cli-validator 7.0.33 → 7.0.35

package/README.md

@@ -24,3 +24,52 @@ Source: https://github.com/88208555/Validator-clitax.git
 Brain Client 服务端在同一次 runtime 请求的事务中绑定真实响应、生成并持久化权威评分与评语，再返回已提交回执。broker 只验证 `feedbackReceiptId`、`feedbackInvocationId` 和权威摘要，不发起第二次评价写入，也不生成分数或评语。`not-reported`、验证不完整、P0/P1 findings、`blocked` 或 `failed` 都不得生成好评；缺凭证、缺回执、摘要不匹配、响应非法或 HTTP 失败都会显式失败。
 
 本地 CLI 不提供手工评分或评语提交命令，人类不能选择技能分数或填写技能评价。日常聊天不属于评价协议。
+
+## 本地受限执行器
+
+先运行 `cli-validator local capabilities` 读取输入合同与限额，再以 JSON stdin 调用 `cli-validator local run-approved-plan`。输入必须完整包含 `repositoryRoot`（绝对目录）、`planPath`（工作区相对路径）、`approvalPath`（外部绝对路径）与 `signerConfigPath`（外部绝对路径或显式 null）。
+
+冻结计划采用 `validator.execution-plan/1.0`：frozen=true，planId/validationRunId/memberId/chainId，排序且唯一的 files[{path,sha256}] 与 artifactSha256，tests[{testId,path}]，GoldenBaseline 与 Aimlock 合同。policy 明确 executable（绝对真实文件）及 executableSha256、args、environment 字符串字典、timeoutMs、maxOutputBytes、requiredExitCode=0。每个测试文件必须列入 manifest 并作为真实命令参数传入；组合测试可使用受审计的入口脚本，不能把未执行文件假报为测试。执行前后校验产物、计划、可执行文件与外部授权。
+
+外部授权为 `validator.runner-approval/1.0`，包含 repositoryRoot、planSha256（冻结计划文件原始字节 SHA-256）、approvedBy、approvedAt、expiresAt，最长 24 小时。文件必须归执行账户所有、0600、非符号链接且位于被测工作区之外。它记录外部批准；智能体不得伪造批准或用测试 fixture 授权真实工作。
+
+未配置 signer 时只返回 local TestEvidence，独立终审仍为 incomplete。可选 `validator.runner-signer/1.0` 配置包含外置 privateKeyPath、keyId（Ed25519 SPKI DER SHA-256）、receiptTtlMs（最长 10 分钟）；配置和私钥同样必须为外部 0600 文件。签名绑定 subject、退出结果与日志指纹，消费方使用已配置公钥核验。密钥配置不是进程隔离：同 UID 子进程可能读取同账户文件，生产可信服务仍须独立 UID/容器及权限隔离；本工具不自动部署隔离、不创建可信密钥，也不改变验证器的信任配置。
+
+本地运行仅支持 POSIX；无 shell、显式子进程环境、受限输出与时限。信号终止保留 exitCode=null，不制造整数退出码或成功 receipt。超时、输出超限、非零退出或运行中完整性变化均失败；原始执行记录与日志摘要可审计。此进程执行器不是 OS 沙箱，不授予任意磁盘或网络访问。
+
+## Brain planning verification
+
+IDE execution reports remain `reported` until a trusted runner verifies them. To prepare an execution plan from the server's complete report response:
+
+```sh
+cli-validator brain prepare /absolute/trusted-workspace report-response.json > prepared-runner.json
+```
+
+The trusted operator supplies the existing external, mode-0600 runner approval and signer configuration. The approval binds the exact `planSha256` printed by preparation. The runner input contains `reportResponse`, `approvalPath`, and `signerConfigPath`.
+
+```sh
+cli-validator brain run /absolute/trusted-workspace brain-runner-input.json > brain-validation.json
+cli-aimlock brain validate /absolute/ide-workspace brain-validation.json
+```
+
+Run this on a dedicated isolated runner, never on the production application host. Brain verification requires a privileged supervisor and executes the frozen checks as UID/GID 65534. The signing key, approved Node executable and runner controls remain protected and root owned. Frozen control files must be regular mode-0600 files; control directories must not be writable by the check process. Provide writable build-output directories separately when a check needs them. A Linux container supervisor needs SETUID, SETGID and KILL capabilities for identity separation and process-group cleanup. Do not mount a host Docker socket or production secrets.
+
+The fixed adapter executes every frozen check with `shell: false` and an explicit PATH. Its source and complete check manifest are included in the signed file manifest. The supervisor bounds the whole run to five minutes and one MiB of output. A failed, timed-out, modified or incomplete run cannot become `verified`.
+
+The API accepts `planId`, `reportDigest`, `executionPlan`, the runner's real `subject`, and `receipts`. It reconstructs and compares the member, plan, report, complete checks, files, adapter, frozen contract and policy before validating the signature. The server uses only the configured `CLITAX_VALIDATOR_RECEIPT_PUBLIC_KEY`, an Ed25519 SPKI DER public key encoded as base64. Test fixture keys must never be added to production trust.
+
+## Isolated integration verification
+
+The normal server test suite includes protocol, substitution, signature and unprivileged-runner rejection checks. The separate integration test runs real commands in a disposable root-to-unprivileged container:
+
+```sh
+docker run --rm --network none --read-only --cap-drop ALL \
+  --cap-add SETUID --cap-add SETGID --cap-add KILL \
+  --security-opt no-new-privileges --pids-limit 64 --memory 256m --cpus 1 \
+  --tmpfs /tmp:rw,nosuid,size=64m \
+  --mount type=bind,source=/absolute/source,target=/code,readonly \
+  --workdir /code node:24-alpine \
+  node --test scripts/brain-validator-isolated-integration.mjs
+```
+
+Use a source fixture containing only the needed first-party modules, not a directory containing environment files or credentials. The fixture generates a temporary signing key inside the disposable container and verifies that the unprivileged checks cannot read it.

package/brain-validator-contract.d.mts

@@ -0,0 +1,9 @@
+export const BRAIN_RUNNER_ADAPTER_SOURCE: string
+export const BRAIN_RUNNER_ADAPTER_PATH: string
+export function brainRunnerContext(userId: string, plan: unknown, report: unknown,
+  frozenAt: string, reportDigest: string, reportedAt: string): Record<string, unknown>
+export function assertBrainRunnerSubmission(context: unknown, executionPlan: unknown,
+  subject: unknown): Record<string, unknown>
+export function buildBrainRunnerPlan(context: unknown, engine: unknown): Record<string, unknown>
+export function canonicalBrainRunnerJson(value: unknown): string
+export function brainRunnerBytesSha256(bytes: string | Buffer): string

package/brain-validator-contract.mjs

@@ -0,0 +1,151 @@
+import { createHash } from 'node:crypto'
+import { basename, isAbsolute } from 'node:path'
+import { validatorArtifactSubject, validatorReceiptSubject } from './validator-runtime.mjs'
+
+export const BRAIN_RUNNER_CONTEXT_SCHEMA = 'brain.runner-context/1.0'
+export const BRAIN_RUNNER_CONTRACT_SCHEMA = 'brain.frozen-runner/1.0'
+export const BRAIN_RUNNER_ADAPTER_PATH = '.aimlock/brain-validation/check-runner.mjs'
+export const BRAIN_RUNNER_MAX_TIMEOUT_MS = 300_000
+export const BRAIN_RUNNER_MAX_OUTPUT_BYTES = 1_048_576
+const BRAIN_RUNNER_OVERHEAD_MS = 5_000
+const SHA256 = /^[0-9a-f]{64}$/
+
+export const BRAIN_RUNNER_ADAPTER_SOURCE = String.raw`import { readFile } from 'node:fs/promises'
+import { spawn } from 'node:child_process'
+import { resolve } from 'node:path'
+
+if (typeof process.getuid !== 'function' || process.getuid() !== 0) throw new Error('Trusted Brain checks require an isolated root runner with a separate unprivileged UID')
+const path = process.argv[2]
+if (process.argv.length !== 3 || typeof path !== 'string') throw new Error('A frozen checks manifest is required')
+const manifest = JSON.parse(await readFile(resolve(path), 'utf8'))
+if (manifest.schemaVersion !== 'brain.trusted-checks/1.0' || !Array.isArray(manifest.checks)
+  || manifest.checks.length === 0 || manifest.checks.length > 16) throw new Error('Invalid frozen checks manifest')
+if (typeof process.env.PATH !== 'string') throw new Error('An explicit executable search path is required')
+
+function executeCheck(check) {
+  if (typeof check.id !== 'string' || typeof check.executable !== 'string'
+    || !Array.isArray(check.args) || check.args.some((arg) => typeof arg !== 'string')
+    || !Number.isSafeInteger(check.timeoutMs) || check.timeoutMs < 1) throw new Error('Invalid frozen check')
+  return new Promise((resolveCheck, reject) => {
+    const child = spawn(check.executable, check.args, {
+      cwd: process.cwd(), shell: false, detached: false, uid: 65534, gid: 65534,
+      env: { PATH: process.env.PATH }, stdio: ['ignore', 'inherit', 'inherit'],
+    })
+    let timedOut = false
+    const timer = setTimeout(() => {
+      timedOut = true
+      process.kill(-process.pid, 'SIGKILL')
+    }, check.timeoutMs)
+    child.once('error', (error) => { clearTimeout(timer); reject(error) })
+    child.once('close', (exitCode, signal) => {
+      clearTimeout(timer)
+      resolveCheck({ checkId: check.id, exitCode, signal, timedOut })
+    })
+  })
+}
+
+const results = []
+for (const check of manifest.checks) results.push(await executeCheck(check))
+const complete = new Set(results.map((result) => result.checkId)).size === manifest.checks.length
+const passed = complete && results.every((result) => result.exitCode === 0 && result.signal === null && !result.timedOut)
+process.stdout.write(JSON.stringify({ schemaVersion: 'brain.trusted-check-results/1.0', results, passed }) + '\n')
+process.exitCode = passed ? 0 : 1
+`
+
+export function canonicalBrainRunnerJson(value) {
+  if (value === null || typeof value === 'string' || typeof value === 'boolean') return JSON.stringify(value)
+  if (typeof value === 'number' && Number.isFinite(value)) return JSON.stringify(value)
+  if (Array.isArray(value)) return '[' + value.map(canonicalBrainRunnerJson).join(',') + ']'
+  if (!value || typeof value !== 'object') throw new Error('Brain runner value must be JSON')
+  return '{' + Object.keys(value).sort().map((key) => JSON.stringify(key) + ':' + canonicalBrainRunnerJson(value[key])).join(',') + '}'
+}
+
+export function brainRunnerBytesSha256(bytes) {
+  return createHash('sha256').update(bytes).digest('hex')
+}
+
+export function brainRunnerContext(userId, plan, report, frozenAt, reportDigest, reportedAt) {
+  const files = [...report.files].sort((left, right) => left.path < right.path ? -1 : 1)
+  if (files.some((file) => file.path.startsWith('.aimlock/brain-validation/'))) throw new Error('Brain runner control paths are reserved')
+  return {
+    schemaVersion: BRAIN_RUNNER_CONTEXT_SCHEMA, memberId: brainRunnerBytesSha256(userId).slice(0, 32),
+    chainId: 'chn-' + report.reportId, validationRunId: 'brain-' + report.reportId,
+    planId: plan.planId, reportId: report.reportId, planDigest: validatorReceiptSubject(plan), reportDigest,
+    checks: plan.checks, files, frozenAt, reportedAt,
+    scopeContractSha256: validatorReceiptSubject(plan.contract), snapshotSha256: validatorReceiptSubject(plan.targets),
+  }
+}
+
+export function brainRunnerManifest(context) {
+  return {
+    schemaVersion: 'brain.trusted-checks/1.0', planId: context.planId, reportId: context.reportId,
+    planDigest: context.planDigest, reportDigest: context.reportDigest, checks: context.checks,
+  }
+}
+
+export function brainRunnerControlFiles(context) {
+  return [
+    { path: BRAIN_RUNNER_ADAPTER_PATH, content: BRAIN_RUNNER_ADAPTER_SOURCE },
+    { path: '.aimlock/brain-validation/' + context.reportId + '/checks.json', content: canonicalBrainRunnerJson(brainRunnerManifest(context)) },
+  ]
+}
+
+export function buildBrainRunnerPlan(context, engine) {
+  if (context.schemaVersion !== BRAIN_RUNNER_CONTEXT_SCHEMA) throw new Error('A server frozen Brain runner context is required')
+  if (typeof engine.executable !== 'string' || !isAbsolute(engine.executable) || basename(engine.executable) !== 'node'
+    || !SHA256.test(engine.executableSha256) || typeof engine.path !== 'string' || engine.path.length === 0) {
+    throw new Error('An approved Node executable, hash, and explicit PATH are required')
+  }
+  const controls = brainRunnerControlFiles(context)
+  const manifestPath = controls[1].path
+  const files = [...context.files, ...controls.map((file) => ({ path: file.path, sha256: brainRunnerBytesSha256(file.content) }))]
+    .sort((left, right) => left.path < right.path ? -1 : 1)
+  const tests = [{ testId: 'brain-all-checks', path: manifestPath }]
+  return {
+    schemaVersion: 'validator.execution-plan/1.0', frozen: true, planId: context.planId,
+    validationRunId: context.validationRunId, memberId: context.memberId, chainId: context.chainId,
+    artifactSha256: validatorArtifactSubject(files), files, tests,
+    policy: { executable: engine.executable, executableSha256: engine.executableSha256,
+      args: [BRAIN_RUNNER_ADAPTER_PATH, manifestPath], environment: { PATH: engine.path },
+      timeoutMs: Math.min(BRAIN_RUNNER_MAX_TIMEOUT_MS,
+        context.checks.reduce((total, check) => total + check.timeoutMs, BRAIN_RUNNER_OVERHEAD_MS)),
+      maxOutputBytes: BRAIN_RUNNER_MAX_OUTPUT_BYTES, requiredExitCode: 0 },
+    goldenBaseline: { schemaVersion: 'validator.golden-baseline/1.0', baselineId: 'brain-' + context.planId,
+      source: { kind: 'approved-record', locator: 'brain-plan:' + context.planId, digestSha256: context.planDigest },
+      version: '1.0', frozen: true, frozenAt: context.frozenAt, frozenBy: 'brain-planning-server',
+      testsSha256: validatorReceiptSubject(tests) },
+    contracts: { brain: { schemaVersion: BRAIN_RUNNER_CONTRACT_SCHEMA,
+      planId: context.planId, planSha256: context.planDigest, reportId: context.reportId, reportSha256: context.reportDigest,
+      checksSha256: validatorReceiptSubject(context.checks), scopeContractSha256: context.scopeContractSha256,
+      snapshotSha256: context.snapshotSha256, adapterSha256: brainRunnerBytesSha256(BRAIN_RUNNER_ADAPTER_SOURCE) } },
+  }
+}
+
+export function assertBrainRunnerSubmission(context, executionPlan, subject) {
+  if (!executionPlan || typeof executionPlan !== 'object' || !executionPlan.policy || typeof executionPlan.policy !== 'object') {
+    throw new Error('A frozen runner execution plan is required')
+  }
+  const policy = executionPlan.policy
+  const expected = buildBrainRunnerPlan(context, {
+    executable: policy.executable, executableSha256: policy.executableSha256, path: policy.environment?.PATH,
+  })
+  if (canonicalBrainRunnerJson(expected) !== canonicalBrainRunnerJson(executionPlan)) {
+    throw new Error('Runner plan does not execute the complete frozen Brain checks')
+  }
+  if (!subject || typeof subject !== 'object' || typeof subject.executedAt !== 'string'
+    || !Number.isFinite(Date.parse(subject.executedAt)) || Date.parse(subject.executedAt) < Date.parse(context.reportedAt)) {
+    throw new Error('Runner execution must follow the frozen Brain report')
+  }
+  const expectedSubject = {
+    schemaVersion: 'validator.validation-subject/1.0', artifactSha256: expected.artifactSha256,
+    memberId: expected.memberId, chainId: expected.chainId, executedAt: subject.executedAt, files: expected.files,
+    validationRunId: expected.validationRunId, planId: expected.planId, tests: expected.tests,
+    policy: { command: [policy.executable, ...policy.args].map((part) => JSON.stringify(part)).join(' '),
+      requiredExitCode: 0, executionPlanSha256: brainRunnerBytesSha256(canonicalBrainRunnerJson(expected)) },
+    goldenBaseline: expected.goldenBaseline, contracts: expected.contracts,
+  }
+  if (canonicalBrainRunnerJson(expectedSubject) !== canonicalBrainRunnerJson(subject)) {
+    throw new Error('Signed runner subject does not match the member, plan, report, artifact, and checks')
+  }
+  return expectedSubject
+}

package/brain-validator-plan.mjs

@@ -0,0 +1,92 @@
+import { constants } from 'node:fs'
+import { lstat, mkdir, open, readFile, realpath } from 'node:fs/promises'
+import { resolve } from 'node:path'
+import { readRegularFile } from './validator-runner-plan.mjs'
+import { runApprovedValidatorPlan } from './validator-local-runner.mjs'
+import {
+  assertBrainRunnerSubmission, brainRunnerBytesSha256, brainRunnerControlFiles,
+  buildBrainRunnerPlan, canonicalBrainRunnerJson,
+} from './brain-validator-contract.mjs'
+
+async function checkedProjectPath(root, relativePath, createParents) {
+  if (typeof relativePath !== 'string' || relativePath.startsWith('/') || relativePath.includes('\\')
+    || relativePath.split('/').some((part) => !part || part === '.' || part === '..')) throw new Error('Invalid runner project path')
+  let directory = root
+  const parts = relativePath.split('/')
+  for (const part of parts.slice(0, -1)) {
+    directory = resolve(directory, part)
+    if (createParents) {
+      try { await mkdir(directory, { mode: 0o700 }) }
+      catch (error) { if (!error || typeof error !== 'object' || error.code !== 'EEXIST') throw error }
+    }
+    const status = await lstat(directory)
+    if (!status.isDirectory() || status.isSymbolicLink()) throw new Error('Runner paths cannot traverse symlinks')
+  }
+  return resolve(directory, parts[parts.length - 1])
+}
+
+async function writeFrozenControl(root, relativePath, content) {
+  const path = await checkedProjectPath(root, relativePath, true)
+  let handle
+  try { handle = await open(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600) }
+  catch (error) {
+    if (!error || typeof error !== 'object' || error.code !== 'EEXIST') throw error
+    const existing = await readRegularFile(path, 1_048_576, true)
+    if (existing.sha256 !== brainRunnerBytesSha256(content)) throw new Error('A frozen runner control file already has different content')
+    return path
+  }
+  try { await handle.writeFile(content) } finally { await handle.close() }
+  return path
+}
+
+export async function prepareBrainValidation(repositoryRoot, reportResponse, environment = process.env) {
+  if (reportResponse.status !== 'reported' || !reportResponse.report || reportResponse.report.checksPassed !== true
+    || !reportResponse.report.validationContext) throw new Error('A complete successful Brain report is required')
+  if (typeof environment.PATH !== 'string' || !environment.PATH) throw new Error('An explicit PATH is required')
+  const rootStatus = await lstat(repositoryRoot)
+  if (!rootStatus.isDirectory() || rootStatus.isSymbolicLink()) throw new Error('Runner workspace must be a real directory')
+  const root = await realpath(repositoryRoot)
+  const context = reportResponse.report.validationContext
+  if (context.planId !== reportResponse.planId || context.reportDigest !== reportResponse.reportDigest) {
+    throw new Error('Brain report identity does not match its runner context')
+  }
+  for (const file of context.files) {
+    const actual = await readRegularFile(await checkedProjectPath(root, file.path, false), 16_777_216, false)
+    if (actual.sha256 !== file.sha256) throw new Error('Reported project file changed before validation: ' + file.path)
+  }
+  for (const file of brainRunnerControlFiles(context)) await writeFrozenControl(root, file.path, file.content)
+  const executable = await realpath(process.execPath)
+  const executionPlan = buildBrainRunnerPlan(context, {
+    executable, executableSha256: brainRunnerBytesSha256(await readFile(executable)), path: environment.PATH,
+  })
+  const planPath = '.aimlock/brain-validation/' + context.reportId + '/execution-plan.json'
+  const planContent = canonicalBrainRunnerJson(executionPlan)
+  await writeFrozenControl(root, planPath, planContent)
+  return { repositoryRoot: root, planPath, executionPlan, planSha256: brainRunnerBytesSha256(planContent), context }
+}
+
+export async function runBrainApprovedValidation(repositoryRoot, input, environment = process.env) {
+  if (typeof input.approvalPath !== 'string' || typeof input.signerConfigPath !== 'string') {
+    throw new Error('An external approved runner authority and signer configuration are required')
+  }
+  const prepared = await prepareBrainValidation(repositoryRoot, input.reportResponse, environment)
+  const execution = await runApprovedValidatorPlan({
+    repositoryRoot: prepared.repositoryRoot, planPath: prepared.planPath,
+    approvalPath: input.approvalPath, signerConfigPath: input.signerConfigPath,
+  })
+  if (execution.status !== 'succeeded' || !execution.receipt) throw new Error('All Brain checks require a successful trusted runner receipt')
+  const subject = assertBrainRunnerSubmission(prepared.context, prepared.executionPlan, execution.subject)
+  return { planId: prepared.context.planId, reportDigest: prepared.context.reportDigest,
+    executionPlan: prepared.executionPlan, subject, receipts: [execution.receipt] }
+}
+
+export async function runBrainValidatorCli(args) {
+  if (args.length !== 3 || !['prepare', 'run'].includes(args[0])) {
+    throw new Error('Usage: cli-validator brain <prepare|run> <repositoryRoot> <inputJsonFile>')
+  }
+  const inputFile = await readRegularFile(resolve(args[2]), 256_000, false)
+  const input = JSON.parse(inputFile.bytes.toString('utf8'))
+  const output = args[0] === 'prepare' ? await prepareBrainValidation(resolve(args[1]), input)
+    : await runBrainApprovedValidation(resolve(args[1]), input)
+  process.stdout.write(JSON.stringify(output, null, 2) + '\n')
+}

package/cli.mjs

@@ -1,7 +1,9 @@
 #!/usr/bin/env node
+import { runBrainValidatorCli } from './brain-validator-plan.mjs'
 import { dirname } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { dispatchOfficialSkillCli, runIntakeHandshake } from './installer.mjs'
+import { runValidatorLocalCli } from './validator-local-cli.mjs'
 
 const INTAKE_QUESTIONS = [
   { id: 'goal', prompt: 'What is being validated? Describe the deliverable and expected behavior.', required: true, example: '电商运营仪表盘计算工具：输入访客数/订单数/GMV/广告费，输出转化率/客单价/ROAS。' },
@@ -10,8 +12,11 @@ const INTAKE_QUESTIONS = [
   { id: 'targetFiles', prompt: 'Files to validate (or "auto" to scan all).', required: false, example: 'auto' },
 ]
 
-await dispatchOfficialSkillCli({
+if (process.argv[2] === 'brain') await runBrainValidatorCli(process.argv.slice(3))
+else if (process.argv[2] === 'local') await runValidatorLocalCli(process.argv.slice(3))
+else await dispatchOfficialSkillCli({
   packageRoot: dirname(fileURLToPath(import.meta.url)),
+  extraUsageLines: ['  cli-validator brain prepare <repositoryRoot> <reportResponse.json>', '  cli-validator brain run <repositoryRoot> <runnerInput.json>', '  cli-validator local capabilities', '  cli-validator local run-approved-plan < runner-input.json'],
   runCommand: (context) => runIntakeHandshake(context, {
     questions: INTAKE_QUESTIONS,
     outputFile: 'VALIDATOR-REQUIREMENTS.json',

package/package.json

@@ -3,13 +3,29 @@
     "cli-validator": "./cli.mjs"
   },
   "description": "Validator skill installer for CLI.Tax: delivery quality gate with three defense lines and golden baseline testing.",
+  "exports": {
+    "./local-runner": "./validator-local-runner.mjs",
+    "./runner-plan": "./validator-runner-plan.mjs",
+    "./runtime": "./validator-runtime.mjs",
+    "./brain-contract": "./brain-validator-contract.mjs",
+    "./brain-runner": "./brain-validator-plan.mjs"
+  },
   "files": [
     "cli.mjs",
     "installer.mjs",
     "broker.mjs",
     "README.md",
     "skill/SKILL.md",
-    "skill/skill.json"
+    "skill/skill.json",
+    "validator-runner-plan.mjs",
+    "validator-local-runner.mjs",
+    "validator-local-cli.mjs",
+    "validator-runtime.mjs",
+    "validator-compliance.mjs",
+    "brain-validator-contract.mjs",
+    "brain-validator-contract.d.mts",
+    "brain-validator-plan.mjs",
+    "validator-brain-contract.mjs"
   ],
   "license": "UNLICENSED",
   "name": "cli-validator",
@@ -18,5 +34,5 @@
     "url": "https://github.com/88208555/Validator-clitax.git"
   },
   "type": "module",
-  "version": "7.0.33"
+  "version": "7.0.35"
 }

package/skill/SKILL.md

@@ -5,7 +5,7 @@ description: '交付前质量门禁：三道防线（静态/动态/对抗）递
 
 # Validator
 
-Package version: v7.0.33
+Package version: v7.0.35
 
 Validator 是技能链最后一站，只消费冻结目标和真实执行证据；模型解释没有裁判权。
 
@@ -107,3 +107,15 @@ GoldenBaseline 只有 `frozen: true` 才有效。来源只允许 `repository-com
 - 本地 CLI 不提供手工评分或评语提交命令，人类不得选择技能分数或填写技能评价；日常聊天不属于评价协议。
 
 调用示例：`npx cli-validator@latest invoke <operation> '<JSON对象>'`。IDE 集成可向 `npx cli-validator@latest broker` 的 stdin 发送 `{"operation":"capabilities","input":{}}`。
+
+## 本地受限执行器
+
+先运行 `cli-validator local capabilities` 读取输入合同与限额，再以 JSON stdin 调用 `cli-validator local run-approved-plan`。输入必须完整包含 `repositoryRoot`（绝对目录）、`planPath`（工作区相对路径）、`approvalPath`（外部绝对路径）与 `signerConfigPath`（外部绝对路径或显式 null）。
+
+冻结计划采用 `validator.execution-plan/1.0`：frozen=true，planId/validationRunId/memberId/chainId，排序且唯一的 files[{path,sha256}] 与 artifactSha256，tests[{testId,path}]，GoldenBaseline 与 Aimlock 合同。policy 明确 executable（绝对真实文件）及 executableSha256、args、environment 字符串字典、timeoutMs、maxOutputBytes、requiredExitCode=0。每个测试文件必须列入 manifest 并作为真实命令参数传入；组合测试可使用受审计的入口脚本，不能把未执行文件假报为测试。执行前后校验产物、计划、可执行文件与外部授权。
+
+外部授权为 `validator.runner-approval/1.0`，包含 repositoryRoot、planSha256（冻结计划文件原始字节 SHA-256）、approvedBy、approvedAt、expiresAt，最长 24 小时。文件必须归执行账户所有、0600、非符号链接且位于被测工作区之外。它记录外部批准；智能体不得伪造批准或用测试 fixture 授权真实工作。
+
+未配置 signer 时只返回 local TestEvidence，独立终审仍为 incomplete。可选 `validator.runner-signer/1.0` 配置包含外置 privateKeyPath、keyId（Ed25519 SPKI DER SHA-256）、receiptTtlMs（最长 10 分钟）；配置和私钥同样必须为外部 0600 文件。签名绑定 subject、退出结果与日志指纹，消费方使用已配置公钥核验。密钥配置不是进程隔离：同 UID 子进程可能读取同账户文件，生产可信服务仍须独立 UID/容器及权限隔离；本工具不自动部署隔离、不创建可信密钥，也不改变验证器的信任配置。
+
+本地运行仅支持 POSIX；无 shell、显式子进程环境、受限输出与时限。信号终止保留 exitCode=null，不制造整数退出码或成功 receipt。超时、输出超限、非零退出或运行中完整性变化均失败；原始执行记录与日志摘要可审计。此进程执行器不是 OS 沙箱，不授予任意磁盘或网络访问。

package/skill/skill.json

@@ -5,6 +5,6 @@
   "method": "POST",
   "name": "validator",
   "type": "Skill",
-  "version": "v7.0.33",
+  "version": "v7.0.35",
   "schemaVersion": "validator.skill.request/1.0"
 }

package/validator-brain-contract.mjs

@@ -0,0 +1,47 @@
+const SHA_PATTERN = '^[0-9a-f]{64}$'
+const UUID_PATTERN = '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'
+const SHA = new RegExp(SHA_PATTERN)
+const UUID = new RegExp(UUID_PATTERN)
+const FIELDS = ['schemaVersion', 'planId', 'planSha256', 'reportId', 'reportSha256',
+  'checksSha256', 'scopeContractSha256', 'snapshotSha256', 'adapterSha256']
+
+export const brainRunnerContractSchema = {
+  type: 'object', additionalProperties: false, required: FIELDS,
+  properties: {
+    schemaVersion: { const: 'brain.frozen-runner/1.0' },
+    planId: { type: 'string', pattern: UUID_PATTERN }, reportId: { type: 'string', pattern: UUID_PATTERN },
+    ...Object.fromEntries(FIELDS.filter((field) => field.endsWith('Sha256'))
+      .map((field) => [field, { type: 'string', pattern: SHA_PATTERN }])),
+  },
+}
+
+export function validBrainRunnerContract(value, subject) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)
+    || Object.keys(value).sort().join('|') !== [...FIELDS].sort().join('|')
+    || value.schemaVersion !== 'brain.frozen-runner/1.0'
+    || !UUID.test(value.planId) || !UUID.test(value.reportId)
+    || value.planId !== subject.planId || subject.chainId !== 'chn-' + value.reportId
+    || subject.validationRunId !== 'brain-' + value.reportId) return false
+  return FIELDS.filter((field) => field.endsWith('Sha256')).every((field) => typeof value[field] === 'string' && SHA.test(value[field]))
+}
+
+export function validateBridgeContracts(value, entityRef, hardened, utilities) {
+  const { isObj, text, idRegex, shaRegex, finding } = utilities
+  const findings = []
+  if (hardened && (!isObj(value.contracts) || (!isObj(value.contracts.aimlock)
+    && !validBrainRunnerContract(value.contracts.brain, value)))) findings.push(finding("P0", "VALIDATION-SUBJECT-SNAPSHOT", `${entityRef}.contracts`, "Hardened validation requires an Aimlock snapshot or server frozen Brain contract binding"));
+  if (value.contracts?.brain !== undefined && !validBrainRunnerContract(value.contracts.brain, value)) findings.push(finding("P0", "VALIDATION-SUBJECT-BRAIN", `${entityRef}.contracts.brain`, "Brain runner contract is invalid or bound to another execution"));
+  if (value.contracts !== undefined && (!isObj(value.contracts)
+    || (value.contracts.aimlock !== undefined && (!isObj(value.contracts.aimlock)
+      || !idRegex.test(text(value.contracts.aimlock.goalId))
+      || !shaRegex.test(text(value.contracts.aimlock.scopeContractSha256))
+      || !shaRegex.test(text(value.contracts.aimlock.snapshotSha256))))
+    || (value.contracts.blueprint !== undefined && (!isObj(value.contracts.blueprint)
+      || !idRegex.test(text(value.contracts.blueprint.blueprintId))
+      || !shaRegex.test(text(value.contracts.blueprint.acceptanceReportSha256))))
+    || (value.contracts.archguard !== undefined && (!isObj(value.contracts.archguard)
+      || !shaRegex.test(text(value.contracts.archguard.contractSha256))
+      || !shaRegex.test(text(value.contracts.archguard.ledgerSha256))
+      || !["green", "yellow", "red"].includes(value.contracts.archguard.driftStatus))))) findings.push(finding("P0", "VALIDATION-SUBJECT-CONTRACTS", `${entityRef}.contracts`, "Aimlock, Blueprint, and ArchGuard bridge contracts require stable ids, SHA-256 digests, and a valid drift status"));
+  return findings
+}

package/validator-compliance.mjs

@@ -0,0 +1,158 @@
+const PUBLIC_BIND_ADDRESSES = new Set(['0.0.0.0', '::', '[::]', '0:0:0:0:0:0:0:0'])
+const BIND_OPTION = /^(?:host|hostname|bind|bindhost|bindaddress|listenhost|listenaddress)$/i
+const BIND_METHODS = new Set(['listen', 'bind'])
+const SCRIPT_EXTENSION = /\.(?:[cm]?[jt]sx?)$/i
+
+function decodeHostLiteral(value) {
+  return value.replace(/\\(?:u\{([0-9a-f]+)\}|u([0-9a-f]{4})|x([0-9a-f]{2})|(.))/gi,
+    (match, point, unicode, byte, character) => {
+      const digits = point ?? unicode ?? byte
+      if (digits === undefined) return character
+      const code = parseInt(digits, 16)
+      return code <= 0x10ffff ? String.fromCodePoint(code) : match
+    })
+}
+
+function quotedToken(source, start) {
+  const quote = source[start]
+  let end = start + 1
+  while (end < source.length) {
+    if (source[end] === '\\') { end += 2; continue }
+    if (source[end] === quote) {
+      return { kind: 'literal', value: decodeHostLiteral(source.slice(start + 1, end)), start, end: end + 1 }
+    }
+    end += 1
+  }
+  return { kind: 'invalid', value: source.slice(start), start, end: source.length }
+}
+
+function templateTokens(source, start) {
+  const tokens = []
+  let index = start + 1
+  while (index < source.length) {
+    if (source[index] === '\\') { index += 2; continue }
+    if (source[index] === '`') {
+      if (tokens.length === 0) tokens.push(quotedToken(source, start))
+      return { tokens, end: index + 1 }
+    }
+    if (source[index] === '$' && source[index + 1] === '{') {
+      const expression = codeTokens(source, index + 2, true)
+      tokens.push(...expression.tokens)
+      index = expression.end
+      continue
+    }
+    index += 1
+  }
+  return { tokens, end: source.length }
+}
+
+function codeTokens(source, start = 0, templateExpression = false) {
+  const tokens = []
+  let depth = 0
+  for (let index = start; index < source.length;) {
+    const tail = source.slice(index)
+    const ignored = tail.match(/^(?:\s+|\/\/[^\n]*|\/\*[\s\S]*?(?:\*\/|$))/)
+    if (ignored) { index += ignored[0].length; continue }
+    if (source[index] === '`') {
+      const template = templateTokens(source, index)
+      tokens.push(...template.tokens)
+      index = template.end
+      continue
+    }
+    if (['"', "'"].includes(source[index])) {
+      const token = quotedToken(source, index)
+      tokens.push(token)
+      index = token.end
+      continue
+    }
+    if (source[index] === '}' && templateExpression && depth === 0) return { tokens, end: index + 1 }
+    if (source[index] === '{') depth += 1
+    if (source[index] === '}') depth -= 1
+    const word = tail.match(/^[A-Za-z_$][\w$]*/)
+    const value = word === null ? source[index] : word[0]
+    tokens.push({ kind: word === null ? 'symbol' : 'word', value, start: index, end: index + value.length })
+    index += value.length
+  }
+  return { tokens, end: source.length }
+}
+
+function bindHost(token, aliases) {
+  if (token === undefined) return false
+  return token.kind === 'literal' ? PUBLIC_BIND_ADDRESSES.has(token.value)
+    : token.kind === 'word' && aliases.has(token.value)
+}
+
+function publicAliases(tokens) {
+  const aliases = new Set()
+  let changed = true
+  while (changed) {
+    changed = false
+    for (let index = 0; index < tokens.length - 2; index += 1) {
+      const token = tokens[index]
+      if (token.kind === 'word' && tokens[index + 1].value === '='
+        && bindHost(tokens[index + 2], aliases) && !aliases.has(token.value)) {
+        aliases.add(token.value)
+        changed = true
+      }
+    }
+  }
+  return aliases
+}
+
+function callArguments(tokens, opening) {
+  const args = [[]]
+  let depth = 0
+  for (let index = opening + 1; index < tokens.length; index += 1) {
+    const token = tokens[index]
+    if (token.value === ')' && depth === 0) return args
+    if (token.value === ',' && depth === 0) { args.push([]); continue }
+    args[args.length - 1].push(token)
+    if (['(', '[', '{'].includes(token.value)) depth += 1
+    if ([')', ']', '}'].includes(token.value)) depth -= 1
+  }
+  return []
+}
+
+function scriptBindSites(source) {
+  const { tokens } = codeTokens(source)
+  const aliases = publicAliases(tokens)
+  const sites = []
+  for (let index = 0; index < tokens.length; index += 1) {
+    const token = tokens[index]
+    const normalized = token.value.replaceAll('_', '').replaceAll('-', '')
+    if (BIND_OPTION.test(normalized) && [':', '='].includes(tokens[index + 1]?.value)
+      && bindHost(tokens[index + 2], aliases)) {
+      sites.push({ offset: token.start, context: 'bind-option', address: tokens[index + 2].value })
+    }
+    if (!BIND_METHODS.has(token.value)) continue
+    let opening = index + 1
+    if (tokens[index - 1]?.value === '[' && tokens[opening]?.value === ']') opening += 1
+    if (tokens[opening]?.value === '?' && tokens[opening + 1]?.value === '.') opening += 2
+    if (tokens[opening]?.value !== '(') continue
+    const args = callArguments(tokens, opening)
+    const hosts = token.value === 'bind' ? args.slice(0, 2).flat() : args[1]
+    if (hosts === undefined) continue
+    const publicHost = hosts.find((candidate) => bindHost(candidate, aliases))
+    if (publicHost) sites.push({ offset: token.start, context: `${token.value}-argument`, address: publicHost.value })
+  }
+  return sites
+}
+
+function configurationBindSites(source) {
+  const sites = []
+  const pattern = /(?:\b(?:host|hostname|bind(?:[_-]?(?:host|address))?|listen(?:[_-]?(?:host|address))?)\b["']?\s*(?:[:=]\s*|\s+)|--(?:host|bind|listen)(?:=|\s+))["']?(0\.0\.0\.0|\[::\]|::)(?=["'\s:;,]|$)/gi
+  for (const match of source.matchAll(pattern)) {
+    const lineStart = source.lastIndexOf('\n', match.index) + 1
+    if (/^\s*(?:#|\/\/)/.test(source.slice(lineStart, match.index))) continue
+    sites.push({ offset: match.index, context: 'bind-configuration', address: match[1] })
+  }
+  return sites
+}
+
+/** Inspect bind sinks and host configuration; address lists and outbound targets are not listeners. */
+export function publicBindSites(path, source) {
+  const sites = SCRIPT_EXTENSION.test(path) ? scriptBindSites(source) : configurationBindSites(source)
+  return sites.map((site) => ({
+    ...site, line: source.slice(0, site.offset).split('\n').length,
+  }))
+}