codex-orchestrator 2.0.10 → 2.0.11

package/dist/src/v2/runtime.js

@@ -1,17 +1,17 @@
 import { constants } from 'node:fs';
 import { createHash, randomUUID } from 'node:crypto';
-import { spawn } from 'node:child_process';
-import { access, lstat, mkdir, open, readFile, readdir, readlink, realpath, rm } from 'node:fs/promises';
-import { homedir, hostname } from 'node:os';
+import { execFile, spawn } from 'node:child_process';
+import { access, link, lstat, mkdir, mkdtemp, open, readFile, readdir, readlink, realpath, rm, unlink } from 'node:fs/promises';
+import { homedir, hostname, platform } from 'node:os';
 import { basename, dirname, isAbsolute, join, posix, relative, resolve } from 'node:path';
 import { writeDurableAtomicFile } from './adapters/durable-atomic-file.js';
 import { GitWorktreeManager } from './adapters/worktree.js';
 import { ReviewFeedbackCoordinator } from './review-feedback-coordinator.js';
 import { defaultProcessExecutor } from './adapters/command.js';
 import { RunnerAndroidProofController } from './android-proof-runner.js';
-import { AcceptanceProof, ProofQuiescenceError } from './acceptance-proof.js';
+import { AcceptanceProof, CandidateProofInspectionError } from './acceptance-proof.js';
 import { createCheckedChangeCapabilities } from './checked-change.js';
-import { InjectedContainedReportOperation } from './contained-report-operation.js';
+import { InjectedContainedMutableOperation, InjectedContainedReportOperation, } from './contained-report-operation.js';
 import { ContainedImplementationReviewer } from './implementation-reviewer.js';
 import { parseAgentAutoConfig } from './config.js';
 import { WaitingHumanCoordinator } from './waiting-human-coordinator.js';
@@ -31,15 +31,393 @@ import { hashRouteDecision, validateRouteReceipt } from './route-decision.js';
 import { OwnerLockContentionError, OwnerLockSafetyError, RunIssue } from './run-issue.js';
 import { FileRunRecordWriter } from './run-store.js';
 import { parseWorkflowExecutionProfile, verifyWorkflowGeneration, } from './workflow-assets.js';
+import { candidateBindingId, candidateBindingSeed, candidateRef, } from './candidate.js';
 export class LocalGitRunIssueAdapter {
     executor;
+    repositoryRoot;
     worktrees;
-    constructor(executor = defaultProcessExecutor) {
+    candidateRepositories = new Map();
+    candidateV2;
+    constructor(executor = defaultProcessExecutor, repositoryRoot) {
         this.executor = executor;
+        this.repositoryRoot = repositoryRoot;
         this.worktrees = new GitWorktreeManager(executor);
+        this.candidateV2 = {
+            reconcileOrphans: (input) => this.reconcileCandidateOrphans(input),
+            captureAndPin: (input) => this.captureAndPinCandidate(input),
+            inspectPin: (binding) => this.inspectCandidatePin(binding),
+            normalizeSharedIndex: (input) => this.candidateOperation('candidate-io-failed', async () => {
+                if (await this.getHead(input.worktreePath) !== input.expectedHeadSha)
+                    throw new Error('candidate expected HEAD diverged');
+                await this.git(['-C', input.worktreePath, 'read-tree', input.expectedHeadSha]);
+            }),
+            prepareExecution: (input) => this.prepareCandidateExecution(input),
+            markExecutionLaunched: ({ lease, pid, processGroupId, launchedAt }) => ({
+                ...lease, phase: 'launched', pid, processGroupId, launchedAt,
+            }),
+            inspectExecution: (input) => this.inspectCandidateExecution(input),
+            removeExecution: (input) => this.removeCandidateExecution(input.lease),
+            copyProofArtifacts: (input) => this.copyCandidateProofArtifacts(input),
+            createOrObserveCommit: (input) => this.createOrObserveCandidateCommit(input),
+            releasePin: (input) => this.releaseCandidatePin(input.binding, input.expectedPinnedCommitSha),
+        };
+    }
+    async reconcileCandidateOrphans(input) {
+        return this.candidateOperation('candidate-io-failed', async () => {
+            const root = (await this.git(['-C', input.repositoryRoot, 'rev-parse', '--show-toplevel'])).trim();
+            const activeRefs = new Set(input.activeCandidateRefs);
+            const adoptableRefs = new Set();
+            for (const pending of input.pendingCandidates) {
+                const first = await this.captureCandidateTree(pending.worktreePath, pending.expectedHeadSha, pending.artifactDir);
+                const second = await this.captureCandidateTree(pending.worktreePath, pending.expectedHeadSha, pending.artifactDir);
+                if (canonicalJson(first) !== canonicalJson(second))
+                    continue;
+                const bindingId = candidateBindingId({
+                    bindingSeed: candidateBindingSeed(pending.runId, pending.boundary),
+                    expectedHeadSha: pending.expectedHeadSha,
+                    candidateTreeSha: first.treeSha,
+                    canonicalChangedFiles: first.changedFiles,
+                    sourceWorktreeIdentity: first.worktreeIdentity,
+                });
+                const ref = candidateRef(pending.runId, bindingId);
+                const commit = await this.resolveOptionalRef(root, ref);
+                if (commit && await this.commitMatches(root, commit, pending.expectedHeadSha, first.treeSha))
+                    adoptableRefs.add(ref);
+            }
+            const refs = (await this.git(['-C', root, 'for-each-ref', '--format=%(refname) %(objectname)', 'refs/codex-orchestrator/candidates/']))
+                .split('\n').filter(Boolean);
+            for (const row of refs) {
+                const separator = row.indexOf(' ');
+                if (separator < 1)
+                    throw new Error('orphan candidate ref row is malformed');
+                const ref = row.slice(0, separator);
+                const sha = row.slice(separator + 1);
+                if (!activeRefs.has(ref) && !adoptableRefs.has(ref)) {
+                    const deleted = await this.executor('git', ['-C', root, 'update-ref', '-d', ref, sha]);
+                    if (deleted.exitCode !== 0)
+                        throw new Error('orphan candidate ref cleanup failed');
+                }
+            }
+            const executionRoot = canonicalFilesystemPath(resolve(input.workspaceRoot, '.candidate-executions'));
+            const activeExecutions = new Map(input.activeExecutions.map((execution) => [
+                canonicalFilesystemPath(execution.path), execution.candidateCommitSha,
+            ]));
+            for (const worktree of await this.worktrees.listWorktrees(root)) {
+                const path = canonicalFilesystemPath(worktree.path);
+                const relativePath = relative(executionRoot, path);
+                if (relativePath === '' || (!relativePath.startsWith('..') && !isAbsolute(relativePath))) {
+                    const expectedCommit = activeExecutions.get(path);
+                    if (expectedCommit) {
+                        if (worktree.branch !== undefined || await this.getHead(path).catch(() => '') !== expectedCommit) {
+                            throw new Error('persisted candidate execution owner diverged');
+                        }
+                    }
+                    else {
+                        if (worktree.branch !== undefined)
+                            throw new Error('orphan candidate execution unexpectedly owns a branch');
+                        await this.git(['-C', root, 'worktree', 'remove', '--force', path]);
+                    }
+                }
+            }
+        });
+    }
+    async captureAndPinCandidate(input) {
+        try {
+            const first = await this.captureCandidateTree(input.worktreePath, input.expectedHeadSha, input.artifactDir);
+            const second = await this.captureCandidateTree(input.worktreePath, input.expectedHeadSha, input.artifactDir);
+            if (canonicalJson(first) !== canonicalJson(second)) {
+                return { kind: 'failed', code: 'candidate-unstable', detailSha256: sha256(canonicalJson({ first, second })) };
+            }
+            const bindingSeed = candidateBindingSeed(input.runId, input.boundary);
+            const bindingId = candidateBindingId({
+                bindingSeed,
+                expectedHeadSha: input.expectedHeadSha,
+                candidateTreeSha: first.treeSha,
+                canonicalChangedFiles: first.changedFiles,
+                sourceWorktreeIdentity: first.worktreeIdentity,
+            });
+            const ref = candidateRef(input.runId, bindingId);
+            const root = (await this.git(['-C', input.worktreePath, 'rev-parse', '--show-toplevel'])).trim();
+            this.candidateRepositories.set(ref, root);
+            let commitSha = await this.resolveOptionalRef(root, ref);
+            if (commitSha) {
+                if (!await this.commitMatches(root, commitSha, input.expectedHeadSha, first.treeSha))
+                    throw new Error('existing candidate ref diverged');
+            }
+            else {
+                commitSha = (await this.git([
+                    '-C', root, '-c', 'user.name=codex-orchestrator', '-c', 'user.email=codex-orchestrator@users.noreply.github.com',
+                    'commit-tree', first.treeSha, '-p', input.expectedHeadSha, '-m', `codex-orchestrator candidate ${bindingId}`,
+                ])).trim();
+                const update = await this.executor('git', ['-C', root, 'update-ref', ref, commitSha, '0'.repeat(commitSha.length)]);
+                if (update.exitCode !== 0) {
+                    const observed = await this.resolveOptionalRef(root, ref);
+                    if (!observed || !await this.commitMatches(root, observed, input.expectedHeadSha, first.treeSha)) {
+                        return { kind: 'failed', code: 'candidate-ref-update-unknown', detailSha256: sha256(update.stderr) };
+                    }
+                    commitSha = observed;
+                }
+            }
+            return { kind: 'ok', value: {
+                    version: 2, bindingId, expectedHeadSha: input.expectedHeadSha, candidateRef: ref,
+                    candidateCommitSha: commitSha, candidateTreeSha: first.treeSha,
+                    canonicalChangedFiles: first.changedFiles, sourceWorktreeIdentity: first.worktreeIdentity,
+                } };
+        }
+        catch (error) {
+            return candidateFailure('candidate-io-failed', error);
+        }
+    }
+    async captureCandidateTree(worktreePath, expectedHeadSha, artifactDir) {
+        validateRelativeRoot(artifactDir);
+        const [head, canonicalPath, gitDirectoryRaw] = await Promise.all([
+            this.getHead(worktreePath), realpath(worktreePath), this.git(['-C', worktreePath, 'rev-parse', '--absolute-git-dir']),
+        ]);
+        if (head !== expectedHeadSha)
+            throw new Error('candidate expected HEAD diverged');
+        const gitDirectory = gitDirectoryRaw.trim();
+        const temporaryRoot = await mkdtemp(join(gitDirectory, 'candidate-index-'));
+        const indexPath = join(temporaryRoot, 'index');
+        const options = { envOverlay: { GIT_INDEX_FILE: indexPath } };
+        try {
+            await this.git(['-C', worktreePath, 'read-tree', expectedHeadSha], options);
+            await this.git(['-C', worktreePath, 'add', '-u', '--'], options);
+            const untracked = (await this.git(['-C', worktreePath, 'ls-files', '--others', '--exclude-standard', '-z'], options)).split('\0')
+                .filter((path) => path && path !== artifactDir && !path.startsWith(`${artifactDir}/`)).sort();
+            if (untracked.length > 0) {
+                await this.git(['-C', worktreePath, 'add', '--pathspec-from-file=-', '--pathspec-file-nul'], {
+                    ...options, stdin: `${untracked.join('\0')}\0`,
+                });
+            }
+            const treeSha = (await this.git(['-C', worktreePath, 'write-tree'], options)).trim();
+            const changedFiles = (await this.git(['-C', worktreePath, 'diff-tree', '--no-commit-id', '--name-only', '-r', '-z', expectedHeadSha, treeSha]))
+                .split('\0').filter(Boolean).sort();
+            return {
+                expectedHeadSha,
+                treeSha,
+                changedFiles,
+                worktreeIdentity: sha256(canonicalJson({ canonicalPath, gitDirectory })),
+            };
+        }
+        finally {
+            await rm(temporaryRoot, { recursive: true, force: true });
+        }
+    }
+    async inspectCandidatePin(binding) {
+        return this.candidateOperation('candidate-io-failed', async () => {
+            const root = await this.candidateRepository(binding.candidateRef);
+            if (!root)
+                return 'missing';
+            const observed = await this.resolveOptionalRef(root, binding.candidateRef);
+            if (!observed)
+                return 'missing';
+            return observed === binding.candidateCommitSha
+                && await this.commitMatches(root, observed, binding.expectedHeadSha, binding.candidateTreeSha) ? 'matching' : 'diverged';
+        });
+    }
+    async prepareCandidateExecution(input) {
+        return this.candidateOperation('candidate-materialization-io-failed', async () => {
+            const root = await this.repositoryFromWorkspaceRoot(input.workspaceRoot);
+            this.candidateRepositories.set(input.binding.candidateRef, root);
+            const path = join(input.workspaceRoot, '.candidate-executions', input.runId, input.binding.bindingId, `${input.operation}-${input.attemptId}`);
+            const existing = (await this.worktrees.listWorktrees(root)).find((worktree) => sameFilesystemPath(worktree.path, path));
+            if (existing) {
+                const clean = await this.worktrees.isWorktreeClean(path);
+                const head = await this.getHead(path).catch(() => 'missing');
+                if (existing.branch !== undefined || head !== input.binding.candidateCommitSha || !clean)
+                    return { kind: 'path-diverged', path };
+            }
+            else {
+                await mkdir(dirname(path), { recursive: true });
+                await this.git(['-C', root, 'worktree', 'add', '--detach', path, input.binding.candidateCommitSha]);
+            }
+            return { kind: 'prepared', lease: {
+                    version: 2, bindingId: input.binding.bindingId, candidateCommitSha: input.binding.candidateCommitSha,
+                    path, operation: input.operation, attemptId: input.attemptId, phase: 'prepared', pid: null,
+                    processGroupId: null, preparedAt: new Date().toISOString(), launchedAt: null,
+                } };
+        });
+    }
+    async inspectCandidateExecution(input) {
+        return this.candidateOperation('candidate-materialization-io-failed', async () => {
+            try {
+                const stat = await lstat(input.lease.path);
+                if (stat.isSymbolicLink() || !stat.isDirectory())
+                    return 'mutated';
+            }
+            catch (error) {
+                if (isErrorCode(error, 'ENOENT'))
+                    return 'missing';
+                throw error;
+            }
+            const [head, tree, changed] = await Promise.all([
+                this.getHead(input.lease.path),
+                this.git(['-C', input.lease.path, 'rev-parse', 'HEAD^{tree}']).then((value) => value.trim()),
+                this.worktrees.listChangedFilesIgnoringUntrackedRoot(input.lease.path, input.artifactDir),
+            ]);
+            return head === input.binding.candidateCommitSha && tree === input.binding.candidateTreeSha && changed.length === 0 ? 'matching' : 'mutated';
+        });
+    }
+    async removeCandidateExecution(lease) {
+        return this.candidateOperation('candidate-materialization-io-failed', async () => {
+            if (lease.phase === 'launched' && lease.processGroupId && processGroupIsAlive(lease.processGroupId))
+                throw new Error('candidate execution process is still active');
+            const root = await this.repositoryFromWorkspaceRoot(lease.path);
+            const registered = (await this.worktrees.listWorktrees(root)).find((worktree) => sameFilesystemPath(worktree.path, lease.path));
+            if (!registered)
+                return;
+            if (registered.branch !== undefined || await this.getHead(lease.path) !== lease.candidateCommitSha)
+                throw new Error('candidate execution owner diverged');
+            await this.git(['-C', root, 'worktree', 'remove', '--force', lease.path]);
+        });
+    }
+    async copyCandidateProofArtifacts(input) {
+        return this.candidateOperation('candidate-materialization-io-failed', async () => {
+            const proofRoot = `${input.artifactDir}/${input.proofId}`;
+            const repositoryRoot = await this.repositoryFromWorkspaceRoot(input.lease.path);
+            const registered = (await this.worktrees.listWorktrees(repositoryRoot))
+                .find((worktree) => sameFilesystemPath(worktree.path, input.lease.path));
+            if (!registered || registered.branch !== undefined
+                || await this.getHead(input.lease.path).catch(() => '') !== input.lease.candidateCommitSha) {
+                return { kind: 'artifact-conflict', relativePath: proofRoot };
+            }
+            const sourceRoot = await inspectSafeArtifactRoot(input.lease.path);
+            const destinationRoot = await inspectSafeArtifactRoot(input.issueWorktreePath);
+            for (const artifact of input.artifacts) {
+                if (artifact.relativePath !== proofRoot && !artifact.relativePath.startsWith(`${proofRoot}/`))
+                    return { kind: 'artifact-conflict', relativePath: artifact.relativePath };
+                try {
+                    const source = join(input.lease.path, artifact.relativePath);
+                    const destination = join(input.issueWorktreePath, artifact.relativePath);
+                    const sourceBytes = await readRegularFileWithoutSymlinkAncestors(sourceRoot, source);
+                    if (sha256(sourceBytes) !== artifact.sha256)
+                        return { kind: 'artifact-conflict', relativePath: artifact.relativePath };
+                    await ensureSafeDirectoryPath(destinationRoot, dirname(destination));
+                    await publishArtifactCreateOnly(destinationRoot, destination, sourceBytes, artifact.sha256);
+                }
+                catch (error) {
+                    if (error instanceof CandidateArtifactConflictError)
+                        return { kind: 'artifact-conflict', relativePath: artifact.relativePath };
+                    throw error;
+                }
+            }
+            return { kind: 'copied-or-observed' };
+        });
+    }
+    async createOrObserveCandidateCommit(input) {
+        return this.candidateOperation('candidate-ref-update-unknown', async () => {
+            const root = (await this.git(['-C', input.worktreePath, 'rev-parse', '--show-toplevel'])).trim();
+            const ref = `refs/heads/${input.branchName}`;
+            const observedHead = (await this.git(['-C', root, 'rev-parse', '--verify', `${ref}^{commit}`])).trim();
+            if (observedHead !== input.parentSha) {
+                const observed = await this.inspectCommit(root, observedHead);
+                if (observed.parentSha === input.parentSha && observed.treeSha === input.treeSha && observed.message === input.message) {
+                    return { kind: 'created-or-observed', sha: observedHead, ...observed };
+                }
+                return { kind: 'branch-diverged', observedHeadSha: observedHead };
+            }
+            if (input.observeOnly)
+                return { kind: 'parent-unchanged' };
+            const pin = await this.resolveOptionalRef(root, input.candidateRef);
+            if (!pin || (await this.git(['-C', root, 'rev-parse', `${pin}^{tree}`])).trim() !== input.treeSha)
+                throw new Error('candidate pin does not authorize publication tree');
+            const sha = (await this.git([
+                '-C', root, '-c', 'user.name=codex-orchestrator', '-c', 'user.email=codex-orchestrator@users.noreply.github.com',
+                'commit-tree', input.treeSha, '-p', input.parentSha, '-m', input.message,
+            ])).trim();
+            const update = await this.executor('git', ['-C', root, 'update-ref', ref, sha, input.parentSha]);
+            if (update.exitCode !== 0) {
+                const after = (await this.git(['-C', root, 'rev-parse', '--verify', `${ref}^{commit}`])).trim();
+                if (after === input.parentSha)
+                    return { kind: 'parent-unchanged' };
+                const observed = await this.inspectCommit(root, after);
+                if (observed.parentSha === input.parentSha && observed.treeSha === input.treeSha && observed.message === input.message) {
+                    return { kind: 'created-or-observed', sha: after, ...observed };
+                }
+                return { kind: 'branch-diverged', observedHeadSha: after };
+            }
+            return { kind: 'created-or-observed', sha, parentSha: input.parentSha, treeSha: input.treeSha, message: input.message };
+        });
+    }
+    async releaseCandidatePin(binding, expected) {
+        return this.candidateOperation('candidate-ref-update-unknown', async () => {
+            const root = await this.candidateRepository(binding.candidateRef);
+            if (!root)
+                return;
+            const observed = await this.resolveOptionalRef(root, binding.candidateRef);
+            if (!observed)
+                return;
+            if (observed !== expected)
+                throw new Error('candidate pin diverged');
+            const result = await this.executor('git', ['-C', root, 'update-ref', '-d', binding.candidateRef, expected]);
+            if (result.exitCode !== 0 && await this.resolveOptionalRef(root, binding.candidateRef))
+                throw new Error('candidate pin deletion outcome is unknown');
+        });
+    }
+    async candidateOperation(code, operation) {
+        try {
+            return { kind: 'ok', value: await operation() };
+        }
+        catch (error) {
+            return candidateFailure(code, error);
+        }
+    }
+    async candidateRepository(ref) {
+        const known = this.candidateRepositories.get(ref);
+        if (known)
+            return known;
+        for (const candidateRoot of [this.repositoryRoot, process.cwd()]) {
+            if (!candidateRoot)
+                continue;
+            try {
+                const root = (await this.git(['-C', candidateRoot, 'rev-parse', '--show-toplevel'])).trim();
+                if (await this.resolveOptionalRef(root, ref)) {
+                    this.candidateRepositories.set(ref, root);
+                    return root;
+                }
+            }
+            catch { /* this location need not be in the target repository */ }
+        }
+        return undefined;
+    }
+    async repositoryFromWorkspaceRoot(path) {
+        let current = resolve(path);
+        while (true) {
+            try {
+                return (await this.git(['-C', current, 'rev-parse', '--show-toplevel'])).trim();
+            }
+            catch {
+                const parent = dirname(current);
+                if (parent === current)
+                    throw new Error('candidate workspace is not below a Git repository');
+                current = parent;
+            }
+        }
+    }
+    async resolveOptionalRef(root, ref) {
+        const result = await this.executor('git', ['-C', root, 'rev-parse', '--verify', `${ref}^{commit}`]);
+        if (result.exitCode === 1 || result.exitCode === 128)
+            return undefined;
+        if (result.exitCode !== 0)
+            throw new Error(`git ref inspection failed: ${result.stderr}`);
+        return result.stdout.trim();
+    }
+    async commitMatches(root, commit, parent, tree) {
+        const observed = await this.inspectCommit(root, commit);
+        return observed.parentSha === parent && observed.treeSha === tree;
+    }
+    async inspectCommit(root, commit) {
+        const output = await this.git(['-C', root, 'show', '-s', '--format=%P%n%T%n%B', commit]);
+        const [parentSha, treeSha, ...message] = output.split('\n');
+        if (!parentSha || parentSha.includes(' ') || !treeSha)
+            throw new Error('candidate commit is not single-parent');
+        return { parentSha, treeSha, message: message.join('\n').trimEnd() };
     }
     async getBaseSha(input) {
-        return (await this.git(['-C', input.targetRoot, 'rev-parse', input.baseBranch])).trim();
+        await this.git([
+            '-C', input.targetRoot, 'fetch', '--quiet', '--no-tags', 'origin', `refs/heads/${input.baseBranch}`,
+        ]);
+        return (await this.git(['-C', input.targetRoot, 'rev-parse', '--verify', 'FETCH_HEAD^{commit}'])).trim();
     }
     async createWorktree(input) {
         await this.worktrees.createIssueWorktree({
@@ -49,6 +427,9 @@ export class LocalGitRunIssueAdapter {
             baseBranch: input.baseBranch,
             requiredBaseSha: input.baseSha,
         });
+        if (await this.getHead(input.worktreePath) !== input.baseSha) {
+            throw new Error('created issue worktree does not match the pinned base SHA');
+        }
     }
     async ensureContinuationWorktree(input) {
         const localHead = (await this.git([
@@ -197,126 +578,311 @@ export class LocalGitRunIssueAdapter {
     push(input) {
         return this.worktrees.pushBranch(input);
     }
-    async git(args) {
-        const result = await this.executor('git', args);
+    async git(args, options) {
+        const result = await this.executor('git', args, options);
         if (result.exitCode !== 0)
             throw new Error(`git failed: ${result.stderr}`);
         return result.stdout;
     }
 }
-export class ContainedImplementationAgent {
-    dependencies;
-    constructor(dependencies) {
-        this.dependencies = dependencies;
+function candidateFailure(code, error) {
+    const detail = error instanceof Error ? `${error.name}:${error.message}` : String(error);
+    return { kind: 'failed', code, detailSha256: sha256(detail) };
+}
+function processGroupIsAlive(processGroupId) {
+    try {
+        process.kill(-processGroupId, 0);
+        return true;
     }
-    async run(input) {
-        const config = this.dependencies.config();
-        const canonicalRepository = `${config.github.owner.toLowerCase()}/${config.github.repo.toLowerCase()}`;
-        const attemptId = (this.dependencies.createAttemptId ?? randomUUID)();
-        const attempt = await prepareContainedAttempt({
-            orchestratorHome: this.dependencies.orchestratorHome,
-            canonicalRepository,
-            runId: input.runId,
-            attemptId,
-            operationId: input.operation,
-            workflowGeneration: input.workflowGeneration,
-            bootId: this.dependencies.bootId,
-        });
-        const baseline = await this.dependencies.git.snapshot(input.worktreePath);
-        await input.onPrepared?.({
-            attemptId,
-            reportPath: attempt.reportPath,
-            preparedAt: (this.dependencies.now ?? (() => new Date().toISOString()))(),
-            baseline,
-        });
-        try {
-            const result = await (this.dependencies.process ?? new CodexProcess()).run({
-                codexPath: config.codex.command,
-                cwd: input.worktreePath,
-                schemaPath: attempt.schemaPath,
-                reportPath: attempt.reportPath,
-                toolHome: attempt.toolHome,
-                tmpDir: attempt.tmpDir,
-                safePath: this.dependencies.safePath,
-                parentCodexHome: this.dependencies.parentCodexHome,
-                parentEnv: process.env,
-                prompt: [
-                    `Package profile instructions: ${attempt.profile.developerInstructions}`,
-                    `Follow the exact operation at ${attempt.operationPath}.`,
-                    `The operation's immutable workflow root is ${attempt.workflowRoot}.`,
-                    ...(input.operation === 'qualification-repair'
-                        ? [
-                            `Pre-implementation qualification repair for issue #${input.issue.number}: ${input.issue.title}`,
-                            'Do not implement the issue acceptance criteria yet. Repair only the reported scoped-check failures so the existing worktree qualifies for implementation.',
-                            'You may modify the product files required by those failures. Return changedFiles as the complete cumulative worktree change set.',
-                        ]
-                        : [`Implement issue #${input.issue.number}: ${input.issue.title}`]),
-                    `Implementation cycle: ${input.cycle}.`,
-                    ...(input.reviewFeedbackRound ? [`Pull-request feedback repair round: ${input.reviewFeedbackRound}.`] : []),
-                    ...(input.reviewFeedback?.length ? [`Frozen trusted pull-request feedback: ${canonicalJson(input.reviewFeedback)}`] : []),
-                    ...(input.operation === 'implementation'
-                        ? [`Frozen acceptance criteria: ${canonicalJson(input.frozenCriteria)}`]
-                        : []),
-                    ...(input.reworkFindings.length > 0 ? [`Repair these verified findings: ${canonicalJson(input.reworkFindings)}`] : []),
-                    ...(input.repairOnly ? ['Report repair only: do not modify any worktree file; emit a schema-valid implementation report for the existing change.'] : []),
-                    'Do not commit, push, publish, or print credentials or local auth paths.',
-                ].join('\n'),
-                timeoutMs: config.codex.timeoutMs,
-                idleTimeoutMs: config.codex.idleTimeoutMs,
-                operationPolicy: attempt.policy,
-                executionProfile: attempt.profile,
-                ...(input.onLaunched ? { onSpawned: ({ pid, processGroupId }) => input.onLaunched({
-                        attemptId, pid, processGroupId, launchedAt: (this.dependencies.now ?? (() => new Date().toISOString()))(),
-                    }) } : {}),
-            }, input.signal);
-            if (result.kind === 'cancelled')
-                return { kind: 'cancelled' };
-            if (['spawn-failed', 'transport-failed', 'timeout', 'idle-timeout'].includes(result.kind)) {
-                return { kind: 'transport-failed', resumable: true };
+    catch (error) {
+        return !isErrorCode(error, 'ESRCH');
+    }
+}
+function sameFilesystemPath(left, right) {
+    return canonicalFilesystemPath(left) === canonicalFilesystemPath(right);
+}
+function canonicalFilesystemPath(value) {
+    const resolved = resolve(value);
+    return resolved.startsWith('/private/') ? resolved.slice('/private'.length) : resolved;
+}
+async function inspectSafeArtifactRoot(root) {
+    const path = resolve(root);
+    const stat = await lstat(path);
+    if (stat.isSymbolicLink() || !stat.isDirectory())
+        throw new CandidateArtifactConflictError('candidate artifact root is unsafe');
+    const realPath = canonicalFilesystemPath(await realpath(path));
+    if (realPath !== canonicalFilesystemPath(path))
+        throw new CandidateArtifactConflictError('candidate artifact root has a symlinked ancestor');
+    const identity = { path, realPath, dev: stat.dev, ino: stat.ino };
+    await assertSafeArtifactRoot(identity);
+    return identity;
+}
+async function assertSafeArtifactRoot(root) {
+    const stat = await lstat(root.path);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || stat.dev !== root.dev || stat.ino !== root.ino
+        || canonicalFilesystemPath(await realpath(root.path)) !== root.realPath) {
+        throw new CandidateArtifactConflictError('candidate artifact root changed');
+    }
+}
+async function readRegularFileWithoutSymlinkAncestors(rootInput, path) {
+    const root = typeof rootInput === 'string' ? await inspectSafeArtifactRoot(rootInput) : rootInput;
+    await assertSafeArtifactRoot(root);
+    const relativePath = relative(root.path, resolve(path));
+    if (!relativePath || relativePath.startsWith('..') || isAbsolute(relativePath))
+        throw new CandidateArtifactConflictError('candidate artifact path escapes its root');
+    let current = root.path;
+    const rootStat = await lstat(current);
+    if (rootStat.isSymbolicLink() || !rootStat.isDirectory())
+        throw new CandidateArtifactConflictError('candidate artifact root is unsafe');
+    const ancestorIdentity = [{ path: current, dev: rootStat.dev, ino: rootStat.ino }];
+    const segments = relativePath.split('/');
+    for (const segment of segments.slice(0, -1)) {
+        current = join(current, segment);
+        const stat = await lstat(current);
+        if (stat.isSymbolicLink() || !stat.isDirectory())
+            throw new CandidateArtifactConflictError('candidate artifact ancestor is unsafe');
+        ancestorIdentity.push({ path: current, dev: stat.dev, ino: stat.ino });
+    }
+    const finalBeforeOpen = await lstat(path);
+    if (finalBeforeOpen.isSymbolicLink() || !finalBeforeOpen.isFile()) {
+        throw new CandidateArtifactConflictError('candidate artifact is not a regular file');
+    }
+    let handle;
+    try {
+        handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    }
+    catch (error) {
+        if (isErrorCode(error, 'ELOOP'))
+            throw new CandidateArtifactConflictError('candidate artifact is not a regular file');
+        throw error;
+    }
+    try {
+        const stat = await handle.stat();
+        if (!stat.isFile())
+            throw new CandidateArtifactConflictError('candidate artifact is not a regular file');
+        const openedPath = await realpath(path);
+        const openedRelative = relative(root.realPath, canonicalFilesystemPath(openedPath));
+        if (!openedRelative || openedRelative.startsWith('..') || isAbsolute(openedRelative)) {
+            throw new CandidateArtifactConflictError('candidate artifact path escaped its root during read');
+        }
+        const finalStat = await lstat(path);
+        if (!finalStat.isFile() || finalStat.isSymbolicLink() || finalStat.dev !== stat.dev || finalStat.ino !== stat.ino) {
+            throw new CandidateArtifactConflictError('candidate artifact changed during read');
+        }
+        for (const identity of ancestorIdentity) {
+            const observed = await lstat(identity.path);
+            if (!observed.isDirectory() || observed.isSymbolicLink() || observed.dev !== identity.dev || observed.ino !== identity.ino) {
+                throw new CandidateArtifactConflictError('candidate artifact ancestor changed during read');
             }
-            if (result.kind !== 'completed' || result.report.kind !== 'available')
-                return { kind: 'internal-error' };
-            return {
-                kind: 'completed',
-                attemptId,
-                report: decodeAgentReportForValidation(result.report.bytes),
-            };
+        }
+        await assertSafeArtifactRoot(root);
+        return await handle.readFile();
+    }
+    finally {
+        await handle.close();
+    }
+}
+async function ensureSafeDirectoryPath(root, directory) {
+    await assertSafeArtifactRoot(root);
+    const relativeDirectory = relative(root.path, resolve(directory));
+    if (relativeDirectory.startsWith('..') || isAbsolute(relativeDirectory))
+        throw new CandidateArtifactConflictError('candidate artifact directory escapes its root');
+    let current = root.path;
+    for (const segment of relativeDirectory.split('/').filter(Boolean)) {
+        current = join(current, segment);
+        try {
+            await mkdir(current);
         }
         catch (error) {
-            if (!(error instanceof ProcessQuiescenceError))
-                return { kind: 'internal-error' };
-            return {
-                kind: 'safe-halt',
-                process: {
-                    pid: error.pid,
-                    processGroupId: error.processGroupId,
-                    startedAt: (this.dependencies.now ?? (() => new Date().toISOString()))(),
-                    baseline: { ...baseline },
-                },
-                waitForAbsence: () => waitForProcessGroupAbsent(error.processGroupId),
-            };
+            if (!isErrorCode(error, 'EEXIST'))
+                throw error;
         }
+        const stat = await lstat(current);
+        if (stat.isSymbolicLink() || !stat.isDirectory())
+            throw new CandidateArtifactConflictError('candidate artifact directory is unsafe');
+    }
+    const parentRealPath = canonicalFilesystemPath(await realpath(directory));
+    const parentRelative = relative(root.realPath, parentRealPath);
+    if (parentRelative.startsWith('..') || isAbsolute(parentRelative))
+        throw new CandidateArtifactConflictError('candidate artifact directory escaped its root');
+    await assertSafeArtifactRoot(root);
+}
+class CandidateArtifactConflictError extends Error {
+}
+async function publishArtifactCreateOnly(root, destination, bytes, expectedSha256) {
+    await assertSafeArtifactRoot(root);
+    const temporary = join(dirname(destination), `.${basename(destination)}.${expectedSha256}.tmp`);
+    let handle;
+    try {
+        handle = await open(temporary, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | constants.O_NOFOLLOW, 0o600);
     }
-    async recover(input) {
-        const expected = join(resolve(this.dependencies.orchestratorHome), 'v2', sha256(input.canonicalRepository), 'runs', input.runId, 'attempts', input.invocation.attemptId, 'report.json');
-        if (resolve(input.invocation.reportPath) !== expected) {
-            throw new Error('review feedback implementation report path is not attempt-owned');
+    catch (error) {
+        if (!isErrorCode(error, 'EEXIST'))
+            throw error;
+        const stale = await readRegularFileWithoutSymlinkAncestors(root, temporary);
+        if (sha256(stale) !== expectedSha256) {
+            await unlink(temporary);
+            handle = await open(temporary, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | constants.O_NOFOLLOW, 0o600);
         }
-        let bytes;
+    }
+    if (handle) {
         try {
-            bytes = await readRegularFile(expected);
+            await handle.writeFile(bytes);
+            await handle.sync();
+            const stat = await handle.stat();
+            const observed = await lstat(temporary);
+            const temporaryRealPath = canonicalFilesystemPath(await realpath(temporary));
+            const temporaryRelative = relative(root.realPath, temporaryRealPath);
+            if (!observed.isFile() || observed.isSymbolicLink() || observed.dev !== stat.dev || observed.ino !== stat.ino
+                || temporaryRelative.startsWith('..') || isAbsolute(temporaryRelative)) {
+                throw new CandidateArtifactConflictError('candidate artifact temporary path changed');
+            }
+            await assertSafeArtifactRoot(root);
         }
-        catch (error) {
-            if (isErrorCode(error, 'ENOENT'))
-                return undefined;
+        finally {
+            await handle.close();
+        }
+    }
+    try {
+        await link(temporary, destination);
+    }
+    catch (error) {
+        if (!isErrorCode(error, 'EEXIST'))
             throw error;
+        const existing = await readRegularFileWithoutSymlinkAncestors(root, destination);
+        if (sha256(existing) !== expectedSha256)
+            throw new CandidateArtifactConflictError('candidate artifact destination conflicts');
+    }
+    const published = await readRegularFileWithoutSymlinkAncestors(root, destination);
+    if (sha256(published) !== expectedSha256)
+        throw new CandidateArtifactConflictError('candidate artifact destination conflicts');
+    const parent = await open(dirname(destination), constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+    try {
+        const parentStat = await parent.stat();
+        const observedParent = await lstat(dirname(destination));
+        const parentRealPath = canonicalFilesystemPath(await realpath(dirname(destination)));
+        const parentRelative = relative(root.realPath, parentRealPath);
+        if (!observedParent.isDirectory() || observedParent.isSymbolicLink()
+            || observedParent.dev !== parentStat.dev || observedParent.ino !== parentStat.ino
+            || parentRelative.startsWith('..') || isAbsolute(parentRelative)) {
+            throw new CandidateArtifactConflictError('candidate artifact destination directory changed');
         }
-        return {
-            kind: 'completed',
-            attemptId: input.invocation.attemptId,
-            report: decodeAgentReportForValidation(bytes),
-        };
+        await parent.sync();
+        await assertSafeArtifactRoot(root);
     }
+    finally {
+        await parent.close();
+    }
+    await unlink(temporary).catch((error) => { if (!isErrorCode(error, 'ENOENT'))
+        throw error; });
+}
+export class ContainedImplementationAgent {
+    dependencies;
+    constructor(dependencies) {
+        this.dependencies = dependencies;
+    }
+    async run(input) {
+        const config = this.dependencies.config();
+        const canonicalRepository = `${config.github.owner.toLowerCase()}/${config.github.repo.toLowerCase()}`;
+        const promptFacts = implementationPromptFacts(input);
+        const operation = this.operation(config, canonicalRepository, promptFacts);
+        const result = await operation.run({
+            operation: input.operation, runId: input.runId, worktreePath: input.worktreePath,
+            workflowGeneration: input.workflowGeneration, promptFacts, signal: input.signal,
+            context: { repairOnly: input.repairOnly, reworkFindings: [...input.reworkFindings] },
+            invocationState: input.invocationState, beforeLaunch: input.beforeLaunch,
+        });
+        if (result.status === 'completed')
+            return { kind: 'completed', attemptId: result.attemptId,
+                report: decodeAgentReportForValidation(result.reportBytes) };
+        if (result.status === 'cancelled')
+            return { kind: 'cancelled' };
+        if (result.status === 'retryable')
+            return { kind: 'transport-failed', resumable: true, code: result.code };
+        if (result.status === 'safe-halt')
+            return { kind: 'safe-halt', code: result.code };
+        return result.kind === 'external'
+            ? { kind: 'transport-failed', resumable: true, code: result.code }
+            : { kind: 'safe-halt', code: result.code };
+    }
+    async settle(input) {
+        const config = this.dependencies.config();
+        const canonicalRepository = `${config.github.owner.toLowerCase()}/${config.github.repo.toLowerCase()}`;
+        const promptFacts = implementationPromptFacts(input);
+        const result = await this.operation(config, canonicalRepository, promptFacts).settle({
+            operation: input.operation, runId: input.runId, worktreePath: input.worktreePath,
+            workflowGeneration: input.workflowGeneration, promptFacts, signal: input.signal,
+            context: { repairOnly: input.repairOnly, reworkFindings: [...input.reworkFindings] },
+            invocationState: input.invocationState,
+        });
+        return result.status === 'settled' ? { kind: 'settled' } : { kind: 'safe-halt', code: result.code };
+    }
+    operation(config, canonicalRepository, promptFacts) {
+        return new InjectedContainedMutableOperation({
+            host: hostname(), bootId: this.dependencies.bootId,
+            now: this.dependencies.now ?? (() => new Date().toISOString()),
+            createAttemptId: this.dependencies.createAttemptId ?? randomUUID,
+            prepare: async ({ operation: worker, attemptId, runId, workflowGeneration }) => ({
+                operation: worker, generationHash: workflowGeneration.generationHash,
+                ...await prepareContainedAttempt({
+                    orchestratorHome: this.dependencies.orchestratorHome, canonicalRepository, runId, attemptId,
+                    operationId: worker, workflowGeneration, bootId: this.dependencies.bootId,
+                }),
+            }),
+            snapshot: (worktreePath) => this.dependencies.git.snapshot(worktreePath),
+            readReport: async (path) => readRegularFile(path).then((bytes) => ({ status: 'available', bytes }))
+                .catch((error) => isErrorCode(error, 'ENOENT') ? { status: 'absent' } : { status: 'unknown' }),
+            processStartIdentity: readProcessStartIdentity,
+            inspectProcess: inspectReportProcess,
+            launch: async ({ attempt, worktreePath, signal, onSpawned }) => {
+                try {
+                    const result = await (this.dependencies.process ?? new CodexProcess()).run({
+                        codexPath: config.codex.command, cwd: worktreePath, schemaPath: attempt.schemaPath,
+                        reportPath: attempt.reportPath, toolHome: attempt.toolHome, tmpDir: attempt.tmpDir,
+                        safePath: this.dependencies.safePath, parentCodexHome: this.dependencies.parentCodexHome,
+                        parentEnv: process.env,
+                        prompt: [
+                            `Package profile instructions: ${attempt.profile.developerInstructions}`,
+                            `Follow the exact operation at ${attempt.operationPath}.`,
+                            `The operation's immutable workflow root is ${attempt.workflowRoot}.`,
+                            ...promptFacts,
+                        ].join('\n'),
+                        timeoutMs: config.codex.timeoutMs, idleTimeoutMs: config.codex.idleTimeoutMs,
+                        operationPolicy: attempt.policy, executionProfile: attempt.profile, onSpawned,
+                    }, signal);
+                    if (result.kind === 'cancelled')
+                        return { status: 'cancelled' };
+                    if (['spawn-failed', 'transport-failed', 'timeout', 'idle-timeout'].includes(result.kind))
+                        return { status: 'retryable', code: `mutable-operation-${result.kind}` };
+                    if (result.kind !== 'completed' || result.report.kind !== 'available')
+                        return { status: 'retryable', code: 'mutable-operation-report-unavailable' };
+                    return { status: 'completed', reportBytes: result.report.bytes };
+                }
+                catch (error) {
+                    return error instanceof ProcessQuiescenceError
+                        ? { status: 'safe-halt' }
+                        : { status: 'retryable', code: 'mutable-operation-launch-failed' };
+                }
+            },
+        });
+    }
+}
+function implementationPromptFacts(input) {
+    const task = input.operation === 'qualification-repair' ? [
+        `Pre-implementation qualification repair for issue #${input.issue.number}: ${input.issue.title}`,
+        'Do not implement the issue acceptance criteria yet. Repair only the reported scoped-check failures so the existing worktree qualifies for implementation.',
+        'You may modify the product files required by those failures. Return changedFiles as the complete cumulative worktree change set.',
+    ] : [`Implement issue #${input.issue.number}: ${input.issue.title}`];
+    return [...task,
+        `Implementation cycle: ${input.cycle}.`,
+        ...(input.reviewFeedbackRound ? [`Pull-request feedback repair round: ${input.reviewFeedbackRound}.`] : []),
+        ...(input.reviewFeedback?.length ? [`Frozen trusted pull-request feedback: ${canonicalJson(input.reviewFeedback)}`] : []),
+        ...(input.operation !== 'qualification-repair' ? [`Frozen acceptance criteria: ${canonicalJson(input.frozenCriteria)}`] : []),
+        ...(input.reworkFindings.length > 0 ? [`Repair these verified findings: ${canonicalJson(input.reworkFindings)}`] : []),
+        ...(input.phaseFacts?.length ? [`Phase-owned invocation correlation: ${canonicalJson(input.phaseFacts)}`] : []),
+        ...(input.repairOnly ? ['Report repair only: do not modify any worktree file; emit a schema-valid implementation report for the existing change.'] : []),
+        'Do not commit, push, publish, or print credentials or local auth paths.',
+    ];
 }
 export class ContainedProofAgent {
     dependencies;
@@ -326,94 +892,53 @@ export class ContainedProofAgent {
     async run(input) {
         if (!input.workflowGeneration)
             throw new Error('proof workflow generation is required');
+        if (!input.iosProofInputs)
+            throw new Error('runner-owned iOS proof inputs are required');
         const config = this.dependencies.config();
-        const canonicalRepository = `${config.github.owner.toLowerCase()}/${config.github.repo.toLowerCase()}`;
-        const worktreePath = resolve(this.dependencies.targetRoot, config.runner.workspaceRoot, `issue-${input.issue.number}`);
-        const attempt = await prepareContainedAttempt({
-            orchestratorHome: this.dependencies.orchestratorHome,
-            canonicalRepository,
-            runId: input.runId,
-            attemptId: (this.dependencies.createAttemptId ?? randomUUID)(),
-            operationId: 'acceptance-proof',
-            workflowGeneration: input.workflowGeneration,
-            bootId: this.dependencies.bootId,
-        });
+        const issueWorktreePath = resolve(this.dependencies.targetRoot, config.runner.workspaceRoot, `issue-${input.issue.number}`);
+        const worktreePath = input.worktreePath ? resolve(input.worktreePath) : issueWorktreePath;
         const artifactRoot = resolve(worktreePath, config.proof.artifactDir);
-        const snapshotRoot = dirname(attempt.sourceSkillPath ?? attempt.operationPath);
-        const iosLeaseRoot = join(resolve(this.dependencies.orchestratorHome), 'v2', sha256(canonicalRepository), 'leases');
-        const iosLeaseArtifact = join(artifactRoot, input.proofId, 'ios-lease.json');
-        const iosTooling = await discoverIosTooling(this.dependencies.processExecutor, this.dependencies.iosXcrunPath);
         const before = await artifactInventory(artifactRoot, config.proof.artifactDir);
-        try {
-            const result = await (this.dependencies.process ?? new CodexProcess()).run({
-                codexPath: config.codex.command,
-                cwd: worktreePath,
-                schemaPath: attempt.schemaPath,
-                reportPath: attempt.reportPath,
-                toolHome: attempt.toolHome,
-                tmpDir: attempt.tmpDir,
-                safePath: this.dependencies.safePath,
-                parentCodexHome: this.dependencies.parentCodexHome,
-                parentEnv: process.env,
-                prompt: [
-                    `Package profile instructions: ${attempt.profile.developerInstructions}`,
-                    `Follow the exact operation at ${attempt.operationPath}.`,
-                    `The operation's immutable workflow root is ${attempt.workflowRoot}.`,
-                    `Independently prove issue #${input.issue.number}.`,
-                    `Frozen acceptance criteria: ${canonicalJson(input.frozenCriteria)}`,
-                    `Checked change digest: ${input.checkedChangeSha256}.`,
-                    `Checked changed files: ${canonicalJson(input.changedFiles)}.`,
-                    `Configured check receipts: ${canonicalJson(input.checks)}.`,
-                    `Write evidence only below ${config.proof.artifactDir}.`,
-                    'When a frozen criterion has a browser surface, follow references/browser.md from the exact acceptance-proof skill snapshot.',
-                    'When a frozen criterion has an Android surface, follow references/android.md from the exact acceptance-proof skill snapshot.',
-                    ...(config.proof.android ? [
-                        `Runner-owned Android artifact paths: ${canonicalJson(input.runnerPreparedArtifactPaths)}.`,
-                        `Runner-owned Android preparation warnings: ${canonicalJson(input.runnerPreparationWarnings)}.`,
-                        'The trusted Runner owns emulator, build, adb, lease, capture, and cleanup actions. Do not invoke adb, emulator, Flutter run, or an Android lease helper.',
-                        'Inspect Runner artifacts when present. If preparation warnings are present, continue with all available non-visual evidence and preserve the warning as a residual risk; Android infrastructure failure alone must not block delivery.',
-                    ] : [
-                        'Runner-owned Android proof is not configured for this repository. Do not invoke adb, emulator, Flutter run, or an Android lease helper; return a typed tool blocker for Android criteria.',
-                    ]),
-                    'When a frozen criterion has an iOS surface, follow references/ios.md from the exact acceptance-proof skill snapshot.',
-                    `iOS lease helper: ${join(snapshotRoot, 'tools', 'ios-lease.mjs')}.`,
-                    `iOS lease root: ${iosLeaseRoot}.`,
-                    `iOS lease artifact: ${iosLeaseArtifact}.`,
-                    `iOS lease proof ID: ${input.proofId}.`,
-                    `iOS lease owner PID: ${process.pid}.`,
-                    `iOS xcrun path: ${this.dependencies.iosXcrunPath}.`,
-                    ...(iosTooling ? [
-                        `iOS runtime ID: ${iosTooling.runtimeId}.`,
-                        `iOS device type ID: ${iosTooling.deviceTypeId}.`,
-                    ] : ['iOS Simulator tooling discovery is unavailable; return a typed tool blocker for an iOS surface.']),
-                    ...(input.repairOnly ? [`Proof Report repair only: ${canonicalJson(input.repairFindings)} Do not modify product or evidence files.`] : []),
-                    'Do not modify product files, commit, push, publish, or print credentials or local auth paths.',
-                ].join('\n'),
-                timeoutMs: config.codex.timeoutMs,
-                idleTimeoutMs: config.codex.idleTimeoutMs,
-                operationPolicy: attempt.policy,
-                executionProfile: attempt.profile,
-            }, input.signal);
-            if (result.kind === 'cancelled')
-                return { kind: 'cancelled' };
-            if (['spawn-failed', 'transport-failed', 'timeout', 'idle-timeout'].includes(result.kind)) {
-                return { kind: 'transport-failed', resumable: true };
-            }
-            if (result.kind !== 'completed' || result.report.kind !== 'available')
-                return { kind: 'internal-error' };
-            const after = await artifactInventory(artifactRoot, config.proof.artifactDir);
-            return {
-                kind: 'report',
-                report: decodeAgentReportForValidation(result.report.bytes, ['visualEvidence', 'blocker']),
-                proofPhaseChangedFiles: changedArtifactPaths(before, after),
-            };
+        if (!input.invocationState)
+            return { kind: 'internal-error' };
+        if (input.repairOnly && await input.invocationState.read() === undefined
+            && !artifactInventoryMatches(before, input.repairArtifactSha256)) {
+            return { kind: 'internal-error', code: 'proof-report-repair-artifact-drift' };
         }
-        catch (error) {
-            if (error instanceof ProcessQuiescenceError) {
-                throw new ProofQuiescenceError(error.pid, error.processGroupId, () => waitForProcessGroupAbsent(error.processGroupId));
+        const result = await this.dependencies.operation.run({
+            operation: 'acceptance-proof', runId: input.runId, worktreePath,
+            workflowGeneration: input.workflowGeneration, signal: input.signal, invocationState: input.invocationState,
+            beforeLaunch: input.beforeLaunch,
+            promptFacts: [
+                `Proof ID: ${input.proofId}. Issue: ${canonicalJson(input.issue)}.`,
+                `Frozen acceptance criteria: ${canonicalJson(input.frozenCriteria)}.`,
+                `Checked change: ${input.checkedChangeSha256}; files: ${canonicalJson(input.changedFiles)}; checks: ${canonicalJson(input.checks)}.`,
+                `Runner artifacts: ${canonicalJson(input.runnerPreparedArtifactPaths)}; hashes: ${canonicalJson(input.runnerPreparedArtifactSha256)}; warnings: ${canonicalJson(input.runnerPreparationWarnings)}.`,
+                `Runner-owned immutable iOS proof inputs: ${canonicalJson(input.iosProofInputs)}.`,
+                ...(input.iosProofInputs.runtimeId === null || input.iosProofInputs.deviceTypeId === null
+                    ? ['iOS Simulator tooling discovery is unavailable; return a typed tool blocker for an iOS surface.'] : []),
+                `Report repair: ${canonicalJson({ repairOnly: input.repairOnly, findings: input.repairFindings })}.`,
+                ...(input.repairOnly ? [`Immutable pre-repair artifact inventory: ${canonicalJson(input.repairArtifactSha256)}.`] : []),
+            ],
+        });
+        if (result.status === 'cancelled')
+            return { kind: 'cancelled' };
+        if (result.status !== 'completed') {
+            if (input.repairOnly && await input.invocationState.read() === undefined
+                && !artifactInventoryMatches(await artifactInventory(artifactRoot, config.proof.artifactDir), input.repairArtifactSha256)) {
+                return { kind: 'internal-error', code: 'proof-report-repair-artifact-drift' };
             }
-            return { kind: 'internal-error' };
+            return { kind: 'deferred', code: result.code };
         }
+        const after = await artifactInventory(artifactRoot, config.proof.artifactDir);
+        const runnerPrepared = new Set(input.runnerPreparedArtifactPaths);
+        const changed = before.size === 0
+            ? [...after.keys()].filter((path) => !runnerPrepared.has(path)).sort()
+            : changedArtifactPaths(before, after);
+        return {
+            kind: 'report', report: decodeAgentReportForValidation(result.reportBytes, ['visualEvidence', 'blocker']),
+            proofPhaseChangedFiles: changed, proofPhaseArtifactSha256: Object.fromEntries([...after.entries()].sort()),
+        };
     }
 }
 export async function resolveCodexExecutable(command, safePath) {
@@ -453,7 +978,7 @@ export function createV2Runtime(input) {
         codexExecutable = { command, path };
         return path;
     };
-    const git = input.git ?? new LocalGitRunIssueAdapter(commandExecutor);
+    const git = input.git ?? new LocalGitRunIssueAdapter(commandExecutor, targetRoot);
     const proofFreshnessGit = git;
     const controller = new AbortController();
     let currentConfig;
@@ -481,13 +1006,6 @@ export function createV2Runtime(input) {
         git,
         now,
     });
-    const proofAgent = input.proofAgent ?? new ContainedProofAgent({
-        ...containedDependencies(),
-        targetRoot,
-        androidAdbPath,
-        iosXcrunPath,
-        processExecutor: commandExecutor,
-    });
     const androidProofController = new RunnerAndroidProofController({
         adbPath: androidAdbPath,
         emulatorPath: androidEmulatorPath,
@@ -495,6 +1013,10 @@ export function createV2Runtime(input) {
         now: () => new Date(now()),
     });
     const reportOperation = new InjectedContainedReportOperation({
+        host: hostname(),
+        bootId: input.bootId,
+        now,
+        createAttemptId: input.createAttemptId ?? randomUUID,
         prepare: async ({ operation, attemptId, runId, workflowGeneration }) => ({
             operation,
             generationHash: workflowGeneration.generationHash,
@@ -508,30 +1030,44 @@ export function createV2Runtime(input) {
                 bootId: input.bootId,
             }),
         }),
-        snapshot: (worktreePath) => git.snapshot(worktreePath),
-        launch: async ({ attempt, worktreePath, promptFacts, signal, onLaunched }) => {
+        snapshot: (worktreePath, operation) => operation === 'acceptance-proof' && proofFreshnessGit.snapshotIgnoringUntrackedRoot
+            ? proofFreshnessGit.snapshotIgnoringUntrackedRoot(worktreePath, requireConfig(currentConfig).proof.artifactDir)
+            : git.snapshot(worktreePath),
+        readReport: async (path) => readRegularFile(path).then((bytes) => ({ status: 'available', bytes }))
+            .catch((error) => isErrorCode(error, 'ENOENT') ? { status: 'absent' } : { status: 'unknown' }),
+        settleAttempt: async (attempt) => attempt.tmpDir
+            ? rm(join(dirname(attempt.tmpDir), 'read-view'), { recursive: true, force: true })
+            : Promise.reject(new Error('report operation attempt temporary directory is missing')),
+        processStartIdentity: readProcessStartIdentity,
+        inspectProcess: inspectReportProcess,
+        launch: async ({ operation, attempt, worktreePath, promptFacts, signal, onSpawned }) => {
             const config = requireConfig(currentConfig);
             if (!attempt.schemaPath || !attempt.reportPath || !attempt.toolHome || !attempt.tmpDir
                 || !attempt.profile || !attempt.operationPath || !attempt.workflowRoot) {
                 return { status: 'blocked', kind: 'safety', code: 'report-operation-attempt-incomplete' };
             }
             let readView;
-            try {
-                readView = await materializeReportReadView({
-                    worktreePath,
-                    destination: join(dirname(attempt.tmpDir), 'read-view'),
-                    deniedPaths: config.deny.readPaths,
-                });
-            }
-            catch {
-                return { status: 'blocked', kind: 'safety', code: 'report-operation-read-view-failed' };
+            if (operation !== 'spec-author' && operation !== 'acceptance-proof') {
+                try {
+                    readView = await materializeReportReadView({
+                        worktreePath,
+                        destination: join(dirname(attempt.tmpDir), 'read-view'),
+                        deniedPaths: config.deny.readPaths,
+                    });
+                }
+                catch {
+                    return { status: 'blocked', kind: 'safety', code: 'report-operation-read-view-failed' };
+                }
             }
+            const revisionPath = operation === 'spec-author'
+                ? join(dirname(attempt.reportPath), `revision-${promptFacts[0]}.md`)
+                : undefined;
             let result;
             let cleanupAfterSafeHalt = false;
             try {
                 result = await containedProcess.run({
                     codexPath: config.codex.command,
-                    cwd: readView,
+                    cwd: operation === 'spec-author' ? dirname(attempt.reportPath) : operation === 'acceptance-proof' ? worktreePath : readView,
                     schemaPath: attempt.schemaPath,
                     reportPath: attempt.reportPath,
                     toolHome: attempt.toolHome,
@@ -539,7 +1075,21 @@ export function createV2Runtime(input) {
                     safePath: requireRuntimeString(input.safePath, 'safePath'),
                     parentCodexHome: requireRuntimeString(input.parentCodexHome, 'parentCodexHome'),
                     parentEnv: process.env,
-                    prompt: [
+                    prompt: operation === 'spec-author' ? [
+                        `Package profile instructions: ${attempt.profile.developerInstructions}`,
+                        `Follow the exact operation at ${attempt.operationPath}.`,
+                        `The operation's immutable workflow root is ${attempt.workflowRoot}.`,
+                        `Runner-provided facts: ${canonicalJson(promptFacts)}`,
+                        `Write the complete new immutable revision only to ${revisionPath}. Return that exact absolute path and its SHA-256 in the report.`,
+                        'Do not modify the product worktree, prior revisions, external state, or any .env file.',
+                    ].join('\n') : operation === 'acceptance-proof' ? [
+                        `Package profile instructions: ${attempt.profile.developerInstructions}`,
+                        `Follow the exact operation at ${attempt.operationPath}.`,
+                        `The operation's immutable workflow root is ${attempt.workflowRoot}.`,
+                        `Runner-provided proof facts:\n${promptFacts.join('\n')}`,
+                        `Write evidence only below ${config.proof.artifactDir}. CheckedChange is the sole authority for completed checks.`,
+                        'Do not modify product files, commit, push, publish, use network or MCP tools, or print credentials or local auth paths.',
+                    ].join('\n') : [
                         `Package profile instructions: ${attempt.profile.developerInstructions}`,
                         `Follow the exact operation at ${attempt.operationPath}.`,
                         `The operation's immutable workflow root is ${attempt.workflowRoot}.`,
@@ -551,27 +1101,18 @@ export function createV2Runtime(input) {
                     idleTimeoutMs: config.codex.idleTimeoutMs,
                     operationPolicy: attempt.policy,
                     executionProfile: attempt.profile,
-                    ...(onLaunched ? { onSpawned: onLaunched } : {}),
+                    onSpawned,
                 }, signal);
             }
             catch (error) {
                 if (error instanceof ProcessQuiescenceError) {
                     cleanupAfterSafeHalt = true;
-                    return {
-                        status: 'safe-halt',
-                        pid: error.pid,
-                        processGroupId: error.processGroupId,
-                        startedAt: now(),
-                        waitForAbsence: async () => {
-                            await waitForProcessGroupAbsent(error.processGroupId);
-                            await rm(readView, { recursive: true, force: true });
-                        },
-                    };
+                    return { status: 'safe-halt' };
                 }
                 throw error;
             }
             finally {
-                if (!cleanupAfterSafeHalt)
+                if (readView && !cleanupAfterSafeHalt)
                     await rm(readView, { recursive: true, force: true });
             }
             if (result.kind === 'cancelled')
@@ -588,195 +1129,101 @@ export function createV2Runtime(input) {
             return { status: 'completed', reportBytes: result.report.bytes };
         },
     });
+    const proofAgent = input.proofAgent ?? new ContainedProofAgent({
+        config: () => requireConfig(currentConfig), targetRoot, operation: reportOperation,
+    });
     const implementationReviewer = new ContainedImplementationReviewer({
         operation: reportOperation,
-        createAttemptId: input.createAttemptId ?? randomUUID,
     });
-    const createAttemptId = input.createAttemptId ?? randomUUID;
     const specOperation = {
-        author: async ({ context, state, mode, signal, onPrepared, onLaunched }) => {
-            const attemptId = createAttemptId();
-            const sessionId = state.authorSessionId ?? randomUUID();
-            let attempt;
+        author: async ({ context, state, mode, authorSessionId: sessionId, signal, invocationState }) => {
+            let completedAttemptId;
             try {
-                attempt = await prepareContainedAttempt({
-                    orchestratorHome, canonicalRepository: requireCanonicalRepository(currentConfig), runId: context.runId,
-                    attemptId, operationId: 'spec-author', workflowGeneration: context.workflowGeneration, bootId: input.bootId,
-                });
-                const revisionPath = join(dirname(attempt.reportPath), `revision-${state.revisions.length + 1}.md`);
-                await onPrepared({ attemptId, sessionId, reportPath: attempt.reportPath, revisionPath });
-                const config = requireConfig(currentConfig);
-                const result = await containedProcess.run({
-                    codexPath: config.codex.command, cwd: dirname(attempt.reportPath), schemaPath: attempt.schemaPath,
-                    reportPath: attempt.reportPath, toolHome: attempt.toolHome, tmpDir: attempt.tmpDir,
-                    safePath: requireRuntimeString(input.safePath, 'safePath'), parentCodexHome: requireRuntimeString(input.parentCodexHome, 'parentCodexHome'),
-                    parentEnv: process.env, timeoutMs: config.codex.timeoutMs, idleTimeoutMs: config.codex.idleTimeoutMs,
-                    operationPolicy: attempt.policy, executionProfile: attempt.profile,
-                    onSpawned: ({ pid, processGroupId }) => onLaunched({ attemptId, sessionId, pid, processGroupId }),
-                    prompt: [
-                        `Package profile instructions: ${attempt.profile.developerInstructions}`,
-                        `Follow the exact operation at ${attempt.operationPath}.`,
-                        `The immutable workflow root is ${attempt.workflowRoot}.`,
-                        `Author mode: ${mode}. Issue authority: ${canonicalJson(context.issue)}.`,
-                        `Frozen criteria: ${canonicalJson(context.frozenCriteria)}.`,
+                const result = await reportOperation.run({
+                    operation: 'spec-author', runId: context.runId, worktreePath: context.worktreePath,
+                    workflowGeneration: context.workflowGeneration, signal, invocationState,
+                    promptFacts: [
+                        String(state.revisions.length + 1),
+                        `Author session ID: ${sessionId}. Author mode: ${mode}.`,
+                        `Issue authority and frozen criteria: ${canonicalJson({ issue: context.issue, frozenCriteria: context.frozenCriteria })}.`,
                         `Prior revisions and review state: ${canonicalJson({ revisions: state.revisions, review: state.review })}.`,
-                        `Write the complete new immutable revision only to ${revisionPath}. Return that exact absolute path and its SHA-256 in the report.`,
-                        'Do not modify the product worktree, prior revisions, external state, or any .env file.',
-                    ].join('\n'),
-                }, signal);
-                if (result.kind === 'cancelled')
+                    ],
+                });
+                if (result.status === 'cancelled')
                     return { status: 'cancelled' };
-                if (['spawn-failed', 'transport-failed', 'timeout', 'idle-timeout'].includes(result.kind))
-                    return { status: 'retryable', code: `spec-author-${result.kind}` };
-                if (result.kind !== 'completed' || result.report.kind !== 'available')
-                    return { status: 'retryable', code: 'spec-author-report-invalid' };
-                const report = decodeAgentReportForValidation(result.report.bytes);
-                if (report.status !== 'ready' || report.specPath !== revisionPath || report.specSha256 === null)
-                    return { status: 'retryable', code: 'spec-author-report-invalid' };
+                if (result.status === 'retryable' || result.status === 'safe-halt')
+                    return { status: 'retryable', code: result.code };
+                if (result.status === 'blocked')
+                    return { status: 'blocked', kind: result.kind, code: result.code };
+                completedAttemptId = result.attemptId;
+                const invocation = await invocationState.read();
+                if (!invocation || invocation.operation !== 'spec-author' || invocation.attemptId !== result.attemptId) {
+                    return { status: 'blocked', kind: 'safety', code: 'spec-author-invocation-correlation-missing' };
+                }
+                const revisionPath = join(dirname(invocation.reportPath), `revision-${state.revisions.length + 1}.md`);
+                const report = decodeAgentReportForValidation(result.reportBytes);
+                if (report.status !== 'ready' || report.specPath !== revisionPath || report.specSha256 === null) {
+                    return { status: 'invalid', code: 'spec-author-report-invalid', attemptId: result.attemptId };
+                }
                 const content = await readRegularFile(revisionPath);
                 if (report.specSha256 !== sha256(content))
-                    return { status: 'retryable', code: 'spec-author-report-invalid' };
+                    return { status: 'invalid', code: 'spec-author-report-invalid', attemptId: result.attemptId };
                 const previous = state.revisions.at(-1) ?? null;
                 return { status: 'completed', value: createSpecRevision({
                         revision: state.revisions.length + 1, path: revisionPath, content: content.toString('utf8'),
                         evidence: [{ path: context.issue.url, sha256: sha256(canonicalJson(context.issue)), description: 'Frozen issue authority' }],
-                        author: { attemptId, sessionId }, previousRevision: previous,
+                        author: { attemptId: result.attemptId, sessionId }, previousRevision: previous,
                     }) };
             }
             catch (error) {
-                if (error instanceof ProcessQuiescenceError) {
-                    try {
-                        await waitForProcessGroupAbsent(error.processGroupId);
-                        return { status: 'retryable', code: 'spec-author-process-quiescence' };
-                    }
-                    catch {
-                        return { status: 'blocked', kind: 'safety', code: 'spec-author-process-absence-unconfirmed' };
-                    }
-                }
-                return { status: 'retryable', code: 'spec-author-report-invalid' };
+                return completedAttemptId
+                    ? { status: 'invalid', code: 'spec-author-report-invalid', attemptId: completedAttemptId }
+                    : { status: 'retryable', code: 'spec-author-report-invalid' };
             }
         },
-        review: async ({ context, state, mode, signal, onPrepared, onLaunched }) => {
-            const attemptId = createAttemptId();
-            const sessionId = state.review.reviewer?.sessionId ?? randomUUID();
+        review: async ({ context, state, mode, reviewerSessionId: sessionId, signal, invocationState }) => {
+            let completedAttemptId;
             try {
-                const attempt = await prepareContainedAttempt({
-                    orchestratorHome, canonicalRepository: requireCanonicalRepository(currentConfig), runId: context.runId,
-                    attemptId, operationId: 'spec-review', workflowGeneration: context.workflowGeneration, bootId: input.bootId,
-                });
-                await onPrepared({ attemptId, sessionId, reportPath: attempt.reportPath });
-                const config = requireConfig(currentConfig);
-                const result = await containedProcess.run({
-                    codexPath: config.codex.command, cwd: context.worktreePath, schemaPath: attempt.schemaPath,
-                    reportPath: attempt.reportPath, toolHome: attempt.toolHome, tmpDir: attempt.tmpDir,
-                    safePath: requireRuntimeString(input.safePath, 'safePath'), parentCodexHome: requireRuntimeString(input.parentCodexHome, 'parentCodexHome'),
-                    parentEnv: process.env, timeoutMs: config.codex.timeoutMs, idleTimeoutMs: config.codex.idleTimeoutMs,
-                    operationPolicy: attempt.policy, executionProfile: attempt.profile,
-                    onSpawned: ({ pid, processGroupId }) => onLaunched({ attemptId, sessionId, pid, processGroupId }),
-                    prompt: [
-                        `Package profile instructions: ${attempt.profile.developerInstructions}`,
-                        `Follow the exact operation at ${attempt.operationPath}.`,
+                const result = await reportOperation.run({
+                    operation: 'spec-review', runId: context.runId, worktreePath: context.worktreePath,
+                    workflowGeneration: context.workflowGeneration, signal, invocationState,
+                    forbiddenAttemptIds: state.revisions.map((revision) => revision.author.attemptId),
+                    promptFacts: [
                         `Reviewer session ID: ${sessionId}. Review mode: ${mode}.`,
                         `Issue authority and frozen criteria: ${canonicalJson({ issue: context.issue, frozenCriteria: context.frozenCriteria })}.`,
                         `Immutable spec delivery state: ${canonicalJson(state)}.`,
-                        'Return only the package spec-review report. Do not edit files or external state.',
-                    ].join('\n'),
-                }, signal);
-                if (result.kind === 'cancelled')
+                    ],
+                });
+                if (result.status === 'cancelled')
                     return { status: 'cancelled' };
-                if (['spawn-failed', 'transport-failed', 'timeout', 'idle-timeout'].includes(result.kind))
-                    return { status: 'retryable', code: `spec-review-${result.kind}` };
-                if (result.kind !== 'completed' || result.report.kind !== 'available')
-                    return { status: 'retryable', code: 'spec-review-report-invalid' };
-                const raw = decodeAgentReportForValidation(result.report.bytes);
+                if (result.status === 'retryable' || result.status === 'safe-halt')
+                    return { status: 'retryable', code: result.code };
+                if (result.status === 'blocked')
+                    return { status: 'blocked', kind: result.kind, code: result.code };
+                completedAttemptId = result.attemptId;
+                const raw = decodeAgentReportForValidation(result.reportBytes);
                 if (raw.mode !== mode || raw.reviewerSessionId !== sessionId || !Array.isArray(raw.coverage) || !Array.isArray(raw.defects)
                     || !Array.isArray(raw.affectedDefectIds) || !Array.isArray(raw.affectedContracts) || !Array.isArray(raw.acceptedRisks)
                     || typeof raw.coverageInvalidated !== 'boolean'
                     || !['approved', 'needs-work', 'rejected'].includes(raw.verdict))
-                    return { status: 'retryable', code: 'spec-review-report-invalid' };
+                    return { status: 'invalid', code: 'spec-review-report-invalid', attemptId: result.attemptId };
                 const target = state.revisions.at(-1);
                 const defects = validateCodeReviewDefects(raw.defects, target.revision);
                 const report = {
                     version: 1, targetRevision: target.revision, targetSha256: target.revisionSha256, mode,
-                    verdict: raw.verdict, reviewer: { attemptId, sessionId },
+                    verdict: raw.verdict, reviewer: { attemptId: result.attemptId, sessionId },
                     coverage: raw.coverage, defects,
                     affectedDefectIds: raw.affectedDefectIds,
                     affectedContracts: raw.affectedContracts,
                     closureRequestSha256: mode === 'closure' ? state.review.closureRequestSha256 : null,
                     acceptedRisks: [], coverageInvalidated: raw.coverageInvalidated,
                 };
-                return { status: 'completed', value: report, reportSha256: sha256(result.report.bytes) };
-            }
-            catch (error) {
-                if (error instanceof ProcessQuiescenceError) {
-                    try {
-                        await waitForProcessGroupAbsent(error.processGroupId);
-                        return { status: 'retryable', code: 'spec-review-process-quiescence' };
-                    }
-                    catch {
-                        return { status: 'blocked', kind: 'safety', code: 'spec-review-process-absence-unconfirmed' };
-                    }
-                }
-                return { status: 'retryable', code: 'spec-review-report-invalid' };
-            }
-        },
-        recover: async ({ context, state, signal }) => {
-            const invocation = state.invocation;
-            if (!invocation || signal.aborted)
-                return signal.aborted ? { status: 'cancelled' } : { status: 'blocked', kind: 'safety', code: 'spec-recovery-invocation-missing' };
-            if (invocation.status === 'launched') {
-                try {
-                    await waitForProcessGroupAbsent(invocation.processGroupId);
-                }
-                catch {
-                    return { status: 'blocked', kind: 'safety', code: 'spec-process-absence-unconfirmed' };
-                }
-            }
-            if (!invocation.reportPath)
-                return { status: 'retryable', code: `spec-${invocation.purpose}-transport-recovery` };
-            let reportBytes;
-            try {
-                reportBytes = await readRegularFile(invocation.reportPath);
-            }
-            catch {
-                return { status: 'retryable', code: `spec-${invocation.purpose}-transport-recovery` };
-            }
-            if (invocation.purpose === 'author') {
-                if (!invocation.revisionPath)
-                    return { status: 'retryable', code: 'spec-author-report-invalid' };
-                try {
-                    const raw = decodeAgentReportForValidation(reportBytes);
-                    const content = await readRegularFile(invocation.revisionPath);
-                    if (raw.status !== 'ready' || raw.specPath !== invocation.revisionPath || raw.specSha256 !== sha256(content))
-                        return { status: 'retryable', code: 'spec-author-report-invalid' };
-                    return { status: 'completed', value: createSpecRevision({
-                            revision: state.revisions.length + 1, path: invocation.revisionPath, content: content.toString('utf8'),
-                            evidence: [{ path: context.issue.url, sha256: sha256(canonicalJson(context.issue)), description: 'Frozen issue authority' }],
-                            author: { attemptId: invocation.attemptId, sessionId: invocation.sessionId }, previousRevision: state.revisions.at(-1) ?? null,
-                        }) };
-                }
-                catch {
-                    return { status: 'retryable', code: 'spec-author-report-invalid' };
-                }
-            }
-            try {
-                const raw = decodeAgentReportForValidation(reportBytes);
-                if (raw.mode !== invocation.mode || raw.reviewerSessionId !== invocation.sessionId || !Array.isArray(raw.coverage)
-                    || !Array.isArray(raw.defects) || !Array.isArray(raw.affectedDefectIds) || !Array.isArray(raw.affectedContracts)
-                    || typeof raw.coverageInvalidated !== 'boolean' || !['approved', 'needs-work', 'rejected'].includes(raw.verdict)) {
-                    return { status: 'retryable', code: 'spec-review-report-invalid' };
-                }
-                const defects = validateCodeReviewDefects(raw.defects, invocation.targetRevision);
-                return { status: 'completed', reportSha256: sha256(reportBytes), value: {
-                        version: 1, targetRevision: invocation.targetRevision, targetSha256: invocation.targetSha256,
-                        mode: invocation.mode, verdict: raw.verdict,
-                        reviewer: { attemptId: invocation.attemptId, sessionId: invocation.sessionId }, coverage: raw.coverage, defects,
-                        affectedDefectIds: raw.affectedDefectIds, affectedContracts: raw.affectedContracts,
-                        closureRequestSha256: invocation.closureRequestSha256, acceptedRisks: [], coverageInvalidated: raw.coverageInvalidated,
-                    } };
+                return { status: 'completed', value: report, reportSha256: result.reportSha256 };
             }
             catch {
-                return { status: 'retryable', code: 'spec-review-report-invalid' };
+                return completedAttemptId
+                    ? { status: 'invalid', code: 'spec-review-report-invalid', attemptId: completedAttemptId }
+                    : { status: 'retryable', code: 'spec-review-report-invalid' };
             }
         },
     };
@@ -790,8 +1237,27 @@ export function createV2Runtime(input) {
             codex: { ...parsed.codex, command: await resolveRuntimeCodex(parsed.codex.command) },
         };
         const path = join(targetRoot, config.runner.stateDir, 'v2', 'run-state.json');
-        if (!runRecords)
-            runRecords = new FileRunRecordWriter(path);
+        if (!runRecords) {
+            const processStartIdentity = await readProcessStartIdentity(process.pid);
+            if (!processStartIdentity)
+                throw new Error('run-store owner process identity is unavailable');
+            runRecords = new FileRunRecordWriter(path, {
+                host: hostname(), bootId: input.bootId, pid: process.pid, processStartIdentity,
+                inspectProcessIdentity: async (pid) => {
+                    const identity = await readProcessStartIdentity(pid);
+                    if (identity)
+                        return { processStartIdentity: identity };
+                    try {
+                        process.kill(pid, 0);
+                        return 'unknown';
+                    }
+                    catch (error) {
+                        return isErrorCode(error, 'ESRCH') ? 'absent' : 'unknown';
+                    }
+                },
+                exclusiveRepositoryOwnership: true,
+            });
+        }
         currentConfig = config;
         return { bytes, config };
     };
@@ -806,6 +1272,11 @@ export function createV2Runtime(input) {
                 throw new Error('run store used before config');
             return runRecords.compareAndSwap(generation, next);
         },
+        markPublicationEffectPossible: async () => {
+            if (!runRecords?.markPublicationEffectPossible)
+                return;
+            await runRecords.markPublicationEffectPossible();
+        },
     };
     const capabilities = createCheckedChangeCapabilities();
     const proof = {
@@ -813,8 +1284,27 @@ export function createV2Runtime(input) {
             const config = requireConfig(currentConfig);
             const checked = capabilities.verifyAndRead(proofInput.checkedChange);
             const repoKey = sha256(checked.payload.canonicalRepository);
-            const proofRecords = new FileProofRecordWriter(join(orchestratorHome, 'v2', repoKey, 'proofs'));
-            const worktreePath = resolve(targetRoot, config.runner.workspaceRoot, `issue-${checked.payload.issueNumber}`);
+            const ownerProcessIdentity = await readProcessStartIdentity(process.pid);
+            if (!ownerProcessIdentity)
+                throw new Error('proof-store owner process identity is unavailable');
+            const proofRecords = new FileProofRecordWriter(join(orchestratorHome, 'v2', repoKey, 'proofs'), {
+                host: hostname(), bootId: input.bootId, pid: process.pid, processStartIdentity: ownerProcessIdentity,
+                inspectProcessIdentity: async (pid) => {
+                    const identity = await readProcessStartIdentity(pid);
+                    if (identity)
+                        return { processStartIdentity: identity };
+                    try {
+                        process.kill(pid, 0);
+                        return 'unknown';
+                    }
+                    catch (error) {
+                        return isErrorCode(error, 'ESRCH') ? 'absent' : 'unknown';
+                    }
+                },
+                exclusiveRepositoryOwnership: true,
+            });
+            const issueWorktreePath = resolve(targetRoot, config.runner.workspaceRoot, `issue-${checked.payload.issueNumber}`);
+            const worktreePath = proofInput.executionLease?.path ?? issueWorktreePath;
             const androidLease = new FileAndroidLeaseVerifier({
                 leaseRoot: join(orchestratorHome, 'v2', repoKey, 'leases'),
                 worktreeRoot: worktreePath,
@@ -835,18 +1325,33 @@ export function createV2Runtime(input) {
                 checkedChangeReader: capabilities,
                 proofRecords,
                 proofAgent,
-                inspectFreshness: async (payload) => ({
-                    ...await (proofFreshnessGit.snapshotIgnoringUntrackedRoot
-                        ? proofFreshnessGit.snapshotIgnoringUntrackedRoot(worktreePath, config.proof.artifactDir)
-                        : git.snapshot(worktreePath)),
-                    checkPolicySha256: sha256(canonicalJson(resolveIssueCheckPolicy(proofInput.issue.body, config.checks).checks)),
-                }),
+                inspectFreshness: async (payload, executionLease) => {
+                    const checkPolicySha256 = sha256(canonicalJson(resolveIssueCheckPolicy(proofInput.issue.body, config.checks).checks));
+                    if (payload.version === 1)
+                        return {
+                            ...await (proofFreshnessGit.snapshotIgnoringUntrackedRoot
+                                ? proofFreshnessGit.snapshotIgnoringUntrackedRoot(worktreePath, config.proof.artifactDir)
+                                : git.snapshot(worktreePath)),
+                            checkPolicySha256,
+                        };
+                    if (!executionLease || !git.candidateV2)
+                        throw new CandidateProofInspectionError('candidate-git-v2-required');
+                    const inspection = await git.candidateV2.inspectExecution({
+                        binding: payload.binding,
+                        lease: executionLease,
+                        artifactDir: config.proof.artifactDir,
+                    });
+                    if (inspection.kind === 'failed')
+                        throw new CandidateProofInspectionError(inspection.code);
+                    if (inspection.value !== 'matching')
+                        throw new CandidateProofInspectionError('candidate-materialization-mutated');
+                    return { bindingId: payload.binding.bindingId, candidateTreeSha: payload.binding.candidateTreeSha, checkPolicySha256 };
+                },
                 readArtifact: async (relativePath) => readRegularFile(resolve(worktreePath, relativePath)),
                 inspectArtifact: async (relativePath) => inspectRegularFile(resolve(worktreePath, relativePath)),
                 androidLease,
                 iosLease,
                 proofArtifactDir: config.proof.artifactDir,
-                createAttemptId: input.createAttemptId ?? randomUUID,
                 now,
                 signal: controller.signal,
             });
@@ -855,11 +1360,22 @@ export function createV2Runtime(input) {
             const runnerPreparedArtifactSha256 = {};
             const runnerPreparationWarnings = [];
             let preparationAttempted = false;
-            return acceptanceProof.proveChange({
+            if (!proofInput.workflowGeneration)
+                throw new Error('proof workflow generation is required');
+            const iosTooling = await discoverIosTooling(commandExecutor, iosXcrunPath);
+            const iosProofInputs = {
+                helperPath: join(proofInput.workflowGeneration.generationRoot, 'skills', 'acceptance-proof', 'tools', 'ios-lease.mjs'),
+                leaseRoot: join(orchestratorHome, 'v2', repoKey, 'leases'),
+                leaseArtifactPath: resolve(worktreePath, config.proof.artifactDir, proofInput.proofId, 'ios-lease.json'),
+                proofId: proofInput.proofId, ownerPid: process.pid, xcrunPath: iosXcrunPath,
+                runtimeId: iosTooling?.runtimeId ?? null, deviceTypeId: iosTooling?.deviceTypeId ?? null,
+            };
+            const result = await acceptanceProof.proveChange({
                 ...proofInput,
                 runnerPreparedArtifactPaths,
                 runnerPreparedArtifactSha256,
                 runnerPreparationWarnings,
+                iosProofInputs,
                 beforeAgentLaunch: async () => {
                     await proofInput.beforeAgentLaunch?.();
                     if (!androidRelevant || preparationAttempted)
@@ -885,6 +1401,21 @@ export function createV2Runtime(input) {
                     }
                 },
             });
+            if (checked.payload.version === 2 && proofInput.executionLease && git.candidateV2 && result.status === 'passed') {
+                const artifacts = result.receipt.publishableEvidence.map((artifact) => ({ relativePath: artifact.ref, sha256: artifact.sha256 }));
+                const copied = await git.candidateV2.copyProofArtifacts({
+                    lease: proofInput.executionLease,
+                    issueWorktreePath,
+                    artifactDir: config.proof.artifactDir,
+                    proofId: proofInput.proofId,
+                    artifacts,
+                });
+                if (copied.kind === 'failed')
+                    throw new CandidateProofInspectionError(copied.code);
+                if (copied.value.kind === 'artifact-conflict')
+                    throw new CandidateProofInspectionError('candidate-artifact-conflict');
+            }
+            return result;
         },
     };
     const runner = new RunIssue({
@@ -953,13 +1484,12 @@ export function createV2Runtime(input) {
                 const match = matches[0];
                 if (!match)
                     return undefined;
-                const reviewTarget = await input.pullRequests.getReviewTarget(match.number);
                 return {
                     url: match.url,
                     body: match.body,
                     number: match.number,
                     nodeId: match.nodeId,
-                    ...(reviewTarget ? { headSha: reviewTarget.headRefOid } : {}),
+                    ...(match.headSha ? { headSha: match.headSha } : {}),
                 };
             },
             createDraft: async ({ title, body, headBranch, baseBranch }) => input.pullRequests.createDraftPullRequest({ title, body, headBranch, baseBranch }),
@@ -976,7 +1506,6 @@ export function createV2Runtime(input) {
             run: ({ state, ...routeInput }) => new RouteCoordinator({
                 state,
                 operation: reportOperation,
-                createAttemptId: input.createAttemptId ?? randomUUID,
                 now,
                 createReceipt: ({ artifact, triage, review, decidedAt }) => {
                     if (artifact.status === 'blocked')
@@ -998,7 +1527,9 @@ export function createV2Runtime(input) {
         },
         routeContinuations: {
             direct: async () => ({ status: 'completed' }),
-            specRequired: (context, state, signal) => new SpecCoordinator({ state, operation: specOperation }).run(context, signal),
+            specRequired: (context, state, signal) => new SpecCoordinator({
+                state, operation: specOperation, createAuthorSessionId: randomUUID, createReviewerSessionId: randomUUID,
+            }).run(context, signal),
             awaitingUser: async (context, state, signal) => {
                 const config = requireConfig(currentConfig);
                 return new WaitingHumanCoordinator({
@@ -1018,11 +1549,12 @@ export function createV2Runtime(input) {
         implementationReviewer,
         waitForReviewProcessAbsence: waitForProcessGroupAbsent,
         checks: {
-            run: async ({ source, command, cwd, signal }) => {
+            supportsLaunchOwnership: true,
+            run: async ({ source, command, cwd, signal, onLaunched }) => {
                 const timeoutMs = requireConfig(currentConfig).codex.timeoutMs;
                 return source === 'issue'
-                    ? runProcessCheck(parseIssueCheckInvocation(command), cwd, signal, timeoutMs)
-                    : runShellCheck(command, cwd, signal, timeoutMs);
+                    ? runProcessCheck(parseIssueCheckInvocation(command), cwd, signal, timeoutMs, onLaunched)
+                    : runShellCheck(command, cwd, signal, timeoutMs, onLaunched);
             },
         },
         proof,
@@ -1078,7 +1610,10 @@ async function acquireOwnerLock(input) {
     }
 }
 async function readRegularFile(path) {
-    const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    const beforeOpen = await lstat(path);
+    if (beforeOpen.isSymbolicLink() || !beforeOpen.isFile())
+        throw new Error(`${path} is not a bounded regular file`);
+    const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
     try {
         const stat = await handle.stat();
         if (!stat.isFile() || stat.size > 5 * 1024 * 1024)
@@ -1101,15 +1636,20 @@ async function inspectRegularFile(path) {
         await handle.close();
     }
 }
-export async function runShellCheck(command, cwd, signal, timeoutMs) {
-    return runSpawnCheck('/bin/sh', ['-lc', command], cwd, signal, timeoutMs);
+export async function runShellCheck(command, cwd, signal, timeoutMs, onLaunched) {
+    return runSpawnCheck('/bin/sh', ['-lc', command], cwd, signal, timeoutMs, onLaunched);
 }
-async function runProcessCheck(invocation, cwd, signal, timeoutMs) {
-    return runSpawnCheck(invocation.file, invocation.args, cwd, signal, timeoutMs);
+async function runProcessCheck(invocation, cwd, signal, timeoutMs, onLaunched) {
+    return runSpawnCheck(invocation.file, invocation.args, cwd, signal, timeoutMs, onLaunched);
 }
-async function runSpawnCheck(file, args, cwd, signal, timeoutMs) {
+async function runSpawnCheck(file, args, cwd, signal, timeoutMs, onLaunched) {
     return new Promise((resolveCheck, rejectCheck) => {
-        const child = spawn(file, args, { cwd, detached: true, stdio: ['ignore', 'pipe', 'pipe'] });
+        const child = spawn('/bin/sh', [
+            '-c', 'IFS= read -r _ || exit 125; exec "$@"', 'codex-orchestrator-check-gate', file, ...args,
+        ], { cwd, detached: true, stdio: ['pipe', 'pipe', 'pipe'] });
+        const launchOwnership = child.pid && onLaunched
+            ? onLaunched({ pid: child.pid, processGroupId: child.pid })
+            : Promise.resolve();
         const chunks = [];
         let retained = 0;
         const outputHash = createHash('sha256');
@@ -1150,6 +1690,7 @@ async function runSpawnCheck(file, args, cwd, signal, timeoutMs) {
             }, 5_000);
             killTimer.unref();
         };
+        void launchOwnership.then(() => child.stdin.end('\n')).catch(() => terminate());
         signal.addEventListener('abort', terminate, { once: true });
         if (signal.aborted)
             terminate();
@@ -1189,6 +1730,7 @@ async function runSpawnCheck(file, args, cwd, signal, timeoutMs) {
                     rejectCheck(new Error(`Check exceeded ${timeoutMs}ms and was terminated.`));
                     return;
                 }
+                await launchOwnership;
                 resolveCheck({
                     status: code === 0 ? 'passed' : 'failed',
                     output: Buffer.concat(chunks),
@@ -1355,7 +1897,9 @@ async function artifactInventory(root, logicalRoot) {
     }
     if (rootStat.isSymbolicLink() || !rootStat.isDirectory())
         throw new Error('proof artifact root must be a direct directory');
+    const rootIdentity = await inspectSafeArtifactRoot(root);
     const visit = async (directory, relative) => {
+        await assertSafeArtifactRoot(rootIdentity);
         for (const entry of await readdir(directory, { withFileTypes: true })) {
             const childRelative = relative ? `${relative}/${entry.name}` : entry.name;
             const childPath = join(directory, entry.name);
@@ -1364,7 +1908,7 @@ async function artifactInventory(root, logicalRoot) {
             if (entry.isDirectory())
                 await visit(childPath, childRelative);
             else if (entry.isFile())
-                output.set(`${logicalRoot}/${childRelative}`, sha256(await readFile(childPath)));
+                output.set(`${logicalRoot}/${childRelative}`, sha256(await readRegularFileWithoutSymlinkAncestors(rootIdentity, childPath)));
             else
                 throw new Error('proof artifact tree contains a special file');
         }
@@ -1377,6 +1921,9 @@ function changedArtifactPaths(before, after) {
         .filter((path) => before.get(path) !== after.get(path))
         .sort();
 }
+function artifactInventoryMatches(actual, expected) {
+    return canonicalJson(Object.fromEntries([...actual.entries()].sort())) === canonicalJson(expected ?? null);
+}
 async function fingerprintRepositoryPath(root, relativePath) {
     const segments = relativePath.split('/');
     let current = root;
@@ -1427,6 +1974,49 @@ async function waitForProcessGroupAbsent(processGroupId) {
         await new Promise((resolveWait) => setTimeout(resolveWait, 1_000));
     }
 }
+async function readProcessStartIdentity(pid) {
+    if (!Number.isSafeInteger(pid) || pid <= 0)
+        return undefined;
+    if (platform() === 'linux') {
+        try {
+            const text = await readFile(`/proc/${pid}/stat`, 'utf8');
+            const close = text.lastIndexOf(') ');
+            const fields = close < 0 ? [] : text.slice(close + 2).trim().split(/\s+/u);
+            return fields[19] ? `linux:${fields[19]}` : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return await new Promise((resolveIdentity) => {
+        execFile('/bin/ps', ['-o', 'lstart=', '-p', String(pid)], { encoding: 'utf8' }, (error, stdout) => {
+            const value = error ? '' : stdout.trim().replace(/\s+/gu, ' ');
+            resolveIdentity(value ? `${platform()}:${value}` : undefined);
+        });
+    });
+}
+async function inspectReportProcess(invocation) {
+    const processStartIdentity = await readProcessStartIdentity(invocation.pid);
+    let processGroupAlive;
+    try {
+        process.kill(-invocation.processGroupId, 0);
+        processGroupAlive = true;
+    }
+    catch (error) {
+        if (isErrorCode(error, 'ESRCH'))
+            processGroupAlive = false;
+        else if (isErrorCode(error, 'EPERM'))
+            processGroupAlive = true;
+        else
+            processGroupAlive = 'unknown';
+    }
+    if (!processStartIdentity) {
+        return processGroupAlive === false
+            ? { status: 'absent', processGroupAlive: false }
+            : { status: 'unknown' };
+    }
+    return { status: 'present', processStartIdentity, processGroupAlive };
+}
 export async function materializeReportReadView(input) {
     await assertDisjointReadViewPaths(input.worktreePath, input.destination);
     const deniedPaths = normalizeReadViewDeniedPaths(input.deniedPaths);