'fixture' : MODEL, timeoutSeconds: smoke ? 180 : 900, maxTurns: toolLimit, maxCost: smoke ? .08 : 2.79, signal: controller.signal, baseUrl: env.CTG_OPENCODE_URL, headers:nativeService?.auth || {}, onEvent: event => { events.push(event); appendFileSync(join(run,'events.jsonl'),JSON.stringify(event)+'\n'); } }); }
+    try { await waitForService(env.CTG_OPENCODE_URL,{signal:controller.signal,headers:nativeService?.auth || {}}); result = await nativeRunner({ directory: workspace, prompt, systemPrompt: arm === 'plain' ? '' : `Use the Carthagent delivery workflow. Required checks: ${JSON.stringify({ toolLimit })}.`, provider:arm === 'plain' ? 'benchmark-fixture' : 'benchmark', model:arm === 'plain' ? 'fixture' : MODEL, timeoutSeconds: smoke ? 180 : 900, maxTurns: toolLimit, maxCost: smoke ? .08 : 2.79, signal: controller.signal, baseUrl: env.CTG_OPENCODE_URL, headers:nativeService?.auth || {}, onEvent: event => { events.push(event); appendFileSync(join(run,'events.jsonl'),JSON.stringify(event)+'\n'); } }); }
     catch (error) { result = { exitCode:1, errors:[error.message], turns:0, productiveTurns:0, tools:{} }; }
     finally { clearTimeout(timer); }
     if (result.outcome !== 'succeeded') {

package/tools/benchmark/runner.test.mjs

@@ -7,7 +7,7 @@ import { initializeCampaign } from './campaign.mjs';
 import { runCandidate, terminalStatus } from './runner.mjs';
 import { createFreeze, verifyFreeze, frozenFiles } from './freeze.mjs';
 import { sha } from './runtime.mjs';
-import { nativeFixture } from '../native-fixture.mjs';
+import { nativeFixture, streamText } from '../native-fixture.mjs';
 const mk = () => mkdtempSync(join(tmpdir(), 'benchmark-runner-'));
 
 test('native terminal classification does not mistake process success for model success', () => {
@@ -56,15 +56,19 @@ test('benchmark refuses arbitrary service endpoints before creating a run', asyn
 
 test('native benchmark plugin loads in OpenCode 2 with both session and tool hooks', async () => {
   const root=mk();
+  let probeSent=false;
+  let markerFile;
   const host=await nativeFixture({
     plugin:join(process.cwd(),'lib/opencode/evaluation-budget-plugin'),
-    plugins:[join(process.cwd(),'tools/benchmark/native-plugin'),join(process.cwd(),'plugins/carthagent')],
+    // Keep this admission probe independent of the delivery plugin's plan gate.
+    plugins:[join(process.cwd(),'tools/benchmark/native-plugin')],
     env:{BENCH_TOOL_LIMIT:'1',BENCH_RETRY_LIMIT:'0',BENCH_GUARD_LOG:join(root,'guard.jsonl'),BENCH_ADVISOR_LOG:join(root,'advisor.jsonl'),BENCH_GATEWAY:'http://127.0.0.1:1',CTG_EVALUATION_MAX_TURNS:'4',CTG_EVALUATION_MAX_COST:'1'},
     respond(body,res) {
-      if(JSON.stringify(body.messages).includes('CTG_PARALLEL_GUARD_PROBE')) {
-        const shell=body.tools.find(tool=>tool.function?.name==='shell');
-        assert.ok(shell,'native host must advertise shell for the concurrent tool admission probe');
-        const calls=Array.from({length:8},(_,index)=>({index,id:`parallel-${index}`,type:'function',function:{name:'shell',arguments:JSON.stringify({command:`printf parallel-${index}`})}}));
+      if(!probeSent && JSON.stringify(body.messages).includes('CTG_PARALLEL_GUARD_PROBE')) {
+        probeSent=true;
+        const read=body.tools.find(tool=>tool.function?.name==='read');
+        assert.ok(read,'native host must advertise read for the concurrent tool admission probe');
+        const calls=Array.from({length:8},(_,index)=>({index,id:`parallel-${index}`,type:'function',function:{name:'read',arguments:JSON.stringify({path:markerFile})}}));
         const chunk=(delta,finish_reason=null)=>`data: ${JSON.stringify({id:'parallel-guard-probe',object:'chat.completion.chunk',created:1,model:'fixture',choices:[{index:0,delta,finish_reason}]})}\n\n`;
         res.writeHead(200,{'content-type':'text/event-stream'});
         res.end(`${chunk({role:'assistant',tool_calls:calls})}${chunk({},'tool_calls')}data: [DONE]\n\n`);
@@ -80,13 +84,25 @@ test('native benchmark plugin loads in OpenCode 2 with both session and tool hoo
     const response=await host.client.session.create({location:host.location,model:host.model,title:'hook initialization probe'},host.request());
     assert.ok(response.id);
     const session=await host.client.session.create({location:host.location,model:host.model,title:'parallel admission probe',metadata:{'ctg.evaluation.budget':{maxTurns:4,maxCost:1}}},host.request());
+    const marker='CTG_BENCHMARK_ADMITTED_READ_RESULT';
+    markerFile=join(host.cwd,'read-admission-proof.txt');
+    writeFileSync(markerFile,marker);
     await host.client.session.prompt({sessionID:session.id,text:'CTG_PARALLEL_GUARD_PROBE'},host.request());
     await host.client.session.wait({sessionID:session.id},host.request());
-    assert.ok(existsSync(join(root,'guard.jsonl')),`${host.output}\n${JSON.stringify(host.requests)}`);
+    assert.ok(existsSync(join(root,'guard.jsonl')),`${JSON.stringify(host.providerErrors.map(error=>error.stack??String(error)))}\n${JSON.stringify(await host.client.message.list({sessionID:session.id},host.request()))}`);
+    assert.deepEqual(host.providerErrors,[],'offline provider requests must complete without fixture errors');
     const rows=readFileSync(join(root,'guard.jsonl'),'utf8').trim().split('\n').map(JSON.parse).filter(row=>row.sessionID===session.id);
     assert.equal(rows.length,8,JSON.stringify(rows));
     assert.equal(rows.filter(row=>!row.blocked).length,1,JSON.stringify(rows));
     assert.equal(rows.filter(row=>row.blocked).length,7,JSON.stringify(rows));
+    const admittedCallID=rows.find(row=>!row.blocked).callID;
+    const toolResults=host.requests.flatMap(request=>request.messages).filter(message=>message.role==='tool');
+    const admittedResult=toolResults.find(message=>message.tool_call_id===admittedCallID);
+    assert.ok(admittedResult?.content?.includes(marker), 'the admitted call must return the unique marker file content');
+    for(const row of rows.filter(row=>row.blocked)) {
+      const rejectedResult=toolResults.find(message=>message.tool_call_id===row.callID);
+      assert.ok(rejectedResult?.content?.toLowerCase().includes('budget'), `blocked call ${row.callID} must return its budget rejection`);
+    }
     const ledger=await host.client.session.context({sessionID:session.id},host.request());
     assert.ok(ledger.at(-1)?.outcome,JSON.stringify(ledger.at(-1)));
   } finally { await host.close(); }

package/tools/benchmark/upstream-error.test.mjs

@@ -1,10 +1,24 @@
 import test from 'node:test';import assert from 'node:assert/strict';
 import {upstreamError}from'./upstream-error.mjs';import{startGateway,MODEL}from'./gateway.mjs';
-import{reconstruct,inspectRequest}from'./diagnose-request.mjs';import{existsSync}from'node:fs';
+import{inspectCapturedRequest,inspectRequest}from'./diagnose-request.mjs';import{mkdtempSync,writeFileSync,rmSync}from'node:fs';import{tmpdir}from'node:os';import{join}from'node:path';
 test('bounded error receipts redact reflected credentials and preserve diagnostic fields',async()=>{
  const secret='private+key/test';const r=await upstreamError(Response.json({error:{code:400,message:'Invalid tool history: '+secret,metadata:{provider_name:'fixture',raw:'Bearer token '+encodeURIComponent(secret)}}},{status:400,headers:{'x-request-id':'req123'}}),{secrets:[secret]});assert.equal(r.status,400);assert.equal(r.requestId,'req123');assert.equal(r.provider,'fixture');assert.match(r.message,/Invalid tool history/);assert.ok(!JSON.stringify(r).includes(secret));assert.ok(!JSON.stringify(r).includes(encodeURIComponent(secret)));
  let canceled=false;const over=await upstreamError(new Response(new ReadableStream({start(c){c.enqueue(new TextEncoder().encode('x'.repeat(17000)));},cancel(){canceled=true;}}),{status:400}));assert.equal(canceled,true);assert.equal(over.bodyExcerpt,'[Oversized upstream error omitted]');
  const html=await upstreamError(new Response('<html>bad request</html>',{status:400}));assert.match(html.bodyExcerpt,/bad request/);
 });
 test('gateway records upstream rejection without replay or credential leak',async()=>{let calls=0;const g=await startGateway({key:'reflected-secret',fetchImpl:async()=>{calls++;return Response.json({error:{code:400,message:'Invalid input reflected-secret'}},{status:400});}});try{for(let i=0;i<2;i++){const r=await fetch(g.url+'/v1/chat/completions',{method:'POST',body:JSON.stringify({model:MODEL,messages:[]})});await r.text();assert.equal(r.status,400);}assert.equal(calls,1);assert.match(g.receipts.find(r=>r.type==='http-failure').message,/Invalid input/);assert.ok(!JSON.stringify(g.receipts).includes('reflected-secret'));assert.equal(g.budget.reserved,.15);}finally{await g.close();}});
-test('offline reconstruction matches original failed multi-turn wire payload, detects orphan results',async(t)=>{const run='/home/baissi/benchmarks/deepseek-jev-v3/voxel-plain';if(!existsSync(run)){t.skip('Historical session not installed');return;}const {payload,report}=await reconstruct(run);assert.equal(report.hashMatches,true);assert.equal(report.toolCalls,11);assert.equal(report.toolResults,11);assert.deepEqual(report.issues,[]);payload.messages.push({role:'tool',tool_call_id:'missing',content:'x'});assert.ok(inspectRequest(payload).issues.some(s=>s.includes('unmatched')));});
+test('offline native request inspection validates captured OpenAI-compatible payloads without replay',async()=>{
+ const dir=mkdtempSync(join(tmpdir(),'ctg-native-request-diagnostic-'));
+ try{
+  const capture=join(dir,'request.json');
+  const payload={model:MODEL,messages:[{role:'assistant',tool_calls:[{id:'read-1',type:'function',function:{name:'read',arguments:JSON.stringify({path:'src/main.rs'})}}]},{role:'tool',tool_call_id:'read-1',content:'ok'}],tools:[{type:'function',function:{name:'read'}}],stream:true,max_tokens:16384,reasoning:{effort:'high'}};
+  writeFileSync(capture,JSON.stringify(payload));
+  const inspected=await inspectCapturedRequest(capture);
+  assert.deepEqual(inspected.report.issues,[]);assert.equal(inspected.report.toolCalls,1);assert.equal(inspected.report.toolResults,1);
+  assert.equal(inspected.report.sourceHash,inspected.report.normalizedHash);
+  assert.equal(JSON.stringify(inspected.report).includes('.pi/'),false);
+  const orphan={...payload,messages:[...payload.messages,{role:'tool',tool_call_id:'missing',content:'x'}]};
+  assert.ok(inspectRequest(orphan).issues.some(issue=>issue.includes('unmatched tool result')));
+  assert.ok(inspectRequest({...payload,messages:[{role:'assistant',tool_calls:[{id:'bad',function:{arguments:'{'}}]}]}).issues.some(issue=>issue.includes('invalid tool arguments')));
+ }finally{rmSync(dir,{recursive:true,force:true});}
+});

package/tools/generate-owned-runtime-release.mjs

@@ -0,0 +1,217 @@
+import { createHash } from 'node:crypto';
+import { randomUUID } from 'node:crypto';
+import { link, mkdir, mkdtemp, readFile, readdir, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { readPinnedOwnedRuntimeInputs } from './pinned-owned-runtime-inputs.mjs';
+
+export const REQUIRED_RUNTIME_TARGETS = Object.freeze({
+  'linux-x64': ['linux', 'x64', 'opencode-linux-x64.tar.gz', 'cli-linux-x64/bin/opencode'],
+  'linux-arm64': ['linux', 'arm64', 'opencode-linux-arm64.tar.gz', 'cli-linux-arm64/bin/opencode'],
+  'darwin-x64': ['darwin', 'x64', 'opencode-darwin-x64.tar.gz', 'cli-darwin-x64/bin/opencode'],
+  'darwin-arm64': ['darwin', 'arm64', 'opencode-darwin-arm64.tar.gz', 'cli-darwin-arm64/bin/opencode'],
+  'windows-x64': ['windows', 'x64', 'opencode-windows-x64.tar.gz', 'cli-windows-x64/bin/opencode.exe'],
+});
+
+if (process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) {
+  const [releaseVersion, assetsDirectory, repoRoot = process.cwd()] = process.argv.slice(2);
+  if (!releaseVersion || !assetsDirectory) {
+    console.error('Usage: node tools/generate-owned-runtime-release.mjs <release-version> <assets-directory> [repo-root]');
+    process.exit(2);
+  }
+  const manifest = await generateOwnedRuntimeRelease({ releaseVersion, assetsDirectory, repoRoot });
+  process.stdout.write(`${JSON.stringify(manifest, null, 2)}\n`);
+}
+
+/**
+ * Verify five build outputs through the production USTAR acquisition parser,
+ * then emit a candidate outer trust manifest. Pinned build records must be
+ * made by the native build job from its binary before it is archived; records
+ * are claims until the acquisition module verifies them against archive bytes.
+ */
+export async function generateOwnedRuntimeRelease({
+  releaseVersion,
+  assetsDirectory,
+  repoRoot,
+  outputPath = path.join(path.dirname(path.resolve(assetsDirectory)), 'runtime-release.json.candidate'),
+  acquireRuntime,
+}) {
+  validateReleaseVersion(releaseVersion);
+  const directory = path.resolve(assetsDirectory);
+  const root = path.resolve(repoRoot ?? process.cwd());
+  const provenance = await readPinnedBuildInputs(root);
+  const acquireOwnedRuntime = acquireRuntime ?? (await import('../lib/opencode/runtime-artifact.mjs')).acquireOwnedRuntime;
+
+  const entries = await readdir(directory, { withFileTypes: true });
+  if (entries.some((entry) => !entry.isFile())) {
+    throw new Error('Assets directory may contain only regular archive and build-record files');
+  }
+  const files = entries.map((entry) => entry.name).sort();
+  const expectedFiles = Object.values(REQUIRED_RUNTIME_TARGETS)
+    .flatMap(([, , archiveName]) => [archiveName, `${archiveName}.build.json`])
+    .sort();
+  if (JSON.stringify(files) !== JSON.stringify(expectedFiles)) {
+    throw new Error(`Assets directory must contain exactly the five runtime archives and their build records: ${expectedFiles.join(', ')}`);
+  }
+
+  const cacheRoot = await mkdtemp(path.join(os.tmpdir(), 'ctg-runtime-manifest-'));
+  const assets = {};
+  try {
+    for (const [key, [platform, arch, name, executablePath]] of Object.entries(REQUIRED_RUNTIME_TARGETS)) {
+      const archivePath = path.join(directory, name);
+      const archiveBytes = await readFile(archivePath);
+      if (!archiveBytes.length) throw new Error(`${name} is empty`);
+      const archiveSha256 = sha256(archiveBytes);
+      const record = JSON.parse(await readFile(path.join(directory, `${name}.build.json`), 'utf8'));
+      validateBuildRecord(record, { key, platform, arch, provenance });
+      const expectedExecutableSha256 = record.executableSha256.toLowerCase();
+
+      // The fetch shim exposes only the exact local archive requested by the
+      // approved acquisition API. No network request or release upload occurs.
+      const fetchImpl = async (url) => {
+        const requestedName = decodeURIComponent(new URL(url).pathname.split('/').at(-1) ?? '');
+        if (requestedName !== name) return new Response('not found', { status: 404 });
+        return new Response(archiveBytes, { status: 200, headers: { 'content-length': String(archiveBytes.length) } });
+      };
+      const verifiedRoot = await acquireOwnedRuntime({
+        releaseVersion,
+        platform,
+        arch,
+        assetName: name,
+        baseUrl: 'https://runtime-manifest-fixture.invalid/assets',
+        fetchImpl,
+        cacheRoot,
+        expectedArchiveSha256: archiveSha256,
+        expectedExecutableSha256,
+        expectedSourceRevision: provenance.sourceRevision,
+        expectedPatchSha256: provenance.patchSha256,
+        expectedLockSha256: provenance.lockSha256,
+        expectedCompatibilityVersion: provenance.compatibilityVersion,
+        expectedRuntimeVersion: provenance.runtimeVersion,
+        expectedChannel: `ctg.${provenance.compatibilityVersion}`,
+      });
+      const verifiedExecutable = await readFile(path.join(verifiedRoot, executablePath));
+      if (sha256(verifiedExecutable) !== expectedExecutableSha256) {
+        throw new Error(`Acquisition returned an unexpected executable for ${key}`);
+      }
+      await validateRuntimeTree(verifiedRoot, { key, executablePath, runtimeVersion: provenance.runtimeVersion });
+      assets[key] = { name, archiveSha256, executableSha256: expectedExecutableSha256 };
+    }
+  } finally {
+    await rm(cacheRoot, { recursive: true, force: true });
+  }
+
+  const manifest = {
+    version: 1,
+    releaseVersion,
+    compatibilityVersion: provenance.compatibilityVersion,
+    runtimeVersion: provenance.runtimeVersion,
+    sourceRevision: provenance.sourceRevision,
+    patchSha256: provenance.patchSha256,
+    lockSha256: provenance.lockSha256,
+    assets,
+  };
+  const destination = path.resolve(outputPath);
+  await mkdir(path.dirname(destination), { recursive: true });
+  const temporary = `${destination}.${process.pid}.${randomUUID()}.tmp`;
+  try {
+    await writeFile(temporary, `${JSON.stringify(manifest, null, 2)}\n`, { flag: 'wx', mode: 0o600 });
+    // Link is atomic and fails if the candidate already exists; the generator
+    // never silently replaces a previously reviewed candidate.
+    await link(temporary, destination);
+  } finally {
+    await rm(temporary, { force: true }).catch(() => {});
+  }
+  return manifest;
+}
+
+function validateReleaseVersion(value) {
+  if (typeof value !== 'string' || !/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/.test(value)) {
+    throw new TypeError('releaseVersion must be a canonical semantic version without a v prefix');
+  }
+}
+
+async function readPinnedBuildInputs(repoRoot) {
+  const recipePath = path.join(repoRoot, 'script/ctg/build-owned-runtime.sh');
+  const recipe = await readFile(recipePath, 'utf8');
+  const pinnedInputs = await readPinnedOwnedRuntimeInputs(repoRoot);
+  const runtime = recipe.match(/OPENCODE_VERSION=([^\s]+)\s+OPENCODE_CHANNEL=ctg\.([^\s]+)/);
+  if (!runtime || runtime[2] !== runtime[1].replace(/^0\.0\.0-ctg\./, '')) {
+    throw new Error('Build recipe must pin a matching CTG compatibility/runtime version');
+  }
+  const provenance = {
+    sourceRevision: pinnedInputs.sourceRevision,
+    lockSha256: pinnedInputs.lockSha256,
+    patchSha256: pinnedInputs.patchSha256,
+    compatibilityVersion: runtime[2],
+    runtimeVersion: runtime[1],
+  };
+  if (!/^[a-f0-9]{40}$/i.test(provenance.sourceRevision)) throw new Error('Build recipe source revision is not a commit SHA');
+  for (const field of ['lockSha256', 'patchSha256']) {
+    if (!/^[a-f0-9]{64}$/.test(provenance[field])) throw new Error(`Build recipe ${field} is not a SHA-256 digest`);
+  }
+  return provenance;
+}
+
+function validateBuildRecord(record, { key, platform, arch, provenance }) {
+  if (!record || record.version !== 1 || record.target !== key
+    || record.platform !== platform || record.arch !== arch
+    || record.sourceRevision !== provenance.sourceRevision
+    || record.patchSha256?.toLowerCase() !== provenance.patchSha256
+    || record.lockSha256?.toLowerCase() !== provenance.lockSha256
+    || record.compatibilityVersion !== provenance.compatibilityVersion
+    || record.runtimeVersion !== provenance.runtimeVersion
+    || typeof record.executableSha256 !== 'string'
+    || !/^[a-f0-9]{64}$/i.test(record.executableSha256)) {
+    throw new Error(`Build record for ${key} does not match the pinned recipe and target`);
+  }
+}
+
+async function validateRuntimeTree(root, { key, executablePath, runtimeVersion }) {
+  const expectedDirectories = new Set(['', `cli-${key}`, `cli-${key}/bin`]);
+  const expectedFiles = new Set([
+    'LICENSE',
+    'SHA256SUMS',
+    'ctg-runtime.json',
+    executablePath,
+    `cli-${key}/package.json`,
+  ]);
+  const actualDirectories = new Set();
+  const actualFiles = new Set();
+  const visit = async (directory, relative) => {
+    for (const entry of await readdir(directory, { withFileTypes: true })) {
+      const childRelative = relative ? `${relative}/${entry.name}` : entry.name;
+      if (entry.isSymbolicLink()) throw new Error(`Runtime archive contains a symlink: ${childRelative}`);
+      if (entry.isDirectory()) {
+        actualDirectories.add(childRelative);
+        await visit(path.join(directory, entry.name), childRelative);
+      } else if (entry.isFile()) actualFiles.add(childRelative);
+      else throw new Error(`Runtime archive contains a non-regular member: ${childRelative}`);
+    }
+  };
+  await visit(root, '');
+  for (const member of actualDirectories) {
+    if (!expectedDirectories.has(member)) throw new Error(`Runtime archive contains an unexpected directory: ${member}`);
+  }
+  for (const member of actualFiles) {
+    if (!expectedFiles.has(member)) throw new Error(`Runtime archive contains an unexpected file: ${member}`);
+  }
+  for (const member of expectedDirectories) {
+    if (member && !actualDirectories.has(member)) throw new Error(`Runtime archive is missing directory: ${member}`);
+  }
+  for (const member of expectedFiles) {
+    if (!actualFiles.has(member)) throw new Error(`Runtime archive is missing file: ${member}`);
+  }
+  const packageMetadata = JSON.parse(await readFile(path.join(root, `cli-${key}/package.json`), 'utf8'));
+  const [, platform, arch] = key.match(/^(linux|darwin|windows)-(x64|arm64)$/) ?? [];
+  const packageOs = platform === 'windows' ? 'win32' : platform;
+  if (packageMetadata.name !== `@opencode/cli-${key}`
+    || packageMetadata.version !== runtimeVersion
+    || packageMetadata.os?.length !== 1 || packageMetadata.os[0] !== packageOs
+    || packageMetadata.cpu?.length !== 1 || packageMetadata.cpu[0] !== arch) {
+    throw new Error(`Runtime archive package metadata does not match ${key} and ${runtimeVersion}`);
+  }
+}
+
+function sha256(bytes) { return createHash('sha256').update(bytes).digest('hex'); }

package/tools/installed-runtime-contract.mjs

@@ -0,0 +1,16 @@
+/** Shared installed-default resolution contract, kept small for offline regression tests. */
+export async function resolveInstalledRuntime(resolveOpenCode, runtimeIdentity, manifestPath) {
+  const options = { runtimeReleaseManifestPath: manifestPath };
+  const binary = await resolveOpenCode(options);
+  const identity = await runtimeIdentity(binary, options);
+  return { binary, identity, options };
+}
+
+export function assertTerminalSemanticsProof(proof, { binary, identity, manifest }) {
+  if (proof.status !== 'PASS') throw new Error('controlled terminal harness did not pass all configured checks');
+  if (proof.binaryResolvedPath !== binary) throw new Error('PTY proof did not identify the default-resolved runtime executable');
+  if (proof.binarySha256 !== identity.binarySha256) throw new Error('PTY proof executable digest differs from trusted owned identity');
+  if (proof.binaryVersion !== `opencode v${manifest.runtimeVersion}`) throw new Error('PTY proof version differs from packaged runtime manifest');
+  if (proof.physicalOSClipboardVerified !== false) throw new Error('controlled terminal model cannot claim physical OS clipboard verification');
+  if (proof.controlledHostClipboardModel !== true) throw new Error('PTY proof is missing controlled terminal host model scope');
+}