cli-validator 7.0.34 → 7.0.35

package/README.md

@@ -36,3 +36,40 @@ Brain Client 服务端在同一次 runtime 请求的事务中绑定真实响应
 未配置 signer 时只返回 local TestEvidence，独立终审仍为 incomplete。可选 `validator.runner-signer/1.0` 配置包含外置 privateKeyPath、keyId（Ed25519 SPKI DER SHA-256）、receiptTtlMs（最长 10 分钟）；配置和私钥同样必须为外部 0600 文件。签名绑定 subject、退出结果与日志指纹，消费方使用已配置公钥核验。密钥配置不是进程隔离：同 UID 子进程可能读取同账户文件，生产可信服务仍须独立 UID/容器及权限隔离；本工具不自动部署隔离、不创建可信密钥，也不改变验证器的信任配置。
 
 本地运行仅支持 POSIX；无 shell、显式子进程环境、受限输出与时限。信号终止保留 exitCode=null，不制造整数退出码或成功 receipt。超时、输出超限、非零退出或运行中完整性变化均失败；原始执行记录与日志摘要可审计。此进程执行器不是 OS 沙箱，不授予任意磁盘或网络访问。
+
+## Brain planning verification
+
+IDE execution reports remain `reported` until a trusted runner verifies them. To prepare an execution plan from the server's complete report response:
+
+```sh
+cli-validator brain prepare /absolute/trusted-workspace report-response.json > prepared-runner.json
+```
+
+The trusted operator supplies the existing external, mode-0600 runner approval and signer configuration. The approval binds the exact `planSha256` printed by preparation. The runner input contains `reportResponse`, `approvalPath`, and `signerConfigPath`.
+
+```sh
+cli-validator brain run /absolute/trusted-workspace brain-runner-input.json > brain-validation.json
+cli-aimlock brain validate /absolute/ide-workspace brain-validation.json
+```
+
+Run this on a dedicated isolated runner, never on the production application host. Brain verification requires a privileged supervisor and executes the frozen checks as UID/GID 65534. The signing key, approved Node executable and runner controls remain protected and root owned. Frozen control files must be regular mode-0600 files; control directories must not be writable by the check process. Provide writable build-output directories separately when a check needs them. A Linux container supervisor needs SETUID, SETGID and KILL capabilities for identity separation and process-group cleanup. Do not mount a host Docker socket or production secrets.
+
+The fixed adapter executes every frozen check with `shell: false` and an explicit PATH. Its source and complete check manifest are included in the signed file manifest. The supervisor bounds the whole run to five minutes and one MiB of output. A failed, timed-out, modified or incomplete run cannot become `verified`.
+
+The API accepts `planId`, `reportDigest`, `executionPlan`, the runner's real `subject`, and `receipts`. It reconstructs and compares the member, plan, report, complete checks, files, adapter, frozen contract and policy before validating the signature. The server uses only the configured `CLITAX_VALIDATOR_RECEIPT_PUBLIC_KEY`, an Ed25519 SPKI DER public key encoded as base64. Test fixture keys must never be added to production trust.
+
+## Isolated integration verification
+
+The normal server test suite includes protocol, substitution, signature and unprivileged-runner rejection checks. The separate integration test runs real commands in a disposable root-to-unprivileged container:
+
+```sh
+docker run --rm --network none --read-only --cap-drop ALL \
+  --cap-add SETUID --cap-add SETGID --cap-add KILL \
+  --security-opt no-new-privileges --pids-limit 64 --memory 256m --cpus 1 \
+  --tmpfs /tmp:rw,nosuid,size=64m \
+  --mount type=bind,source=/absolute/source,target=/code,readonly \
+  --workdir /code node:24-alpine \
+  node --test scripts/brain-validator-isolated-integration.mjs
+```
+
+Use a source fixture containing only the needed first-party modules, not a directory containing environment files or credentials. The fixture generates a temporary signing key inside the disposable container and verifies that the unprivileged checks cannot read it.

package/brain-validator-contract.d.mts

@@ -0,0 +1,9 @@
+export const BRAIN_RUNNER_ADAPTER_SOURCE: string
+export const BRAIN_RUNNER_ADAPTER_PATH: string
+export function brainRunnerContext(userId: string, plan: unknown, report: unknown,
+  frozenAt: string, reportDigest: string, reportedAt: string): Record<string, unknown>
+export function assertBrainRunnerSubmission(context: unknown, executionPlan: unknown,
+  subject: unknown): Record<string, unknown>
+export function buildBrainRunnerPlan(context: unknown, engine: unknown): Record<string, unknown>
+export function canonicalBrainRunnerJson(value: unknown): string
+export function brainRunnerBytesSha256(bytes: string | Buffer): string

package/brain-validator-contract.mjs

@@ -0,0 +1,151 @@
+import { createHash } from 'node:crypto'
+import { basename, isAbsolute } from 'node:path'
+import { validatorArtifactSubject, validatorReceiptSubject } from './validator-runtime.mjs'
+
+export const BRAIN_RUNNER_CONTEXT_SCHEMA = 'brain.runner-context/1.0'
+export const BRAIN_RUNNER_CONTRACT_SCHEMA = 'brain.frozen-runner/1.0'
+export const BRAIN_RUNNER_ADAPTER_PATH = '.aimlock/brain-validation/check-runner.mjs'
+export const BRAIN_RUNNER_MAX_TIMEOUT_MS = 300_000
+export const BRAIN_RUNNER_MAX_OUTPUT_BYTES = 1_048_576
+const BRAIN_RUNNER_OVERHEAD_MS = 5_000
+const SHA256 = /^[0-9a-f]{64}$/
+
+export const BRAIN_RUNNER_ADAPTER_SOURCE = String.raw`import { readFile } from 'node:fs/promises'
+import { spawn } from 'node:child_process'
+import { resolve } from 'node:path'
+
+if (typeof process.getuid !== 'function' || process.getuid() !== 0) throw new Error('Trusted Brain checks require an isolated root runner with a separate unprivileged UID')
+const path = process.argv[2]
+if (process.argv.length !== 3 || typeof path !== 'string') throw new Error('A frozen checks manifest is required')
+const manifest = JSON.parse(await readFile(resolve(path), 'utf8'))
+if (manifest.schemaVersion !== 'brain.trusted-checks/1.0' || !Array.isArray(manifest.checks)
+  || manifest.checks.length === 0 || manifest.checks.length > 16) throw new Error('Invalid frozen checks manifest')
+if (typeof process.env.PATH !== 'string') throw new Error('An explicit executable search path is required')
+
+function executeCheck(check) {
+  if (typeof check.id !== 'string' || typeof check.executable !== 'string'
+    || !Array.isArray(check.args) || check.args.some((arg) => typeof arg !== 'string')
+    || !Number.isSafeInteger(check.timeoutMs) || check.timeoutMs < 1) throw new Error('Invalid frozen check')
+  return new Promise((resolveCheck, reject) => {
+    const child = spawn(check.executable, check.args, {
+      cwd: process.cwd(), shell: false, detached: false, uid: 65534, gid: 65534,
+      env: { PATH: process.env.PATH }, stdio: ['ignore', 'inherit', 'inherit'],
+    })
+    let timedOut = false
+    const timer = setTimeout(() => {
+      timedOut = true
+      process.kill(-process.pid, 'SIGKILL')
+    }, check.timeoutMs)
+    child.once('error', (error) => { clearTimeout(timer); reject(error) })
+    child.once('close', (exitCode, signal) => {
+      clearTimeout(timer)
+      resolveCheck({ checkId: check.id, exitCode, signal, timedOut })
+    })
+  })
+}
+
+const results = []
+for (const check of manifest.checks) results.push(await executeCheck(check))
+const complete = new Set(results.map((result) => result.checkId)).size === manifest.checks.length
+const passed = complete && results.every((result) => result.exitCode === 0 && result.signal === null && !result.timedOut)
+process.stdout.write(JSON.stringify({ schemaVersion: 'brain.trusted-check-results/1.0', results, passed }) + '\n')
+process.exitCode = passed ? 0 : 1
+`
+
+export function canonicalBrainRunnerJson(value) {
+  if (value === null || typeof value === 'string' || typeof value === 'boolean') return JSON.stringify(value)
+  if (typeof value === 'number' && Number.isFinite(value)) return JSON.stringify(value)
+  if (Array.isArray(value)) return '[' + value.map(canonicalBrainRunnerJson).join(',') + ']'
+  if (!value || typeof value !== 'object') throw new Error('Brain runner value must be JSON')
+  return '{' + Object.keys(value).sort().map((key) => JSON.stringify(key) + ':' + canonicalBrainRunnerJson(value[key])).join(',') + '}'
+}
+
+export function brainRunnerBytesSha256(bytes) {
+  return createHash('sha256').update(bytes).digest('hex')
+}
+
+export function brainRunnerContext(userId, plan, report, frozenAt, reportDigest, reportedAt) {
+  const files = [...report.files].sort((left, right) => left.path < right.path ? -1 : 1)
+  if (files.some((file) => file.path.startsWith('.aimlock/brain-validation/'))) throw new Error('Brain runner control paths are reserved')
+  return {
+    schemaVersion: BRAIN_RUNNER_CONTEXT_SCHEMA, memberId: brainRunnerBytesSha256(userId).slice(0, 32),
+    chainId: 'chn-' + report.reportId, validationRunId: 'brain-' + report.reportId,
+    planId: plan.planId, reportId: report.reportId, planDigest: validatorReceiptSubject(plan), reportDigest,
+    checks: plan.checks, files, frozenAt, reportedAt,
+    scopeContractSha256: validatorReceiptSubject(plan.contract), snapshotSha256: validatorReceiptSubject(plan.targets),
+  }
+}
+
+export function brainRunnerManifest(context) {
+  return {
+    schemaVersion: 'brain.trusted-checks/1.0', planId: context.planId, reportId: context.reportId,
+    planDigest: context.planDigest, reportDigest: context.reportDigest, checks: context.checks,
+  }
+}
+
+export function brainRunnerControlFiles(context) {
+  return [
+    { path: BRAIN_RUNNER_ADAPTER_PATH, content: BRAIN_RUNNER_ADAPTER_SOURCE },
+    { path: '.aimlock/brain-validation/' + context.reportId + '/checks.json', content: canonicalBrainRunnerJson(brainRunnerManifest(context)) },
+  ]
+}
+
+export function buildBrainRunnerPlan(context, engine) {
+  if (context.schemaVersion !== BRAIN_RUNNER_CONTEXT_SCHEMA) throw new Error('A server frozen Brain runner context is required')
+  if (typeof engine.executable !== 'string' || !isAbsolute(engine.executable) || basename(engine.executable) !== 'node'
+    || !SHA256.test(engine.executableSha256) || typeof engine.path !== 'string' || engine.path.length === 0) {
+    throw new Error('An approved Node executable, hash, and explicit PATH are required')
+  }
+  const controls = brainRunnerControlFiles(context)
+  const manifestPath = controls[1].path
+  const files = [...context.files, ...controls.map((file) => ({ path: file.path, sha256: brainRunnerBytesSha256(file.content) }))]
+    .sort((left, right) => left.path < right.path ? -1 : 1)
+  const tests = [{ testId: 'brain-all-checks', path: manifestPath }]
+  return {
+    schemaVersion: 'validator.execution-plan/1.0', frozen: true, planId: context.planId,
+    validationRunId: context.validationRunId, memberId: context.memberId, chainId: context.chainId,
+    artifactSha256: validatorArtifactSubject(files), files, tests,
+    policy: { executable: engine.executable, executableSha256: engine.executableSha256,
+      args: [BRAIN_RUNNER_ADAPTER_PATH, manifestPath], environment: { PATH: engine.path },
+      timeoutMs: Math.min(BRAIN_RUNNER_MAX_TIMEOUT_MS,
+        context.checks.reduce((total, check) => total + check.timeoutMs, BRAIN_RUNNER_OVERHEAD_MS)),
+      maxOutputBytes: BRAIN_RUNNER_MAX_OUTPUT_BYTES, requiredExitCode: 0 },
+    goldenBaseline: { schemaVersion: 'validator.golden-baseline/1.0', baselineId: 'brain-' + context.planId,
+      source: { kind: 'approved-record', locator: 'brain-plan:' + context.planId, digestSha256: context.planDigest },
+      version: '1.0', frozen: true, frozenAt: context.frozenAt, frozenBy: 'brain-planning-server',
+      testsSha256: validatorReceiptSubject(tests) },
+    contracts: { brain: { schemaVersion: BRAIN_RUNNER_CONTRACT_SCHEMA,
+      planId: context.planId, planSha256: context.planDigest, reportId: context.reportId, reportSha256: context.reportDigest,
+      checksSha256: validatorReceiptSubject(context.checks), scopeContractSha256: context.scopeContractSha256,
+      snapshotSha256: context.snapshotSha256, adapterSha256: brainRunnerBytesSha256(BRAIN_RUNNER_ADAPTER_SOURCE) } },
+  }
+}
+
+export function assertBrainRunnerSubmission(context, executionPlan, subject) {
+  if (!executionPlan || typeof executionPlan !== 'object' || !executionPlan.policy || typeof executionPlan.policy !== 'object') {
+    throw new Error('A frozen runner execution plan is required')
+  }
+  const policy = executionPlan.policy
+  const expected = buildBrainRunnerPlan(context, {
+    executable: policy.executable, executableSha256: policy.executableSha256, path: policy.environment?.PATH,
+  })
+  if (canonicalBrainRunnerJson(expected) !== canonicalBrainRunnerJson(executionPlan)) {
+    throw new Error('Runner plan does not execute the complete frozen Brain checks')
+  }
+  if (!subject || typeof subject !== 'object' || typeof subject.executedAt !== 'string'
+    || !Number.isFinite(Date.parse(subject.executedAt)) || Date.parse(subject.executedAt) < Date.parse(context.reportedAt)) {
+    throw new Error('Runner execution must follow the frozen Brain report')
+  }
+  const expectedSubject = {
+    schemaVersion: 'validator.validation-subject/1.0', artifactSha256: expected.artifactSha256,
+    memberId: expected.memberId, chainId: expected.chainId, executedAt: subject.executedAt, files: expected.files,
+    validationRunId: expected.validationRunId, planId: expected.planId, tests: expected.tests,
+    policy: { command: [policy.executable, ...policy.args].map((part) => JSON.stringify(part)).join(' '),
+      requiredExitCode: 0, executionPlanSha256: brainRunnerBytesSha256(canonicalBrainRunnerJson(expected)) },
+    goldenBaseline: expected.goldenBaseline, contracts: expected.contracts,
+  }
+  if (canonicalBrainRunnerJson(expectedSubject) !== canonicalBrainRunnerJson(subject)) {
+    throw new Error('Signed runner subject does not match the member, plan, report, artifact, and checks')
+  }
+  return expectedSubject
+}

package/brain-validator-plan.mjs

@@ -0,0 +1,92 @@
+import { constants } from 'node:fs'
+import { lstat, mkdir, open, readFile, realpath } from 'node:fs/promises'
+import { resolve } from 'node:path'
+import { readRegularFile } from './validator-runner-plan.mjs'
+import { runApprovedValidatorPlan } from './validator-local-runner.mjs'
+import {
+  assertBrainRunnerSubmission, brainRunnerBytesSha256, brainRunnerControlFiles,
+  buildBrainRunnerPlan, canonicalBrainRunnerJson,
+} from './brain-validator-contract.mjs'
+
+async function checkedProjectPath(root, relativePath, createParents) {
+  if (typeof relativePath !== 'string' || relativePath.startsWith('/') || relativePath.includes('\\')
+    || relativePath.split('/').some((part) => !part || part === '.' || part === '..')) throw new Error('Invalid runner project path')
+  let directory = root
+  const parts = relativePath.split('/')
+  for (const part of parts.slice(0, -1)) {
+    directory = resolve(directory, part)
+    if (createParents) {
+      try { await mkdir(directory, { mode: 0o700 }) }
+      catch (error) { if (!error || typeof error !== 'object' || error.code !== 'EEXIST') throw error }
+    }
+    const status = await lstat(directory)
+    if (!status.isDirectory() || status.isSymbolicLink()) throw new Error('Runner paths cannot traverse symlinks')
+  }
+  return resolve(directory, parts[parts.length - 1])
+}
+
+async function writeFrozenControl(root, relativePath, content) {
+  const path = await checkedProjectPath(root, relativePath, true)
+  let handle
+  try { handle = await open(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600) }
+  catch (error) {
+    if (!error || typeof error !== 'object' || error.code !== 'EEXIST') throw error
+    const existing = await readRegularFile(path, 1_048_576, true)
+    if (existing.sha256 !== brainRunnerBytesSha256(content)) throw new Error('A frozen runner control file already has different content')
+    return path
+  }
+  try { await handle.writeFile(content) } finally { await handle.close() }
+  return path
+}
+
+export async function prepareBrainValidation(repositoryRoot, reportResponse, environment = process.env) {
+  if (reportResponse.status !== 'reported' || !reportResponse.report || reportResponse.report.checksPassed !== true
+    || !reportResponse.report.validationContext) throw new Error('A complete successful Brain report is required')
+  if (typeof environment.PATH !== 'string' || !environment.PATH) throw new Error('An explicit PATH is required')
+  const rootStatus = await lstat(repositoryRoot)
+  if (!rootStatus.isDirectory() || rootStatus.isSymbolicLink()) throw new Error('Runner workspace must be a real directory')
+  const root = await realpath(repositoryRoot)
+  const context = reportResponse.report.validationContext
+  if (context.planId !== reportResponse.planId || context.reportDigest !== reportResponse.reportDigest) {
+    throw new Error('Brain report identity does not match its runner context')
+  }
+  for (const file of context.files) {
+    const actual = await readRegularFile(await checkedProjectPath(root, file.path, false), 16_777_216, false)
+    if (actual.sha256 !== file.sha256) throw new Error('Reported project file changed before validation: ' + file.path)
+  }
+  for (const file of brainRunnerControlFiles(context)) await writeFrozenControl(root, file.path, file.content)
+  const executable = await realpath(process.execPath)
+  const executionPlan = buildBrainRunnerPlan(context, {
+    executable, executableSha256: brainRunnerBytesSha256(await readFile(executable)), path: environment.PATH,
+  })
+  const planPath = '.aimlock/brain-validation/' + context.reportId + '/execution-plan.json'
+  const planContent = canonicalBrainRunnerJson(executionPlan)
+  await writeFrozenControl(root, planPath, planContent)
+  return { repositoryRoot: root, planPath, executionPlan, planSha256: brainRunnerBytesSha256(planContent), context }
+}
+
+export async function runBrainApprovedValidation(repositoryRoot, input, environment = process.env) {
+  if (typeof input.approvalPath !== 'string' || typeof input.signerConfigPath !== 'string') {
+    throw new Error('An external approved runner authority and signer configuration are required')
+  }
+  const prepared = await prepareBrainValidation(repositoryRoot, input.reportResponse, environment)
+  const execution = await runApprovedValidatorPlan({
+    repositoryRoot: prepared.repositoryRoot, planPath: prepared.planPath,
+    approvalPath: input.approvalPath, signerConfigPath: input.signerConfigPath,
+  })
+  if (execution.status !== 'succeeded' || !execution.receipt) throw new Error('All Brain checks require a successful trusted runner receipt')
+  const subject = assertBrainRunnerSubmission(prepared.context, prepared.executionPlan, execution.subject)
+  return { planId: prepared.context.planId, reportDigest: prepared.context.reportDigest,
+    executionPlan: prepared.executionPlan, subject, receipts: [execution.receipt] }
+}
+
+export async function runBrainValidatorCli(args) {
+  if (args.length !== 3 || !['prepare', 'run'].includes(args[0])) {
+    throw new Error('Usage: cli-validator brain <prepare|run> <repositoryRoot> <inputJsonFile>')
+  }
+  const inputFile = await readRegularFile(resolve(args[2]), 256_000, false)
+  const input = JSON.parse(inputFile.bytes.toString('utf8'))
+  const output = args[0] === 'prepare' ? await prepareBrainValidation(resolve(args[1]), input)
+    : await runBrainApprovedValidation(resolve(args[1]), input)
+  process.stdout.write(JSON.stringify(output, null, 2) + '\n')
+}

package/cli.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { runBrainValidatorCli } from './brain-validator-plan.mjs'
 import { dirname } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { dispatchOfficialSkillCli, runIntakeHandshake } from './installer.mjs'
@@ -11,10 +12,11 @@ const INTAKE_QUESTIONS = [
   { id: 'targetFiles', prompt: 'Files to validate (or "auto" to scan all).', required: false, example: 'auto' },
 ]
 
-if (process.argv[2] === 'local') await runValidatorLocalCli(process.argv.slice(3))
+if (process.argv[2] === 'brain') await runBrainValidatorCli(process.argv.slice(3))
+else if (process.argv[2] === 'local') await runValidatorLocalCli(process.argv.slice(3))
 else await dispatchOfficialSkillCli({
   packageRoot: dirname(fileURLToPath(import.meta.url)),
-  extraUsageLines: ['  cli-validator local capabilities', '  cli-validator local run-approved-plan < runner-input.json'],
+  extraUsageLines: ['  cli-validator brain prepare <repositoryRoot> <reportResponse.json>', '  cli-validator brain run <repositoryRoot> <runnerInput.json>', '  cli-validator local capabilities', '  cli-validator local run-approved-plan < runner-input.json'],
   runCommand: (context) => runIntakeHandshake(context, {
     questions: INTAKE_QUESTIONS,
     outputFile: 'VALIDATOR-REQUIREMENTS.json',

package/package.json

@@ -6,7 +6,9 @@
   "exports": {
     "./local-runner": "./validator-local-runner.mjs",
     "./runner-plan": "./validator-runner-plan.mjs",
-    "./runtime": "./validator-runtime.mjs"
+    "./runtime": "./validator-runtime.mjs",
+    "./brain-contract": "./brain-validator-contract.mjs",
+    "./brain-runner": "./brain-validator-plan.mjs"
   },
   "files": [
     "cli.mjs",
@@ -19,7 +21,11 @@
     "validator-local-runner.mjs",
     "validator-local-cli.mjs",
     "validator-runtime.mjs",
-    "validator-compliance.mjs"
+    "validator-compliance.mjs",
+    "brain-validator-contract.mjs",
+    "brain-validator-contract.d.mts",
+    "brain-validator-plan.mjs",
+    "validator-brain-contract.mjs"
   ],
   "license": "UNLICENSED",
   "name": "cli-validator",
@@ -28,5 +34,5 @@
     "url": "https://github.com/88208555/Validator-clitax.git"
   },
   "type": "module",
-  "version": "7.0.34"
+  "version": "7.0.35"
 }

package/skill/SKILL.md

@@ -5,7 +5,7 @@ description: '交付前质量门禁：三道防线（静态/动态/对抗）递
 
 # Validator
 
-Package version: v7.0.34
+Package version: v7.0.35
 
 Validator 是技能链最后一站，只消费冻结目标和真实执行证据；模型解释没有裁判权。
 

package/skill/skill.json

@@ -5,6 +5,6 @@
   "method": "POST",
   "name": "validator",
   "type": "Skill",
-  "version": "v7.0.34",
+  "version": "v7.0.35",
   "schemaVersion": "validator.skill.request/1.0"
 }

package/validator-brain-contract.mjs

@@ -0,0 +1,47 @@
+const SHA_PATTERN = '^[0-9a-f]{64}$'
+const UUID_PATTERN = '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'
+const SHA = new RegExp(SHA_PATTERN)
+const UUID = new RegExp(UUID_PATTERN)
+const FIELDS = ['schemaVersion', 'planId', 'planSha256', 'reportId', 'reportSha256',
+  'checksSha256', 'scopeContractSha256', 'snapshotSha256', 'adapterSha256']
+
+export const brainRunnerContractSchema = {
+  type: 'object', additionalProperties: false, required: FIELDS,
+  properties: {
+    schemaVersion: { const: 'brain.frozen-runner/1.0' },
+    planId: { type: 'string', pattern: UUID_PATTERN }, reportId: { type: 'string', pattern: UUID_PATTERN },
+    ...Object.fromEntries(FIELDS.filter((field) => field.endsWith('Sha256'))
+      .map((field) => [field, { type: 'string', pattern: SHA_PATTERN }])),
+  },
+}
+
+export function validBrainRunnerContract(value, subject) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)
+    || Object.keys(value).sort().join('|') !== [...FIELDS].sort().join('|')
+    || value.schemaVersion !== 'brain.frozen-runner/1.0'
+    || !UUID.test(value.planId) || !UUID.test(value.reportId)
+    || value.planId !== subject.planId || subject.chainId !== 'chn-' + value.reportId
+    || subject.validationRunId !== 'brain-' + value.reportId) return false
+  return FIELDS.filter((field) => field.endsWith('Sha256')).every((field) => typeof value[field] === 'string' && SHA.test(value[field]))
+}
+
+export function validateBridgeContracts(value, entityRef, hardened, utilities) {
+  const { isObj, text, idRegex, shaRegex, finding } = utilities
+  const findings = []
+  if (hardened && (!isObj(value.contracts) || (!isObj(value.contracts.aimlock)
+    && !validBrainRunnerContract(value.contracts.brain, value)))) findings.push(finding("P0", "VALIDATION-SUBJECT-SNAPSHOT", `${entityRef}.contracts`, "Hardened validation requires an Aimlock snapshot or server frozen Brain contract binding"));
+  if (value.contracts?.brain !== undefined && !validBrainRunnerContract(value.contracts.brain, value)) findings.push(finding("P0", "VALIDATION-SUBJECT-BRAIN", `${entityRef}.contracts.brain`, "Brain runner contract is invalid or bound to another execution"));
+  if (value.contracts !== undefined && (!isObj(value.contracts)
+    || (value.contracts.aimlock !== undefined && (!isObj(value.contracts.aimlock)
+      || !idRegex.test(text(value.contracts.aimlock.goalId))
+      || !shaRegex.test(text(value.contracts.aimlock.scopeContractSha256))
+      || !shaRegex.test(text(value.contracts.aimlock.snapshotSha256))))
+    || (value.contracts.blueprint !== undefined && (!isObj(value.contracts.blueprint)
+      || !idRegex.test(text(value.contracts.blueprint.blueprintId))
+      || !shaRegex.test(text(value.contracts.blueprint.acceptanceReportSha256))))
+    || (value.contracts.archguard !== undefined && (!isObj(value.contracts.archguard)
+      || !shaRegex.test(text(value.contracts.archguard.contractSha256))
+      || !shaRegex.test(text(value.contracts.archguard.ledgerSha256))
+      || !["green", "yellow", "red"].includes(value.contracts.archguard.driftStatus))))) findings.push(finding("P0", "VALIDATION-SUBJECT-CONTRACTS", `${entityRef}.contracts`, "Aimlock, Blueprint, and ArchGuard bridge contracts require stable ids, SHA-256 digests, and a valid drift status"));
+  return findings
+}

package/validator-runner-plan.mjs

@@ -221,7 +221,29 @@ async function signerAuthority(root, signerConfigPath, policy) {
   return { ...file, config: { ...config, privateKeyPath: privatePath } }
 }
 
+async function verifyBrainControlAuthority(authority) {
+  if (authority.plan.contracts.brain === undefined) return
+  if (process.getuid() !== 0) throw new Error('Brain validation requires an isolated privileged runner')
+  const executable = await lstat(authority.plan.policy.executable)
+  if (executable.uid !== 0 || (executable.mode & 0o022) !== 0) throw new Error('Brain runner executable must be root owned and protected')
+  for (const name of authority.plan.policy.args) {
+    const parts = relativeFile(name).split('/')
+    let target = authority.root
+    for (const [index, part] of ['', ...parts].entries()) {
+      if (part) target = resolve(target, part)
+      const status = await lstat(target)
+      if (status.uid !== 0 || status.isSymbolicLink() || (status.mode & 0o022) !== 0) {
+        throw new Error('Brain runner control paths must be root owned and protected')
+      }
+      if (index === parts.length && (!status.isFile() || status.nlink !== 1 || (status.mode & 0o777) !== 0o600)) {
+        throw new Error('Brain runner controls require root owned mode-0600 regular files')
+      }
+    }
+  }
+}
+
 export async function verifyPlanFiles(authority) {
+  await verifyBrainControlAuthority(authority)
   let bytes = 0
   for (const file of authority.plan.files) {
     const actual = await projectFile(authority.root, file.path, false)

package/validator-runtime.mjs

@@ -1,3 +1,4 @@
+import { brainRunnerContractSchema, validateBridgeContracts } from "./validator-brain-contract.mjs";
 import { publicBindSites } from "./validator-compliance.mjs";
 import { createHash, createPublicKey, verify as verifySignature } from "node:crypto";
 
@@ -5,7 +6,7 @@ const REQ = "validator.skill.request/1.0";
 const RES = "validator.skill.response/1.0";
 const ERR = "validator.skill.error/1.0";
 const NAME = "validator";
-const COMPILER_VERSION = "v7.0.34";
+const COMPILER_VERSION = "v7.0.35";
 const CATALOG_SCHEMA = "cli.tax.skill-catalog/1.0";
 const RECEIPT_SCHEMA = "validator.execution-receipt/1.0";
 const VALIDATION_SUBJECT_SCHEMA = "validator.validation-subject/1.0";
@@ -57,6 +58,7 @@ const baselineSchema = objectSchema({
   testsSha256: stringSchema({ pattern: SHA_PATTERN }),
 }, ["schemaVersion", "baselineId", "source", "version", "frozen", "frozenAt", "frozenBy", "testsSha256"]);
 const contractsSchema = objectSchema({
+  brain: brainRunnerContractSchema,
   aimlock: objectSchema({ goalId: stringSchema({ pattern: ID_PATTERN }),
     scopeContractSha256: stringSchema({ pattern: SHA_PATTERN }), snapshotSha256: stringSchema({ pattern: SHA_PATTERN }) },
   ["goalId", "scopeContractSha256", "snapshotSha256"]),
@@ -206,19 +208,7 @@ function readValidationSubject(value, entityRef) {
         && value.artifactSha256 !== validatorArtifactSubject(value.files)) findings.push(finding("P0", "VALIDATION-SUBJECT-ARTIFACT-MANIFEST", `${entityRef}.artifactSha256`, "Artifact digest does not match the file manifest"));
     }
   }
-  if (hardened && (!isObj(value.contracts) || !isObj(value.contracts.aimlock))) findings.push(finding("P0", "VALIDATION-SUBJECT-SNAPSHOT", `${entityRef}.contracts.aimlock`, "Hardened validation requires an Aimlock snapshot binding"));
-  if (value.contracts !== undefined && (!isObj(value.contracts)
-    || (value.contracts.aimlock !== undefined && (!isObj(value.contracts.aimlock)
-      || !idRegex.test(text(value.contracts.aimlock.goalId))
-      || !shaRegex.test(text(value.contracts.aimlock.scopeContractSha256))
-      || !shaRegex.test(text(value.contracts.aimlock.snapshotSha256))))
-    || (value.contracts.blueprint !== undefined && (!isObj(value.contracts.blueprint)
-      || !idRegex.test(text(value.contracts.blueprint.blueprintId))
-      || !shaRegex.test(text(value.contracts.blueprint.acceptanceReportSha256))))
-    || (value.contracts.archguard !== undefined && (!isObj(value.contracts.archguard)
-      || !shaRegex.test(text(value.contracts.archguard.contractSha256))
-      || !shaRegex.test(text(value.contracts.archguard.ledgerSha256))
-      || !["green", "yellow", "red"].includes(value.contracts.archguard.driftStatus))))) findings.push(finding("P0", "VALIDATION-SUBJECT-CONTRACTS", `${entityRef}.contracts`, "Aimlock, Blueprint, and ArchGuard bridge contracts require stable ids, SHA-256 digests, and a valid drift status"));
+  findings.push(...validateBridgeContracts(value, entityRef, hardened, { isObj, text, idRegex, shaRegex, finding }));
   if (Array.isArray(value.tests)) findings.push(...validateGoldenBaseline(value.goldenBaseline, `${entityRef}.goldenBaseline`, value.tests));
   try { canonicalJson(value); } catch (error) { findings.push(finding("P0", "VALIDATION-SUBJECT-JSON", entityRef, error instanceof Error ? error.message : "Invalid JSON")); }
   return findings.length ? { findings } : { value };