driftproof 0.7.2 → 0.8.1

package/README.md

@@ -1,25 +1,28 @@
 <!-- SPDX-License-Identifier: Apache-2.0 -->
 # Driftproof
 
-**A dated proof that this skill, this hash, this model, still helps.**
+**Your skill passed. On which model? On what date?**
+
+A SKILL.md teaches an AI coding agent how you like things done. When a new model
+ships, the same file can stop helping, or start hurting. Driftproof re-runs the
+skill's tests on the new model and hands you a dated, hash-verified receipt
+saying whether it still helps.
 
 [![driftproof](https://img.shields.io/endpoint?url=https://driftproofhq.com/badges/commit-message-conventions.json)](https://driftproofhq.com)
 &nbsp;— live badge for the bundled `commit-message-conventions` example, generated from its own receipt.
 
-Driftproof is an open **receipt spec** plus a **runner** that measures whether an
-agent skill actually helps — by running the skill's eval suite **with** and
-**without** the skill on a named model version, judging each case several times to
-get a confidence band, and emitting a **hash-verified**, dated **receipt**. Diff two receipts
-across model releases and you get a **drift report**.
+**[Quickstart](https://driftproofhq.com/#quickstart)** ·
+**[Latest report](https://driftproofhq.com/reports/008/)** ·
+[driftproofhq.com](https://driftproofhq.com)
 
 Driftproof **consumes** the [`agentskills.io/evals`](https://agentskills.io) eval
 format; it does not invent its own.
 
-📊 **Seven published reports** (each re-derived from committed receipts, nothing
-hand-entered), spanning six published report types, the newest being instrument
-re-measurement. All seven share one band-based, floor-gated verdict rule and
+📊 **Eight published reports** (each re-derived from committed receipts, nothing
+hand-entered), spanning six published report types, the newest being release
+drift. All eight share one band-based, floor-gated verdict rule and
 differ in what moves underneath the skill — or, in the value report, in which
-axes are measured; or, in the newest, in the instrument itself:
+axes are measured; or, in the instrument re-measurement, in the instrument itself:
 
 - **[Report #001](https://driftproofhq.com/reports/001/)** — *release drift*: ten
   public agent skills across a current-vs-previous Sonnet release; 9 of 10 moved
@@ -62,9 +65,18 @@ axes are measured; or, in the newest, in the instrument itself:
   2026-07-27, and the truncated run it caused measured *less* variance than the
   clean re-run, which is the direction that flatters an instrument. Both runs are
   published, the broken one as evidence. Amends #005 to v1.2 and #006 to v1.1.
+- **[Report #008](https://driftproofhq.com/reports/008/)** — *release drift*:
+  two of Report #007's cells re-measured on `claude-fable-5-1` against
+  `claude-fable-5`, with the skill `content_hash` and `suite_hash` asserted
+  identical before the first call. **Both cells came back within noise**: the
+  14 cases read 0 improved, 0 regressed, 14 within noise, 0 not measured. The
+  first release pair in this project where both sides are generation-sampled
+  receipts, which is what makes the delta attributable to the model rather than
+  to the instrument. One case sits inside the verdict on the effect floor alone
+  and the report names it.
 
 ✍️ The launch essay, **[Three model releases later: what actually happens to agent
-skills](https://driftproofhq.com/writing/three-releases/)**, reads all seven reports
+skills](https://driftproofhq.com/writing/three-releases/)**, reads all eight reports
 together: what moves underneath a skill, what the skill costs to run, and what a
 corrected instrument did to three published results. Revised 2026-09-01; every
 figure in it is gate-checked against the report page it cites.
@@ -199,6 +211,36 @@ Writing a suite that measures fairly is its own craft — see
 
 The surface and judge settings used are recorded in every receipt.
 
+### Isolation (the cli surfaces)
+
+A `SKILL.md` you did not write is instructions to an agent that has tools. On
+the two cli surfaces driftproof therefore never runs `claude` or `codex` as you.
+Every spawn goes through a hop to a dedicated unprivileged unix user, from an
+empty environment:
+
+```
+/usr/bin/sudo -n -u driftproof-eval /usr/bin/env -i HOME=<its home> PATH=<its ~/.local/bin>:/usr/bin:/bin bash -lc '<wrapper>' driftproof-eval-hop claude -p ...
+```
+
+Only `HOME` and `PATH` reach the child, both constructed from the user name, none
+copied from your shell. The working directory is a fresh temp directory made for
+that one call and removed after it, including on timeout. The CLI argv is passed
+as separate arguments, never as a shell string. What the evaluated agent cannot
+see: your environment (tokens, keys), your home directory (SSH keys, CLI session
+files), your current directory, and your CLI configuration.
+
+**Operator prerequisite, set up once** (see `RUNBOOK.md`): that user exists with a
+mode-700 home and no extra groups, has its own logged-in `claude` and `codex`
+under `~/.local/bin`, and a sudoers rule lets you run commands as it with
+`NOPASSWD`. `DRIFTPROOF_EVAL_USER` names the user (default `driftproof-eval`).
+Without the prerequisite a run fails at once, before any call, and says so.
+
+**`--trusted-skill`** runs the legacy same-user path instead: your environment,
+your cwd, your CLI login. It exists for exactly one case, a skill you authored
+yourself on a machine with no eval user. Never pass it for a skill fetched from
+anywhere else. The api surfaces are unaffected either way; they make HTTP calls
+and spawn nothing.
+
 ### Cost guard
 
 Sampling multiplies calls on two axes, and the second one is easy to miss. Each
@@ -229,7 +271,7 @@ A receipt is the unit of evidence — one JSON document conforming to
     "model_release_date": "2025-10-01",
     "provider": "anthropic",
     "surface": "claude-cli",
-    "runner_version": "0.7.2",
+    "runner_version": "0.8.1",
     "date_utc": "2026-07-27T…Z",
     "registry": "registered",
     "transcripts": "hashes-only",
@@ -303,7 +345,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: driftproofhq/driftproof@v0.7.2
+      - uses: driftproofhq/driftproof@v0.8.1
         with:
           skill-dir: skills/my-skill
           models: claude-haiku-4-5
@@ -319,7 +361,11 @@ fails the job on `REGRESSED` unless you set `fail-on-regression: 'false'`. For a
 free CI dry-run with **zero model calls**, set `DRIFTPROOF_STUB=1` in the job env —
 the runner returns canned receipts so the wiring can be tested without spend (this
 is exactly how the action's own [self-test](.github/workflows/action-selftest.yml)
-runs).
+runs). That self-test is also the proof behind the input hardening: on every
+run it passes one hostile value (a quote, a semicolon, `$(...)`, a backtick and
+a newline) through each of the action's five inputs on the real runner and
+fails unless every one is refused before anything ran, so a green check there
+is a claim you can read, not one you have to take.
 
 ### Badge
 
@@ -343,7 +389,7 @@ site, so it reflects a real dated run, not a hand-set color.
 
 ## Reports
 
-Seven reports are published, spanning six report types. A report page lives at a
+Eight reports are published, spanning six report types. A report page lives at a
 draft path — `docs/reports/NNN-draft/` — until the publish sequence renames it, and
 `scripts/build-public.sh` excludes every `*-draft/` path from the published tree
 (see the roll at the top of this README, and

package/bin/driftproof

@@ -10,7 +10,7 @@ const { runSkillOnModel, summarizeReceipt, projectCalls } = require('../lib/run'
 const { SAMPLING } = require('../lib/sampling');
 const { validateReceipt, verifyReceiptHash } = require('../lib/receipt');
 const { buildDriftReport, revisionPairProblem } = require('../lib/diff');
-const { surfaceForModel, isSubscriptionSurface, resolveModel } = require('../lib/provider');
+const { surfaceForModel, isSubscriptionSurface, resolveModel, evalUser } = require('../lib/provider');
 const { estimateRunCostUSD, BudgetTracker } = require('../lib/cost');
 const { registryStatus } = require('../lib/models');
 const { verdictFromReceipt, badgeEndpoint, githubOutputLines } = require('../lib/verdict');
@@ -54,6 +54,10 @@ function loadRc(skillDir) {
   return merged;
 }
 
+// Flags that never take a value, so `--trusted-skill <skill-dir>` keeps the dir
+// positional instead of swallowing it as the flag's value.
+const BOOLEAN_FLAGS = new Set(['trusted-skill']);
+
 function parseArgs(argv) {
   const positional = [];
   const flags = {};
@@ -62,7 +66,7 @@ function parseArgs(argv) {
     if (a.startsWith('--')) {
       const key = a.slice(2);
       const next = argv[i + 1];
-      if (next === undefined || next.startsWith('--')) { flags[key] = true; }
+      if (BOOLEAN_FLAGS.has(key) || next === undefined || next.startsWith('--')) { flags[key] = true; }
       else { flags[key] = next; i++; }
     } else positional.push(a);
   }
@@ -76,7 +80,7 @@ USAGE
   ${PROJECT_NAME} init <dir>                          scaffold SKILL.md + evals/evals.json + .driftproofrc
   ${PROJECT_NAME} run <skill-dir> [--models a,b] [--samples N] [--max-cases N] [--max-calls N]
                         [--judge-model M] [--concurrency N] [--max-usd N]
-                        [--keep-transcripts] [--out DIR]
+                        [--keep-transcripts] [--out DIR] [--trusted-skill]
   ${PROJECT_NAME} diff <receiptA.json> <receiptB.json> [--out FILE] [--mode release|revision]
   ${PROJECT_NAME} validate <receipt.json>
   ${PROJECT_NAME} badge <receipt.json> [--out FILE] [--github-output]
@@ -88,6 +92,7 @@ ENV
   ANTHROPIC_API_KEY required when CLAUDE_PROVIDER=api
   DRIFTPROOF_REGISTRY  path to an alternate model registry (default: the packaged config/models.json)
   DRIFTPROOF_STUB=1    offline stub surface — canned receipts, zero model calls (for CI)
+  DRIFTPROOF_EVAL_USER the unix user the isolated hop runs the CLI as (default: driftproof-eval)
 
 NOTES
   - Default models list is 'haiku' only (cheap dev default).
@@ -112,6 +117,16 @@ NOTES
     conservative default price.
   - --concurrency runs that many (case,mode) tasks at once (default 1). Higher
     values cut wall-clock on the cli surface (cold-start dominated).
+  - ISOLATION (default). On the two cli surfaces every \`claude\` / \`codex\` spawn
+    runs as a dedicated unprivileged unix user (DRIFTPROOF_EVAL_USER) through
+    sudo, from an EMPTY environment (only HOME and PATH, constructed), in a fresh
+    temp working directory removed after the call. A third-party SKILL.md is
+    instructions to an agent with tools; this is what keeps it away from your
+    keys, tokens and files. Operator prerequisite: that user, its own logged-in
+    CLIs, and a NOPASSWD sudoers rule (see RUNBOOK.md).
+  - --trusted-skill runs the legacy same-user path instead: your environment,
+    your cwd, your CLI login. FOR SKILLS YOU AUTHORED YOURSELF ONLY. Never pass
+    it for a skill fetched from anywhere else.
   - import converts another tool's results into a valid receipt with HONEST
     epistemics: verification_level DECLARED (never TESTED), surface "external",
     source "imported/<tool>", and NO fabricated hashes. Imported receipts are
@@ -137,6 +152,10 @@ async function cmdRun(positional, flags) {
   const concurrency = flags.concurrency ? parseInt(flags.concurrency, 10) : (rc.concurrency != null ? parseInt(rc.concurrency, 10) : 1);
   const maxUsd = flags['max-usd'] ? parseFloat(flags['max-usd']) : (rc.max_usd != null ? parseFloat(rc.max_usd) : DEV_MAX_USD);
   const keepTranscripts = !!flags['keep-transcripts'];
+  // spec 022: the same-user spawn exists only behind this flag. Resolving the
+  // eval user here means a bad DRIFTPROOF_EVAL_USER is refused before the banner.
+  const trusted = !!flags['trusted-skill'];
+  const isolation = trusted ? 'same-user (--trusted-skill: self-authored skill)' : `eval-user (${evalUser()})`;
   const outDir = flags.out ? path.resolve(flags.out) : RECEIPTS_DIR;
   fs.mkdirSync(outDir, { recursive: true });
 
@@ -166,6 +185,7 @@ async function cmdRun(positional, flags) {
   console.log(`  content_hash: ${skill.contentHash.slice(0, 16)}…  suite: ${skill.suite.caseCount} cases (${skill.suite.suiteHash.slice(0, 12)}…)`);
   console.log(`  surface: ${surface}   models: ${models.join(', ')}   samples/case: ${samples}   concurrency: ${concurrency}`);
   console.log(`  registry: ${regStatuses.join('  ')}${keepTranscripts ? '   transcripts: retained-local' : ''}`);
+  if (subSurfaces.length) console.log(`  isolation: ${isolation}`);
   console.log(`  projected calls: ${perModelCalls}/model × ${models.length} model(s) = ${totalProjected}   per-model cap: ${maxCalls}`);
   console.log(`  projected cost: ~$${cost.totalUSD.toFixed(2)} (rough upper bound; budget $${maxUsd.toFixed(2)}, hard-stop $${(maxUsd * 1.25).toFixed(2)})`);
   if (subSurfaces.length) console.log(`  actual metered spend on ${subSurfaces.join(', ')}: $0.00 (subscription; the $ figure is the estimated-equivalent API cost, counted against the cap identically)`);
@@ -200,7 +220,7 @@ async function cmdRun(positional, flags) {
         skill,
         model,
         opts: {
-          maxCases, maxCalls, samples, judgeModel, concurrency, budget, keepTranscripts,
+          maxCases, maxCalls, samples, judgeModel, concurrency, budget, keepTranscripts, trusted,
           onProgress: (p) => {
             if (p.phase === 'done') console.log(`  ${p.case} / ${p.mode}: ${p.outcome} (${p.score.toFixed(2)} ± ${(p.stddev || 0).toFixed(2)})`);
           },

package/config/models.json

@@ -1,5 +1,5 @@
 {
-  "_comment": "Driftproof model registry. The runner resolves --models ids against this list; an unknown id still runs but its receipt is marked registry:\"unregistered\" and its cost is estimated with the conservative default price in lib/models.js. Prices are STANDARD first-party USD per 1,000,000 tokens (input/output). Anthropic prices are from platform.claude.com (July 2026); Sonnet 5's introductory rate is deliberately NOT used so projections stay an upper bound. OpenAI prices are the public standard per-MTok rates as of July 2026 (see reports/phase-6-providers.md for the fetched source): GPT-5.6 Sol $5/$30, Terra $2.50/$15, Luna $1/$6; GPT-5.5 $5/$30; GPT-5.4 $2.50/$15. gpt-5.4-mini is NOT in the published table (which lists a Nano tier at $0.20/$1.25), so its price here is a deliberately conservative UPPER-bound estimate flagged price_estimate:true. `released` is best-effort (spec RECEIPT.md open question #4). `tier` drives reporting; `judge_eligible` encodes the fixed-judge policy (docs/judge-policy.html) — only the cheap Haiku judge is eligible, and NO OpenAI model is judge-eligible (the judge stays claude-haiku across providers so a cross-substrate report varies only the target model). `provider` is the two-axis provider; per-provider surface/base_url config is under `providers`. The release trigger (scripts/release-watch.js) appends auto-discovered ids here with auto_added:true.",
+  "_comment": "Driftproof model registry. The runner resolves --models ids against this list; an unknown id still runs but its receipt is marked registry:\"unregistered\" and its cost is estimated with the conservative default price in lib/models.js. Prices are STANDARD first-party USD per 1,000,000 tokens (input/output). Anthropic prices are from platform.claude.com (July 2026); Sonnet 5's introductory rate is deliberately NOT used so projections stay an upper bound. OpenAI prices are the public standard per-MTok rates as of July 2026 (see reports/phase-6-providers.md for the fetched source): GPT-5.6 Sol $5/$30, Terra $2.50/$15, Luna $1/$6; GPT-5.5 $5/$30; GPT-5.4 $2.50/$15. gpt-5.4-mini is NOT in the published table (which lists a Nano tier at $0.20/$1.25), so its price here is a deliberately conservative UPPER-bound estimate flagged price_estimate:true. `released` is best-effort (spec RECEIPT.md open question #4). `tier` drives reporting; `judge_eligible` encodes the fixed-judge policy (docs/judge-policy.html) — only the cheap Haiku judge is eligible, and NO OpenAI model is judge-eligible (the judge stays claude-haiku across providers so a cross-substrate report varies only the target model). `provider` is the two-axis provider; per-provider surface/base_url config is under `providers`. The release trigger (scripts/release-watch.js) appends auto-discovered ids here with auto_added:true. Three optional per-row annotations were added by spec-019b (2026-09-01) and are read by NO code path in lib/: `cache_read_price` is the documented cache-read rate per MTok, recorded for provenance and NOT consumed -- lib/cost.js prices input and output only, and the 019b gate asserts that it stays that way, so wiring caching into the projection turns that assertion red rather than leaving this note quietly false; `lifecycle: legacy` records that the docs moved an id to the Legacy list, and never means removed (claude-fable-5 is referenced by receipts/report-007 and receipts/report-007-rerun); `surface_verified` records that a live call reached the id on that surface on `surface_verified_at`, which is an OBSERVATION, not a routing setting -- the surface is chosen at call time by lib/provider.js from CLAUDE_PROVIDER. claude-fable-5-1 prices are sourced to specs/019b-fable-5-1-registration/evidence/docs-pricing-snapshot-2026-09-01.json.",
   "registry_version": "1.1",
   "provider": "anthropic",
   "providers": {
@@ -8,7 +8,8 @@
   },
   "default_price_note": "Unregistered ids are costed at the most expensive known tier (Fable, $10/$50) — a budget guard must never under-estimate. See lib/models.js DEFAULT_PRICE.",
   "models": [
-    { "id": "claude-fable-5",              "family": "fable",  "provider": "anthropic", "released": "2026-06-09", "input_price": 10.0, "output_price": 50.0, "tier": "frontier", "judge_eligible": false },
+    { "id": "claude-fable-5-1",            "family": "fable",  "provider": "anthropic", "released": "2026-09-01", "input_price": 10.0, "output_price": 50.0, "cache_read_price": 0.25, "tier": "frontier", "judge_eligible": false, "surface_verified": "claude-cli", "surface_verified_at": "2026-09-01" },
+    { "id": "claude-fable-5",              "family": "fable",  "provider": "anthropic", "released": "2026-06-09", "input_price": 10.0, "output_price": 50.0, "tier": "frontier", "judge_eligible": false, "lifecycle": "legacy" },
     { "id": "claude-opus-5",               "family": "opus",   "provider": "anthropic", "released": null,         "input_price": 5.0,  "output_price": 25.0, "tier": "frontier", "judge_eligible": false },
     { "id": "claude-opus-4-8",             "family": "opus",   "provider": "anthropic", "released": null,         "input_price": 5.0,  "output_price": 25.0, "tier": "frontier", "judge_eligible": false },
     { "id": "claude-opus-4-7",             "family": "opus",   "provider": "anthropic", "released": null,         "input_price": 5.0,  "output_price": 25.0, "tier": "frontier", "judge_eligible": false },

package/config.js

@@ -9,7 +9,7 @@ const PROJECT_NAME = 'driftproof';
 // Bumped whenever the runner's behaviour or receipt-generation semantics change
 // in a way that could affect results. Recorded into every receipt as
 // run.runner_version so a receipt is reproducible against a known engine.
-const RUNNER_VERSION = '0.7.2';
+const RUNNER_VERSION = '0.8.1';
 
 // The eval format we CONSUME (we deliberately do not invent our own).
 const SUITE_FORMAT = 'agentskills.io/evals';

package/lib/judge.js

@@ -81,9 +81,9 @@ function judgeSettings(samples, judgeModel) {
 // Grade one response once. Returns { score, reason, raw }.
 // `raw` is the judge's verbatim output text (hashed into the receipt for
 // transcript auditability, and optionally retained under --keep-transcripts).
-async function gradeOnce({ task, response, rubric, model, timeoutMs, temperature }) {
+async function gradeOnce({ task, response, rubric, model, timeoutMs, temperature, trusted = false }) {
   const prompt = buildJudgePrompt({ task, response, rubric });
-  const { text, attempts, usage } = await complete({ system: JUDGE_SYSTEM, prompt, model, maxTokens: 400, timeoutMs, temperature });
+  const { text, attempts, usage } = await complete({ system: JUDGE_SYSTEM, prompt, model, maxTokens: 400, timeoutMs, temperature, trusted });
   let parsed;
   try {
     parsed = extractJsonObject(text);
@@ -104,7 +104,9 @@ async function gradeOnce({ task, response, rubric, model, timeoutMs, temperature
 // JUDGE calls timed out on the api policy while running on a CLI surface, which
 // is the second shadowing site and the one #007's prep session had not found.
 // Passing `undefined` through lets lib/provider.js resolve the declared policy.
-async function gradeSamples({ task, response, rubric, model, samples = 5, timeoutMs }) {
+// `trusted` (spec 022) is plumbed to complete() untouched: the judge takes the
+// same spawn path as the generation it grades, so --trusted-skill is whole-run.
+async function gradeSamples({ task, response, rubric, model, samples = 5, timeoutMs, trusted = false }) {
   const settings = judgeSettings(samples, model);
   const scores = [];
   const reasons = [];
@@ -114,7 +116,7 @@ async function gradeSamples({ task, response, rubric, model, samples = 5, timeou
   for (let i = 0; i < samples; i++) {
     let r;
     try {
-      r = await gradeOnce({ task, response, rubric, model, timeoutMs, temperature: settings.temperature === null ? undefined : settings.temperature });
+      r = await gradeOnce({ task, response, rubric, model, timeoutMs, temperature: settings.temperature === null ? undefined : settings.temperature, trusted });
     } catch (e) {
       // A judge sample that persistently failed (e.g. timed out after retries):
       // tag the error so the runner can charge for the spend and mark the whole

package/lib/provider.js

@@ -4,7 +4,9 @@
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
-const { spawn } = require('child_process');
+// Called through the module object (cp.spawn), never destructured: the gate
+// records spawns by replacing that property, so nothing real runs offline.
+const cp = require('child_process');
 const { withRetry, withTimeout } = require('./json');
 const { stubComplete, stubEnabled } = require('./stub');
 const {
@@ -126,7 +128,10 @@ const CODEX_OVERHEAD_NOTE =
 //
 // `temperature` is honoured ONLY on api surfaces; cli surfaces control sampling
 // themselves, so temperature is ignored there and the receipt records that fact.
-async function complete({ system, prompt, model, maxTokens = 1024, timeoutMs = null, temperature = undefined }) {
+// `trusted` (spec 022) selects the SAME-USER legacy spawn on the two CLI lanes.
+// It is false unless a caller says otherwise; bin/driftproof exposes it as
+// --trusted-skill, for skills the operator authored. Api lanes ignore it.
+async function complete({ system, prompt, model, maxTokens = 1024, timeoutMs = null, temperature = undefined, trusted = false }) {
   const surface = surfaceForModel(model);
   const provider = providerForSurface(surface);
   // Offline stub surface: canned completion, zero model calls. The receipt still
@@ -149,9 +154,9 @@ async function complete({ system, prompt, model, maxTokens = 1024, timeoutMs = n
   const laneRunner = () => {
     switch (surface) {
       case 'api': return completeAnthropicApi({ system, prompt, model, maxTokens, temperature });
-      case 'claude-cli': return completeClaudeCli({ system, prompt, model, timeoutMs: effTimeout });
+      case 'claude-cli': return completeClaudeCli({ system, prompt, model, timeoutMs: effTimeout, trusted });
       case 'openai-api': return completeOpenaiApi({ system, prompt, model, maxTokens, temperature, timeoutMs: effTimeout });
-      case 'openai-cli': return completeCodexCli({ system, prompt, model, timeoutMs: effTimeout });
+      case 'openai-cli': return completeCodexCli({ system, prompt, model, timeoutMs: effTimeout, trusted });
       default: throw new Error(`unknown surface: ${surface}`);
     }
   };
@@ -200,47 +205,182 @@ async function completeAnthropicApi({ system, prompt, model, maxTokens, temperat
   return { text, usage: parseAnthropicApiUsage(resp.usage) };
 }
 
-// ── anthropic/cli (claude -p) ──────────────────────────────────────────────────
-function completeClaudeCli({ system, prompt, model, timeoutMs }) {
-  return new Promise((resolve, reject) => {
-    // Strip ANTHROPIC_API_KEY so the CLI uses the subscription session, not the
-    // metered API key. Everything else in the env is preserved.
+// ── isolation: the eval-user hop (spec 022) ───────────────────────────────────
+//
+// Every local-CLI spawn runs as a DEDICATED UNPRIVILEGED UNIX USER by default.
+// The third-party SKILL.md a run evaluates is instructions to an agent with
+// tools, and until spec 022 that agent ran as the operator: same uid, whole
+// environment block, operator's cwd, operator's CLI configuration. The
+// 2026-09-03 security audit (findings A2, N5) confirmed a live API token in the
+// inherited environment and this host's SSH keys and CLI session tokens
+// readable by the same uid; this was then reproduced by execution.
+//
+// The boundary is a uid change reached through sudo from an EMPTY environment:
+//
+//   /usr/bin/sudo -n -u <eval-user> /usr/bin/env -i HOME=/home/<eval-user>
+//     PATH=/home/<eval-user>/.local/bin:/usr/bin:/bin bash -lc '<wrapper>'
+//     driftproof-eval-hop <cli> <cli-args...>
+//
+// Operator prerequisite, NOT created here (RUNBOOK.md): the user exists with a
+// mode-700 home and no extra groups, has its own logged-in `claude` and `codex`
+// under ~/.local/bin, and a sudoers rule grants the operator NOPASSWD as that
+// user. The runner refuses loudly when any of that is missing; it never creates
+// a user, edits sudoers, or logs a CLI in.
+//
+// The same-user (legacy) spawn survives ONLY behind `trusted: true`, exposed by
+// bin/driftproof as --trusted-skill, for skills the operator authored.
+const SUDO_BIN = '/usr/bin/sudo';
+const ENV_BIN = '/usr/bin/env';
+const EVAL_USER_DEFAULT = 'driftproof-eval';
+// A user name that can safely follow `sudo -u`: no leading dash, no shell
+// metacharacter, no path separator. Anything else is refused before any spawn.
+const EVAL_USER_RE = /^[a-z_][a-z0-9_-]{0,31}$/;
+// The ONLY names the child environment carries, each CONSTRUCTED from the eval
+// user's name in isolatedEnv() and never copied from process.env. Verified
+// 2026-09-03: both CLIs run through the hop with these two alone; the login
+// shell supplies LANG and TERM itself. Data, frozen, asserted by the gate.
+const ISOLATED_ENV_ALLOWLIST = Object.freeze(['HOME', 'PATH']);
+// $0 of the wrapper, so `ps` shows what the bash process is.
+const HOP_LABEL = 'driftproof-eval-hop';
+// The wrapper runs INSIDE the hop, as the eval user. It takes the CLI as
+// positional parameters ("$@"), so no SKILL.md text is ever shell-interpreted.
+//   - the cwd is a fresh per-call directory under the system tmp, created by
+//     the eval user (one the parent creates is mode 700 to it);
+//   - the CLI runs under setsid in its own process group, stdin preserved
+//     (`<&0` defeats the /dev/null a non-interactive bash gives a background job);
+//   - TERM/INT/HUP, which sudo relays from the parent on timeout, kill that
+//     whole group, remove the directory and exit 143;
+//   - a normal exit removes the directory and returns the CLI's status.
+const ISOLATED_WRAPPER = [
+  'd=$(mktemp -d -t driftproof-eval.XXXXXXXX) || exit 97',
+  'cd "$d" || exit 97',
+  'setsid -w "$@" <&0 & pid=$!',
+  'trap \'kill -TERM -- "-$pid" 2>/dev/null; sleep 1; kill -KILL -- "-$pid" 2>/dev/null; cd /; rm -rf "$d"; exit 143\' TERM INT HUP',
+  'wait "$pid"; r=$?',
+  'cd /; rm -rf "$d"; exit $r',
+].join('; ');
+
+// DRIFTPROOF_EVAL_USER selects WHICH user isolates, never WHETHER isolation
+// happens (that is the trusted flag, an argv decision). Empty means default.
+function evalUser() {
+  const raw = process.env.DRIFTPROOF_EVAL_USER;
+  const u = raw === undefined || raw === '' ? EVAL_USER_DEFAULT : raw;
+  if (!EVAL_USER_RE.test(u)) throw new Error(`DRIFTPROOF_EVAL_USER is not a plausible unix user name: ${JSON.stringify(u)}`);
+  return u;
+}
+
+// The child environment: constructed, not copied. Keys are exactly the allowlist.
+function isolatedEnv(user) {
+  const home = `/home/${user}`;
+  return { HOME: home, PATH: `${home}/.local/bin:/usr/bin:/bin` };
+}
+
+// The spawn plan for one CLI call: { mode, user, file, args, env }. Pure, so the
+// gate can inspect what WOULD be spawned. Untrusted → the hop; trusted → the
+// legacy same-user spawn exactly as it was (env inherited; the claude lane still
+// strips ANTHROPIC_API_KEY so the CLI uses the subscription, not the metered key).
+function buildSpawnPlan({ bin, args, trusted = false }) {
+  if (trusted) {
     const env = { ...process.env };
-    delete env.ANTHROPIC_API_KEY;
-
-    // v0.4: `--output-format json` returns ONE JSON object carrying both the
-    // final text (`result`) and the token usage (`usage`) — the default text
-    // output carries no usage at all, which is why usage was previously null on
-    // this lane. The text is read from the parsed object; if the CLI ever emits
-    // something unparseable we fall back to the raw stdout so a run degrades to
-    // the old behaviour (text, no usage) rather than failing.
-    const args = ['-p', '--output-format', 'json', '--model', resolveModel(model)];
-    if (system) args.push('--append-system-prompt', system);
-
-    const child = spawn('claude', args, { env, stdio: ['pipe', 'pipe', 'pipe'] });
-    let out = '';
-    let err = '';
-    const killer = setTimeout(() => { child.kill('SIGKILL'); }, timeoutMs + 5000);
-    child.stdout.on('data', (d) => { out += d; });
-    child.stderr.on('data', (d) => { err += d; });
-    child.on('error', (e) => {
-      clearTimeout(killer);
-      if (e.code === 'ENOENT') reject(new Error("the anthropic/cli surface requires the `claude` CLI on PATH. Install it or set CLAUDE_PROVIDER=api."));
-      else reject(e);
-    });
-    child.on('close', (code) => {
-      clearTimeout(killer);
-      if (code !== 0) return reject(new Error(`claude CLI exited ${code}: ${err.slice(0, 400)}`));
-      const parsed = parseClaudeCliJson(out);
-      if (!parsed) return resolve({ text: out.trim(), usage: null });
-      if (parsed.isError) return reject(new Error(`claude CLI reported is_error: ${String(parsed.text || '').slice(0, 300)}`));
-      resolve({ text: String(parsed.text || '').trim(), usage: parsed.usage });
-    });
-    child.stdin.write(prompt);
+    if (bin === 'claude') delete env.ANTHROPIC_API_KEY;
+    return { mode: 'same-user', user: null, file: bin, args: [...args], env };
+  }
+  const user = evalUser();
+  const childEnv = isolatedEnv(user);
+  return {
+    mode: 'isolated',
+    user,
+    file: SUDO_BIN,
+    args: ['-n', '-u', user, ENV_BIN, '-i', ...ISOLATED_ENV_ALLOWLIST.map((k) => `${k}=${childEnv[k]}`), 'bash', '-lc', ISOLATED_WRAPPER, HOP_LABEL, bin, ...args],
+    // The sudo front process gets NOTHING from this process. sudo resolves
+    // /usr/bin/env itself; env -i then starts the child from empty.
+    env: {},
+  };
+}
+
+// Run a plan: `input` to stdin, stdout/stderr collected, settled on close.
+// The timeout signal differs by mode. The legacy child gets SIGKILL as it
+// always did. The hop gets SIGTERM: it is the signal the operator's uid can
+// deliver to a root-owned sudo, and the one sudo relays to the wrapper's trap.
+// SIGKILL would neither be permitted nor relayed, and a wrapper without the
+// trap left the CLI orphaned with the stdout pipe open, so close never fired.
+function runPlan(plan, { input = null, timeoutMs = 300000, graceMs = 5000 } = {}) {
+  return new Promise((resolve, reject) => {
+    let child;
+    try { child = cp.spawn(plan.file, plan.args, { env: plan.env, stdio: ['pipe', 'pipe', 'pipe'] }); }
+    catch (e) { return reject(e); }
+    let stdout = '';
+    let stderr = '';
+    let timedOut = false;
+    const killer = setTimeout(() => {
+      timedOut = true;
+      child.kill(plan.mode === 'isolated' ? 'SIGTERM' : 'SIGKILL');
+    }, timeoutMs + graceMs);
+    child.stdout.on('data', (d) => { stdout += d; });
+    child.stderr.on('data', (d) => { stderr += d; });
+    child.on('error', (e) => { clearTimeout(killer); reject(e); });
+    child.on('close', (code, signal) => { clearTimeout(killer); resolve({ code, signal, stdout, stderr, timedOut }); });
+    child.stdin.on('error', () => { /* EPIPE if the CLI exits before reading all of stdin */ });
+    if (input != null) child.stdin.write(input);
     child.stdin.end();
   });
 }
 
+// The hop with an arbitrary command in place of the CLI, for the gate: the same
+// plan builder and the same runner, never trusted. No provider is reached.
+function runIsolated(cmdArgv, opts = {}) {
+  const [bin, ...args] = cmdArgv;
+  return runPlan(buildSpawnPlan({ bin, args, trusted: false }), { graceMs: 0, ...opts });
+}
+
+// A hop failure, said in terms of what to fix. Returns null when the failure is
+// the CLI's own (exit status from inside the hop), which the lane reports as before.
+function hopFailure(bin, r) {
+  const err = String(r.stderr || '').trim();
+  if (r.code === 127) {
+    return `the \`${bin}\` CLI is not on the eval user's PATH inside the isolated hop (${err.slice(0, 200)}). `
+      + 'Install and log it in as that user (RUNBOOK.md), or pass --trusted-skill for a skill you authored.';
+  }
+  const sudoLine = err.split('\n').find((l) => /^sudo:/.test(l));
+  if (sudoLine) {
+    return `the isolated eval-user hop failed before reaching \`${bin}\`: ${sudoLine}. The eval user and its NOPASSWD sudoers `
+      + 'rule are an operator prerequisite (RUNBOOK.md); pass --trusted-skill only for a skill you authored.';
+  }
+  return null;
+}
+
+// ── anthropic/cli (claude -p) ──────────────────────────────────────────────────
+async function completeClaudeCli({ system, prompt, model, timeoutMs, trusted = false }) {
+  // v0.4: `--output-format json` returns ONE JSON object carrying both the
+  // final text (`result`) and the token usage (`usage`) — the default text
+  // output carries no usage at all, which is why usage was previously null on
+  // this lane. The text is read from the parsed object; if the CLI ever emits
+  // something unparseable we fall back to the raw stdout so a run degrades to
+  // the old behaviour (text, no usage) rather than failing.
+  const args = ['-p', '--output-format', 'json', '--model', resolveModel(model)];
+  if (system) args.push('--append-system-prompt', system);
+  const plan = buildSpawnPlan({ bin: 'claude', args, trusted });
+  let r;
+  try {
+    r = await runPlan(plan, { input: prompt, timeoutMs });
+  } catch (e) {
+    if (e.code === 'ENOENT') {
+      throw new Error(plan.mode === 'isolated'
+        ? `the isolated hop requires ${SUDO_BIN}`
+        : "the anthropic/cli surface requires the `claude` CLI on PATH. Install it or set CLAUDE_PROVIDER=api.");
+    }
+    throw e;
+  }
+  if (r.code !== 0) {
+    const hop = plan.mode === 'isolated' ? hopFailure('claude', r) : null;
+    throw new Error(hop || `claude CLI exited ${r.code}: ${r.stderr.slice(0, 400)}`);
+  }
+  const parsed = parseClaudeCliJson(r.stdout);
+  if (!parsed) return { text: r.stdout.trim(), usage: null };
+  if (parsed.isError) throw new Error(`claude CLI reported is_error: ${String(parsed.text || '').slice(0, 300)}`);
+  return { text: String(parsed.text || '').trim(), usage: parsed.usage };
+}
+
 // ── openai/api (Chat Completions-compatible) ───────────────────────────────────
 // Generic OpenAI-compatible client using global fetch (Node ≥ 18). The base_url
 // is configurable — env OPENAI_BASE_URL wins, else the registry's provider
@@ -294,7 +434,7 @@ function openaiProviderConfig() {
 
 // ── openai/cli (codex exec — ChatGPT subscription) ─────────────────────────────
 // Invocation template (from the verified recon, reference_codex_cli):
-//   codex exec --json -s read-only --skip-git-repo-check --ephemeral -o <tmp> [-m <model>] "PROMPT"
+//   codex exec --json -s read-only --skip-git-repo-check --ephemeral [-m <model>] -
 // Honoured facts:
 //   - `-a/--ask-for-approval` is INVALID on `codex exec` — it is NEVER passed;
 //     exec already defaults to approval_policy "never".
@@ -305,6 +445,12 @@ function openaiProviderConfig() {
 //   - `codex exec` has no system-prompt flag, so a system prompt (the SKILL.md in
 //     with_skill mode) is folded into the prompt text.
 //   - stderr emits a harmless "Reading additional input from stdin…" notice.
+//   - `-o/--output-last-message` is NEVER passed (spec 022 AC-9, approval F-1).
+//     The final message is taken from the `--json` stream on the stdout pipe
+//     this process owns. A `-o` path is a file the child writes and the parent
+//     reads back; isolated, the child is the eval user running third-party
+//     instructions, and a symlink planted at that path would have made this
+//     process read an operator-owned file into the generation.
 const CODEX_EXEC_ARGS = ['exec', '--json', '-s', 'read-only', '--skip-git-repo-check', '--ephemeral'];
 
 function codexAuthPresent(homeDir) {
@@ -315,9 +461,9 @@ function codexAuthPresent(homeDir) {
 }
 
 // Build the exact argv for a codex exec call. Exposed for the gate to assert the
-// template (and that `-a` never appears). `outFile` receives the final message.
-function buildCodexArgs({ model, outFile }) {
-  const args = [...CODEX_EXEC_ARGS, '-o', outFile];
+// template (that `-a` never appears, and neither does `-o`).
+function buildCodexArgs({ model } = {}) {
+  const args = [...CODEX_EXEC_ARGS];
   if (model) args.push('-m', resolveModel(model));
   return args;
 }
@@ -326,66 +472,58 @@ function buildCodexArgs({ model, outFile }) {
 // means "read the prompt from stdin". The prompt is NEVER a positional argv —
 // real SKILL.md files start with `---` (YAML frontmatter) and codex rejects a
 // positional beginning with `--`. Exposed so the gate can lock this in.
-function codexFinalArgs({ model, outFile }) {
-  return [...buildCodexArgs({ model, outFile }), '-'];
+function codexFinalArgs({ model } = {}) {
+  return [...buildCodexArgs({ model }), '-'];
 }
 
-function completeCodexCli({ system, prompt, model, timeoutMs }) {
-  return new Promise((resolve, reject) => {
-    if (!codexAuthPresent()) {
-      return reject(new Error('the openai/cli surface requires codex auth (~/.codex/auth.json). Run `codex login` (or `codex login --device-auth` on a headless box).'));
+async function completeCodexCli({ system, prompt, model, timeoutMs, trusted = false }) {
+  // The auth presence check is a PARENT-side read of ~/.codex/auth.json, which
+  // only means something on the same-user path; the eval user's home is not
+  // readable from here, and a missing login there surfaces as codex's own error.
+  if (trusted && !codexAuthPresent()) {
+    throw new Error('the openai/cli surface requires codex auth (~/.codex/auth.json). Run `codex login` (or `codex login --device-auth` on a headless box).');
+  }
+  // codex exec has no system-prompt flag → fold the system prompt into the
+  // prompt text (this is how the SKILL.md reaches the model in with_skill mode).
+  const fullPrompt = system ? `${system}\n\n---\n\n${prompt}` : prompt;
+  // The prompt is delivered on STDIN, not as a positional argv: real SKILL.md
+  // files begin with `---` (YAML frontmatter), and a positional argument that
+  // starts with `--` is rejected by codex's arg parser ("unexpected argument
+  // '---'"). `-` as the positional tells `codex exec` to read instructions from
+  // stdin (per its --help), which is content-agnostic.
+  const plan = buildSpawnPlan({ bin: 'codex', args: codexFinalArgs({ model }), trusted });
+  // stdout is CAPTURED. `--json` streams JSONL events there: the last
+  // `item.completed`/`agent_message` carries the final text and the terminal
+  // `turn.completed` event carries this call's token usage — the only place
+  // codex reports it. Nothing is read from the filesystem after the call, on
+  // either mode: the stdout pipe is the one channel only the child we spawned
+  // can write to, and the eval user cannot make this process read a file
+  // through it (spec 022 AC-9).
+  let r;
+  try {
+    r = await runPlan(plan, { input: fullPrompt, timeoutMs });
+  } catch (e) {
+    if (e.code === 'ENOENT') {
+      throw new Error(plan.mode === 'isolated'
+        ? `the isolated hop requires ${SUDO_BIN}`
+        : 'the openai/cli surface requires the `codex` CLI on PATH (npm i -g @openai/codex).');
     }
-    // codex exec has no system-prompt flag → fold the system prompt into the
-    // prompt text (this is how the SKILL.md reaches the model in with_skill mode).
-    const fullPrompt = system ? `${system}\n\n---\n\n${prompt}` : prompt;
-    const outFile = path.join(os.tmpdir(), `driftproof-codex-${process.pid}-${Date.now()}-${Math.floor(codexCounter())}.txt`);
-    // The prompt is delivered on STDIN, not as a positional argv: real SKILL.md
-    // files begin with `---` (YAML frontmatter), and a positional argument that
-    // starts with `--` is rejected by codex's arg parser ("unexpected argument
-    // '---'"). `-` as the positional tells `codex exec` to read instructions from
-    // stdin (per its --help), which is content-agnostic.
-    const args = codexFinalArgs({ model, outFile });
-
-    // v0.4: stdout is CAPTURED (it was 'ignore'). `--json` streams JSONL events
-    // there, and the terminal `turn.completed` event carries this call's token
-    // usage — the only place codex reports it. The final message still comes from
-    // the -o file (cleaner than scraping the stream); the JSONL is read for usage.
-    const child = spawn('codex', args, { env: { ...process.env }, stdio: ['pipe', 'pipe', 'pipe'] });
-    let err = '';
-    let jsonl = '';
-    const killer = setTimeout(() => { child.kill('SIGKILL'); }, timeoutMs + 5000);
-    child.stdout.on('data', (d) => { jsonl += d; });
-    child.stderr.on('data', (d) => { err += d; });
-    child.on('error', (e) => {
-      clearTimeout(killer);
-      if (e.code === 'ENOENT') reject(new Error('the openai/cli surface requires the `codex` CLI on PATH (npm i -g @openai/codex).'));
-      else reject(e);
-    });
-    child.on('close', (code) => {
-      clearTimeout(killer);
-      let text = '';
-      try { text = fs.readFileSync(outFile, 'utf8'); } catch (_e) { /* fall through */ }
-      try { fs.unlinkSync(outFile); } catch (_e) { /* best effort */ }
-      if (code !== 0) return reject(new Error(`codex exec exited ${code}: ${String(err).slice(0, 400)}`));
-      const ev = parseCodexJsonl(jsonl);
-      // Prefer the -o file; fall back to the stream's agent_message if it is empty.
-      const finalText = String(text || ev.text || '').trim();
-      resolve({ text: finalText, usage: ev.usage });
-    });
-    child.stdin.on('error', () => { /* ignore EPIPE if codex exits before reading all input */ });
-    child.stdin.write(fullPrompt);
-    child.stdin.end();
-  });
+    throw e;
+  }
+  if (r.code !== 0) {
+    const hop = plan.mode === 'isolated' ? hopFailure('codex', r) : null;
+    throw new Error(hop || `codex exec exited ${r.code}: ${String(r.stderr).slice(0, 400)}`);
+  }
+  const ev = parseCodexJsonl(r.stdout);
+  return { text: String(ev.text || '').trim(), usage: ev.usage };
 }
 
-// A monotonically-increasing counter for temp-file uniqueness that does not use
-// Math.random (kept deterministic-friendly for any harness that forbids it).
-let _codexCounter = 0;
-function codexCounter() { _codexCounter += 1; return _codexCounter; }
-
 module.exports = {
   complete, resolveModel, surfaceLabel, providerName, MODEL_ALIASES,
   inferProvider, surfaceForModel, providerForSurface,
   isMeteredSurface, isSubscriptionSurface, retryPolicyForSurface,
   CODEX_OVERHEAD_NOTE, CODEX_EXEC_ARGS, buildCodexArgs, codexFinalArgs, codexAuthPresent,
+  // spec 022 — the eval-user hop
+  SUDO_BIN, EVAL_USER_DEFAULT, ISOLATED_ENV_ALLOWLIST, ISOLATED_WRAPPER, HOP_LABEL,
+  evalUser, isolatedEnv, buildSpawnPlan, runIsolated,
 };

package/lib/run.js

@@ -51,7 +51,7 @@ function projectCalls(caseCount, samples, draws = 1) {
 // Ask the target model to perform one eval case. `withSkill` decides whether the
 // SKILL.md is prepended as a system prompt (the whole point: measure the skill's
 // marginal effect vs a bare baseline).
-async function runCase({ skillMd, caseObj, model, withSkill, timeoutMs }) {
+async function runCase({ skillMd, caseObj, model, withSkill, timeoutMs, trusted = false }) {
   // Test seam (gate only): force a persistent timeout for a named case id so the
   // failed_timeout path is exercised deterministically without any live call.
   if (process.env.DRIFTPROOF_TEST_TIMEOUT_CASEID && process.env.DRIFTPROOF_TEST_TIMEOUT_CASEID === caseObj.id) {
@@ -60,7 +60,7 @@ async function runCase({ skillMd, caseObj, model, withSkill, timeoutMs }) {
     throw e;
   }
   const system = withSkill ? skillMd : undefined;
-  const { text, usage, wall_ms, attempts } = await complete({ system, prompt: caseObj.prompt, model, maxTokens: 1024, timeoutMs });
+  const { text, usage, wall_ms, attempts } = await complete({ system, prompt: caseObj.prompt, model, maxTokens: 1024, timeoutMs, trusted });
   return { text, usage, wall_ms, attempts };
 }
 
@@ -78,8 +78,8 @@ function outcomeFor(mean, stddev, threshold) {
 // `generationHash` binds the graded case to the exact generation text (v0.3).
 // Returns { caseResult, sampleTexts } — sampleTexts is transient (retained only
 // under --keep-transcripts; never part of the receipt).
-async function judgeCase({ caseObj, response, generationHash, judgeModel, mode, timeoutMs, samples }) {
-  const g = await gradeSamples({ task: caseObj.prompt, response, rubric: caseObj.rubric, model: judgeModel, samples, timeoutMs });
+async function judgeCase({ caseObj, response, generationHash, judgeModel, mode, timeoutMs, samples, trusted = false }) {
+  const g = await gradeSamples({ task: caseObj.prompt, response, rubric: caseObj.rubric, model: judgeModel, samples, timeoutMs, trusted });
   const outcome = outcomeFor(g.mean, g.stddev, caseObj.pass_threshold);
   const caseResult = {
     id: caseObj.id,
@@ -127,7 +127,7 @@ async function mapPool(items, concurrency, fn) {
 // a sealed receipt. Enforces a hard call cap; every model+judge call counts.
 //
 // opts: { maxCases, maxCalls, samples, judgeModel, timeoutMs, concurrency,
-//         onProgress, budget, keepTranscripts, nowIso }
+//         onProgress, budget, keepTranscripts, nowIso, trusted }
 //   budget          — optional BudgetTracker; accumulates estimated per-call
 //                     USD as the run proceeds and hard-stops at 1.25× the cap.
 //   keepTranscripts — when true, the run records transcripts:"retained-local"
@@ -177,6 +177,10 @@ async function runSkillOnModel({ skill, model, opts = {} }) {
   const onProgress = opts.onProgress || (() => {});
   const budget = opts.budget || null;
   const keepTranscripts = !!opts.keepTranscripts;
+  // spec 022: the SAME-USER legacy spawn is reachable only when a caller says
+  // `trusted: true` (bin/driftproof --trusted-skill). Every other caller of this
+  // function, the report scripts and the release watcher included, isolates.
+  const trusted = !!opts.trusted;
 
   let cases = skill.suite.cases;
   if (opts.maxCases && cases.length > opts.maxCases) cases = cases.slice(0, opts.maxCases);
@@ -222,12 +226,12 @@ async function runSkillOnModel({ skill, model, opts = {} }) {
       const drawIndex = draws.length;
       try {
         onProgress({ case: c.id, mode, phase: 'generate', draw: drawIndex });
-        const gen = await runCase({ skillMd: skill.skillMd, caseObj: c, model: modelId, withSkill, timeoutMs: ctGen });
+        const gen = await runCase({ skillMd: skill.skillMd, caseObj: c, model: modelId, withSkill, timeoutMs: ctGen, trusted });
         calls += 1;
         if (budget) budget.add((gen.attempts || 1) * perCallCostUSD(modelId, genKind(withSkill)));
         const generationHash = sha256(String(gen.text || ''));
         onProgress({ case: c.id, mode, phase: 'judge', samples, draw: drawIndex });
-        const jr = await judgeCase({ caseObj: c, response: gen.text, generationHash, judgeModel, mode, timeoutMs: ctJudge, samples });
+        const jr = await judgeCase({ caseObj: c, response: gen.text, generationHash, judgeModel, mode, timeoutMs: ctJudge, samples, trusted });
         calls += samples;
         if (budget) budget.add((jr.attempts || samples) * perCallCostUSD(judgeModel, 'judge'));
         const draw = {

package/lib/verdict.js

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 'use strict';
 
+const crypto = require('crypto');
 const { EFFECT_FLOOR } = require('../config');
 
 // Single-receipt verdict + shields.io badge.
@@ -72,14 +73,39 @@ function badgeEndpoint(receipt, { label = 'driftproof' } = {}) {
 }
 
 // Lines suitable for appending to a GitHub Actions $GITHUB_OUTPUT file.
+//
+// Spec 023 (audit A6). Each entry is written in GitHub's multiline form,
+//
+//   name<<ghadelim_<32 hex>
+//   value
+//   ghadelim_<32 hex>
+//
+// with a delimiter drawn fresh from crypto.randomBytes for EVERY entry, so no
+// value can close a block early; and any value carrying \r or \n is refused
+// with a throw before anything is written. The bare `name=value` form this used
+// to emit let a model_id with a newline in it (any string a receipt carries; a
+// .driftproofrc in a skill directory sets it) append a second, attacker-chosen
+// entry, and that entry was then interpolated into the enforce step's shell.
+// Refusing is the honest writer: a line break in a model id is not a value
+// anybody meant to publish. Entries are joined by '\n' with no trailing newline
+// so the caller's console.log stays the one that terminates the text.
+function githubOutputEntry(name, value) {
+  const val = String(value);
+  if (/[\r\n]/.test(val)) {
+    throw new Error(`refusing to write $GITHUB_OUTPUT: the value of "${name}" contains a line break (${JSON.stringify(val)})`);
+  }
+  const delim = `ghadelim_${crypto.randomBytes(16).toString('hex')}`;
+  return `${name}<<${delim}\n${val}\n${delim}`;
+}
+
 function githubOutputLines(receipt) {
   const v = verdictFromReceipt(receipt);
   return [
-    `verdict=${v.verdict}`,
-    `delta=${v.delta}`,
-    `message=${v.message}`,
-    `color=${v.color}`,
-  ].join('\n');
+    ['verdict', v.verdict],
+    ['delta', v.delta],
+    ['message', v.message],
+    ['color', v.color],
+  ].map(([k, val]) => githubOutputEntry(k, val)).join('\n');
 }
 
-module.exports = { verdictFromReceipt, badgeEndpoint, githubOutputLines, shortModel, VERDICTS };
+module.exports = { verdictFromReceipt, badgeEndpoint, githubOutputLines, githubOutputEntry, shortModel, VERDICTS };

package/package.json

@@ -1,14 +1,16 @@
 {
   "name": "driftproof",
-  "version": "0.7.2",
+  "version": "0.8.1",
   "description": "A dated proof that this skill, this hash, this model, still helps: run a skill's eval suite with and without the skill across model versions, emit hash-verified dated receipts, and diff receipts into drift reports.",
   "license": "Apache-2.0",
   "keywords": [
     "agent-skills",
-    "evals",
-    "llm",
+    "skill-md",
+    "skill-eval",
+    "llm-evaluation",
+    "claude-code",
     "drift",
-    "verification"
+    "receipts"
   ],
   "homepage": "https://driftproofhq.com",
   "repository": {
@@ -41,5 +43,8 @@
   },
   "engines": {
     "node": ">=22"
+  },
+  "devDependencies": {
+    "html-validate": "^11.11.0"
   }
 }