carthagent 1.0.7 → 1.1.0-preview.12

package/tests/native-pty-runtime.test.mjs

@@ -0,0 +1,45 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { resolve } from 'node:path';
+import { selectNativePtyRuntime } from '../tools/native-pty-runtime.mjs';
+
+test('injected owned artifact is independently preflighted before production runtime resolution', async () => {
+  const calls = [];
+  const runtime = {
+    async resolveOpenCode(options) { calls.push(['resolve', options]); return '/fixture/owned/cli-linux-x64/bin/opencode'; },
+    async runtimeIdentity() { calls.push(['identity']); return {}; },
+  };
+  const identityTools = {
+    async preflightNativeTestRuntimeArtifact(options) {
+      calls.push(['preflight', options]);
+      throw new Error('trusted digest mismatch');
+    },
+    async loadNativeTestRuntime() { calls.push(['verify']); },
+  };
+  await assert.rejects(selectNativePtyRuntime({
+    runtime,
+    env: { CTG_TEST_RUNTIME_ARTIFACT_ROOT: '/fixture/owned', CTG_TEST_RUNTIME_RELEASE_MANIFEST: '/trusted/release.json' },
+    identityTools,
+  }), /trusted digest mismatch/);
+  assert.deepEqual(calls.map(([operation]) => operation), ['preflight']);
+  assert.equal(calls[0][1].ownedRoot, resolve('/fixture/owned'));
+  assert.equal(calls[0][1].expectedManifestPath, '/trusted/release.json');
+});
+
+test('ambient owned-runtime selector is rejected as an untrusted acceptance root', async () => {
+  let resolved = false;
+  await assert.rejects(selectNativePtyRuntime({
+    runtime: { async resolveOpenCode() { resolved = true; }, async runtimeIdentity() {} },
+    env: { CTG_OWNED_OPENCODE_RUNTIME: '/ambient/staging/runtime' },
+  }), /not an acceptance trust root/);
+  assert.equal(resolved, false);
+});
+
+test('explicit developer binary requires an independently supplied digest before runtime resolution', async () => {
+  let resolved = false;
+  await assert.rejects(selectNativePtyRuntime({
+    runtime: { async resolveOpenCode() { resolved = true; }, async runtimeIdentity() {} },
+    env: { CTG_OPENCODE_BIN: '/missing/native/opencode' },
+  }), /requires CTG_NATIVE_PTY_EXPECTED_SHA256/);
+  assert.equal(resolved, false);
+});

package/tests/native-resume-session.test.mjs

@@ -0,0 +1,46 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { findNativeResumeSession } from '../plugins/carthagent/src/ui/resume-session.mjs';
+
+test('resume finds ID prefixes outside the server title-search results', async () => {
+  const calls = [];
+  const byPrefix = { id: 'ses_abc123', title: 'An unrelated session title', time: { updated: 2 } };
+  const byTitle = { id: 'ses_xyz789', title: 'Parser implementation', time: { updated: 1 } };
+  const client = {
+    session: {
+      async get() { throw new Error('not an exact ID'); },
+      async list(input) {
+        calls.push(input);
+        const rows = input.search ? [byTitle] : [byPrefix];
+        return { data: rows, cursor: { next: null } };
+      },
+    },
+  };
+  assert.equal((await findNativeResumeSession({ query: 'ses_abc', directory: 'repo', client })).id, byPrefix.id);
+  assert.equal(calls[0].search, undefined, 'ID prefix lookup first uses unfiltered listing');
+});
+
+test('resume falls back to title search after an unfiltered ID-prefix miss', async () => {
+  const calls = [];
+  const byTitle = { id: 'ses_xyz789', title: 'Parser implementation', time: { updated: 1 } };
+  const client = {
+    session: {
+      async get() { throw new Error('not an exact ID'); },
+      async list(input) {
+        calls.push(input);
+        return { data: input.search ? [byTitle] : [], cursor: { next: null } };
+      },
+    },
+  };
+  assert.equal((await findNativeResumeSession({ query: 'parser', directory: 'repo', client })).id, byTitle.id);
+  assert.equal(calls.length, 2);
+  assert.equal(calls[1].search, 'parser');
+});
+
+test('resume rejects sessions from another project location', async () => {
+  const client = { session: {
+    get: async () => ({ id: 'ses_exact', location: { directory: 'other' } }),
+    list: async () => ({ data: [], cursor: { next: null } }),
+  } };
+  assert.equal(await findNativeResumeSession({ query: 'ses_exact', directory: 'repo', client }), undefined);
+});

package/tests/native-review-consumer.test.mjs

@@ -0,0 +1,267 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { reviewKickoff } from '../lib/review.mjs';
+import { createNativeReviewConsumer, nativeReviewMode, sendNativeReviewKickoff, subscribeNativeReviewEvents } from '../plugins/carthagent/src/ui/native-review.mjs';
+
+const execution = (id, sessionID) => ({ id, data: { sessionID } });
+const changed = [{ file: 'src/change.ts', additions: 1, deletions: 0, status: 'modified', patch: '@@ change' }];
+
+function makeDiff() {
+  const calls = new Map();
+  return async (sessionID, signal) => {
+    signal?.throwIfAborted();
+    const count = (calls.get(sessionID) ?? 0) + 1;
+    calls.set(sessionID, count);
+    return count % 2 === 1 ? [] : changed;
+  };
+}
+
+test('native prompt payload is the legacy PR-review kickoff and only bypasses framing', async () => {
+  let request;
+  const signal = new AbortController().signal;
+  await sendNativeReviewKickoff({
+    client: { session: { async prompt(input, options) { request = { input, options }; } } },
+    sessionID: 'working-session', signal,
+  });
+  assert.equal(request.input.sessionID, 'working-session');
+  assert.equal(request.input.text, reviewKickoff());
+  assert.match(request.input.text, /gh pr create/);
+  assert.match(request.input.text, /ctg\.mjs" review <pr-number-or-url>/);
+  assert.deepEqual(request.input.metadata, { 'ctg.raw': true, 'ctg.reviewKickoff': true });
+  assert.equal(request.options.signal, signal);
+});
+
+test('session explicit review mode overrides profile; launch mode overrides both', () => {
+  const session = { metadata: { 'carthagent.options': { review: 'yes' } } };
+  assert.equal(nativeReviewMode(session, { review: 'no' }), 'yes');
+  assert.equal(nativeReviewMode(session, { review: 'yes' }, 'no'), 'no');
+  assert.equal(nativeReviewMode({}, { review: 'no' }), 'no');
+  assert.equal(nativeReviewMode({}, {}), 'ask');
+});
+
+test('ask confirmation is current-run-bound and one-shot; a later run invalidates the old offer', async () => {
+  const offers = [];
+  const kickoffs = [];
+  const consumer = createNativeReviewConsumer({
+    mode: () => 'ask', diff: makeDiff(), offer: async (offer) => offers.push(offer),
+    kickoff: async (sessionID) => kickoffs.push(sessionID),
+  });
+  consumer.onStarted(execution('run-1', 'session-a'));
+  await consumer.onSucceeded(execution('run-1', 'session-a'));
+  assert.equal(offers.length, 1);
+  consumer.onStarted(execution('run-2', 'session-a'));
+  assert.equal(await offers[0].start(), false, 'older confirmation cannot start after a new run');
+  await consumer.onSucceeded(execution('run-2', 'session-a'));
+  assert.equal(offers.length, 2);
+  assert.equal(await offers[1].start(), true);
+  assert.equal(await offers[1].start(), false, 'confirmation closure admits exactly once');
+  assert.deepEqual(kickoffs, ['session-a']);
+});
+
+test('yes kicks off only successful new-change runs and suppresses only that session loop', async () => {
+  const loops = new Set();
+  const started = [];
+  const consumer = createNativeReviewConsumer({
+    mode: () => 'yes', diff: makeDiff(), offer: async () => assert.fail('yes does not prompt'),
+    kickoff: async (sessionID) => started.push(sessionID),
+    isLoopActive: (sessionID) => loops.has(sessionID),
+    setLoopActive: (sessionID, active) => active ? loops.add(sessionID) : loops.delete(sessionID),
+  });
+  consumer.onStarted(execution('run-a1', 'session-a'));
+  consumer.onStarted(execution('run-b1', 'session-b'));
+  await Promise.all([
+    consumer.onSucceeded(execution('run-a1', 'session-a')),
+    consumer.onSucceeded(execution('run-b1', 'session-b')),
+  ]);
+  assert.deepEqual(started.sort(), ['session-a', 'session-b'], 'one session loop must not suppress an unrelated session');
+  assert.ok(loops.has('session-a') && loops.has('session-b'));
+  consumer.onUserPromptAdmitted('session-a', { type: 'user', metadata: {} });
+  assert.equal(loops.has('session-a'), false, 'admitted user prompt exits the session loop state');
+  assert.equal(loops.has('session-b'), true, 'unrelated session loop state remains active');
+  consumer.onStarted(execution('run-a2', 'session-a'));
+  consumer.onStarted(execution('run-b2', 'session-b'));
+  await Promise.all([
+    consumer.onSucceeded(execution('run-a2', 'session-a')),
+    consumer.onSucceeded(execution('run-b2', 'session-b')),
+  ]);
+  assert.equal(started.length, 3, 'only session-a may re-enter a loop after a new user prompt');
+});
+
+test('inbox.delivered resets restored loop only for the admitted message, not auto-review kickoff', async () => {
+  const persisted = new Set(['session-restored', 'session-kickoff']);
+  const messages = new Map();
+  const consumer = createNativeReviewConsumer({
+    mode: () => 'no', diff: async () => [], offer: async () => {}, kickoff: async () => {},
+    isLoopActive: (sessionID) => persisted.has(sessionID),
+    setLoopActive: (sessionID, active) => active ? persisted.add(sessionID) : persisted.delete(sessionID),
+  });
+  const handlers = new Map();
+  const cleanups = subscribeNativeReviewEvents(
+    { on(type, handler) { handlers.set(type, handler); return () => {}; } },
+    consumer,
+    assert.fail,
+    async (sessionID, messageID) => messages.get(`${sessionID}:${messageID}`),
+  );
+
+  messages.set('session-restored:user-2', { type: 'user', metadata: {} });
+  handlers.get('session.inbox.delivered')({ data: { sessionID: 'session-restored', inboxID: 'user-2' } });
+  await new Promise((resolve) => setImmediate(resolve));
+  assert.equal(persisted.has('session-restored'), false, 'restored session loop state is explicitly persisted as cleared');
+  messages.set('session-kickoff:review-1', { type: 'user', metadata: { 'ctg.raw': true, 'ctg.reviewKickoff': true } });
+  handlers.get('session.inbox.delivered')({ data: { sessionID: 'session-kickoff', inboxID: 'review-1' } });
+  await new Promise((resolve) => setImmediate(resolve));
+  assert.equal(persisted.has('session-kickoff'), true, 'review kickoff does not clear its own loop suppression');
+
+  cleanups.forEach((cleanup) => cleanup());
+  consumer.dispose();
+});
+
+test('execution.started does not use stale cached message state; inbox deliveries distinguish kickoff then user and coalesced work', async () => {
+  const persisted = new Set(['session-a']);
+  const messages = new Map([
+    ['session-a:kickoff', { type: 'user', metadata: { 'ctg.raw': true, 'ctg.reviewKickoff': true } }],
+    ['session-a:user-1', { type: 'user', metadata: {} }],
+    ['session-a:user-2', { type: 'user', metadata: {} }],
+    ['session-a:assistant', { type: 'assistant', metadata: {} }],
+  ]);
+  const writes = [];
+  const consumer = createNativeReviewConsumer({
+    mode: () => 'no', diff: async () => [], offer: async () => {}, kickoff: async () => {},
+    isLoopActive: (sessionID) => persisted.has(sessionID),
+    setLoopActive: (sessionID, active) => { writes.push([sessionID, active]); if (active) persisted.add(sessionID); else persisted.delete(sessionID); },
+  });
+  const handlers = new Map();
+  const cleanups = subscribeNativeReviewEvents(
+    { on(type, handler) { handlers.set(type, handler); return () => {}; } }, consumer, assert.fail,
+    async (sessionID, messageID) => messages.get(`${sessionID}:${messageID}`),
+  );
+  // The execution-start lifecycle fires first; it must not inspect an old
+  // cached message and reset this restored loop.
+  handlers.get('session.execution.started')(execution('run-1', 'session-a'));
+  assert.deepEqual(writes, []);
+  handlers.get('session.inbox.delivered')({ data: { sessionID: 'session-a', inboxID: 'kickoff' } });
+  await new Promise((resolve) => setImmediate(resolve));
+  assert.deepEqual(writes, [], 'kickoff delivery preserves suppression');
+
+  // Multiple queued user messages are distinct admissions even if the host
+  // coalesces them into one later execution.started event.
+  handlers.get('session.inbox.delivered')({ data: { sessionID: 'session-a', inboxID: 'user-1' } });
+  handlers.get('session.inbox.delivered')({ data: { sessionID: 'session-a', inboxID: 'user-2' } });
+  await new Promise((resolve) => setImmediate(resolve));
+  assert.deepEqual(writes, [['session-a', false]], 'restored state is persisted cleared once on real user admission');
+  assert.equal(persisted.has('session-a'), false);
+
+  handlers.get('session.inbox.delivered')({ data: { sessionID: 'session-a', inboxID: 'assistant' } });
+  await new Promise((resolve) => setImmediate(resolve));
+  assert.deepEqual(writes, [['session-a', false]], 'non-user delivered message is ignored');
+  cleanups.forEach((cleanup) => cleanup());
+  consumer.dispose();
+});
+
+test('terminal handling waits for exact inbox admission lookup before deciding loop suppression', async () => {
+  const persisted = new Set(['session-race']);
+  const kickoffs = [];
+  const handlers = new Map();
+  let resolveMessage;
+  const consumer = createNativeReviewConsumer({
+    mode: () => 'yes', diff: makeDiff(), offer: async () => assert.fail(),
+    kickoff: async (sessionID) => kickoffs.push(sessionID),
+    isLoopActive: (sessionID) => persisted.has(sessionID),
+    setLoopActive: (sessionID, active) => active ? persisted.add(sessionID) : persisted.delete(sessionID),
+  });
+  const cleanups = subscribeNativeReviewEvents(
+    { on(type, handler) { handlers.set(type, handler); return () => {}; } }, consumer, assert.fail,
+    async (_sessionID, _messageID, lookupSignal) => await new Promise((resolve) => {
+      resolveMessage = resolve;
+      lookupSignal.addEventListener('abort', () => resolve(undefined), { once: true });
+    }),
+  );
+  handlers.get('session.execution.started')(execution('run-race', 'session-race'));
+  const admission = handlers.get('session.inbox.delivered')({ data: { sessionID: 'session-race', inboxID: 'admitted-user' } });
+  await new Promise((resolve) => setImmediate(resolve));
+  const terminal = handlers.get('session.execution.succeeded')(execution('run-race', 'session-race'));
+  await new Promise((resolve) => setImmediate(resolve));
+  assert.deepEqual(kickoffs, [], 'success waits while admitted-message metadata is unresolved');
+  resolveMessage({ type: 'user', metadata: {} });
+  await admission;
+  await terminal;
+  assert.equal(kickoffs.length, 1, 'the admitted user prompt clears restored suppression before successful-run handling');
+  assert.equal(persisted.has('session-race'), true, 'the changed successful run starts its next review loop');
+  cleanups.forEach((cleanup) => cleanup());
+  consumer.dispose();
+});
+
+test('inbox lookup queue preserves event order, times out, and disposal cancels pending metadata lookup', async () => {
+  const loops = new Set(['session-ordered', 'session-disposed']);
+  const handlers = new Map();
+  const requested = [];
+  let resolveStale;
+  const consumer = createNativeReviewConsumer({
+    mode: () => 'no', diff: async () => [], offer: async () => {}, kickoff: async () => {},
+    isLoopActive: (sessionID) => loops.has(sessionID),
+    setLoopActive: (sessionID, active) => active ? loops.add(sessionID) : loops.delete(sessionID),
+  });
+  const cleanups = subscribeNativeReviewEvents(
+    { on(type, handler) { handlers.set(type, handler); return () => {}; } }, consumer, assert.fail,
+    async (_sessionID, messageID, signal) => {
+      requested.push(messageID);
+      if (messageID === 'stale-slow') return await new Promise((resolve) => { resolveStale = resolve; });
+      if (messageID === 'kickoff-slow') await new Promise((resolve) => setTimeout(resolve, 30));
+      if (messageID === 'pending') await new Promise((resolve) => setTimeout(resolve, 50));
+      signal.throwIfAborted();
+      return { type: 'user', metadata: messageID === 'kickoff-slow' ? { 'ctg.reviewKickoff': true } : {} };
+    },
+  );
+  handlers.get('session.inbox.delivered')({ data: { sessionID: 'session-ordered', inboxID: 'kickoff-slow' } });
+  handlers.get('session.inbox.delivered')({ data: { sessionID: 'session-ordered', inboxID: 'normal-next' } });
+  await new Promise((resolve) => setTimeout(resolve, 60));
+  assert.deepEqual(requested.slice(0, 2), ['kickoff-slow', 'normal-next']);
+  assert.equal(loops.has('session-ordered'), false, 'later normal prompt wins after earlier kickoff lookup completes');
+
+  const staleLookup = handlers.get('session.inbox.delivered')({ data: { sessionID: 'session-stale', inboxID: 'stale-slow' } });
+  await new Promise((resolve) => setImmediate(resolve));
+  consumer.setLoopActive('session-stale', true);
+  resolveStale({ type: 'user', metadata: {} });
+  await staleLookup;
+  assert.equal(loops.has('session-stale'), true, 'a lookup started before a newer loop generation cannot clear it');
+
+  const pendingLookup = handlers.get('session.inbox.delivered')({ data: { sessionID: 'session-disposed', inboxID: 'pending' } });
+  await new Promise((resolve) => setImmediate(resolve));
+  consumer.dispose();
+  await pendingLookup;
+  await new Promise((resolve) => setTimeout(resolve, 20));
+  assert.equal(loops.has('session-disposed'), true, 'a lookup completing after disposal cannot mutate persisted state');
+  cleanups.forEach((cleanup) => cleanup());
+});
+
+test('failed/interrupted and unchanged executions do not launch a workflow', async () => {
+  const starts = [];
+  const consumer = createNativeReviewConsumer({
+    mode: () => 'yes', diff: async () => [], offer: async () => assert.fail(),
+    kickoff: async (sessionID) => starts.push(sessionID),
+  });
+  consumer.onStarted(execution('failed', 'failed'));
+  await consumer.onFailed(execution('failed', 'failed'));
+  consumer.onStarted(execution('interrupted', 'interrupted'));
+  await consumer.onInterrupted(execution('interrupted', 'interrupted'));
+  consumer.onStarted(execution('unchanged', 'unchanged'));
+  await consumer.onSucceeded(execution('unchanged', 'unchanged'));
+  assert.deepEqual(starts, []);
+});
+
+test('host execution subscriptions are disposed and plugin shutdown blocks pending review admission', async () => {
+  const handlers = new Map();
+  const unsubscribed = [];
+  const data = { on(type, handler) { handlers.set(type, handler); return () => unsubscribed.push(type); } };
+  const offers = [];
+  const consumer = createNativeReviewConsumer({ mode: () => 'ask', diff: makeDiff(), offer: async (value) => offers.push(value), kickoff: async () => {} });
+  const cleanups = subscribeNativeReviewEvents(data, consumer);
+  handlers.get('session.execution.started')(execution('run', 'session'));
+  handlers.get('session.execution.succeeded')(execution('run', 'session'));
+  await new Promise((resolve) => setImmediate(resolve));
+  assert.equal(offers.length, 1);
+  consumer.dispose();
+  assert.equal(await offers[0].start(), false);
+  cleanups.forEach((cleanup) => cleanup());
+  assert.equal(unsubscribed.length, 5);
+});

package/tests/native-runtime-identity.test.mjs

@@ -0,0 +1,214 @@
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { EventEmitter } from 'node:events';
+import { mkdtemp, mkdir, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import test from 'node:test';
+import {
+  loadNativeTestRuntime,
+  preflightNativeTestRuntimeArtifact,
+  NATIVE_TEST_COMPATIBILITY_VERSION,
+} from '../tools/native-runtime-identity.mjs';
+
+const payload = Buffer.from('reviewed fixture executable bytes');
+const digest = createHash('sha256').update(payload).digest('hex');
+const sourceRevision = '843a6c514e606b436a7fe713422ace0a93ad3d61';
+const patchSha256 = 'a'.repeat(64);
+const lockSha256 = 'b'.repeat(64);
+const runtimeVersion = '0.0.0-ctg.2.0.32';
+const platform = process.platform === 'win32' ? `windows-${process.arch}` : `${process.platform}-${process.arch}`;
+
+async function fixture(t, overrides = {}) {
+  const root = await mkdtemp(join(tmpdir(), 'ctg-native-identity-'));
+  t.after(() => rm(root, { recursive: true, force: true }));
+  const ownedRoot = join(root, 'owned');
+  const executableName = platform.startsWith('windows-') ? 'opencode.exe' : 'opencode';
+  const binary = join(ownedRoot, `cli-${platform}`, 'bin', executableName);
+  await mkdir(join(ownedRoot, `cli-${platform}`, 'bin'), { recursive: true });
+  await writeFile(binary, payload);
+  const manifest = {
+    owner: 'Carthagent',
+    sourceRepository: 'https://github.com/anomalyco/opencode',
+    compatibilityVersion: NATIVE_TEST_COMPATIBILITY_VERSION,
+    runtimeVersion,
+    sourceRevision,
+    patchSha256,
+    lockSha256,
+    channel: `ctg.${NATIVE_TEST_COMPATIBILITY_VERSION}`,
+    platform,
+    webUI: false,
+    ...overrides,
+  };
+  await writeFile(join(ownedRoot, 'ctg-runtime.json'), JSON.stringify(manifest));
+  const release = {
+    version: 1,
+    releaseVersion: '1.2.3',
+    compatibilityVersion: NATIVE_TEST_COMPATIBILITY_VERSION,
+    runtimeVersion,
+    sourceRevision,
+    patchSha256,
+    lockSha256,
+    assets: {
+      [platform]: {
+        name: `opencode-${platform}.tar.gz`,
+        archiveSha256: 'c'.repeat(64),
+        executableSha256: digest,
+      },
+    },
+  };
+  return { binary, ownedRoot, release };
+}
+
+function versionSpawner(version) {
+  return (_binary, args, options) => {
+    assert.deepEqual(args, ['--version']);
+    assert.equal(options.windowsHide, true);
+    const child = new EventEmitter();
+    child.stdout = new EventEmitter();
+    child.stderr = new EventEmitter();
+    queueMicrotask(() => {
+      child.stdout.emit('data', `${version}\n`);
+      child.emit('close', 0);
+    });
+    return child;
+  };
+}
+
+function versionSpawnerWithEnv(version, observeEnv) {
+  return (_binary, args, options) => {
+    assert.deepEqual(args, ['--version']);
+    assert.equal(options.windowsHide, true);
+    observeEnv(options.env);
+    const child = new EventEmitter();
+    child.stdout = new EventEmitter();
+    child.stderr = new EventEmitter();
+    queueMicrotask(() => {
+      child.stdout.emit('data', `${version}\n`);
+      child.emit('close', 0);
+    });
+    return child;
+  };
+}
+
+test('accepts exactly the upstream compatibility CLI identity', async t => {
+  const { binary } = await fixture(t);
+  assert.deepEqual(await loadNativeTestRuntime({ binary, spawnImpl: versionSpawner('opencode v2.0.32') }), {
+    binary,
+    compatibilityVersion: '2.0.32',
+    runtimeVersion: '2.0.32',
+  });
+});
+
+test('independent native version verification removes only the draft transport credential from child env', async t => {
+  const { binary, ownedRoot, release } = await fixture(t);
+  let childEnv;
+  await loadNativeTestRuntime({
+    binary,
+    ownedRoot,
+    expectedManifest: release,
+    env: { PATH: '/fixture/path', LANG: 'C.UTF-8', CTG_RUNTIME_GITHUB_TOKEN: 'fake-runtime-token' },
+    spawnImpl: versionSpawnerWithEnv(`opencode v${runtimeVersion}`, env => { childEnv = env; }),
+  });
+  assert.equal(childEnv.CTG_RUNTIME_GITHUB_TOKEN, undefined);
+  assert.equal(childEnv.PATH, '/fixture/path');
+  assert.equal(childEnv.LANG, 'C.UTF-8');
+});
+
+test('accepts the CTG runtime only with pinned provenance and independently expected hash', async t => {
+  const { binary, ownedRoot, release } = await fixture(t);
+  const runtime = await loadNativeTestRuntime({
+    binary,
+    ownedRoot,
+    expectedManifest: release,
+    spawnImpl: versionSpawner(`opencode v${runtimeVersion}`),
+  });
+  assert.deepEqual(runtime, {
+    binary,
+    compatibilityVersion: '2.0.32',
+    runtimeVersion,
+    binarySha256: digest,
+    sourceRevision,
+    patchSha256,
+    lockSha256,
+    platform,
+  });
+});
+
+test('uses the explicit developer hash input when no trusted release record is passed', async t => {
+  const { binary, ownedRoot, release } = await fixture(t);
+  const runtime = await loadNativeTestRuntime({
+    binary,
+    ownedRoot,
+    expectedManifest: release,
+    env: { CTG_TEST_RUNTIME_SHA256: digest },
+    spawnImpl: versionSpawner(`opencode v${runtimeVersion}`),
+  });
+  assert.equal(runtime.binarySha256, digest);
+});
+
+test('preflights an injected artifact against an explicit trusted manifest before runtime selection', async t => {
+  const { ownedRoot, binary, release } = await fixture(t);
+  const expectedManifestPath = join(ownedRoot, 'trusted-release.json');
+  await writeFile(expectedManifestPath, JSON.stringify(release));
+  const result = await preflightNativeTestRuntimeArtifact({
+    ownedRoot,
+    expectedManifestPath,
+    spawnImpl: versionSpawner(`opencode v${runtimeVersion}`),
+  });
+  assert.equal(result.identity.binary, binary);
+  assert.deepEqual(result.expectedManifest, release);
+});
+
+test('requires a trusted test manifest before preflighting an injected artifact', async t => {
+  const { ownedRoot } = await fixture(t);
+  await assert.rejects(preflightNativeTestRuntimeArtifact({ ownedRoot }), /trusted CTG_TEST_RUNTIME_RELEASE_MANIFEST is required/);
+});
+
+test('rejects versions that merely contain the compatibility version', async t => {
+  const { binary } = await fixture(t);
+  await assert.rejects(loadNativeTestRuntime({
+    binary,
+    spawnImpl: versionSpawner('opencode v9.0.0-ctg.2.0.32'),
+  }), /Unsupported native test runtime version/);
+});
+
+test('requires trusted release metadata for owned artifacts', async t => {
+  const { binary, ownedRoot } = await fixture(t);
+  await assert.rejects(loadNativeTestRuntime({ binary, ownedRoot }), /required pinned identity fields/);
+});
+
+test('rejects self-declared provenance mismatches against trusted release metadata before execution', async t => {
+  const cases = [
+    ['sourceRevision', 'f'.repeat(40), /sourceRevision mismatch/],
+    ['patchSha256', 'd'.repeat(64), /patchSha256 mismatch/],
+    ['lockSha256', 'e'.repeat(64), /lockSha256 mismatch/],
+    ['compatibilityVersion', '2.0.33', /compatibilityVersion mismatch/],
+    ['runtimeVersion', '0.0.0-ctg.2.0.33', /runtimeVersion mismatch/],
+  ];
+  for (const [field, value, error] of cases) {
+    const { binary, ownedRoot, release } = await fixture(t, { [field]: value });
+    let spawned = false;
+    await assert.rejects(loadNativeTestRuntime({ binary, ownedRoot, expectedManifest: release, spawnImpl: (...args) => { spawned = true; return versionSpawner(`opencode v${runtimeVersion}`)(...args); } }), error);
+    assert.equal(spawned, false, `${field} mismatch must be rejected before executing binary`);
+  }
+});
+
+test('checks owned executable path and bytes before invoking version command', async t => {
+  const { binary, ownedRoot, release } = await fixture(t);
+  let spawned = false;
+  await assert.rejects(loadNativeTestRuntime({
+    binary: join(ownedRoot, '..', 'opencode'),
+    ownedRoot,
+    expectedManifest: release,
+    spawnImpl: () => { spawned = true; throw Error('must not execute'); },
+  }), /executable must be/);
+  await writeFile(binary, 'tampered executable');
+  await assert.rejects(loadNativeTestRuntime({
+    binary,
+    ownedRoot,
+    expectedManifest: release,
+    spawnImpl: () => { spawned = true; throw Error('must not execute'); },
+  }), /binary SHA-256 mismatch/);
+  assert.equal(spawned, false);
+});