cli-validator 7.0.32 → 7.0.34

package/README.md

@@ -24,3 +24,15 @@ Source: https://github.com/88208555/Validator-clitax.git
 Brain Client 服务端在同一次 runtime 请求的事务中绑定真实响应、生成并持久化权威评分与评语，再返回已提交回执。broker 只验证 `feedbackReceiptId`、`feedbackInvocationId` 和权威摘要，不发起第二次评价写入，也不生成分数或评语。`not-reported`、验证不完整、P0/P1 findings、`blocked` 或 `failed` 都不得生成好评；缺凭证、缺回执、摘要不匹配、响应非法或 HTTP 失败都会显式失败。
 
 本地 CLI 不提供手工评分或评语提交命令，人类不能选择技能分数或填写技能评价。日常聊天不属于评价协议。
+
+## 本地受限执行器
+
+先运行 `cli-validator local capabilities` 读取输入合同与限额，再以 JSON stdin 调用 `cli-validator local run-approved-plan`。输入必须完整包含 `repositoryRoot`（绝对目录）、`planPath`（工作区相对路径）、`approvalPath`（外部绝对路径）与 `signerConfigPath`（外部绝对路径或显式 null）。
+
+冻结计划采用 `validator.execution-plan/1.0`：frozen=true，planId/validationRunId/memberId/chainId，排序且唯一的 files[{path,sha256}] 与 artifactSha256，tests[{testId,path}]，GoldenBaseline 与 Aimlock 合同。policy 明确 executable（绝对真实文件）及 executableSha256、args、environment 字符串字典、timeoutMs、maxOutputBytes、requiredExitCode=0。每个测试文件必须列入 manifest 并作为真实命令参数传入；组合测试可使用受审计的入口脚本，不能把未执行文件假报为测试。执行前后校验产物、计划、可执行文件与外部授权。
+
+外部授权为 `validator.runner-approval/1.0`，包含 repositoryRoot、planSha256（冻结计划文件原始字节 SHA-256）、approvedBy、approvedAt、expiresAt，最长 24 小时。文件必须归执行账户所有、0600、非符号链接且位于被测工作区之外。它记录外部批准；智能体不得伪造批准或用测试 fixture 授权真实工作。
+
+未配置 signer 时只返回 local TestEvidence，独立终审仍为 incomplete。可选 `validator.runner-signer/1.0` 配置包含外置 privateKeyPath、keyId（Ed25519 SPKI DER SHA-256）、receiptTtlMs（最长 10 分钟）；配置和私钥同样必须为外部 0600 文件。签名绑定 subject、退出结果与日志指纹，消费方使用已配置公钥核验。密钥配置不是进程隔离：同 UID 子进程可能读取同账户文件，生产可信服务仍须独立 UID/容器及权限隔离；本工具不自动部署隔离、不创建可信密钥，也不改变验证器的信任配置。
+
+本地运行仅支持 POSIX；无 shell、显式子进程环境、受限输出与时限。信号终止保留 exitCode=null，不制造整数退出码或成功 receipt。超时、输出超限、非零退出或运行中完整性变化均失败；原始执行记录与日志摘要可审计。此进程执行器不是 OS 沙箱，不授予任意磁盘或网络访问。

package/broker.mjs

@@ -25,6 +25,19 @@ const EVALUATION_SCHEMA = 'skill-automatic-evaluation/1.0'
 const IDENTIFIER_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/
 const REQUEST_SCHEMA_PATTERN = /^([A-Za-z0-9.-]+\.skill)\.request\/([0-9]+\.[0-9]+)$/
 const TRANSPORT_ERROR_CODE_PATTERN = /^[A-Z][A-Z0-9_]{1,63}$/
+const NETWORK_TRANSPORT_ERROR = 'NETWORK_TRANSPORT'
+const SKILL_INVOCATION_ERROR = 'SKILL_INVOCATION_FAILED'
+
+class OfficialSkillInvocationError extends Error {
+  constructor(context, operation, transportCode) {
+    super(`${context.displayName} ${operation} invocation failed: network transport ${transportCode}`)
+    this.name = 'OfficialSkillInvocationError'
+    this.code = NETWORK_TRANSPORT_ERROR
+    this.operation = operation
+    this.retryable = false
+    this.transportCode = transportCode
+  }
+}
 
 function asObject(value, label) {
   if (!value || typeof value !== 'object' || Array.isArray(value)) {
@@ -237,6 +250,29 @@ export function transportFailureCode(error) {
   return 'UNKNOWN_TRANSPORT_ERROR'
 }
 
+export function officialSkillFailureResponse(error) {
+  if (error instanceof OfficialSkillInvocationError) {
+    return {
+      ok: false,
+      error: {
+        code: error.code,
+        message: error.message,
+        operation: error.operation,
+        retryable: error.retryable,
+        transportCode: error.transportCode,
+      },
+    }
+  }
+  return {
+    ok: false,
+    error: {
+      code: SKILL_INVOCATION_ERROR,
+      message: error instanceof Error ? error.message : 'Skill invocation failed',
+      retryable: false,
+    },
+  }
+}
+
 export async function invokeOfficialSkill(context, operation, input, dependencies) {
   const environment = asObject(dependencies.environment, 'broker environment')
   if (typeof dependencies.request !== 'function') {
@@ -253,9 +289,7 @@ export async function invokeOfficialSkill(context, operation, input, dependencie
       signal: AbortSignal.timeout(CALL_TIMEOUT_MS),
     })
   } catch (error) {
-    throw new Error(
-      `${context.displayName} ${operation} invocation failed: network transport ${transportFailureCode(error)}`,
-    )
+    throw new OfficialSkillInvocationError(context, operation, transportFailureCode(error))
   }
   const payload = await responsePayload(response, `${context.displayName} ${operation} response`)
   if (!response.ok || payload.ok !== true) {

package/cli.mjs

@@ -2,6 +2,7 @@
 import { dirname } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { dispatchOfficialSkillCli, runIntakeHandshake } from './installer.mjs'
+import { runValidatorLocalCli } from './validator-local-cli.mjs'
 
 const INTAKE_QUESTIONS = [
   { id: 'goal', prompt: 'What is being validated? Describe the deliverable and expected behavior.', required: true, example: '电商运营仪表盘计算工具：输入访客数/订单数/GMV/广告费，输出转化率/客单价/ROAS。' },
@@ -10,8 +11,10 @@ const INTAKE_QUESTIONS = [
   { id: 'targetFiles', prompt: 'Files to validate (or "auto" to scan all).', required: false, example: 'auto' },
 ]
 
-await dispatchOfficialSkillCli({
+if (process.argv[2] === 'local') await runValidatorLocalCli(process.argv.slice(3))
+else await dispatchOfficialSkillCli({
   packageRoot: dirname(fileURLToPath(import.meta.url)),
+  extraUsageLines: ['  cli-validator local capabilities', '  cli-validator local run-approved-plan < runner-input.json'],
   runCommand: (context) => runIntakeHandshake(context, {
     questions: INTAKE_QUESTIONS,
     outputFile: 'VALIDATOR-REQUIREMENTS.json',

package/installer.mjs

@@ -13,6 +13,7 @@ import {
   brokerCommandInput,
   invokeCommandInput,
   invokeOfficialSkill,
+  officialSkillFailureResponse,
 } from './broker.mjs'
 
 export {
@@ -25,6 +26,7 @@ export {
   callOfficialSkill,
   invokeCommandInput,
   invokeOfficialSkill,
+  officialSkillFailureResponse,
 } from './broker.mjs'
 
 const INSTALL_META = 'install-meta.json'
@@ -184,11 +186,19 @@ async function readBrokerSource(input) {
 }
 
 async function runBrokerInvocation(context, commandInput) {
-  const invocation = await invokeOfficialSkill(
-    context, commandInput.operation, commandInput.input, brokerDependencies(),
-  )
-  console.log(JSON.stringify(invocation))
-  return invocation
+  try {
+    const invocation = await invokeOfficialSkill(
+      context, commandInput.operation, commandInput.input, brokerDependencies(),
+    )
+    console.log(JSON.stringify(invocation))
+    return invocation
+  } catch (error) {
+    const response = officialSkillFailureResponse(error)
+    console.log(JSON.stringify({ response }))
+    console.error(response.error.message)
+    process.exitCode = 1
+    return null
+  }
 }
 
 export async function runIntakeHandshake(context, spec) {

package/package.json

@@ -3,13 +3,23 @@
     "cli-validator": "./cli.mjs"
   },
   "description": "Validator skill installer for CLI.Tax: delivery quality gate with three defense lines and golden baseline testing.",
+  "exports": {
+    "./local-runner": "./validator-local-runner.mjs",
+    "./runner-plan": "./validator-runner-plan.mjs",
+    "./runtime": "./validator-runtime.mjs"
+  },
   "files": [
     "cli.mjs",
     "installer.mjs",
     "broker.mjs",
     "README.md",
     "skill/SKILL.md",
-    "skill/skill.json"
+    "skill/skill.json",
+    "validator-runner-plan.mjs",
+    "validator-local-runner.mjs",
+    "validator-local-cli.mjs",
+    "validator-runtime.mjs",
+    "validator-compliance.mjs"
   ],
   "license": "UNLICENSED",
   "name": "cli-validator",
@@ -18,5 +28,5 @@
     "url": "https://github.com/88208555/Validator-clitax.git"
   },
   "type": "module",
-  "version": "7.0.32"
+  "version": "7.0.34"
 }

package/skill/SKILL.md

@@ -5,7 +5,7 @@ description: '交付前质量门禁：三道防线（静态/动态/对抗）递
 
 # Validator
 
-Package version: v7.0.32
+Package version: v7.0.34
 
 Validator 是技能链最后一站，只消费冻结目标和真实执行证据；模型解释没有裁判权。
 
@@ -107,3 +107,15 @@ GoldenBaseline 只有 `frozen: true` 才有效。来源只允许 `repository-com
 - 本地 CLI 不提供手工评分或评语提交命令，人类不得选择技能分数或填写技能评价；日常聊天不属于评价协议。
 
 调用示例：`npx cli-validator@latest invoke <operation> '<JSON对象>'`。IDE 集成可向 `npx cli-validator@latest broker` 的 stdin 发送 `{"operation":"capabilities","input":{}}`。
+
+## 本地受限执行器
+
+先运行 `cli-validator local capabilities` 读取输入合同与限额，再以 JSON stdin 调用 `cli-validator local run-approved-plan`。输入必须完整包含 `repositoryRoot`（绝对目录）、`planPath`（工作区相对路径）、`approvalPath`（外部绝对路径）与 `signerConfigPath`（外部绝对路径或显式 null）。
+
+冻结计划采用 `validator.execution-plan/1.0`：frozen=true，planId/validationRunId/memberId/chainId，排序且唯一的 files[{path,sha256}] 与 artifactSha256，tests[{testId,path}]，GoldenBaseline 与 Aimlock 合同。policy 明确 executable（绝对真实文件）及 executableSha256、args、environment 字符串字典、timeoutMs、maxOutputBytes、requiredExitCode=0。每个测试文件必须列入 manifest 并作为真实命令参数传入；组合测试可使用受审计的入口脚本，不能把未执行文件假报为测试。执行前后校验产物、计划、可执行文件与外部授权。
+
+外部授权为 `validator.runner-approval/1.0`，包含 repositoryRoot、planSha256（冻结计划文件原始字节 SHA-256）、approvedBy、approvedAt、expiresAt，最长 24 小时。文件必须归执行账户所有、0600、非符号链接且位于被测工作区之外。它记录外部批准；智能体不得伪造批准或用测试 fixture 授权真实工作。
+
+未配置 signer 时只返回 local TestEvidence，独立终审仍为 incomplete。可选 `validator.runner-signer/1.0` 配置包含外置 privateKeyPath、keyId（Ed25519 SPKI DER SHA-256）、receiptTtlMs（最长 10 分钟）；配置和私钥同样必须为外部 0600 文件。签名绑定 subject、退出结果与日志指纹，消费方使用已配置公钥核验。密钥配置不是进程隔离：同 UID 子进程可能读取同账户文件，生产可信服务仍须独立 UID/容器及权限隔离；本工具不自动部署隔离、不创建可信密钥，也不改变验证器的信任配置。
+
+本地运行仅支持 POSIX；无 shell、显式子进程环境、受限输出与时限。信号终止保留 exitCode=null，不制造整数退出码或成功 receipt。超时、输出超限、非零退出或运行中完整性变化均失败；原始执行记录与日志摘要可审计。此进程执行器不是 OS 沙箱，不授予任意磁盘或网络访问。

package/skill/skill.json

@@ -5,6 +5,6 @@
   "method": "POST",
   "name": "validator",
   "type": "Skill",
-  "version": "v7.0.32",
+  "version": "v7.0.34",
   "schemaVersion": "validator.skill.request/1.0"
 }

package/validator-compliance.mjs

@@ -0,0 +1,158 @@
+const PUBLIC_BIND_ADDRESSES = new Set(['0.0.0.0', '::', '[::]', '0:0:0:0:0:0:0:0'])
+const BIND_OPTION = /^(?:host|hostname|bind|bindhost|bindaddress|listenhost|listenaddress)$/i
+const BIND_METHODS = new Set(['listen', 'bind'])
+const SCRIPT_EXTENSION = /\.(?:[cm]?[jt]sx?)$/i
+
+function decodeHostLiteral(value) {
+  return value.replace(/\\(?:u\{([0-9a-f]+)\}|u([0-9a-f]{4})|x([0-9a-f]{2})|(.))/gi,
+    (match, point, unicode, byte, character) => {
+      const digits = point ?? unicode ?? byte
+      if (digits === undefined) return character
+      const code = parseInt(digits, 16)
+      return code <= 0x10ffff ? String.fromCodePoint(code) : match
+    })
+}
+
+function quotedToken(source, start) {
+  const quote = source[start]
+  let end = start + 1
+  while (end < source.length) {
+    if (source[end] === '\\') { end += 2; continue }
+    if (source[end] === quote) {
+      return { kind: 'literal', value: decodeHostLiteral(source.slice(start + 1, end)), start, end: end + 1 }
+    }
+    end += 1
+  }
+  return { kind: 'invalid', value: source.slice(start), start, end: source.length }
+}
+
+function templateTokens(source, start) {
+  const tokens = []
+  let index = start + 1
+  while (index < source.length) {
+    if (source[index] === '\\') { index += 2; continue }
+    if (source[index] === '`') {
+      if (tokens.length === 0) tokens.push(quotedToken(source, start))
+      return { tokens, end: index + 1 }
+    }
+    if (source[index] === '$' && source[index + 1] === '{') {
+      const expression = codeTokens(source, index + 2, true)
+      tokens.push(...expression.tokens)
+      index = expression.end
+      continue
+    }
+    index += 1
+  }
+  return { tokens, end: source.length }
+}
+
+function codeTokens(source, start = 0, templateExpression = false) {
+  const tokens = []
+  let depth = 0
+  for (let index = start; index < source.length;) {
+    const tail = source.slice(index)
+    const ignored = tail.match(/^(?:\s+|\/\/[^\n]*|\/\*[\s\S]*?(?:\*\/|$))/)
+    if (ignored) { index += ignored[0].length; continue }
+    if (source[index] === '`') {
+      const template = templateTokens(source, index)
+      tokens.push(...template.tokens)
+      index = template.end
+      continue
+    }
+    if (['"', "'"].includes(source[index])) {
+      const token = quotedToken(source, index)
+      tokens.push(token)
+      index = token.end
+      continue
+    }
+    if (source[index] === '}' && templateExpression && depth === 0) return { tokens, end: index + 1 }
+    if (source[index] === '{') depth += 1
+    if (source[index] === '}') depth -= 1
+    const word = tail.match(/^[A-Za-z_$][\w$]*/)
+    const value = word === null ? source[index] : word[0]
+    tokens.push({ kind: word === null ? 'symbol' : 'word', value, start: index, end: index + value.length })
+    index += value.length
+  }
+  return { tokens, end: source.length }
+}
+
+function bindHost(token, aliases) {
+  if (token === undefined) return false
+  return token.kind === 'literal' ? PUBLIC_BIND_ADDRESSES.has(token.value)
+    : token.kind === 'word' && aliases.has(token.value)
+}
+
+function publicAliases(tokens) {
+  const aliases = new Set()
+  let changed = true
+  while (changed) {
+    changed = false
+    for (let index = 0; index < tokens.length - 2; index += 1) {
+      const token = tokens[index]
+      if (token.kind === 'word' && tokens[index + 1].value === '='
+        && bindHost(tokens[index + 2], aliases) && !aliases.has(token.value)) {
+        aliases.add(token.value)
+        changed = true
+      }
+    }
+  }
+  return aliases
+}
+
+function callArguments(tokens, opening) {
+  const args = [[]]
+  let depth = 0
+  for (let index = opening + 1; index < tokens.length; index += 1) {
+    const token = tokens[index]
+    if (token.value === ')' && depth === 0) return args
+    if (token.value === ',' && depth === 0) { args.push([]); continue }
+    args[args.length - 1].push(token)
+    if (['(', '[', '{'].includes(token.value)) depth += 1
+    if ([')', ']', '}'].includes(token.value)) depth -= 1
+  }
+  return []
+}
+
+function scriptBindSites(source) {
+  const { tokens } = codeTokens(source)
+  const aliases = publicAliases(tokens)
+  const sites = []
+  for (let index = 0; index < tokens.length; index += 1) {
+    const token = tokens[index]
+    const normalized = token.value.replaceAll('_', '').replaceAll('-', '')
+    if (BIND_OPTION.test(normalized) && [':', '='].includes(tokens[index + 1]?.value)
+      && bindHost(tokens[index + 2], aliases)) {
+      sites.push({ offset: token.start, context: 'bind-option', address: tokens[index + 2].value })
+    }
+    if (!BIND_METHODS.has(token.value)) continue
+    let opening = index + 1
+    if (tokens[index - 1]?.value === '[' && tokens[opening]?.value === ']') opening += 1
+    if (tokens[opening]?.value === '?' && tokens[opening + 1]?.value === '.') opening += 2
+    if (tokens[opening]?.value !== '(') continue
+    const args = callArguments(tokens, opening)
+    const hosts = token.value === 'bind' ? args.slice(0, 2).flat() : args[1]
+    if (hosts === undefined) continue
+    const publicHost = hosts.find((candidate) => bindHost(candidate, aliases))
+    if (publicHost) sites.push({ offset: token.start, context: `${token.value}-argument`, address: publicHost.value })
+  }
+  return sites
+}
+
+function configurationBindSites(source) {
+  const sites = []
+  const pattern = /(?:\b(?:host|hostname|bind(?:[_-]?(?:host|address))?|listen(?:[_-]?(?:host|address))?)\b["']?\s*(?:[:=]\s*|\s+)|--(?:host|bind|listen)(?:=|\s+))["']?(0\.0\.0\.0|\[::\]|::)(?=["'\s:;,]|$)/gi
+  for (const match of source.matchAll(pattern)) {
+    const lineStart = source.lastIndexOf('\n', match.index) + 1
+    if (/^\s*(?:#|\/\/)/.test(source.slice(lineStart, match.index))) continue
+    sites.push({ offset: match.index, context: 'bind-configuration', address: match[1] })
+  }
+  return sites
+}
+
+/** Inspect bind sinks and host configuration; address lists and outbound targets are not listeners. */
+export function publicBindSites(path, source) {
+  const sites = SCRIPT_EXTENSION.test(path) ? scriptBindSites(source) : configurationBindSites(source)
+  return sites.map((site) => ({
+    ...site, line: source.slice(0, site.offset).split('\n').length,
+  }))
+}

package/validator-local-cli.mjs

@@ -0,0 +1,49 @@
+import { stdin, stdout } from 'node:process'
+import { runApprovedValidatorPlan } from './validator-local-runner.mjs'
+import { RUNNER_LIMITS, RUNNER_PLAN_SCHEMA, RUNNER_APPROVAL_SCHEMA, RUNNER_SIGNER_SCHEMA } from './validator-runner-plan.mjs'
+
+const CAPABILITIES = Object.freeze({
+  schemaVersion: 'validator.local-runner/1.0',
+  operations: ['capabilities', 'run-approved-plan'],
+  operationSchemas: {
+    capabilities: { type: 'object', additionalProperties: false, properties: {} },
+    'run-approved-plan': {
+      type: 'object', additionalProperties: false,
+      required: ['repositoryRoot', 'planPath', 'approvalPath', 'signerConfigPath'],
+      properties: {
+        repositoryRoot: { type: 'string', minLength: 1 }, planPath: { type: 'string', minLength: 1 },
+        approvalPath: { type: 'string', minLength: 1 }, signerConfigPath: { type: ['string', 'null'] },
+      },
+    },
+  },
+  planSchema: RUNNER_PLAN_SCHEMA, approvalSchema: RUNNER_APPROVAL_SCHEMA, signerSchema: RUNNER_SIGNER_SCHEMA,
+  limits: RUNNER_LIMITS,
+  boundary: 'POSIX subprocess runner; external preapproval required. Signed receipts require separately configured trust and isolation.',
+})
+
+async function readInput() {
+  const chunks = []
+  let bytes = 0
+  for await (const chunk of stdin) {
+    bytes += Buffer.byteLength(chunk)
+    if (bytes > RUNNER_LIMITS.maxControlBytes) throw new Error('Validator runner input exceeds its limit')
+    chunks.push(Buffer.from(chunk))
+  }
+  return JSON.parse(Buffer.concat(chunks).toString('utf8'))
+}
+
+export async function runValidatorLocalCli(args) {
+  try {
+    if (args.length !== 1 || !CAPABILITIES.operations.includes(args[0])) {
+      throw new Error('Usage: cli-validator local capabilities | local run-approved-plan < runner-input.json')
+    }
+    const output = args[0] === 'capabilities' ? CAPABILITIES : await runApprovedValidatorPlan(await readInput())
+    stdout.write(JSON.stringify(output) + '\n')
+    if (output.status === 'failed') process.exitCode = 1
+  } catch (error) {
+    const failure = { status: 'failed', error: error instanceof Error ? error.message : String(error) }
+    if (error instanceof Error && error.execution) failure.execution = error.execution
+    stdout.write(JSON.stringify(failure) + '\n')
+    process.exitCode = 1
+  }
+}

package/validator-local-runner.mjs

@@ -0,0 +1,170 @@
+import { spawn } from 'node:child_process'
+import { createHash, randomUUID, sign } from 'node:crypto'
+import { performance } from 'node:perf_hooks'
+import {
+  bytesSha256, loadApprovedExecutionPlan, loadApprovedSigner, validationSubjectForPlan, verifyPlanFiles,
+} from './validator-runner-plan.mjs'
+import { validatorReceiptPayload, validatorReceiptSubject } from './validator-runtime.mjs'
+
+const TERMINATION_GRACE_MS = 250
+const REAP_DEADLINE_MS = 1_000
+const EXECUTION_SCHEMA = 'validator.runner-execution/1.0'
+const EVIDENCE_SCHEMA = 'cli.tax.test-evidence/1.0'
+const RECEIPT_SCHEMA = 'validator.execution-receipt/1.0'
+
+function signalProcessGroup(child, signal) {
+  if (!Number.isInteger(child.pid)) throw new Error('Runner child has no process identifier')
+  try {
+    process.kill(-child.pid, signal)
+    return { signal, status: 'delivered' }
+  } catch (error) {
+    if (!(error instanceof Error) || !('code' in error) || error.code !== 'ESRCH') throw error
+    return { signal, status: 'already-exited' }
+  }
+}
+
+function executeBoundedCommand(authority) {
+  const { policy } = authority.plan
+  return new Promise((resolve, reject) => {
+    const started = performance.now()
+    const child = spawn(policy.executable, policy.args, {
+      cwd: authority.root, env: { ...policy.environment },
+      shell: false, detached: true, stdio: ['ignore', 'pipe', 'pipe'],
+    })
+    const termination = []
+    const stdout = []
+    const stderr = []
+    const stdoutHash = createHash('sha256')
+    const stderrHash = createHash('sha256')
+    let capturedBytes = 0
+    let droppedBytes = 0
+    let timedOut = false
+    let outputLimitExceeded = false
+    let terminating = false
+    let escalation = null
+    let failure = null
+    const terminate = () => {
+      if (terminating) return
+      terminating = true
+      try {
+        termination.push(signalProcessGroup(child, 'SIGTERM'))
+        escalation = setTimeout(() => {
+          try { termination.push(signalProcessGroup(child, 'SIGKILL')) } catch (error) { failure = error }
+        }, TERMINATION_GRACE_MS)
+      } catch (error) {
+        failure = error
+      }
+    }
+    const timer = setTimeout(() => { timedOut = true; terminate() }, policy.timeoutMs)
+    const hardLimit = setTimeout(() => {
+      clearTimeout(timer)
+      if (escalation !== null) clearTimeout(escalation)
+      try { if (Number.isInteger(child.pid)) termination.push(signalProcessGroup(child, 'SIGKILL')) } catch (error) { failure = error }
+      child.stdout.destroy()
+      child.stderr.destroy()
+      child.unref()
+      reject(new Error('Validator process could not be reaped within its hard deadline', { cause: failure }))
+    }, policy.timeoutMs + TERMINATION_GRACE_MS + REAP_DEADLINE_MS)
+    const consume = (target, hash, chunk) => {
+      const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+      hash.update(bytes)
+      const remaining = policy.maxOutputBytes - capturedBytes
+      const retained = Math.min(bytes.length, remaining)
+      if (retained > 0) target.push(Buffer.from(bytes.subarray(0, retained)))
+      capturedBytes += retained
+      droppedBytes += bytes.length - retained
+      if (droppedBytes > 0) { outputLimitExceeded = true; terminate() }
+    }
+    child.stdout.on('data', (chunk) => consume(stdout, stdoutHash, chunk))
+    child.stderr.on('data', (chunk) => consume(stderr, stderrHash, chunk))
+    child.once('error', (error) => { failure = error })
+    child.once('close', (exitCode, signal) => {
+      clearTimeout(timer)
+      clearTimeout(hardLimit)
+      if (escalation !== null) clearTimeout(escalation)
+      try { if (Number.isInteger(child.pid)) termination.push(signalProcessGroup(child, 'SIGKILL')) } catch (error) { failure = error }
+      if (failure !== null) return reject(new Error('Validator subprocess lifecycle failed', { cause: failure }))
+      resolve({
+        exitCode, signal, timedOut, outputLimitExceeded,
+        durationMs: Math.max(0, Math.round(performance.now() - started)),
+        stdout: Buffer.concat(stdout).toString('utf8'), stderr: Buffer.concat(stderr).toString('utf8'),
+        stdoutSha256: stdoutHash.digest('hex'), stderrSha256: stderrHash.digest('hex'),
+        capturedBytes, droppedBytes, termination,
+      })
+    })
+  })
+}
+
+function executionSummary(result) {
+  if (result.timedOut) return 'Approved validation command exceeded its deadline'
+  if (result.outputLimitExceeded) return 'Approved validation command exceeded its output limit'
+  if (result.signal !== null) return `Approved validation command ended on signal ${result.signal}`
+  return `Approved validation command exited with code ${result.exitCode}`
+}
+
+export function validatorExecutionLogsDigest(result) {
+  return bytesSha256(JSON.stringify({
+    stdout: result.stdout, stderr: result.stderr, stdoutSha256: result.stdoutSha256, stderrSha256: result.stderrSha256,
+    capturedBytes: result.capturedBytes, droppedBytes: result.droppedBytes,
+  }))
+}
+
+function receiptSummary(result) {
+  return JSON.stringify({
+    message: executionSummary(result), logsSha256: validatorExecutionLogsDigest(result),
+    stdoutSha256: result.stdoutSha256, stderrSha256: result.stderrSha256,
+    capturedBytes: result.capturedBytes, droppedBytes: result.droppedBytes,
+  })
+}
+
+function localEvidence(subject, result, summary) {
+  if (!Number.isInteger(result.exitCode)) return null
+  return {
+    schemaVersion: EVIDENCE_SCHEMA, evidenceId: `${subject.validationRunId}:process`,
+    kind: 'test', runner: 'local', command: subject.policy.command,
+    exitCode: result.exitCode, durationMs: result.durationMs, summary,
+    artifactSha256: subject.artifactSha256, subject, subjectDigest: validatorReceiptSubject(subject),
+  }
+}
+
+function signedEvidence(subject, result, summary, signer, passed) {
+  const issuedAt = new Date()
+  const unsigned = {
+    schemaVersion: RECEIPT_SCHEMA, keyId: signer.keyId, nonce: `receipt-${randomUUID()}`,
+    subjectDigest: validatorReceiptSubject(subject), issuedAt: issuedAt.toISOString(),
+    expiresAt: new Date(issuedAt.getTime() + signer.receiptTtlMs).toISOString(),
+    result: { runner: 'trusted-runner', passed, exitCode: result.exitCode,
+      durationMs: result.durationMs, summary },
+  }
+  const receipt = { ...unsigned,
+    signature: sign(null, Buffer.from(validatorReceiptPayload(unsigned)), signer.key).toString('base64url') }
+  return { ...localEvidence(subject, result, summary), runner: 'trusted-runner', receipt }
+}
+
+export async function runApprovedValidatorPlan(input) {
+  const authority = await loadApprovedExecutionPlan(input)
+  const subject = validationSubjectForPlan(authority.plan, authority.planSha256, new Date().toISOString())
+  const result = await executeBoundedCommand(authority)
+  try {
+    await verifyPlanFiles(authority)
+  } catch (error) {
+    const failure = new Error('Validator integrity changed during execution', { cause: error })
+    failure.execution = { schemaVersion: EXECUTION_SCHEMA, status: 'failed', subject, process: result, evidence: [] }
+    throw failure
+  }
+  const passed = result.exitCode === authority.plan.policy.requiredExitCode
+    && result.signal === null && !result.timedOut && !result.outputLimitExceeded
+  const summary = receiptSummary(result)
+  const signer = Number.isInteger(result.exitCode) ? await loadApprovedSigner(authority) : null
+  const evidence = signer === null ? localEvidence(subject, result, summary)
+    : signedEvidence(subject, result, summary, signer, passed)
+  return {
+    schemaVersion: EXECUTION_SCHEMA, status: passed ? 'succeeded' : 'failed',
+    planSha256: authority.planSha256,
+    approvalSha256: authority.approval.sha256, approvedBy: authority.approval.approval.approvedBy,
+    subject, process: result, evidence: evidence === null ? [] : [evidence],
+    receipt: evidence !== null && signer !== null ? evidence.receipt : null,
+    signingBoundary: signer === null ? 'local-evidence-only'
+      : 'configured-signature-only; independent-uid-or-container-isolation-required-for-production-trust',
+  }
+}