create-walle 0.10.0 → 0.10.2

package/template/coding-task-manager/lib/model-proxy/stream-accounting.js

@@ -0,0 +1,205 @@
+'use strict';
+
+// §5 D-9 / §9 S-5, S-8: how many requests this proxy is still carrying, and what it was carrying when
+// it last stopped. Both truths live here on purpose -- the exit record is nothing but the counter read
+// at exit, and a second copy of that number is exactly how the two would drift apart.
+
+const fsp = require('node:fs/promises');
+const path = require('node:path');
+
+// The health probe is itself a request, so counting it would make the counter unobservable from the one
+// surface that reports it (the probe would always see its own 1). Only these two status paths are
+// exempt; every other path is counted, keep-alive or not.
+const UNCOUNTED_PATHS = new Set(['/_health', '/_status']);
+
+const EXIT_RECORD_VERSION = 1;
+
+function _pathOf(url) {
+  const raw = String(url || '');
+  const cut = raw.indexOf('?');
+  return cut === -1 ? raw : raw.slice(0, cut);
+}
+
+/**
+ * The process's own in-flight stream counter.
+ *
+ * @param {{startedAt?: string}} [options] `startedAt` is overridable only so a test can pin it.
+ */
+function createStreamAccounting({ startedAt = new Date().toISOString() } = {}) {
+  let openStreams = 0;
+  // §5 D-3: the loaded-code hash this process published, set ONCE after listen by
+  // proxy-instance-record.publishInstanceRecord(). Read here so the /_health answer and the on-disk
+  // record can never describe different code; null until then (a start that never binds publishes none).
+  // §5 D-7 (WP-2): `generation` and `draining` travel the same way -- the successor of a handoff is
+  // generation N+1 and says so on /_health while its predecessor is still draining.
+  let identity = null;
+  // §5 D-7 step 7: the drain ends when this counter reaches zero, so the DECREMENT is what notifies --
+  // there is no polling loop and no second copy of the count.
+  const idleWaiters = new Set();
+
+  function _notifyIdle() {
+    const waiters = [...idleWaiters];
+    idleWaiters.clear();
+    for (const waiter of waiters) {
+      try {
+        waiter();
+      } catch (err) {
+        // REPORT: a drain waiter that throws is not the counter's problem; the drain deadline owns the
+        // fallback, so the failure is worth one line and nothing else.
+        process.stderr.write(`[model-proxy] drain waiter failed: ${(err && err.message) || 'unknown'}\n`);
+      }
+    }
+  }
+
+  return {
+    /**
+     * Count every request this server is still answering. An idle keep-alive SOCKET carries no request
+     * and is never counted; a request is in flight until its response emits 'close' (whether it
+     * completed, errored or was cut by the client).
+     */
+    track(server) {
+      server.on('request', (req, res) => {
+        if (UNCOUNTED_PATHS.has(_pathOf(req.url))) return;
+        openStreams += 1;
+        res.once('close', () => {
+          openStreams -= 1;
+          if (openStreams === 0) _notifyIdle();
+        });
+      });
+    },
+    count() {
+      return openStreams;
+    },
+    snapshot() {
+      return { openStreams, startedAt, identity };
+    },
+    /** §5 D-3: the code this process loaded, published once; what /_health reports from. */
+    setIdentity(next) {
+      identity = next
+        ? {
+          closureHash: next.closureHash || null,
+          closureFiles: Array.isArray(next.closureFiles) ? next.closureFiles : [],
+          generation: Number.isSafeInteger(next.generation) && next.generation > 0 ? next.generation : 1,
+          draining: next.draining === true,
+        }
+        : null;
+    },
+    /** §5 D-7 step 8: the predecessor answers /_health with draining:true from here until it exits. */
+    setDraining(value) {
+      const current = identity || { closureHash: null, closureFiles: [], generation: 1, draining: false };
+      identity = { ...current, draining: value === true };
+    },
+    /**
+     * §5 D-7 step 7: called ONCE by the handoff drain, on the decrement that brings the count to zero.
+     * @returns {Function} unsubscribe, so a drain that was already forced does not hold a callback
+     */
+    onIdle(callback) {
+      idleWaiters.add(callback);
+      return () => idleWaiters.delete(callback);
+    },
+  };
+}
+
+/**
+ * §9 S-8: the process-identity fields the `/_health` answer reports alongside its existing ones. The
+ * count is read live, never cached, so the answer can never describe an earlier moment. `generation`
+ * and `draining` come from the published identity (a handoff successor is generation N+1 and reports
+ * `draining:true` while its predecessor drains); a process that published none reports today's
+ * 1/false.
+ */
+function healthFields(accounting) {
+  const snapshot = accounting.snapshot();
+  const identity = snapshot.identity || {};
+  return {
+    pid: process.pid,
+    generation: identity.generation || 1,
+    protocol: 'proxy-v1',
+    floor_version: 0,
+    open_streams: snapshot.openStreams,
+    draining: identity.draining === true,
+    started_at: snapshot.startedAt,
+    // §5 D-3: what CTM compares against its own disk hash to decide adopt vs hand off.
+    closure_hash: identity.closureHash || null,
+    closure_files: identity.closureFiles || [],
+  };
+}
+
+/**
+ * §9 S-8: the health fields merged into whatever JSON body the responder writes. The relay keeps
+ * ownership of its own five fields (unchanged, names and types); this only adds what D-9/S-8 own, and a
+ * non-JSON end (there is none today) is passed through untouched rather than guessed at.
+ */
+function withHealthFields(res, accounting) {
+  const end = res.end.bind(res);
+  res.end = (chunk, ...rest) => {
+    let body;
+    try {
+      body = JSON.parse(Buffer.isBuffer(chunk) ? chunk.toString('utf8') : String(chunk));
+    } catch {
+      return end(chunk, ...rest); // expected: only the health JSON body is augmented
+    }
+    return end(JSON.stringify({ ...body, ...healthFields(accounting) }), ...rest);
+  };
+  return res;
+}
+
+function exitRecordPath(dataDir) {
+  return path.join(dataDir, 'oauth-proxy', 'last-exit.json');
+}
+
+/**
+ * §9 S-5: the previous exit, written once. Atomic (tmp + rename) and owner-only, so a concurrent reader
+ * sees either the whole record or no record — never a half-written one. Async like the budget journals
+ * beside it (request-budget-store.js): the proxy awaits the write before it exits, and the supervisor
+ * reads it off the main thread.
+ * @returns {Promise<object>} the record written
+ */
+async function writeExitRecord({ dataDir, reason, openStreams }) {
+  const record = { v: EXIT_RECORD_VERSION, at: new Date().toISOString(), pid: process.pid, reason, openStreams };
+  const target = exitRecordPath(dataDir);
+  const tmp = `${target}.${process.pid}.tmp`;
+  await fsp.mkdir(path.dirname(target), { recursive: true, mode: 0o700 });
+  await fsp.writeFile(tmp, `${JSON.stringify(record)}\n`, { mode: 0o600 });
+  await fsp.rename(tmp, target);
+  return record;
+}
+
+/**
+ * @returns {Promise<object|null>} the recorded previous exit, or null when there is none to report. A
+ * truncated or hand-edited record is reported as absent rather than thrown: it is evidence of nothing.
+ */
+async function readExitRecord({ dataDir }) {
+  let raw;
+  try {
+    raw = await fsp.readFile(exitRecordPath(dataDir), 'utf8');
+  } catch (err) {
+    if (err && err.code === 'ENOENT') return null; // expected: no previous exit was recorded
+    throw err;
+  }
+  try {
+    const record = JSON.parse(raw);
+    return record && typeof record === 'object' ? record : null;
+  } catch {
+    return null; // expected: an unparseable record is not evidence; report it as absent
+  }
+}
+
+/** One exit is reported once: the supervisor reads the record, then clears it. */
+async function clearExitRecord({ dataDir }) {
+  try {
+    await fsp.rm(exitRecordPath(dataDir), { force: true });
+  } catch (err) {
+    // REPORT: a record that cannot be removed is stale truth on disk, which is worth a line.
+    console.error(`[model-proxy] exit record not removed: ${(err && err.code) || 'unknown'}`);
+  }
+}
+
+module.exports = {
+  createStreamAccounting,
+  healthFields,
+  withHealthFields,
+  writeExitRecord,
+  readExitRecord,
+  clearExitRecord,
+  exitRecordPath,
+};

package/template/coding-task-manager/lib/model-proxy/tokens.js

@@ -781,6 +781,81 @@ function tokenCount() {
   return _tokens.size;
 }
 
+// ── §9 S-10 / §5 D-7 state export (WP-2 handoff) ────────────────────────────────────────────────
+//
+// The token registry is memory-only, and the handoff successor is a DIFFERENT process, so the rows
+// have to travel over IPC. Two shapes live in `_tokens` and they are not equally serializable:
+//   * a lead entry is plain data (its `aliases` is the only non-JSON member, a Set);
+//   * a worker entry additionally owns a live `budget` handle (lib/model-proxy/request-budget.js: a
+//     journal, a clock, in-process callbacks). That handle is PROCESS state, not a row -- it is
+//     deliberately NOT serialized, and the imported row carries `budget: null`, exactly the shape
+//     `mintWorkerToken` already produces for a token minted without a policy. Authorization
+//     (`authorize()`, `tokenEntry()`) is therefore preserved byte-for-byte, while admission accounting
+//     stays with the owner that holds the journal: CTM re-mints/replays worker tokens itself, the same
+//     way a fresh spawn is served today.
+
+/** @returns {Array<{token:string, entry:object}>} every NON-REVOKED row, in IPC-safe (plain JSON) form. */
+function exportAll() {
+  const rows = [];
+  for (const [token, entry] of _tokens) {
+    if (!entry || entry.revoked) continue;
+    if (entry.kind === 'lead') {
+      rows.push({ token, entry: { ...entry, aliases: [...entry.aliases] } });
+      continue;
+    }
+    rows.push({
+      token,
+      entry: {
+        kind: 'worker',
+        ctmSessionId: entry.ctmSessionId,
+        aliases: [...entry.aliases],
+        binding: entry.binding || null,
+        expiresAt: entry.expiresAt,
+        revoked: false,
+      },
+    });
+  }
+  return rows;
+}
+
+/**
+ * Register each exported row verbatim (§9 S-10). A row that is not shaped like an export is SKIPPED
+ * rather than throwing: a successor that cannot read one row must still come up serving the rest, and
+ * the row it skipped simply authorizes nothing. Re-registering an identical lead row is a no-op, which
+ * is what makes an overlap between this and a later CTM replay harmless.
+ * @returns {number} how many rows were registered
+ */
+function importAll(rows) {
+  if (!Array.isArray(rows)) return 0;
+  let imported = 0;
+  for (const row of rows) {
+    if (!row || typeof row !== 'object' || Array.isArray(row)) continue;
+    const { token, entry } = row;
+    if (typeof token !== 'string' || !entry || typeof entry !== 'object' || Array.isArray(entry)) continue;
+    if (!Array.isArray(entry.aliases) || entry.aliases.some((alias) => typeof alias !== 'string')) continue;
+    const next = entry.kind === 'lead'
+      ? { ...entry, aliases: new Set(entry.aliases), expiresAt: Infinity, revoked: entry.revoked === true }
+      : {
+        kind: 'worker',
+        ctmSessionId: entry.ctmSessionId,
+        aliases: new Set(entry.aliases),
+        binding: entry.binding || null,
+        expiresAt: typeof entry.expiresAt === 'number' ? entry.expiresAt : Infinity,
+        revoked: entry.revoked === true,
+        // The budget handle is process state and is re-derived by its owner, never carried across
+        // processes (see the export note above).
+        budget: null,
+      };
+    _tokens.set(token, next);
+    // The certificate -> token index is part of the registry, so a rehydrated mTLS owner keeps
+    // resolving by fingerprint without a replay from CTM.
+    const fingerprint = _resolvedNativeCertFingerprint(next);
+    if (fingerprint) _nativeCertOwners.set(fingerprint, token);
+    imported += 1;
+  }
+  return imported;
+}
+
 module.exports = {
   TOKEN_PREFIX,
   TOKEN_RE,
@@ -819,4 +894,7 @@ module.exports = {
   stopWorkerBudget,
   resetTokens,
   tokenCount,
+  // §9 S-10 (WP-2 handoff): the memory-only rows, in IPC-safe form, and their verbatim re-registration.
+  exportAll,
+  importAll,
 };

package/template/coding-task-manager/lib/model-proxy/upstream-outcome.js

@@ -9,6 +9,8 @@ const SAFE_MESSAGES = Object.freeze({
   rate_limit_exceeded: 'The provider is rate limiting requests.',
   server_is_overloaded: 'The provider is temporarily overloaded.',
   server_error: 'The provider could not complete the request.',
+  model_not_invocable: 'This route cannot invoke this model id; it needs the model’s inference-profile id.',
+  model_access_denied: 'The route’s provider account denies access to this model.',
 });
 
 const SAFE_CODE = /^[A-Za-z0-9_.-]{1,64}$/;
@@ -16,6 +18,7 @@ const SAFE_PROVIDER_CODES = new Set([
   'invalid_prompt', 'invalid_request', 'invalid_request_error', 'model_not_found',
   'context_length_exceeded', 'insufficient_quota', 'rate_limit_exceeded',
   'server_is_overloaded', 'overloaded_error', 'server_error', 'internal_error',
+  'model_not_invocable', 'model_access_denied',
 ]);
 
 function _stringCode(value) {
@@ -36,6 +39,12 @@ function _classify(code, status, message) {
   if (/insufficient[_ -]?quota|quota[_ -]?exceeded|billing/.test(folded)) return 'insufficient_quota';
   if (/rate[_ -]?limit|too many requests/.test(folded) || status === 429) return 'rate_limit_exceeded';
   if (/overloaded|capacity[_ -]?exceeded/.test(folded)) return 'server_is_overloaded';
+  // D-5 (docs/routed-anthropic-lead-effort-levels-2026-10-25.html): a permission denial does not clear
+  // on retry, and a 400/422 naming on-demand/inference-profile is a route/model-id mismatch, not a bad
+  // prompt. Both run after the four message-driven classes above (a 429 naming "inference profile" stays
+  // rate_limit_exceeded) and before the generic invalid/4xx line. The provider's own prose is never copied.
+  if (status === 401 || status === 403 || code === '401' || code === '403') return 'model_access_denied';
+  if (/on-demand throughput|inference profile/.test(folded) && (status === 400 || status === 422 || code === '400' || code === '422')) return 'model_not_invocable';
   if (/invalid|model[_ -]?not[_ -]?found|history/.test(folded) || ['400', '404', '422'].includes(code) || [400, 404, 422].includes(status)) return 'invalid_prompt';
   return 'server_error';
 }

package/template/coding-task-manager/lib/native-history-control.js

@@ -5,16 +5,36 @@ const { StringDecoder } = require('node:string_decoder');
 const path = require('node:path');
 const { codexProxyProviderArgs } = require('./codex-launch-health');
 // S-5: the adapter id and the qualified-version membership test come from the one table.
-const { CODEX_CONTROL_ADAPTER, isQualifiedCodexVersion } = require('./codex-harness-qualification');
+const { CODEX_CONTROL_ADAPTER, isQualifiedCodexVersion, isNonElevatedCyberAccessProgram } = require('./codex-harness-qualification');
 
 const QUALIFIED_ADAPTER = CODEX_CONTROL_ADAPTER;
 const MAX_FRAME_BYTES = 1024 * 1024;
+const TURNS_PAGE_LIMIT = 8;
 const DEFAULT_TIMEOUT_MS = 20_000;
 const MAX_TIMEOUT_MS = 30_000;
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 const POLICY_CONFIG_KEYS = new Set(['approval_policy', 'sandbox_mode', 'sandbox_workspace_write.network_access',
   'sandbox_workspace_write.writable_roots', 'sandbox_workspace_write.allowed_domains',
   'sandbox_workspace_write.exclude_tmpdir_env_var', 'sandbox_workspace_write.exclude_slash_tmp']);
+const HANDOFF_SHA_RE = /^[a-f0-9]{64}$/;
+// D-6/D-7 (docs/codex-lead-routed-switch-history-handoff-2026-10-21.html §6.4): the plaintext
+// handoff the source model wrote, verbatim from Codex rust-v0.163.0
+// codex-rs/prompts/templates/compact/summary_prefix.md (Apache-2.0, attributed there). It is the
+// same preamble Codex puts in front of a native summary, so the target reads it as one.
+const SUMMARY_PREFIX = 'Another language model started to solve this problem and produced a summary of its thinking process. You also have access to the state of the tools that were used by that language model. Use this to build on the work that has already been done and avoid duplicating work. Here is the summary produced by the other language model, use the information in this summary to assist with your own analysis:';
+// The ONE marker grammar the scanner (lib/history-transition-read-op.js HANDOFF_MARKER) and the
+// proxy (lib/model-proxy/collaboration-codec.js) both read. The sha binds the summary to exactly
+// one sealed compaction item; the model name is what the source model was when it wrote it.
+const HANDOFF_MARKER_PREFIX = '<ctm_handoff compaction_sha256="';
+
+function handoffMessage(handoff) {
+  if (!isRecord(handoff) || !HANDOFF_SHA_RE.test(String(handoff.compactionSha256 || ''))
+      || typeof handoff.text !== 'string' || !handoff.text.trim()
+      || !nonempty(handoff.sourceModel)) throw adapterError('native_handoff_inject_failed');
+  const body = `${HANDOFF_MARKER_PREFIX}${handoff.compactionSha256}" source_model="${handoff.sourceModel}">\n`
+    + SUMMARY_PREFIX + '\n\n' + handoff.text + '\n</ctm_handoff>';
+  return { type: 'message', role: 'developer', content: [{ type: 'input_text', text: body }] };
+}
 
 function createCodexNativeHistoryControl({ sourceRecipe, targetRecipe } = {}) {
   const source = validateSource(sourceRecipe);
@@ -88,11 +108,14 @@ function validatePolicyOverrides(value) {
   return Object.freeze(output);
 }
 
-async function forkCheckpoint(source, target, checkpoint, { signal, timeoutMs = DEFAULT_TIMEOUT_MS, targetAuthToken } = {}) {
+async function forkCheckpoint(source, target, checkpoint, { signal, timeoutMs = DEFAULT_TIMEOUT_MS, targetAuthToken, handoff } = {}) {
   const sourceThreadId = nonempty(checkpoint?.sourceThreadId);
   const lastTurnId = nonempty(checkpoint?.lastTurnId);
   const sourceGeneration = nonempty(checkpoint?.sourceGeneration);
   if (!UUID_RE.test(sourceThreadId) || !lastTurnId || !sourceGeneration) throw adapterError('source_checkpoint_invalid');
+  // D-7: the handoff message is validated BEFORE the fork starts, so an unusable summary can never
+  // leave a half-created target thread behind.
+  const handoffItem = handoff === undefined || handoff === null ? null : handoffMessage(handoff);
   if (signal?.aborted) throw adapterError('transition_cancelled');
   const deadlineMs = Number.isSafeInteger(timeoutMs) && timeoutMs > 0 ? Math.min(timeoutMs, MAX_TIMEOUT_MS) : DEFAULT_TIMEOUT_MS;
   const deadlineAt = Date.now() + deadlineMs;
@@ -106,13 +129,22 @@ async function forkCheckpoint(source, target, checkpoint, { signal, timeoutMs =
     });
     if (!initialized || rpc.closed) throw adapterError('native_initialize_failed');
     await rpc.notify('initialized', {});
+    // excludeTurns: a full-history fork response is the whole thread in one frame (a live 23 MB
+    // rollout hydrates to 5.5 MB); only the new thread id is read from it.
     const result = await rpc.request('thread/fork', {
-      threadId: sourceThreadId, lastTurnId, model: target.modelId, ephemeral: false,
+      threadId: sourceThreadId, lastTurnId, model: target.modelId, ephemeral: false, excludeTurns: true,
     });
     if (signal?.aborted) throw adapterError('transition_cancelled');
     const targetThreadId = nonempty(result?.thread?.id || result?.threadId || result?.thread_id);
     createdTargetId = targetThreadId;
     if (!UUID_RE.test(targetThreadId) || targetThreadId === sourceThreadId) throw adapterError('native_fork_checkpoint_invalid');
+    // D-7: the covered compaction's plaintext handoff is persisted INTO the forked thread as one
+    // developer message. Codex sends the sealed `compaction` item on verbatim; the proxy drops it
+    // only when this same request carries the marker, so a failed inject must fail the fork closed.
+    if (handoffItem) {
+      try { await rpc.request('thread/inject_items', { threadId: targetThreadId, items: [handoffItem] }); }
+      catch { throw adapterError('native_handoff_inject_failed'); }
+    }
     // Close the creating process before the readback. A new app-server must recover the
     // fork from disk; resuming in the process that created it could pass from cache alone.
     await rpc.close();
@@ -171,21 +203,33 @@ async function coldResume(source, args, target, threadId, expectedLastTurnId, si
     });
     if (!initialized || rpc.closed) throw adapterError('native_readback_initialize_failed');
     await rpc.notify('initialized', {});
-    const resumed = await rpc.request('thread/resume', { threadId });
+    const resumed = await rpc.request('thread/resume', { threadId, excludeTurns: true });
     const resumedId = nonempty(resumed?.thread?.id || resumed?.threadId || resumed?.thread_id);
     if (resumedId !== threadId) throw adapterError('native_fork_cold_resume_mismatch');
-    const readback = await rpc.request('thread/read', { threadId, includeTurns: true });
-    const readThread = readback?.thread;
-    const turns = readThread?.turns;
-    if (readThread?.id !== threadId || !Array.isArray(turns)) throw adapterError('native_fork_cold_resume_checkpoint_mismatch');
-    const restored = turns.find((turn) => turn?.id === expectedLastTurnId && turn?.status === 'completed');
-    if (!restored) throw adapterError('native_fork_cold_resume_checkpoint_mismatch');
+    const restored = await findTurn(rpc, threadId, expectedLastTurnId);
+    if (restored?.status !== 'completed') throw adapterError('native_fork_cold_resume_checkpoint_mismatch');
     return { ...resumed, restoredCheckpoint: { turnId: restored.id, status: restored.status } };
   } finally {
     await rpc.close();
   }
 }
 
+// Codex rust-v0.163.0 thread/turns/list, newest first and without items: the fork ends at the
+// checkpoint, so it is on the first page, and a page stays ~2 KB however long the thread is
+// (measured on a 24-turn thread: 3 pages of 8, largest frame 2,021 B).
+async function findTurn(rpc, threadId, turnId) {
+  let cursor = null;
+  do {
+    const page = await rpc.request('thread/turns/list', { threadId, limit: TURNS_PAGE_LIMIT,
+      sortDirection: 'desc', itemsView: 'notLoaded', ...(cursor ? { cursor } : {}) });
+    if (!Array.isArray(page?.data)) throw adapterError('native_fork_cold_resume_checkpoint_mismatch');
+    const turn = page.data.find((item) => item?.id === turnId);
+    if (turn) return turn;
+    cursor = nonempty(page.nextCursor);
+  } while (cursor);
+  return null;
+}
+
 function buildAppServerArgs(target) {
   const args = codexProxyProviderArgs({
     providerId: target.providerId, name: target.providerName, proxyPort: target.proxyPort,
@@ -200,7 +244,7 @@ function buildAppServerArgs(target) {
   return args;
 }
 
-function createBoundedRpc(child, { signal, timeoutMs }) {
+function createBoundedRpc(child, { signal, timeoutMs, allowTurn = false, onNotification = null }) {
   let buffer = '';
   let closed = false;
   let nextId = 1;
@@ -240,11 +284,14 @@ function createBoundedRpc(child, { signal, timeoutMs }) {
             || (message.params !== undefined && !isRecord(message.params))) {
           fail(adapterError('native_rpc_frame_invalid')); void terminateOnce(); return;
         }
-        if (/^(?:turn|item)\//.test(message.method)) {
+        // D-6: the ephemeral handoff fork is the ONE caller that runs a model turn on purpose, and it
+        // asks for that explicitly. Every fork/readback path keeps the fail-closed guard.
+        if (!allowTurn && /^(?:turn|item)\//.test(message.method)) {
           fail(adapterError('native_fork_emitted_model_turn'));
           void terminateOnce();
           return;
         }
+        if (onNotification) onNotification(message.method, message.params);
         continue;
       }
       if (!Number.isSafeInteger(message.id) || !waiters.has(message.id)) {
@@ -369,7 +416,7 @@ function absolute(value) { return typeof value === 'string' && path.isAbsolute(v
 function nonempty(value) { return typeof value === 'string' && value.trim() ? value.trim() : ''; }
 function validAlias(value) { return typeof value === 'string' && /^[a-z0-9][a-z0-9._-]{0,63}$/i.test(value); }
 function validEnvKey(value) { return typeof value === 'string' && /^[A-Z_][A-Z0-9_]{0,63}$/.test(value); }
-function validCyberAccessProgram(value) { return value === null; }
+function validCyberAccessProgram(value) { return isNonElevatedCyberAccessProgram(value); }
 function validApprovalPolicy(value) { return ['never', 'on-request', 'on-failure', 'untrusted'].includes(value); }
 function validSandboxPolicy(value) {
   return isRecord(value) && ['read-only', 'workspace-write', 'danger-full-access'].includes(value.type)
@@ -384,4 +431,5 @@ function sameSandboxPolicy(a, b) {
 }
 function isRecord(value) { return !!value && typeof value === 'object' && !Array.isArray(value); }
 
-module.exports = { createCodexNativeHistoryControl, buildAppServerArgs, buildAppServerEnv, QUALIFIED_ADAPTER };
+module.exports = { createCodexNativeHistoryControl, buildAppServerArgs, buildAppServerEnv, QUALIFIED_ADAPTER,
+  createBoundedRpc, terminateChild, handoffMessage, SUMMARY_PREFIX, HANDOFF_MARKER_PREFIX };

package/template/coding-task-manager/lib/native-lead-settings-client.js

@@ -53,6 +53,7 @@ const { spawn } = require('node:child_process');
 
 const { LAUNCH_PLAN_DEFAULT_REQUEST_TIMEOUT_MS } = require('./launch-plan-pool');
 const { buildNativeLeadBaseUrl } = require('./native-lead-endpoint');
+const { isWritableOnlyByOwner } = require('../../shared/owner-write-safety');
 const {
   NATIVE_LEAD_TLS_CODES,
   LOOPBACK_ADDRESS,
@@ -190,7 +191,7 @@ async function _ensureGeneratedDirAsync(dirPath, dataDir) {
       || base.stat.isSymbolicLink()
       || !base.stat.isDirectory()
       || (typeof process.getuid === 'function' && Number(base.stat.uid) !== process.getuid())
-      || (Number(base.stat.mode) & 0o022) !== 0) {
+      || !isWritableOnlyByOwner(base.stat)) {
     _fail(NATIVE_LEAD_SETTINGS_CLIENT_CODES.RESERVE_FAILED);
   }
   let current = dataDir;

package/template/coding-task-manager/lib/native-lead-tls.js

@@ -38,6 +38,7 @@
 const fs = require('node:fs');
 const path = require('node:path');
 const crypto = require('node:crypto');
+const { isWritableOnlyByOwner } = require('../../shared/owner-write-safety');
 
 // --- fixed, public vocabulary ---------------------------------------------------------------
 
@@ -283,7 +284,7 @@ function _assertPrivateRoot(dirPath) {
   }
   if (stat.isSymbolicLink() || !stat.isDirectory()) _fail(NATIVE_LEAD_TLS_CODES.PRIVATE_PATH_INVALID);
   if (typeof process.getuid === 'function' && stat.uid !== process.getuid()) _fail(NATIVE_LEAD_TLS_CODES.PRIVATE_PATH_INVALID);
-  if ((stat.mode & 0o022) !== 0) _fail(NATIVE_LEAD_TLS_CODES.PRIVATE_PATH_INVALID);
+  if (!isWritableOnlyByOwner(stat)) _fail(NATIVE_LEAD_TLS_CODES.PRIVATE_PATH_INVALID);
   return stat;
 }
 
@@ -380,18 +381,31 @@ function syncWritePrivateFileExclusive(filePath, contents, { code = NATIVE_LEAD_
 /**
  * The deterministic snapshot seam shared by both private readers: after a bounded read, the descriptor
  * must still describe EXACTLY the file that was opened — same device/inode (a replacement), same size
- * and same mtime/ctime (a same-size mutation), same uid/mode (a permissions change). Pure, so the
- * check is unit-testable without a filesystem race or any real-time threshold.
+ * and same mtime (a same-size mutation), same uid/mode (a permissions change). Pure, so the check is
+ * unit-testable without a filesystem race or any real-time threshold.
+ *
+ * ctime is compared only while the link count is UNCHANGED (D-8,
+ * docs/nightly-followups-r3-pty-selector-flakes-2026-10-22.html). A hard-link count change moves ctime
+ * by itself — unlinking a sibling link (macOS, probe I-4: nlink 2 -> 1, mtime equal, ctime different)
+ * or creating one (Linux) rewrites the inode's ctime without touching the bytes or their mtime. That is
+ * exactly the window the authority publisher occupies: it links the candidate to the authority
+ * (`fs.linkSync(candidateFile, authorityPath)`) and then unlinks its own candidate link, so a reader
+ * sitting between its two fstats sees only the link-count swap and would otherwise fail closed with
+ * `native_tls_authority_invalid` on a file nobody modified. The nlink delta fully explains the ctime
+ * delta, so the ctime comparison is skipped when nlink moved; dev, ino, size, mtimeMs, uid and mode are
+ * still compared unconditionally, which keeps the same-size-write detection for the case that matters
+ * (a rewrite that preserves mtime while nlink is unchanged).
  *
  * @returns {boolean} true when `after` is still the same, unmodified, correctly-permissioned file.
  */
 function isSamePrivateFileSnapshot(opened, after) {
   if (!opened || !after) return false;
+  const linkCountChanged = Number(after.nlink) !== Number(opened.nlink);
   return Number(after.dev) === Number(opened.dev)
     && Number(after.ino) === Number(opened.ino)
     && Number(after.size) === Number(opened.size)
     && Number(after.mtimeMs) === Number(opened.mtimeMs)
-    && Number(after.ctimeMs) === Number(opened.ctimeMs)
+    && (linkCountChanged || Number(after.ctimeMs) === Number(opened.ctimeMs))
     && Number(after.uid) === Number(opened.uid)
     && Number(after.mode) === Number(opened.mode);
 }