chati-dev 4.5.16 → 4.5.27

package/scripts/verify-real-harness-e2e.js

@@ -0,0 +1,1581 @@
+#!/usr/bin/env node
+
+import { spawn, spawnSync } from 'node:child_process';
+import { createHash, randomBytes } from 'node:crypto';
+import {
+  chmodSync, closeSync, constants, existsSync, fchmodSync, fstatSync, mkdirSync, mkdtempSync, openSync,
+  readSync, readdirSync, realpathSync, rmSync, writeFileSync, writeSync,
+} from 'node:fs';
+import { homedir, tmpdir } from 'node:os';
+import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import * as yaml from 'js-yaml';
+import {
+  loadRuntimeInstallationV2, resolveRuntimeRailInvocationV2,
+} from '../src/orchestrator/runtime-installation-v2.js';
+import {
+  digestProviderExecutable, openPinnedProviderExecutable, openPinnedProviderSupportingExecutables,
+} from '../src/installer-v2/provider-executable.js';
+import {
+  installationAuthorityPublicKeyPath, installationAuthorityStateDirectory,
+} from '../src/installer-v2/installation-authority.js';
+
+const REAL_HARNESS_SEQUENCE = Object.freeze(['claude', 'codex', 'grok']);
+const E2E_ROUTE_REASON = 'installed-harness-e2e-deterministic-contract';
+const PYTHON_PATH = '/usr/bin/python3';
+const BUBBLEWRAP_PATH = '/usr/bin/bwrap';
+const SANDBOX_OUTPUT_PATH = '/output';
+const SANDBOX_STATE_PATH = '/state';
+const SANDBOX_TMP_PATH = '/tmp';
+const SEALED_CODEX_EXECUTABLE_PATH = '/run/chati-sealed/bin/codex';
+const SEALED_CODEX_HOST_PATH = '/run/chati-sealed/bin/codex-code-mode-host';
+const CODEX_RUNTIME_PATHS = Object.freeze(['/usr', '/bin', '/lib', '/lib64', '/etc']);
+const CODEX_DNS_RUNTIME_PATH = '/run/systemd/resolve';
+const GROK_E2E_STRICT_SANDBOX_PROFILE_PREFIX = 'chati-e2e-strict';
+const GROK_SYSTEM_PATH = '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin';
+const GROK_RUNTIME_ENVIRONMENT_KEYS = new Set([
+  'HOME', 'USER', 'LOGNAME', 'SHELL', 'TERM', 'COLORTERM', 'LANG', 'LC_ALL', 'LC_CTYPE',
+  'XDG_CONFIG_HOME', 'XDG_CACHE_HOME', 'XDG_DATA_HOME', 'XDG_STATE_HOME', 'XDG_RUNTIME_DIR',
+]);
+const GROK_RUNTIME_CREDENTIAL_PREFIXES = Object.freeze(['XAI_', 'GROK_']);
+const SEALED_PROVIDER_RUNNER = String.raw`import fcntl, hashlib, json, os, sys
+F_ADD_SEALS = 1033
+F_SEAL_SEAL = 0x0001
+F_SEAL_SHRINK = 0x0002
+F_SEAL_GROW = 0x0004
+F_SEAL_WRITE = 0x0008
+
+def seal_descriptor(source, expected_sha256, label):
+    image = os.memfd_create('chati-sealed-provider', os.MFD_ALLOW_SEALING)
+    digest = hashlib.sha256()
+    os.lseek(source, 0, os.SEEK_SET)
+    while True:
+        chunk = os.read(source, 1024 * 1024)
+        if not chunk:
+            break
+        digest.update(chunk)
+        view = memoryview(chunk)
+        while view:
+            written = os.write(image, view)
+            if written < 1:
+                raise RuntimeError('could not write sealed ' + label)
+            view = view[written:]
+    if digest.hexdigest() != expected_sha256:
+        raise RuntimeError('sealed ' + label + ' differs from its signed binding')
+    fcntl.fcntl(image, F_ADD_SEALS, F_SEAL_SEAL | F_SEAL_SHRINK | F_SEAL_GROW | F_SEAL_WRITE)
+    os.lseek(image, 0, os.SEEK_SET)
+    return image
+
+def read_exact(length, label):
+    chunks = []
+    remaining = length
+    while remaining:
+        chunk = os.read(0, remaining)
+        if not chunk:
+            raise RuntimeError('could not read ' + label)
+        chunks.append(chunk)
+        remaining -= len(chunk)
+    return b''.join(chunks)
+
+def seal_bytes(content, label):
+    image = os.memfd_create('chati-sealed-' + label, os.MFD_ALLOW_SEALING)
+    view = memoryview(content)
+    while view:
+        written = os.write(image, view)
+        if written < 1:
+            raise RuntimeError('could not write sealed ' + label)
+        view = view[written:]
+    fcntl.fcntl(image, F_ADD_SEALS, F_SEAL_SEAL | F_SEAL_SHRINK | F_SEAL_GROW | F_SEAL_WRITE)
+    os.lseek(image, 0, os.SEEK_SET)
+    return image
+
+payload = json.loads(sys.argv[1])
+primary = seal_descriptor(3, payload['executable_sha256'], payload['label'])
+os.dup2(primary, 3)
+authority = None
+if payload.get('authority_key_bytes_length', 0):
+    authority = seal_bytes(read_exact(payload['authority_key_bytes_length'], 'installation authority public key'), 'authority-key')
+args = [str(authority) if argument == '{authority_fd}' else argument for argument in payload['args']]
+os.execvpe(payload['command'], [payload['command'], *args], os.environ)`;
+const SEALED_CODEX_RUNNER = String.raw`import fcntl, hashlib, json, os, subprocess, sys
+F_ADD_SEALS = 1033
+F_SEAL_SEAL = 0x0001
+F_SEAL_SHRINK = 0x0002
+F_SEAL_GROW = 0x0004
+F_SEAL_WRITE = 0x0008
+
+def seal_descriptor(source, expected_sha256, label):
+    image = os.memfd_create('chati-sealed-codex', os.MFD_ALLOW_SEALING)
+    digest = hashlib.sha256()
+    os.lseek(source, 0, os.SEEK_SET)
+    while True:
+        chunk = os.read(source, 1024 * 1024)
+        if not chunk:
+            break
+        digest.update(chunk)
+        view = memoryview(chunk)
+        while view:
+            written = os.write(image, view)
+            if written < 1:
+                raise RuntimeError('could not write sealed Codex executable')
+            view = view[written:]
+    if digest.hexdigest() != expected_sha256:
+        raise RuntimeError('sealed ' + label + ' differs from its signed binding')
+    fcntl.fcntl(image, F_ADD_SEALS, F_SEAL_SEAL | F_SEAL_SHRINK | F_SEAL_GROW | F_SEAL_WRITE)
+    os.lseek(image, 0, os.SEEK_SET)
+    return image
+
+def read_exact(length, label):
+    chunks = []
+    remaining = length
+    while remaining:
+        chunk = os.read(0, remaining)
+        if not chunk:
+            raise RuntimeError('could not read ' + label)
+        chunks.append(chunk)
+        remaining -= len(chunk)
+    return b''.join(chunks)
+
+def seal_bytes(content, label):
+    image = os.memfd_create('chati-sealed-' + label, os.MFD_ALLOW_SEALING)
+    view = memoryview(content)
+    while view:
+        written = os.write(image, view)
+        if written < 1:
+            raise RuntimeError('could not write sealed ' + label)
+        view = view[written:]
+    fcntl.fcntl(image, F_ADD_SEALS, F_SEAL_SEAL | F_SEAL_SHRINK | F_SEAL_GROW | F_SEAL_WRITE)
+    os.lseek(image, 0, os.SEEK_SET)
+    return image
+
+payload = json.loads(sys.argv[1])
+primary = seal_descriptor(3, payload['executable_sha256'], 'Codex executable')
+supporting = seal_descriptor(4, payload['supporting_executable_sha256'], 'Codex code-mode host')
+os.dup2(primary, 3)
+os.dup2(supporting, 4)
+credential = read_exact(payload['credential_bytes_length'], 'Codex credential')
+auth = read_exact(payload['auth_bytes_length'], 'Codex auth')
+authority = seal_bytes(read_exact(payload['authority_key_bytes_length'], 'installation authority public key'), 'authority-key')
+auth_fd = seal_bytes(auth, 'auth') if auth else None
+environment = {
+    'CODEX_HOME': payload['state_path'],
+    'HOME': payload['state_path'],
+    'TMPDIR': payload['tmp_path'],
+    'PATH': '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin',
+    'LANG': 'C.UTF-8',
+    'NO_COLOR': '1',
+}
+if payload['credential_name']:
+    environment[payload['credential_name']] = credential.decode('utf-8')
+if payload['test_host_pid'] is not None:
+    environment['CHATI_TEST_HOST_PID'] = str(payload['test_host_pid'])
+command = [
+    payload['bubblewrap_path'], '--die-with-parent', '--unshare-all', '--unshare-user', '--share-net',
+    '--disable-userns', '--as-pid-1',
+]
+for runtime_path in payload['runtime_paths']:
+    command.extend(['--ro-bind', runtime_path, runtime_path])
+command.extend([
+    '--dir', '/run', '--dir', '/run/systemd',
+    '--ro-bind', payload['dns_runtime_path'], payload['dns_runtime_path'],
+    '--dev', '/dev', '--proc', '/proc', '--tmpfs', payload['tmp_path'],
+    '--dir', '/run', '--dir', '/run/chati-sealed', '--dir', '/run/chati-sealed/bin',
+    '--perms', '0500', '--ro-bind-data', '3', payload['sealed_executable_path'],
+    '--perms', '0500', '--ro-bind-data', '4', payload['sealed_host_path'],
+    '--bind-fd', str(payload['project_fd']), payload['project_path'],
+    '--ro-bind', '/proc/self/fd/' + str(payload['runtime_fd']), payload['runtime_path'],
+    '--bind-fd', str(payload['state_fd']), payload['state_path'],
+])
+if payload['output_fd'] is not None:
+    command.extend(['--bind-fd', str(payload['output_fd']), payload['output_path']])
+if auth_fd is not None:
+    command.extend(['--perms', '0400', '--ro-bind-data', str(auth_fd), payload['state_path'] + '/auth.json'])
+for directory in payload['authority_key_parent_directories']:
+    command.extend(['--dir', directory])
+command.extend([
+    '--perms', '0555', '--tmpfs', payload['authority_key_directory'],
+    '--perms', '0444', '--file', str(authority), payload['authority_key_destination'],
+    '--remount-ro', payload['authority_key_directory'],
+])
+command.extend([
+    '--chdir', payload['project_path'],
+    payload['sealed_executable_path'], *payload['args'],
+])
+pass_fds = [3, 4, payload['project_fd'], payload['runtime_fd'], payload['state_fd'], authority]
+if payload['output_fd'] is not None:
+    pass_fds.append(payload['output_fd'])
+if auth_fd is not None:
+    pass_fds.append(auth_fd)
+result = subprocess.run(command, env=environment, pass_fds=tuple(pass_fds), close_fds=True)
+sys.exit(result.returncode)`;
+const CLAUDE_NATIVE_MODELS = Object.freeze({
+  'claude-fable-5': 'claude-fable-5',
+  'claude-opus-5': 'claude-opus-5',
+  'claude-sonnet-5': 'claude-sonnet-5',
+  'claude-haiku-4-5': 'claude-haiku-4-5',
+});
+
+function fail(message, details = {}) {
+  const error = new Error(message);
+  error.details = details;
+  throw error;
+}
+
+function sameSnapshot(left, right) {
+  return left?.dev === right?.dev
+    && left?.ino === right?.ino
+    && left?.mode === right?.mode
+    && left?.uid === right?.uid
+    && left?.gid === right?.gid
+    && left?.nlink === right?.nlink
+    && left?.size === right?.size
+    && left?.mtimeMs === right?.mtimeMs
+    && left?.ctimeMs === right?.ctimeMs;
+}
+
+function runSecurityTestHook(name, payload) {
+  const hook = globalThis[Symbol.for('chati.real-harness-e2e.security-test-hooks')]?.[name];
+  if (typeof hook === 'function') hook(payload);
+}
+
+function readBoundedRegularFile(path, maxBytes, label) {
+  let descriptor;
+  try {
+    descriptor = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW || 0) | (constants.O_NONBLOCK || 0));
+  } catch {
+    return fail(label + ' is not a bounded regular file');
+  }
+  try {
+    return readBoundedRegularDescriptor(descriptor, maxBytes, label, { path });
+  } finally {
+    closeSync(descriptor);
+  }
+}
+
+function readBoundedRegularDescriptor(descriptor, maxBytes, label, { path = null } = {}) {
+  const before = fstatSync(descriptor);
+  if (!before.isFile() || before.nlink !== 1 || before.size > maxBytes) {
+    return fail(label + ' is not a bounded regular file');
+  }
+  runSecurityTestHook('afterBoundedFileStat', { path, descriptor, maxBytes, label });
+  const bytes = Buffer.allocUnsafe(maxBytes + 1);
+  let offset = 0;
+  while (offset < bytes.length) {
+    const count = readSync(descriptor, bytes, offset, bytes.length - offset, null);
+    if (count === 0) break;
+    offset += count;
+  }
+  const after = fstatSync(descriptor);
+  if (offset > maxBytes || !after.isFile() || after.nlink !== 1 || !sameSnapshot(before, after)) {
+    return fail(label + ' is not a bounded regular file');
+  }
+  return bytes.subarray(0, offset);
+}
+
+function value(argv, flag, fallback = null) {
+  const index = argv.indexOf(flag);
+  return index === -1 ? fallback : argv[index + 1];
+}
+
+function parentDirectories(path) {
+  const parents = [];
+  for (let current = dirname(path); current !== '/'; current = dirname(current)) parents.push(current);
+  return parents.reverse();
+}
+
+export function resolveE2EAuthorityPublicKeyPath(authorityDirectory) {
+  const locations = [
+    installationAuthorityPublicKeyPath(authorityDirectory),
+    join(installationAuthorityStateDirectory(authorityDirectory), 'installation-ed25519-public.pem'),
+  ];
+  for (const path of locations) {
+    try {
+      readBoundedRegularFile(path, 64 * 1024, 'installation authority public key');
+      return path;
+    } catch {
+      // Try the legacy location only when the public-only projection is absent.
+    }
+  }
+  return fail('real harness E2E requires the installation authority public key');
+}
+
+export function configureGrokStrictSandbox(projectRoot, authorityPublicKey) {
+  if (typeof authorityPublicKey !== 'string' || resolve(authorityPublicKey) !== authorityPublicKey) {
+    fail('real Grok E2E requires a resolved installation authority public key');
+  }
+  const sandboxDirectory = join(projectRoot, '.grok');
+  const sandboxConfig = join(sandboxDirectory, 'sandbox.toml');
+  if (existsSync(sandboxConfig)) {
+    fail('real Grok E2E refuses to replace an existing sandbox profile');
+  }
+  mkdirSync(sandboxDirectory, { recursive: true, mode: 0o700 });
+  // A global Grok profile wins a same-name conflict. A fresh opaque name makes
+  // a pre-existing permissive user profile unable to shadow this E2E profile.
+  const profile = `${GROK_E2E_STRICT_SANDBOX_PROFILE_PREFIX}-${randomBytes(16).toString('hex')}`;
+  writeFileSync(sandboxConfig, [
+    `[profiles.${profile}]`,
+    'extends = "strict"',
+    'restrict_network = true',
+    // Grok profiles accept directories only. runPinnedGrokCommand replaces
+    // this directory with a one-file read-only mount before Grok starts.
+    `read_only = [${JSON.stringify(dirname(authorityPublicKey))}]`,
+    '',
+  ].join('\n'), { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+  return Object.freeze({ profile, sandboxConfig, authorityPublicKey });
+}
+
+function visibleSentence(language, harness) {
+  const names = { claude: 'Claude', codex: 'Codex', grok: 'Grok' };
+  return language === 'fr'
+    ? 'Session active dans ' + names[harness] + '.'
+    : 'Sessão ativa no ' + names[harness] + '.';
+}
+
+function canonicalClaudeModel(model) {
+  const entry = Object.entries(CLAUDE_NATIVE_MODELS).find(([canonical, native]) => model === canonical || model === native);
+  if (!entry) fail('Claude verification requires a supported explicit --claude-model');
+  return entry[0];
+}
+
+function nativeModelFor(harness, modelId) {
+  if (harness === 'claude') {
+    const native = CLAUDE_NATIVE_MODELS[modelId];
+    if (!native) fail(`Claude model ${modelId} has no native E2E mapping`);
+    return native;
+  }
+  return modelId;
+}
+
+function permissionPolicyFor(harness) {
+  return harness === 'claude'
+    ? 'router-command-only'
+    : harness === 'codex'
+      ? 'outer-bubblewrap-controlled-project-workspace-write'
+      : 'controlled-project-auto-no-subagents-no-web';
+}
+
+function descriptorBoundExecutablePath() {
+  if (process.platform !== 'linux') fail('descriptor-bound real harness execution is supported only on Linux');
+  // `stdio[3]` below duplicates the parent descriptor into child fd 3 before
+  // exec. Resolve the path in that child, never through the mutable parent path.
+  return '/proc/self/fd/3';
+}
+
+function writeAll(descriptor, buffer) {
+  let offset = 0;
+  while (offset < buffer.length) {
+    const written = writeSync(descriptor, buffer, offset, buffer.length - offset);
+    if (written < 1) fail('could not materialize sealed executable');
+    offset += written;
+  }
+}
+
+function sealedExecutablePath(directory, executablePath) {
+  if (typeof executablePath !== 'string') return join(directory, 'provider');
+  const marker = `${process.platform === 'win32' ? '\\' : '/'}node_modules${process.platform === 'win32' ? '\\' : '/'}`;
+  const markerIndex = executablePath.indexOf(marker);
+  if (markerIndex < 0) return join(directory, 'provider');
+  const suffix = executablePath.slice(markerIndex + 1);
+  if (!suffix || suffix.split(/[\\/]/).some((part) => !part || part === '.' || part === '..')) {
+    fail('verified executable path cannot be safely materialized');
+  }
+  return join(directory, suffix);
+}
+
+/**
+ * The source descriptor proves the installed executable binding. The temporary
+ * copy preserves Codex's sibling layout, then becomes the input to a private
+ * immutable SquashFS mount and is rehashed there before native execution.
+ */
+function copySealedExecutable(sourceRecord, path) {
+  const source = sourceRecord?.descriptor;
+  if (!Number.isInteger(source) || !sourceRecord?.binding?.executable_sha256 || !sourceRecord?.executable?.snapshot) {
+    fail('sealed executable materialization requires a verified source descriptor');
+  }
+  let target = null;
+  let descriptor = null;
+  let result;
+  let primaryError = null;
+  const cleanupFailures = [];
+  try {
+    const before = fstatSync(source);
+    if (!sameSnapshot(before, sourceRecord.executable.snapshot)) fail('provider executable drifted before sealed materialization');
+    target = openSync(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW || 0), 0o500);
+    const buffer = Buffer.allocUnsafe(1024 * 1024);
+    let position = 0;
+    while (position < before.size) {
+      const bytes = readSync(source, buffer, 0, Math.min(buffer.length, before.size - position), position);
+      if (bytes < 1) fail('provider executable changed during sealed materialization');
+      writeAll(target, buffer.subarray(0, bytes));
+      position += bytes;
+    }
+    fchmodSync(target, 0o500);
+    const targetSnapshot = fstatSync(target);
+    if (!targetSnapshot.isFile() || targetSnapshot.nlink !== 1 || (targetSnapshot.mode & 0o777) !== 0o500) {
+      fail('sealed executable copy is not a private single-link executable');
+    }
+    if (!sameSnapshot(before, fstatSync(source))) fail('provider executable changed during sealed materialization');
+    closeSync(target);
+    target = null;
+    descriptor = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW || 0));
+    const executable = digestProviderExecutable(descriptor);
+    if (executable.sha256 !== sourceRecord.binding.executable_sha256) {
+      fail('sealed executable copy differs from the signed binding');
+    }
+    result = Object.freeze({ descriptor, path, binding: sourceRecord.binding, executable });
+  } catch (error) {
+    primaryError = error;
+  } finally {
+    if (primaryError && descriptor !== null) {
+      collectCleanupFailure(cleanupFailures, 'close-failed-sealed-descriptor', () => closeSync(descriptor));
+    }
+    if (target !== null) collectCleanupFailure(cleanupFailures, 'close-sealed-copy-target', () => closeSync(target));
+    if (primaryError) recordCleanupFailure(primaryError, cleanupFailures);
+  }
+  if (primaryError) throw primaryError;
+  throwCleanupFailures(cleanupFailures);
+  return result;
+}
+
+export function materializeSealedExecutable(pinnedExecutable, supportingExecutables = []) {
+  if (!Array.isArray(supportingExecutables)) fail('sealed supporting executables must be an array');
+  const directory = mkdtempSync(join(tmpdir(), 'chati-real-harness-exec-'));
+  let primary = null;
+  const supporting = [];
+  try {
+    chmodSync(directory, 0o700);
+    const path = sealedExecutablePath(directory, pinnedExecutable?.binding?.executable_path);
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    primary = copySealedExecutable(pinnedExecutable, path);
+    for (const source of supportingExecutables) {
+      const supportPath = join(dirname(path), basename(source?.binding?.executable_path || ''));
+      if (supportPath === dirname(path) || supportPath === path) fail('sealed supporting executable path is invalid');
+      supporting.push(copySealedExecutable(source, supportPath));
+    }
+    return Object.freeze({
+      ...primary,
+      directory,
+      supporting_executables: Object.freeze(supporting),
+    });
+  } catch (error) {
+    const cleanupFailures = [];
+    if (primary) collectCleanupFailure(cleanupFailures, 'close-sealed-primary-descriptor', () => closeSync(primary.descriptor));
+    for (const support of supporting) {
+      collectCleanupFailure(cleanupFailures, 'close-sealed-supporting-descriptor', () => closeSync(support.descriptor));
+    }
+    collectCleanupFailure(cleanupFailures, 'remove-sealed-executable-directory', () => rmSync(directory, { recursive: true, force: true }));
+    recordCleanupFailure(error, cleanupFailures);
+    throw error;
+  }
+}
+
+function cleanupDetails(failures) {
+  return failures.map(({ label, error }) => ({ label, message: error?.message || String(error) }));
+}
+
+function collectCleanupFailure(failures, label, cleanup) {
+  try {
+    runSecurityTestHook('beforeCleanup', { label });
+    cleanup();
+  } catch (error) {
+    failures.push({ label, error });
+  }
+}
+
+function recordCleanupFailure(primaryError, failures) {
+  if (!primaryError || failures.length === 0) return;
+  primaryError.details = {
+    ...(primaryError.details || {}),
+    cleanup_errors: cleanupDetails(failures),
+  };
+}
+
+function throwCleanupFailures(failures) {
+  if (failures.length === 0) return;
+  const error = new Error('one or more real harness cleanup operations failed');
+  error.details = { cleanup_errors: cleanupDetails(failures) };
+  throw error;
+}
+
+function openSandboxDirectory(path, label) {
+  if (typeof path !== 'string' || resolve(path) !== path || path === '/') {
+    fail(label + ' must be a non-root absolute directory');
+  }
+  let descriptor;
+  try {
+    descriptor = openSync(path, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
+  } catch {
+    return fail(label + ' must be a directory without a final symlink');
+  }
+  try {
+    if (!fstatSync(descriptor).isDirectory()) fail(label + ' must be a directory');
+    return descriptor;
+  } catch (error) {
+    closeSync(descriptor);
+    throw error;
+  }
+}
+
+function assertSandboxDirectoryDescriptor(descriptor, label) {
+  if (!Number.isInteger(descriptor)) fail(label + ' requires an open directory descriptor');
+  try {
+    if (!fstatSync(descriptor).isDirectory()) fail(label + ' requires an open directory descriptor');
+  } catch (error) {
+    if (error?.message === label + ' requires an open directory descriptor') throw error;
+    fail(label + ' requires an open directory descriptor');
+  }
+  return descriptor;
+}
+
+function projectPathSegments(relativePath, label) {
+  if (typeof relativePath !== 'string' || !relativePath || relativePath.startsWith('/')) {
+    fail(label + ' must be a non-empty project-relative path');
+  }
+  const segments = relativePath.split('/');
+  if (segments.some((segment) => !segment || segment === '.' || segment === '..')) {
+    fail(label + ' must be a normalized project-relative path');
+  }
+  return segments;
+}
+
+function openPinnedProjectDirectory(projectDescriptor, relativePath = '', label = 'pinned project directory') {
+  const pinned = assertSandboxDirectoryDescriptor(projectDescriptor, 'real harness project directory');
+  if (process.platform !== 'linux') fail(label + ' requires Linux descriptor traversal');
+  const segments = relativePath ? projectPathSegments(relativePath, label) : [];
+  let current;
+  try {
+    current = openSync(
+      `/proc/self/fd/${pinned}`,
+      constants.O_RDONLY | (constants.O_DIRECTORY || 0),
+    );
+    for (const segment of segments) {
+      const next = openSync(
+        join(`/proc/self/fd/${current}`, segment),
+        constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0),
+      );
+      if (!fstatSync(next).isDirectory()) {
+        closeSync(next);
+        fail(label + ' must contain only real directories');
+      }
+      closeSync(current);
+      current = next;
+    }
+    return current;
+  } catch (error) {
+    if (current !== undefined) closeSync(current);
+    if (error?.message?.startsWith(label)) throw error;
+    return fail(label + ' must contain only real directories');
+  }
+}
+
+function openPinnedProjectFile(projectDescriptor, relativePath, label) {
+  const segments = projectPathSegments(relativePath, label);
+  const filename = segments.pop();
+  const parent = openPinnedProjectDirectory(projectDescriptor, segments.join('/'), label);
+  try {
+    return openSync(
+      join(`/proc/self/fd/${parent}`, filename),
+      constants.O_RDONLY | (constants.O_NOFOLLOW || 0) | (constants.O_NONBLOCK || 0),
+    );
+  } catch (error) {
+    if (error?.message?.startsWith(label)) throw error;
+    return fail(label + ' must be a bounded regular file');
+  } finally {
+    closeSync(parent);
+  }
+}
+
+export function readPinnedProjectFile(projectDescriptor, relativePath, maxBytes, label) {
+  let descriptor;
+  try {
+    descriptor = openPinnedProjectFile(projectDescriptor, relativePath, label);
+    return readBoundedRegularDescriptor(descriptor, maxBytes, label, { path: relativePath });
+  } finally {
+    if (descriptor !== undefined) closeSync(descriptor);
+  }
+}
+
+function releaseProtectedRuntimeEntries(entries) {
+  const cleanupFailures = [];
+  for (const entry of [...entries].reverse()) {
+    if (!entry.descriptorClosed) {
+      try {
+        closeSync(entry.descriptor);
+        entry.descriptorClosed = true;
+      } catch (error) {
+        cleanupFailures.push({ label: 'close-protected-runtime-descriptor', error });
+      }
+    }
+  }
+  throwCleanupFailures(cleanupFailures);
+}
+
+function digestPinnedRuntimeFile(descriptor, snapshot) {
+  const digest = createHash('sha256');
+  const buffer = Buffer.allocUnsafe(1024 * 1024);
+  let position = 0;
+  while (position < snapshot.size) {
+    const count = readSync(descriptor, buffer, 0, Math.min(buffer.length, snapshot.size - position), position);
+    if (count < 1) fail('installed runtime file changed during integrity verification');
+    digest.update(buffer.subarray(0, count));
+    position += count;
+  }
+  if (!sameSnapshot(snapshot, fstatSync(descriptor))) fail('installed runtime file changed during integrity verification');
+  return digest.digest('hex');
+}
+
+function assertProtectedRuntimeEntries(projectDescriptor, entries) {
+  for (const entry of entries) {
+    const path = entry.relativePath ? `.chati.dev/${entry.relativePath}` : '.chati.dev';
+    let descriptor;
+    try {
+      descriptor = entry.directory
+        ? openPinnedProjectDirectory(projectDescriptor, path, 'installed runtime')
+        : openPinnedProjectFile(projectDescriptor, path, 'installed runtime');
+      if (!sameSnapshot(entry.snapshot, fstatSync(descriptor))) {
+        fail('installed runtime changed during provider execution');
+      }
+      if (!entry.directory && digestPinnedRuntimeFile(descriptor, entry.snapshot) !== entry.sha256) {
+        fail('installed runtime file content changed during provider execution');
+      }
+    } finally {
+      if (descriptor !== undefined) closeSync(descriptor);
+    }
+  }
+}
+
+/**
+ * The provider CLIs can retain a descriptor-bound CWD but cannot retain
+ * arbitrary file descriptors in the shell command they execute. Freeze the
+ * installed runtime tree by descriptor before a provider starts so its
+ * relative router command and every static or dynamic import observe the
+ * same verified non-symlink tree. The verifier never changes the project's
+ * inode modes: provider mounts enforce read-only access and post-run snapshots
+ * detect any in-place modification, even if the verifier is killed abruptly.
+ */
+export function protectPinnedProjectRuntime(projectDescriptor) {
+  const entries = [];
+  let released = false;
+  const lockEntry = (descriptor, relativePath = '') => {
+    const stat = fstatSync(descriptor);
+    if (stat.isDirectory()) {
+      const snapshot = fstatSync(descriptor);
+      entries.push({ descriptor, directory: true, relativePath, snapshot });
+      for (const entry of readdirSync(`/proc/self/fd/${descriptor}`)) {
+        const child = openSync(
+          join(`/proc/self/fd/${descriptor}`, entry),
+          constants.O_RDONLY | (constants.O_NOFOLLOW || 0) | (constants.O_NONBLOCK || 0),
+        );
+        lockEntry(child, relativePath ? `${relativePath}/${entry}` : entry);
+      }
+      return;
+    }
+    if (!stat.isFile() || stat.nlink !== 1) {
+      closeSync(descriptor);
+      fail('installed runtime must contain only regular single-link files and directories');
+    }
+    const snapshot = fstatSync(descriptor);
+    entries.push({
+      descriptor, directory: false, relativePath, snapshot,
+      sha256: digestPinnedRuntimeFile(descriptor, snapshot),
+    });
+  };
+  try {
+    lockEntry(openPinnedProjectDirectory(projectDescriptor, '.chati.dev', 'installed runtime'));
+  } catch (error) {
+    try { releaseProtectedRuntimeEntries(entries); }
+    catch (cleanupError) { recordCleanupFailure(error, [{ label: 'restore-protected-runtime', error: cleanupError }]); }
+    throw error;
+  }
+  return Object.freeze({
+    runtimeDescriptor: entries[0].descriptor,
+    assertIntact() { assertProtectedRuntimeEntries(projectDescriptor, entries); },
+    release() {
+      if (released) return;
+      releaseProtectedRuntimeEntries(entries);
+      released = true;
+    },
+  });
+}
+
+function assertPinnedProjectDirectory(path, descriptor) {
+  const pinned = assertSandboxDirectoryDescriptor(descriptor, 'real harness project directory');
+  if (path === `/proc/self/fd/${pinned}`) return;
+  let currentDescriptor;
+  try {
+    currentDescriptor = openSync(path, constants.O_RDONLY | (constants.O_DIRECTORY || 0) | (constants.O_NOFOLLOW || 0));
+    const current = fstatSync(currentDescriptor);
+    const expected = fstatSync(pinned);
+    if (!current.isDirectory() || current.dev !== expected.dev || current.ino !== expected.ino) {
+      fail('real harness project directory changed after it was pinned');
+    }
+  } catch {
+    fail('real harness project directory changed after it was pinned');
+  } finally {
+    if (currentDescriptor !== undefined) closeSync(currentDescriptor);
+  }
+}
+
+function sameDirectoryIdentity(descriptor, path) {
+  let candidate;
+  try {
+    candidate = openSandboxDirectory(path, 'real Codex protected directory');
+    const current = fstatSync(descriptor);
+    const protectedDirectory = fstatSync(candidate);
+    return current.dev === protectedDirectory.dev && current.ino === protectedDirectory.ino;
+  } finally {
+    if (candidate !== undefined) closeSync(candidate);
+  }
+}
+
+function pathIsInsidePinnedProject(projectDescriptor, path) {
+  const projectPath = realpathSync(`/proc/self/fd/${projectDescriptor}`);
+  const candidatePath = realpathSync(path);
+  const remainder = relative(projectPath, candidatePath);
+  return remainder === '' || (remainder !== '..' && !remainder.startsWith('../') && !isAbsolute(remainder));
+}
+
+function assertCodexProjectScope(projectDescriptor, protectedPaths) {
+  for (const path of protectedPaths.filter(Boolean)) {
+    if (sameDirectoryIdentity(projectDescriptor, path) || pathIsInsidePinnedProject(projectDescriptor, path)) {
+      fail('real Codex project directory overlaps a protected host directory');
+    }
+  }
+}
+
+function selectCodexEnvironmentCredential() {
+  if (typeof process.env.CODEX_ACCESS_TOKEN === 'string' && process.env.CODEX_ACCESS_TOKEN) {
+    return Object.freeze({ name: 'CODEX_ACCESS_TOKEN', bytes: Buffer.from(process.env.CODEX_ACCESS_TOKEN, 'utf8') });
+  }
+  if (typeof process.env.OPENAI_API_KEY === 'string' && process.env.OPENAI_API_KEY) {
+    return Object.freeze({ name: 'OPENAI_API_KEY', bytes: Buffer.from(process.env.OPENAI_API_KEY, 'utf8') });
+  }
+  return null;
+}
+
+function sandboxCodexArgs(processCommand, args) {
+  const outputPath = processCommand.finalMessagePath || null;
+  return args.map((argument) => {
+    if (outputPath && argument === outputPath) return join(SANDBOX_OUTPUT_PATH, basename(outputPath));
+    return argument;
+  });
+}
+
+function sandboxProviderArgs(args, projectPath) {
+  return args.map((argument, index) => args[index - 1] === '--cwd' ? projectPath : argument);
+}
+
+export function runProtectedProviderCommand(processCommand, sealedExecutable, runtimeDescriptor, {
+  args = processCommand.args,
+} = {}) {
+  if (process.platform !== 'linux' || !existsSync(PYTHON_PATH) || !existsSync(BUBBLEWRAP_PATH)
+    || !existsSync(CODEX_DNS_RUNTIME_PATH) || CODEX_RUNTIME_PATHS.some((path) => !existsSync(path))) {
+    fail('real provider E2E requires Linux Python 3 and Bubblewrap runtime protection');
+  }
+  const executionPath = sealedExecutable?.binding?.executable_path;
+  if (!Number.isInteger(sealedExecutable?.descriptor)
+    || !/^[a-f0-9]{64}$/.test(sealedExecutable?.binding?.executable_sha256 || '')
+    || !Number.isInteger(runtimeDescriptor)
+    || typeof executionPath !== 'string' || resolve(executionPath) !== executionPath) {
+    fail('real provider E2E requires sealed executable and installed runtime descriptors');
+  }
+  const projectDescriptor = assertSandboxDirectoryDescriptor(
+    processCommand.projectDescriptor,
+    'real provider project directory',
+  );
+  const projectPath = processCommand.projectPath;
+  if (typeof projectPath !== 'string' || resolve(projectPath) !== projectPath || projectPath === '/') {
+    fail('real provider E2E requires a non-root absolute project path');
+  }
+  assertSandboxDirectoryDescriptor(runtimeDescriptor, 'installed runtime directory');
+  const authorityKeySource = processCommand.authorityPublicKeyPath || resolveE2EAuthorityPublicKeyPath();
+  if (typeof authorityKeySource !== 'string' || resolve(authorityKeySource) !== authorityKeySource) {
+    fail('real provider E2E requires the installation authority public key');
+  }
+  const authorityKey = readBoundedRegularFile(authorityKeySource, 64 * 1024, 'installation authority public key');
+  const authorityKeyDestination = installationAuthorityPublicKeyPath();
+  const authorityKeyDirectory = dirname(authorityKeyDestination);
+  const home = homedir();
+  const command = [
+    '--die-with-parent', '--unshare-all', '--unshare-user', '--share-net', '--disable-userns', '--as-pid-1',
+  ];
+  for (const runtimePath of CODEX_RUNTIME_PATHS) command.push('--ro-bind', runtimePath, runtimePath);
+  command.push('--dir', '/run', '--dir', '/run/systemd', '--ro-bind', CODEX_DNS_RUNTIME_PATH, CODEX_DNS_RUNTIME_PATH);
+  for (const parent of parentDirectories(home)) command.push('--dir', parent);
+  command.push('--ro-bind', home, home);
+  // Claude needs its own home-backed authentication state, but a read-only
+  // bind of HOME must never make the host installation signing key visible.
+  const privateAuthorityPath = installationAuthorityStateDirectory();
+  if (existsSync(privateAuthorityPath)) command.push('--tmpfs', privateAuthorityPath);
+  if (authorityKeyDirectory !== privateAuthorityPath) command.push('--tmpfs', authorityKeyDirectory);
+  command.push(
+    '--dev', '/dev', '--proc', '/proc', '--tmpfs', '/tmp',
+    // Preserve the canonical project path. The signed authority receipt binds
+    // its realpath, so substituting an arbitrary sandbox path would correctly
+    // be rejected by the router even though the directory descriptor is sound.
+    '--bind-fd', '4', projectPath,
+    '--ro-bind', '/proc/self/fd/5', join(projectPath, '.chati.dev'),
+    // Native CLIs can locate their immutable companion resources through their
+    // own executable path. The Python trampoline hashes the staged descriptor
+    // into a sealed memfd before Bubblewrap mounts it at this exact path.
+    '--perms', '0500', '--ro-bind-data', '3', executionPath,
+    // --ro-bind-data exposes an anonymous memfd with nlink=0. The runtime
+    // verifier deliberately rejects that shape for trust anchors, so copy the
+    // sealed bytes into a fresh single-link file in the sandbox instead.
+    '--perms', '0400', '--file', '{authority_fd}', authorityKeyDestination,
+    '--chdir', projectPath, executionPath, ...sandboxProviderArgs(args, projectPath),
+  );
+  return spawnSync(PYTHON_PATH, ['-I', '-c', SEALED_PROVIDER_RUNNER, JSON.stringify({
+    command: BUBBLEWRAP_PATH,
+    args: command,
+    executable_sha256: sealedExecutable.binding.executable_sha256,
+    label: 'Claude executable',
+    authority_key_bytes_length: authorityKey.length,
+  })], {
+    encoding: 'utf8', timeout: 10 * 60 * 1000, maxBuffer: 4 * 1024 * 1024,
+    env: { ...process.env, NO_COLOR: '1' }, input: authorityKey,
+    stdio: ['pipe', 'pipe', 'pipe', sealedExecutable.descriptor, projectDescriptor, runtimeDescriptor],
+  });
+}
+
+const PINNED_RUNTIME_ENTRY_MONITOR = String.raw`import { watch, writeFileSync } from 'node:fs';
+const [readyPath, changedPath, stoppedPath] = process.argv.slice(1);
+let stopped = false;
+const failClosed = () => {
+  if (stopped) return;
+  stopped = true;
+  try { writeFileSync(changedPath, 'watcher-error\n', { flag: 'wx' }); } catch {}
+  process.exitCode = 1;
+};
+let watcher;
+try {
+  watcher = watch('/proc/self/fd/3', (eventType, filename) => {
+    if (filename === null || filename === '.chati.dev') {
+      try { writeFileSync(changedPath, eventType + '\n', { flag: 'wx' }); }
+      catch { failClosed(); }
+    }
+  });
+  watcher.on('error', failClosed);
+  writeFileSync(readyPath, 'ready\n', { flag: 'wx' });
+} catch { failClosed(); }
+process.on('SIGUSR1', () => {
+  try {
+    watcher.close();
+    setTimeout(() => {
+      try { writeFileSync(stoppedPath, 'stopped\n', { flag: 'wx' }); }
+      catch { failClosed(); return; }
+      process.exit(0);
+    }, 25);
+  } catch { failClosed(); }
+});
+setInterval(() => {}, 2 ** 30);`;
+
+function pause(milliseconds) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, milliseconds);
+}
+
+function startPinnedRuntimeEntryMonitor(projectDescriptor) {
+  const directory = mkdtempSync(join(tmpdir(), 'chati-pinned-runtime-monitor-'));
+  const readyPath = join(directory, 'ready');
+  const changedPath = join(directory, 'changed');
+  const stoppedPath = join(directory, 'stopped');
+  let monitor;
+  try {
+    monitor = spawn(process.execPath, ['--input-type=module', '-e', PINNED_RUNTIME_ENTRY_MONITOR, readyPath, changedPath, stoppedPath], {
+      cwd: '/', env: { PATH: process.env.PATH || '/usr/bin:/bin', LANG: 'C.UTF-8' },
+      stdio: ['ignore', 'ignore', 'ignore', projectDescriptor],
+    });
+    const deadline = Date.now() + 1000;
+    while (!existsSync(readyPath) && !existsSync(changedPath) && monitor.exitCode === null && Date.now() < deadline) pause(5);
+    if (!existsSync(readyPath) || existsSync(changedPath) || monitor.exitCode !== null) {
+      fail('could not start pinned installed runtime monitor');
+    }
+  } catch (error) {
+    if (monitor && monitor.exitCode === null) monitor.kill('SIGTERM');
+    rmSync(directory, { recursive: true, force: true });
+    throw error;
+  }
+  return Object.freeze({
+    release() {
+      if (monitor.exitCode === null && !monitor.kill('SIGUSR1')) {
+        fail('pinned installed runtime monitor could not begin drain');
+      }
+      const deadline = Date.now() + 1000;
+      while (!existsSync(stoppedPath) && monitor.exitCode === null && Date.now() < deadline) pause(5);
+      const observation = Object.freeze({ changed: existsSync(changedPath), stopped: existsSync(stoppedPath) });
+      if (!observation.stopped) fail('pinned installed runtime monitor did not drain cleanly');
+      rmSync(directory, { recursive: true, force: true });
+      return observation;
+    },
+  });
+}
+
+/**
+ * Grok's native workspace sandbox creates its own user namespace, so an outer
+ * Bubblewrap namespace would fail before Grok can start. Retain the
+ * descriptor-bound CWD and fail closed if inotify observes any rename or
+ * replacement of .chati.dev while Grok performs its one router invocation.
+ */
+export function runPinnedGrokCommand(processCommand, {
+  args = processCommand.args, monitorRuntime = true, sealedExecutable = null,
+} = {}) {
+  const projectDescriptor = assertSandboxDirectoryDescriptor(
+    processCommand.projectDescriptor,
+    'real Grok project directory',
+  );
+  if (sealedExecutable !== null && (!existsSync(BUBBLEWRAP_PATH)
+    || !Number.isInteger(sealedExecutable?.descriptor)
+    || !/^[a-f0-9]{64}$/.test(sealedExecutable?.binding?.executable_sha256 || '')
+    || typeof sealedExecutable?.binding?.executable_path !== 'string'
+    || resolve(sealedExecutable.binding.executable_path) !== sealedExecutable.binding.executable_path
+    || typeof processCommand?.projectPath !== 'string'
+    || resolve(processCommand.projectPath) !== processCommand.projectPath
+    || !Number.isInteger(processCommand?.runtimeDescriptor)
+    || !existsSync(join(homedir(), '.grok')))) {
+    fail('real Grok E2E requires a pinned executable, runtime and Bubblewrap');
+  }
+  let monitor = null;
+  let result;
+  let primaryError = null;
+  let authorityDescriptor = null;
+  const cleanupFailures = [];
+  try {
+    if (monitorRuntime) monitor = startPinnedRuntimeEntryMonitor(projectDescriptor);
+    let executable = processCommand.file;
+    let executableArgs = args;
+    if (sealedExecutable !== null) {
+      let digest;
+      try { digest = digestProviderExecutable(sealedExecutable.descriptor); }
+      catch { fail('sealed Grok executable differs from its signed binding'); }
+      if (digest.sha256 !== sealedExecutable.binding.executable_sha256) {
+        fail('sealed Grok executable differs from its signed binding');
+      }
+      if (typeof processCommand.authorityPublicKeyPath !== 'string'
+        || resolve(processCommand.authorityPublicKeyPath) !== processCommand.authorityPublicKeyPath) {
+        fail('real Grok E2E requires the installation authority public key');
+      }
+      readBoundedRegularFile(processCommand.authorityPublicKeyPath, 64 * 1024, 'installation authority public key');
+      authorityDescriptor = openSync(
+        processCommand.authorityPublicKeyPath,
+        constants.O_RDONLY | (constants.O_NOFOLLOW || 0) | (constants.O_NONBLOCK || 0),
+      );
+      const authorityStat = fstatSync(authorityDescriptor);
+      if (!authorityStat.isFile() || authorityStat.nlink !== 1 || authorityStat.size > 64 * 1024) {
+        fail('real Grok E2E requires a bounded installation authority public key');
+      }
+      // Grok's native strict sandbox reopens /proc/self/exe by a linked path.
+      // Bind the verified private inode through its descriptor, then remount
+      // it read-only at that canonical path. A memfd is kernel-sealed but has
+      // no linked pathname, so Grok's nested Bubblewrap cannot execute it.
+      executable = BUBBLEWRAP_PATH;
+      const grokStateDirectory = join(homedir(), '.grok');
+      const privateAuthorityDirectory = installationAuthorityStateDirectory();
+      const publicAuthorityDirectory = dirname(processCommand.authorityPublicKeyPath);
+      executableArgs = [
+        '--die-with-parent', '--unshare-pid', '--ro-bind', '/', '/', '--dev', '/dev', '--proc', '/proc', '--tmpfs', '/tmp',
+        // Grok creates local session state before applying its own strict
+        // workspace sandbox. Keep that tool-owned state writable, but no
+        // other part of HOME is writable in this outer namespace.
+        '--bind', grokStateDirectory, grokStateDirectory,
+        '--bind-fd', '4', processCommand.projectPath,
+        '--ro-bind', '/proc/self/fd/5', join(processCommand.projectPath, '.chati.dev'),
+        '--ro-bind', '/proc/self/fd/3', sealedExecutable.binding.executable_path,
+        // The strict profile requires a directory. Replace the host directory
+        // with one sandbox-owned regular key file, never its private sibling.
+        // Mask the canonical private state separately because legacy and
+        // custom public-key paths need not share its parent directory.
+        '--tmpfs', privateAuthorityDirectory,
+        ...(resolve(publicAuthorityDirectory) === resolve(privateAuthorityDirectory)
+          ? []
+          : ['--tmpfs', publicAuthorityDirectory]),
+        '--perms', '0400', '--file', '6', processCommand.authorityPublicKeyPath,
+        '--remount-ro', publicAuthorityDirectory,
+        '--chdir', processCommand.projectPath, sealedExecutable.binding.executable_path,
+        ...sandboxProviderArgs(args, processCommand.projectPath),
+      ];
+    }
+    result = spawnSync(executable, executableArgs, {
+      cwd: processCommand.cwd,
+      encoding: 'utf8', timeout: 10 * 60 * 1000, maxBuffer: 4 * 1024 * 1024,
+      env: grokSandboxEnvironment(process.env),
+      stdio: authorityDescriptor === null ? processCommand.stdio : [...processCommand.stdio, authorityDescriptor],
+    });
+  } catch (error) {
+    primaryError = error;
+    throw error;
+  } finally {
+    if (authorityDescriptor !== null) {
+      collectCleanupFailure(cleanupFailures, 'close-Grok-authority-public-key-descriptor', () => closeSync(authorityDescriptor));
+    }
+    if (monitor) {
+      let observation = null;
+      collectCleanupFailure(cleanupFailures, 'stop-Grok-runtime-entry-monitor', () => { observation = monitor.release(); });
+      if (observation?.changed && !primaryError) primaryError = new Error('installed runtime directory entry changed during Grok execution');
+    }
+    if (primaryError) recordCleanupFailure(primaryError, cleanupFailures);
+    else throwCleanupFailures(cleanupFailures);
+  }
+  if (primaryError) throw primaryError;
+  return result;
+}
+
+export function grokSandboxEnvironment(environment) {
+  const allowed = {};
+  for (const [key, value] of Object.entries(environment || {})) {
+    if (GROK_RUNTIME_ENVIRONMENT_KEYS.has(key)
+      || GROK_RUNTIME_CREDENTIAL_PREFIXES.some((prefix) => key.startsWith(prefix))) {
+      allowed[key] = value;
+    }
+  }
+  return Object.freeze({ ...allowed, PATH: GROK_SYSTEM_PATH, NO_COLOR: '1' });
+}
+
+function runProtectedRouterExit(projectDescriptor, runtimeDescriptor, projectPath) {
+  assertSandboxDirectoryDescriptor(projectDescriptor, 'real harness project directory');
+  assertSandboxDirectoryDescriptor(runtimeDescriptor, 'installed runtime directory');
+  if (typeof projectPath !== 'string' || resolve(projectPath) !== projectPath || projectPath === '/') {
+    fail('protected router exit requires a non-root absolute project path');
+  }
+  const home = homedir();
+  const command = ['--die-with-parent', '--unshare-all', '--unshare-user', '--share-net', '--disable-userns', '--as-pid-1'];
+  for (const runtimePath of CODEX_RUNTIME_PATHS) command.push('--ro-bind', runtimePath, runtimePath);
+  for (const parent of parentDirectories(home)) command.push('--dir', parent);
+  command.push(
+    '--dir', '/run', '--dir', '/run/systemd', '--ro-bind', CODEX_DNS_RUNTIME_PATH, CODEX_DNS_RUNTIME_PATH,
+    '--ro-bind', home, home,
+    '--dev', '/dev', '--proc', '/proc', '--tmpfs', '/tmp',
+    '--bind-fd', '3', projectPath, '--ro-bind', '/proc/self/fd/4', join(projectPath, '.chati.dev'),
+    '--chdir', projectPath, process.execPath, '.chati.dev/orchestrator/chati-router.js', 'exit',
+  );
+  return spawnSync(BUBBLEWRAP_PATH, command, {
+    encoding: 'utf8', timeout: 30_000, maxBuffer: 4 * 1024 * 1024,
+    env: { PATH: process.env.PATH || '/usr/bin:/bin', LANG: 'C.UTF-8', LC_ALL: 'C.UTF-8' },
+    stdio: ['ignore', 'pipe', 'pipe', projectDescriptor, runtimeDescriptor],
+  });
+}
+
+export function runSealedCodexCommand(processCommand, sealedExecutable, { args = processCommand.args } = {}) {
+  if (process.platform !== 'linux' || !existsSync(PYTHON_PATH) || !existsSync(BUBBLEWRAP_PATH)
+    || !existsSync(CODEX_DNS_RUNTIME_PATH) || CODEX_RUNTIME_PATHS.some((path) => !existsSync(path))) {
+    fail('real Codex E2E requires Linux Python 3 and Bubblewrap sealed execution');
+  }
+  const supportingExecutable = sealedExecutable?.supporting_executables?.[0];
+  if (!Number.isInteger(sealedExecutable?.descriptor)
+    || !/^[a-f0-9]{64}$/.test(sealedExecutable?.binding?.executable_sha256 || '')
+    || !Number.isInteger(supportingExecutable?.descriptor)
+    || !/^[a-f0-9]{64}$/.test(supportingExecutable?.binding?.executable_sha256 || '')) {
+    fail('sealed Codex command requires pinned primary and code-mode host descriptors');
+  }
+  const runtimeDescriptor = assertSandboxDirectoryDescriptor(
+    processCommand.runtimeDescriptor,
+    'installed runtime directory',
+  );
+  if (typeof processCommand.cwd !== 'string'
+    || processCommand.cwd === '/tmp'
+    || ['/run', '/state', '/output'].some((reserved) => processCommand.cwd === reserved || processCommand.cwd.startsWith(reserved + '/'))) {
+    fail('real Codex project directory collides with a reserved sandbox mount');
+  }
+  const credential = selectCodexEnvironmentCredential();
+  const configuredCodexHome = process.env.CODEX_HOME || join(homedir(), '.codex');
+  const authPath = join(configuredCodexHome, 'auth.json');
+  const auth = credential ? Buffer.alloc(0) : readBoundedRegularFile(authPath, 1024 * 1024, 'Codex auth');
+  if (!credential && auth.length === 0) fail('real Codex E2E requires its existing auth.json or an environment credential');
+  const authorityKeyDestination = installationAuthorityPublicKeyPath();
+  const authorityKeySource = processCommand.authorityPublicKeyPath || resolveE2EAuthorityPublicKeyPath();
+  if (typeof authorityKeySource !== 'string' || resolve(authorityKeySource) !== authorityKeySource) {
+    fail('real Codex E2E requires the installation authority public key');
+  }
+  const authorityKey = readBoundedRegularFile(authorityKeySource, 64 * 1024, 'installation authority public key');
+  const stateDirectory = mkdtempSync(join(tmpdir(), 'chati-real-codex-state-'));
+  let projectDescriptor = null;
+  let ownsProjectDescriptor = false;
+  let outputDescriptor = null;
+  let stateDescriptor = null;
+  let result;
+  let primaryError = null;
+  const cleanupFailures = [];
+  try {
+    chmodSync(stateDirectory, 0o700);
+    projectDescriptor = processCommand.projectDescriptor === undefined
+      ? openSandboxDirectory(processCommand.cwd, 'real Codex project directory')
+      : assertSandboxDirectoryDescriptor(processCommand.projectDescriptor, 'real Codex project directory');
+    ownsProjectDescriptor = processCommand.projectDescriptor === undefined;
+    stateDescriptor = openSandboxDirectory(stateDirectory, 'real Codex ephemeral state directory');
+    const outputDirectory = processCommand.finalMessagePath ? dirname(processCommand.finalMessagePath) : null;
+    if (outputDirectory) outputDescriptor = openSandboxDirectory(outputDirectory, 'real Codex final-message directory');
+    assertCodexProjectScope(projectDescriptor, [
+      '/tmp', tmpdir(), existsSync(dirname(authPath)) ? dirname(authPath) : null,
+      dirname(authorityKeySource), outputDirectory,
+    ]);
+    const input = Buffer.concat([credential?.bytes || Buffer.alloc(0), auth, authorityKey]);
+    runSecurityTestHook('beforeCodexSandboxLaunch', { authorityKeySource, authPath, stateDirectory });
+    result = spawnSync(PYTHON_PATH, [
+      '-I', '-c', SEALED_CODEX_RUNNER,
+      JSON.stringify({
+        args: sandboxCodexArgs(processCommand, args),
+        executable_sha256: sealedExecutable.binding.executable_sha256,
+        supporting_executable_sha256: supportingExecutable.binding.executable_sha256,
+        bubblewrap_path: BUBBLEWRAP_PATH,
+        runtime_paths: CODEX_RUNTIME_PATHS,
+        dns_runtime_path: CODEX_DNS_RUNTIME_PATH,
+        sealed_executable_path: SEALED_CODEX_EXECUTABLE_PATH,
+        sealed_host_path: SEALED_CODEX_HOST_PATH,
+        project_fd: 5,
+        project_path: processCommand.cwd,
+        output_fd: outputDescriptor === null ? null : 6,
+        output_path: SANDBOX_OUTPUT_PATH,
+        state_fd: 7,
+        state_path: SANDBOX_STATE_PATH,
+        runtime_fd: 8,
+        runtime_path: join(processCommand.cwd, '.chati.dev'),
+        tmp_path: SANDBOX_TMP_PATH,
+        credential_name: credential?.name || null,
+        credential_bytes_length: credential?.bytes.length || 0,
+        auth_bytes_length: auth.length,
+        authority_key_bytes_length: authorityKey.length,
+        authority_key_destination: authorityKeyDestination,
+        authority_key_directory: dirname(authorityKeyDestination),
+        authority_key_parent_directories: parentDirectories(dirname(authorityKeyDestination)),
+        test_host_pid: Number.isInteger(processCommand.sandboxTestHostPid) ? processCommand.sandboxTestHostPid : null,
+      }),
+    ], {
+      cwd: '/',
+      encoding: 'utf8',
+      env: { PATH: process.env.PATH || '/usr/bin:/bin', LANG: 'C.UTF-8', LC_ALL: 'C.UTF-8' },
+      input,
+      timeout: 10 * 60 * 1000,
+      maxBuffer: 4 * 1024 * 1024,
+      stdio: [
+        'pipe', 'pipe', 'pipe', sealedExecutable.descriptor, supportingExecutable.descriptor,
+        projectDescriptor, outputDescriptor === null ? 'ignore' : outputDescriptor, stateDescriptor, runtimeDescriptor,
+      ],
+    });
+  } catch (error) {
+    primaryError = error;
+    throw error;
+  } finally {
+    if (ownsProjectDescriptor && projectDescriptor !== null) collectCleanupFailure(cleanupFailures, 'close-Codex-project-directory-descriptor', () => closeSync(projectDescriptor));
+    if (outputDescriptor !== null) collectCleanupFailure(cleanupFailures, 'close-Codex-final-message-directory-descriptor', () => closeSync(outputDescriptor));
+    if (stateDescriptor !== null) collectCleanupFailure(cleanupFailures, 'close-Codex-ephemeral-state-directory-descriptor', () => closeSync(stateDescriptor));
+    collectCleanupFailure(cleanupFailures, 'remove-Codex-ephemeral-state-directory', () => rmSync(stateDirectory, { recursive: true, force: true }));
+    if (primaryError) recordCleanupFailure(primaryError, cleanupFailures);
+  }
+  throwCleanupFailures(cleanupFailures);
+  return result;
+}
+
+export function commandFor(harness, projectDir, prompt, {
+  invocation,
+  codexFinalMessagePath = null,
+  grokSandboxProfile = null,
+  authorityPublicKeyPath = null,
+  pinnedDescriptor = null,
+  projectDescriptor = null,
+  runtimeDescriptor = null,
+} = {}) {
+  if (!invocation?.model_pin?.model_id || !invocation?.model_pin?.reasoning_configuration || pinnedDescriptor === null) {
+    fail(`real ${harness} requires a sealed invocation and pinned executable descriptor`);
+  }
+  const executablePath = descriptorBoundExecutablePath();
+  const nativeModel = nativeModelFor(harness, invocation.model_pin.model_id);
+  // Provider CLIs inherit the descriptor-bound current working directory, but
+  // their shell tools do not inherit arbitrary extra file descriptors. Keep
+  // the router command relative to that pinned CWD; every verifier read around
+  // the command traverses the project descriptor with O_NOFOLLOW.
+  const pinnedProjectPath = projectDescriptor === null ? projectDir : '/proc/self/fd/4';
+  const common = {
+    file: executablePath,
+    projectPath: projectDir,
+    cwd: harness === 'codex' ? projectDir : pinnedProjectPath,
+    ...(authorityPublicKeyPath === null ? {} : { authorityPublicKeyPath }),
+    stdio: projectDescriptor === null
+      ? ['ignore', 'pipe', 'pipe', pinnedDescriptor]
+      : [
+        'ignore', 'pipe', 'pipe', pinnedDescriptor, projectDescriptor,
+        ...(runtimeDescriptor === null ? [] : [runtimeDescriptor]),
+      ],
+    ...(projectDescriptor === null ? {} : {
+      projectDescriptor,
+      ...(runtimeDescriptor === null ? {} : { runtimeDescriptor }),
+    }),
+  };
+  if (harness === 'claude') {
+    return {
+      ...common,
+      args: [
+        '-p', '--safe-mode', '--strict-mcp-config', '--no-session-persistence',
+        '--tools', 'Bash', '--model', nativeModel, '--effort', invocation.model_pin.reasoning_configuration,
+        '--allowedTools', 'Bash(node .chati.dev/orchestrator/chati-router.js *)',
+        '--', prompt,
+      ],
+    };
+  }
+  if (harness === 'codex') {
+    if (!codexFinalMessagePath) fail('Codex verification requires a final-message output path');
+    return {
+      ...common,
+      args: [
+        'exec', '-C', projectDir, '--sandbox', 'danger-full-access', '--ephemeral', '--ignore-user-config', '--skip-git-repo-check', '--color', 'never',
+        '-m', nativeModel,
+        '-c', `model_reasoning_effort=${JSON.stringify(invocation.model_pin.reasoning_configuration)}`,
+        '--output-last-message', codexFinalMessagePath, prompt,
+      ],
+      finalMessagePath: codexFinalMessagePath,
+    };
+  }
+  if (typeof grokSandboxProfile !== 'string' || !/^[a-z0-9-]{24,128}$/.test(grokSandboxProfile)) {
+    fail('real Grok E2E requires a unique strict sandbox profile');
+  }
+  return {
+    ...common,
+    args: [
+      '--cwd', pinnedProjectPath, '--single', prompt, '--permission-mode', 'auto', '--sandbox', grokSandboxProfile,
+      '--tools', 'Bash', '--no-subagents', '--disable-web-search', '--no-plan', '--max-turns', '3',
+      '--output-format', 'plain', '-m', nativeModel, '--reasoning-effort', invocation.model_pin.reasoning_configuration,
+    ],
+  };
+}
+
+function promptFor(language, harness, invocation) {
+  const visible = visibleSentence(language, harness);
+  const languageName = language === 'fr' ? 'French' : 'Brazilian Portuguese';
+  return [
+    'This is a non-interactive deterministic Chati.dev installed-runtime verification.',
+    `route_reason=${E2E_ROUTE_REASON}.`,
+    `provider_id=${invocation.provider_id}; model_id=${invocation.model_pin.model_id}; reasoning_configuration=${invocation.model_pin.reasoning_configuration}.`,
+    'The harness has pre-authorized exactly one local shell command: node .chati.dev/orchestrator/chati-router.js --harness ' + harness,
+    'Run that command once with the shell. Do not edit files and do not run another provider command.',
+    'Inspect its JSON result. If it fails or does not report a successful active session for ' + harness + ', report the observed failure and do not emit a receipt.',
+    'Only if the command succeeds, emit the following two lines and nothing else. The visible sentence must be in ' + languageName + '.',
+    visible,
+    'CHATI_REAL_E2E {"harness":"' + harness + '","language":"' + language + '","router_ok":true,"active_harness":"' + harness + '"}',
+    'That receipt states only the successful result you just observed from the local command.',
+  ].join('\n');
+}
+
+export function parseMarker(output, harness) {
+  const matches = [...output.matchAll(/CHATI_REAL_E2E\s+(\{[^\n]+\})/g)];
+  if (matches.length !== 1) fail('real ' + harness + ' process did not emit exactly one E2E marker', { output: output.slice(-10_000) });
+  try { return JSON.parse(matches[0][1]); } catch {
+    return fail('real ' + harness + ' process emitted malformed E2E JSON');
+  }
+}
+
+export function readCodexFinalMessage(path) {
+  return readBoundedRegularFile(path, 1024 * 1024, 'real codex final message').toString('utf8');
+}
+
+export function validateNativeLocks(projectDir, { active = true, projectDescriptor = null } = {}) {
+  for (const path of ['CLAUDE.local.md', 'AGENTS.override.md', '.grok/session-lock.md']) {
+    const content = projectDescriptor === null
+      ? readBoundedRegularFile(join(projectDir, path), 1024 * 1024, 'native session projection').toString('utf8')
+      : readPinnedProjectFile(projectDescriptor, path, 1024 * 1024, 'native session projection').toString('utf8');
+    if (active && (!/Session Lock: ACTIVE/.test(content) || /## Session Paused/.test(content))) {
+      fail('native session projection is not active: ' + path);
+    }
+    if (!active && (/Session Lock: ACTIVE/.test(content) || !/Status: INACTIVE/.test(content))) {
+      fail('native session projection is not inactive: ' + path);
+    }
+  }
+}
+
+function releaseCandidateEvidence(tarballSha256, packageVersion) {
+  if (tarballSha256 === null && packageVersion === null) return null;
+  if (!/^[a-f0-9]{64}$/.test(tarballSha256 || '') || typeof packageVersion !== 'string' || !packageVersion) {
+    fail('release candidate evidence requires a tarball SHA-256 and package version');
+  }
+  const installedPackage = JSON.parse(readBoundedRegularFile(
+    join(dirname(fileURLToPath(import.meta.url)), '..', 'package.json'),
+    1024 * 1024,
+    'installed package metadata',
+  ).toString('utf8'));
+  if (installedPackage.name !== 'chati-dev' || installedPackage.version !== packageVersion) {
+    fail('installed real harness verifier package does not match release candidate metadata');
+  }
+  return Object.freeze({ tarball_sha256: tarballSha256, package_version: packageVersion });
+}
+
+function assertPinnedInstallationAuthority(projectRoot, installationBytes, expectedInstallation) {
+  const revalidated = loadRuntimeInstallationV2(projectRoot, {
+    source: { content: installationBytes.toString('utf8') },
+  });
+  if (!revalidated || revalidated.digest !== expectedInstallation.digest
+    || revalidated.installation_artifact_id !== expectedInstallation.installation_artifact_id) {
+    fail('signed installation authority changed during real harness execution');
+  }
+}
+
+export function runRealHarnessE2E({
+  projectDir,
+  language,
+  claudeModel = null,
+  harnesses = REAL_HARNESS_SEQUENCE,
+  tarballSha256 = null,
+  packageVersion = null,
+}) {
+  const projectRoot = resolve(projectDir);
+  if (!['pt', 'fr'].includes(language)) fail('language must be pt or fr');
+  if (!Array.isArray(harnesses) || harnesses.length === 0
+    || harnesses.length > REAL_HARNESS_SEQUENCE.length
+    || harnesses.some((harness, index) => harness !== REAL_HARNESS_SEQUENCE[index])) {
+    fail('harnesses must be a non-empty ordered prefix of claude,codex,grok');
+  }
+  const projectDescriptor = openSandboxDirectory(projectRoot, 'real harness project directory');
+  let runtimeProtection = null;
+  let outerError = null;
+  try {
+  const root = `/proc/self/fd/${projectDescriptor}`;
+  assertPinnedProjectDirectory(root, projectDescriptor);
+  const routerPath = '.chati.dev/orchestrator/chati-router.js';
+  const installationPath = '.chati/v2/installation.json';
+  const installationBefore = readPinnedProjectFile(projectDescriptor, installationPath, 4 * 1024 * 1024, 'signed installation');
+  const installation = loadRuntimeInstallationV2(root, {
+    source: { content: installationBefore.toString('utf8') },
+  });
+  assertPinnedProjectDirectory(root, projectDescriptor);
+  if (!installation) fail('project must have an authorized v2 installation');
+  runtimeProtection = protectPinnedProjectRuntime(projectDescriptor);
+  const routerBefore = readPinnedProjectFile(projectDescriptor, routerPath, 4 * 1024 * 1024, 'installed runtime router');
+  if (routerBefore.length === 0) fail('project must be a complete installed v2 runtime');
+  if (typeof claudeModel !== 'string' || !claudeModel.trim()) {
+    fail('real harness E2E requires an explicit --claude-model');
+  }
+  const releaseCandidate = releaseCandidateEvidence(tarballSha256, packageVersion);
+  const requestedClaudeModel = canonicalClaudeModel(claudeModel.trim());
+  const authorityPublicKey = resolveE2EAuthorityPublicKeyPath();
+  const grokSandbox = harnesses.includes('grok')
+    ? configureGrokStrictSandbox(projectRoot, authorityPublicKey)
+    : null;
+  const results = [];
+
+  for (const harness of harnesses) {
+    const codexOutputDir = harness === 'codex'
+      ? mkdtempSync(join(tmpdir(), 'chati-real-codex-output-'))
+      : null;
+    let pinnedExecutable = null;
+    let pinnedSupportingExecutables = [];
+    let sealedExecutable = null;
+    let primaryError = null;
+    const cleanupFailures = [];
+    try {
+      assertPinnedProjectDirectory(root, projectDescriptor);
+      const selected = installation.installation.enabled_providers.find((binding) => binding.harness_id === harness);
+      if (!selected) fail('real ' + harness + ' is not selected by the signed installation');
+      pinnedExecutable = openPinnedProviderExecutable(selected, { harnessId: harness, projectDir: root });
+      pinnedSupportingExecutables = openPinnedProviderSupportingExecutables(selected, { harnessId: harness, projectDir: root });
+      if (harness === 'codex' && pinnedSupportingExecutables.length !== 1) {
+        fail('real Codex E2E requires one sealed code-mode host supporting executable');
+      }
+      sealedExecutable = materializeSealedExecutable(pinnedExecutable, pinnedSupportingExecutables);
+      const invocation = resolveRuntimeRailInvocationV2({
+        artifact: installation,
+        action: 'review',
+        binding: { provider_id: selected.provider_id, harness_id: harness },
+        ...(harness === 'claude' ? { model_id: requestedClaudeModel } : {}),
+        reasoning_configuration: 'high',
+      });
+      const prompt = promptFor(language, harness, invocation);
+      const executionExecutable = sealedExecutable;
+      assertPinnedProjectDirectory(root, projectDescriptor);
+      readPinnedProjectFile(projectDescriptor, routerPath, 4 * 1024 * 1024, 'installed runtime router');
+      const processCommand = commandFor(harness, projectRoot, prompt, {
+        invocation,
+        pinnedDescriptor: executionExecutable.descriptor,
+        projectDescriptor,
+        runtimeDescriptor: runtimeProtection.runtimeDescriptor,
+        authorityPublicKeyPath: authorityPublicKey,
+        ...(harness === 'grok' ? { grokSandboxProfile: grokSandbox.profile } : {}),
+        ...(codexOutputDir ? { codexFinalMessagePath: join(codexOutputDir, 'final.txt') } : {}),
+      });
+      const versionResult = harness === 'codex'
+        ? runSealedCodexCommand(processCommand, executionExecutable, { args: ['--version'] })
+        : harness === 'grok'
+          ? runPinnedGrokCommand(processCommand, {
+            args: ['--version'], monitorRuntime: false, sealedExecutable: executionExecutable,
+          })
+          : runProtectedProviderCommand(processCommand, executionExecutable, runtimeProtection.runtimeDescriptor, { args: ['--version'] });
+      if (versionResult.error || versionResult.status !== 0) {
+        fail('real ' + harness + ' version probe failed', {
+          status: versionResult.status,
+          signal: versionResult.signal,
+          error: versionResult.error?.message,
+          output: ((versionResult.stdout || '') + '\n' + (versionResult.stderr || '')).slice(-20_000),
+        });
+      }
+      runtimeProtection.assertIntact();
+      const processResult = harness === 'codex'
+        ? runSealedCodexCommand(processCommand, executionExecutable)
+        : harness === 'grok'
+          ? runPinnedGrokCommand(processCommand, { sealedExecutable: executionExecutable })
+          : runProtectedProviderCommand(processCommand, executionExecutable, runtimeProtection.runtimeDescriptor);
+      const output = (processResult.stdout || '') + '\n' + (processResult.stderr || '');
+      if (processResult.error || processResult.status !== 0) {
+        fail('real ' + harness + ' process failed', {
+          status: processResult.status,
+          signal: processResult.signal,
+          error: processResult.error?.message,
+          output: output.slice(-20_000),
+          completed: results,
+        });
+      }
+      if (harness === 'grok' && /sandbox could not be applied/i.test(output)) {
+        fail('real Grok E2E custom strict sandbox was not applied', { output: output.slice(-20_000) });
+      }
+      runtimeProtection.assertIntact();
+      const visibleOutput = processCommand.finalMessagePath
+        ? readCodexFinalMessage(processCommand.finalMessagePath)
+        : (processResult.stdout || '');
+      if (/failed to parse hooks config|unknown field [`'"]?\$comment/i.test(processResult.stderr || '')) {
+        fail('real ' + harness + ' process rejected its installed native configuration', { output: (processResult.stderr || '').slice(-10_000) });
+      }
+      const marker = parseMarker(visibleOutput, harness);
+      const expected = { harness, language, router_ok: true, active_harness: harness };
+      if (JSON.stringify(marker) !== JSON.stringify(expected)) {
+        fail('real ' + harness + ' marker does not match the router contract', {
+          marker, expected, visible_output: visibleOutput.slice(-10_000), process_output: output.slice(-10_000),
+        });
+      }
+      if (!visibleOutput.includes(visibleSentence(language, harness))) fail('real ' + harness + ' output did not preserve visible language');
+      const session = yaml.load(readPinnedProjectFile(
+        projectDescriptor, '.chati/session.yaml', 4 * 1024 * 1024, 'canonical session',
+      ).toString('utf8'));
+      if (session.language !== language || session.active_harness !== harness || session.session_status !== 'active') {
+        fail('real ' + harness + ' process did not activate the expected canonical session', {
+          language: session.language,
+          active_harness: session.active_harness,
+          session_status: session.session_status,
+          visible_output: visibleOutput.slice(-10_000),
+          process_output: output.slice(-10_000),
+        });
+      }
+      validateNativeLocks(root, { projectDescriptor });
+      assertPinnedProjectDirectory(root, projectDescriptor);
+      if (!readPinnedProjectFile(projectDescriptor, installationPath, 4 * 1024 * 1024, 'signed installation').equals(installationBefore)) {
+        fail('real ' + harness + ' process changed the signed installation');
+      }
+      assertPinnedInstallationAuthority(root, installationBefore, installation);
+      const executableAfter = digestProviderExecutable(
+        executionExecutable.descriptor,
+        executionExecutable.executable.snapshot,
+      );
+      if (executableAfter.sha256 !== pinnedExecutable.binding.executable_sha256) {
+        fail('real ' + harness + ' executable drifted from its signed binding');
+      }
+      const supportingExecutableSha256 = executionExecutable.supporting_executables.map((support) => {
+        const after = digestProviderExecutable(support.descriptor, support.executable.snapshot);
+        if (after.sha256 !== support.binding.executable_sha256) {
+          fail('real ' + harness + ' supporting executable drifted from its signed binding');
+        }
+        return after.sha256;
+      });
+      results.push({
+        harness,
+        provider_id: invocation.provider_id,
+        model_id: invocation.model_pin.model_id,
+        cli_model_id: nativeModelFor(harness, invocation.model_pin.model_id),
+        reasoning_configuration: invocation.model_pin.reasoning_configuration,
+        route_reason: E2E_ROUTE_REASON,
+        permission_policy: permissionPolicyFor(harness),
+        bound_executable_path: pinnedExecutable.binding.executable_path,
+        sealed_executable_sha256: executableAfter.sha256,
+        sealed_supporting_executable_sha256: supportingExecutableSha256,
+        executable_sha256: executableAfter.sha256,
+        cli_version: (versionResult.stdout || versionResult.stderr || '').trim().split('\n')[0],
+        stdout_sha256: createHash('sha256').update(visibleOutput).digest('hex'),
+        marker,
+        visible: visibleSentence(language, harness),
+      });
+    } catch (error) {
+      primaryError = error;
+      throw error;
+    } finally {
+      if (sealedExecutable) {
+        collectCleanupFailure(cleanupFailures, 'close-sealed-primary-descriptor', () => closeSync(sealedExecutable.descriptor));
+        for (const support of sealedExecutable.supporting_executables) {
+          collectCleanupFailure(cleanupFailures, 'close-sealed-supporting-descriptor', () => closeSync(support.descriptor));
+        }
+        collectCleanupFailure(cleanupFailures, 'remove-sealed-executable-directory', () => rmSync(sealedExecutable.directory, { recursive: true, force: true }));
+      }
+      if (pinnedExecutable) {
+        collectCleanupFailure(cleanupFailures, 'close-pinned-primary-descriptor', () => closeSync(pinnedExecutable.descriptor));
+      }
+      for (const support of pinnedSupportingExecutables) {
+        collectCleanupFailure(cleanupFailures, 'close-pinned-supporting-descriptor', () => closeSync(support.descriptor));
+      }
+      if (codexOutputDir) {
+        collectCleanupFailure(cleanupFailures, 'remove-codex-final-message-directory', () => rmSync(codexOutputDir, { recursive: true, force: true }));
+      }
+      if (primaryError) recordCleanupFailure(primaryError, cleanupFailures);
+    }
+    throwCleanupFailures(cleanupFailures);
+  }
+
+  assertPinnedProjectDirectory(root, projectDescriptor);
+  runtimeProtection.assertIntact();
+  assertPinnedInstallationAuthority(root, installationBefore, installation);
+  readPinnedProjectFile(projectDescriptor, routerPath, 4 * 1024 * 1024, 'installed runtime router');
+  const exitResult = runProtectedRouterExit(projectDescriptor, runtimeProtection.runtimeDescriptor, projectRoot);
+  if (exitResult.error || exitResult.status !== 0) {
+    fail('protected router exit failed', {
+      status: exitResult.status, signal: exitResult.signal, error: exitResult.error?.message,
+      output: ((exitResult.stdout || '') + '\n' + (exitResult.stderr || '')).slice(-20_000),
+    });
+  }
+  const exited = JSON.parse(exitResult.stdout);
+  if (exited.language !== language) fail('exit changed the session language');
+  if (exited.exited !== true || exited.session_saved !== true || exited.lock_removed !== true) {
+    fail('exit did not durably deactivate every native lock', { exited });
+  }
+  const exitedSession = yaml.load(readPinnedProjectFile(
+    projectDescriptor, '.chati/session.yaml', 4 * 1024 * 1024, 'canonical session',
+  ).toString('utf8'));
+  if (exitedSession.language !== language || exitedSession.session_status !== 'paused') {
+    fail('exit did not pause the canonical session without changing language', {
+      language: exitedSession.language,
+      session_status: exitedSession.session_status,
+    });
+  }
+  assertPinnedProjectDirectory(root, projectDescriptor);
+  validateNativeLocks(root, { active: false, projectDescriptor });
+  assertPinnedInstallationAuthority(root, installationBefore, installation);
+  return Object.freeze({
+    ok: true,
+    language,
+    sequence: results,
+    ...(releaseCandidate ? { release_candidate: releaseCandidate } : {}),
+    exit: Object.freeze({ session_status: exitedSession.session_status, lock_removed: true }),
+    resume_message: exited.resume_message,
+  });
+  } catch (error) {
+    outerError = error;
+    throw error;
+  } finally {
+    const cleanupFailures = [];
+    if (runtimeProtection) collectCleanupFailure(cleanupFailures, 'restore-protected-installed-runtime', () => runtimeProtection.release());
+    collectCleanupFailure(cleanupFailures, 'close-real-harness-project-directory-descriptor', () => closeSync(projectDescriptor));
+    if (outerError) recordCleanupFailure(outerError, cleanupFailures);
+    else throwCleanupFailures(cleanupFailures);
+  }
+}
+
+function main() {
+  const projectDir = value(process.argv, '--project-dir');
+  const language = value(process.argv, '--language');
+  const claudeModel = value(process.argv, '--claude-model');
+  const tarballSha256 = value(process.argv, '--tarball-sha256');
+  const packageVersion = value(process.argv, '--package-version');
+  const harnessesValue = value(process.argv, '--harnesses');
+  const harnesses = harnessesValue ? harnessesValue.split(',').map((item) => item.trim()) : undefined;
+  if (!projectDir || !language || !claudeModel) fail('usage: verify-real-harness-e2e --project-dir <installed-project> --language <pt|fr> --claude-model <canonical-or-native-model>');
+  process.stdout.write(JSON.stringify(runRealHarnessE2E({
+    projectDir, language, claudeModel, ...(harnesses ? { harnesses } : {}),
+    ...(tarballSha256 || packageVersion ? { tarballSha256, packageVersion } : {}),
+  }), null, 2) + '\n');
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === resolve(fileURLToPath(import.meta.url))) {
+  try { main(); } catch (error) {
+    process.stderr.write(JSON.stringify({ ok: false, error: error.message, details: error.details }, null, 2) + '\n');
+    process.exitCode = 1;
+  }
+}