faberun 0.20.0 → 0.22.0

package/src/campaign/chain.mjs

@@ -42,6 +42,7 @@ import { pidAlive, processStartToken } from "../run/lock.mjs";
 import { delay, errorCode, errorMessage } from "../util.mjs";
 import { writeJsonAtomic } from "../run/store.mjs";
 import { runDirectory } from "../run/paths.mjs";
+import { listNodeSnapshots, readNodeSnapshot } from "../run/node-store.mjs";
 import { gitArguments, killTarget } from "../host/platform.mjs";
 
 /** @typedef {import("../contract/index.mjs").ControllerIdentity} ControllerIdentity */
@@ -561,12 +562,14 @@ export async function driveCampaignChain(campaignPath, options = {}) {
       try {
         await launch(entry.path, { baseRef, controllerIdentity, runDir, contract });
       } catch (error) {
+        const stranded = strandedRunNote(runDir);
         return park({
           code: errorCode(error) ?? "launch_failed",
-          message: errorMessage(error),
+          message: stranded ? `${errorMessage(error)}; ${stranded}` : errorMessage(error),
           contractPath: entry.path,
           contractId: id,
           runId: id,
+          ...(stranded ? { resume: `resume ${runDir}` } : {}),
         });
       }
       heartbeat.progress();
@@ -578,3 +581,29 @@ export async function driveCampaignChain(campaignPath, options = {}) {
     if (acquired) releaseCoordinatorLock(campaignPath, acquired.lock);
   }
 }
+
+/**
+ * What a launch that died before readiness left on disk. RM-053, measured on
+ * `rec-audit-remediation`: the controller died with the launcher's cgroup,
+ * the park said only `detached bootstrap did not become ready`, and the run
+ * directory it left, every node pending, finished under a durable `resume`.
+ *
+ * @param {string} runDir
+ * @returns {string|null}
+ */
+function strandedRunNote(runDir) {
+  if (!runDir || !existsSync(runDir)) return null;
+  /** @type {Map<string, number>} */
+  const counts = new Map();
+  for (const name of listNodeSnapshots(runDir)) {
+    let status = "unreadable";
+    try {
+      status = String(/** @type {{status?: unknown}} */ (readNodeSnapshot(runDir, name.replace(/\.json$/u, ""))).status ?? "unknown");
+    } catch {
+      // A snapshot caught mid-write is counted as unreadable, not dropped.
+    }
+    counts.set(status, (counts.get(status) ?? 0) + 1);
+  }
+  const nodes = [...counts].sort(([left], [right]) => left.localeCompare(right)).map(([status, count]) => `${count} ${status}`).join(" · ");
+  return `run directory ${runDir} exists (nodes: ${nodes || "none written yet"}); \`faberun resume ${runDir}\` completes it, under tmux, systemd-run or faberun seat so it outlives this shell`;
+}

package/src/campaign/projection.mjs

@@ -17,6 +17,7 @@ import { readJournal, validateJournalEntry, withoutLegacyLivenessFields } from "
 /** @typedef {import("../notify/index.mjs").JsonObject} JsonObject */
 /** @typedef {import("./index.mjs").Projection} Projection */
 /** @typedef {import("./index.mjs").ProjectionRecord} ProjectionRecord */
+/** @typedef {{id: string, text: string, at: string, sessionId: string}} ProjectedDecision */
 
 /**
  * @param {string} campaignPath
@@ -58,6 +59,39 @@ export function readProjectionState(campaignPath, campaign) {
     changed: true,
   };
 }
+/**
+ * The active decisions a campaign journal folds to: every `decision` entry the
+ * projection still holds, ordered by journal position, with `supersede`
+ * bookkeeping already applied by the fold. This is the only journal view a
+ * Campaign Brief may use for decisions; nothing is inferred from a run graph, a
+ * run status or prose. A projection that carries no decisions yields an empty
+ * list, never a guess.
+ *
+ * @param {Projection} state
+ * @returns {ProjectedDecision[]}
+ */
+export function projectCampaignDecisions(state) {
+  const decisions = state && typeof state === "object" && typeof state.decisions === "object" && state.decisions !== null && !Array.isArray(state.decisions)
+    ? /** @type {Record<string, JournalEntry>} */ (state.decisions)
+    : {};
+  /** @type {ProjectedDecision[]} */
+  const projected = [];
+  for (const entry of Object.values(decisions)) {
+    if (entry.type !== "decision" || typeof entry.decisionId !== "string") continue;
+    projected.push({
+      id: entry.decisionId,
+      text: typeof entry.text === "string" ? entry.text : "",
+      at: typeof entry.at === "string" ? entry.at : "",
+      sessionId: typeof entry.sessionId === "string" ? entry.sessionId : "",
+    });
+  }
+  projected.sort((left, right) => {
+    if (left.at !== right.at) return left.at < right.at ? -1 : 1;
+    if (left.id !== right.id) return left.id < right.id ? -1 : 1;
+    return 0;
+  });
+  return projected;
+}
 /**
  * @param {unknown} stored
  * @returns {stored is ProjectionRecord}

package/src/cli/campaign.mjs

@@ -11,6 +11,7 @@ import {
   resolveCampaign,
 } from "../campaign/index.mjs";
 import { addContract, replaceContract } from "./campaign-contract.mjs";
+import { generateCampaignBrief } from "../campaign/brief-cli.mjs";
 import { runsRoot } from "../run/paths.mjs";
 import { syncAgentSignal } from "../repo/signal.mjs";
 import { acknowledgeJournalEvent, appendJournal, appendSeatAllowanceEvent, readJournal, watchJournal } from "../campaign/journal.mjs";
@@ -83,12 +84,13 @@ const OPERATION_OPTIONS = {
   unpark: { cwd: { type: "string" }, force: { type: "boolean" }, "event-id": { type: "string" } },
   "add-contract": { cwd: { type: "string" }, path: { type: "string" } },
   "replace-contract": { cwd: { type: "string" }, path: { type: "string" }, replace: { type: "string" } },
+  brief: { cwd: { type: "string" }, phase: { type: "string" } },
   show: { cwd: { type: "string" } },
   sync: { cwd: { type: "string" }, "session-id": { type: "string" } },
   ack: { cwd: { type: "string" }, "session-id": { type: "string" }, "event-id": { type: "string" } },
 };
 
-/** @typedef {{cwd?: string, goal?: string, contract?: string[], landBranch?: string, tool?: string, sessionId?: string, transcript?: string, format?: string, cursor?: string, since?: string, kind?: string, text?: string, runId?: string, supersedes?: string, decisionId?: string, questionId?: string, eventId?: string, noTranscript?: boolean, wake?: boolean, detach?: boolean, interval?: string, once?: boolean, allowMain?: boolean, force?: boolean, path?: string, replace?: string}} CliValues */
+/** @typedef {{cwd?: string, goal?: string, contract?: string[], landBranch?: string, tool?: string, sessionId?: string, transcript?: string, format?: string, cursor?: string, since?: string, kind?: string, text?: string, runId?: string, supersedes?: string, decisionId?: string, questionId?: string, eventId?: string, noTranscript?: boolean, wake?: boolean, detach?: boolean, interval?: string, once?: boolean, allowMain?: boolean, force?: boolean, path?: string, replace?: string, phase?: string}} CliValues */
 /** @typedef {import("../campaign/index.mjs").Campaign} Campaign */
 
 /**
@@ -99,6 +101,24 @@ export async function campaignCli(args) {
   const operation = args[0];
   if (!operation || !(operation in OPERATION_OPTIONS)) return usage();
   const { positional, values } = parseArgs(args.slice(1), operation);
+  if (operation === "brief") {
+    const [action, campaignId, ...extra] = positional;
+    if (campaignId === undefined || extra.length) return usage();
+    if (action === "generate") {
+      generateCampaignBrief({ campaignId, phase: values.phase, cwd: values.cwd });
+      return;
+    }
+    // `serve` starts the separate R8 loopback server; the module owns the
+    // verification and HTTP behavior, the CLI only parses and dispatches. It is
+    // imported on demand so the ordinary CLI startup graph stays free of the
+    // HTTP server for every other verb.
+    if (action === "serve") {
+      const { serveCampaignBrief } = await import("../web/campaign-brief-server.mjs");
+      await serveCampaignBrief({ campaignId, phase: values.phase, cwd: values.cwd });
+      return;
+    }
+    return usage();
+  }
   const [campaignId, ...extra] = positional;
   if (operation === "list") {
     if (campaignId !== undefined || extra.length) return usage();
@@ -625,7 +645,7 @@ function positiveIntervalMs(value) {
 
 function usage() {
   process.stderr.write(
-    "usage: faberun campaign <init|watch|attach|note|resolve|close|supervise|unpark|show|list|sync|ack|add-contract|replace-contract> <campaign-id> [--cwd <dir>] ...\n",
+    "usage: faberun campaign <init|watch|attach|note|resolve|close|supervise|unpark|show|list|sync|ack|add-contract|replace-contract|brief> <campaign-id> [--cwd <dir>] ...\n",
   );
   process.exitCode = 2;
 }

package/src/contract/index.mjs

@@ -13,9 +13,9 @@ import { DISCOVERY_RUNTIME_DEFINITIONS } from "../engine/runtime-discovery.mjs";
 import { stableJson } from "../util.mjs";
 import { assertObject, boundedString, nonNegativeInteger, nonNegativeNumber, positiveInteger, positiveNumber, rejectUnknown, requireId, requireString } from "./assert.mjs";
 import { validateMetadata } from "./schema-version.mjs";
-import { assertRuntimeExecutesCommands, requireRuntime, validateRuntime } from "./runtime.mjs";
+import { assertRuntimeExecutesCommands, judgeWriteWarnings, requireRuntime, validateRuntime } from "./runtime.mjs";
 import { validateSourceIdentity } from "../repo/source-identity.mjs";
-import { commandCoverageWarnings, mirrorCoverageWarnings, unsnapshottedWriteWarnings } from "../repo/declared-paths.mjs";
+import { commandCoverageWarnings, ignoreSourceWriteWarnings, mirrorCoverageWarnings, unsnapshottedWriteWarnings } from "../repo/declared-paths.mjs";
 import { crossNodeScopeFindings, scopeClosureFindings } from "../repo/scope-closure.mjs";
 
 export { CONTRACT_VERSION, PROTOCOL_SCHEMA_VERSION } from "../harnesses/index.mjs";
@@ -98,7 +98,7 @@ const GATE_REVIEWS = new Set(["none", "advisory", "blocking"]);
 /** @typedef {{history: RoutingHistoryEntry[], currentOverride: RoutingOverride|null, assignments?: RuntimeAssignments, availability?: Record<string, RuntimeAvailability>, tierExhaustion?: TierExhaustion, tierExhaustionCycle?: number}} RoutingState */
 /** @typedef {{revision?: number, heartbeatCount: number, dryHeartbeatCount: number, progressSignature?: string|null, lastHeartbeatAt: string|null, lastProgressAt: string|null, nextCheckAt?: string|null}} ProgressState */
 /** @typedef {{status: "unassigned"|"provisioning"|"ready"|"failed"|"removed", path: string|null, branch: string|null, commit: string|null, baseSha?: string|null, sealedSha?: string|null, sealError?: string|null, previousAttempt?: number|null}} WorktreeState */
-/** @typedef {{schemaVersion: number, contractVersion: string, id: string, type: string, sourceIdentity: SourceIdentity, packetHash: string, requirementIds?: string[], status: NodeStatus, phase: NodePhase, attempt: number, revisions: number, judgeFailures?: number, review?: ("none"|"advisory"|"blocking"), runtime: RuntimeSnapshot|null, blockedBy: string[], startedAt: string|null, updatedAt: string, result: unknown, gate: GateResult|null, error: SnapshotError|null, usage?: Usage, costUsd?: number, routing?: RoutingState|null, progress?: ProgressState|null, worktree?: WorktreeState|null, integratedHead?: string|null, invocations?: Invocation[], executionOverrides?: ExecutionOverride[], verification?: VerificationState|null, scope?: BoundedScope|null, scopeFindings?: ScopeFindings|null, previousAttempt?: string, sessionPolicy?: {forceFresh?: boolean}|null, declaredReadBytes?: number|null}} NodeSnapshot */
+/** @typedef {{schemaVersion: number, contractVersion: string, id: string, type: string, sourceIdentity: SourceIdentity, packetHash: string, requirementIds?: string[], status: NodeStatus, phase: NodePhase, attempt: number, revisions: number, judgeFailures?: number, review?: ("none"|"advisory"|"blocking"), runtime: RuntimeSnapshot|null, blockedBy: string[], startedAt: string|null, updatedAt: string, result: unknown, gate: GateResult|null, error: SnapshotError|null, usage?: Usage, costUsd?: number, routing?: RoutingState|null, progress?: ProgressState|null, worktree?: WorktreeState|null, integratedHead?: string|null, invocations?: Invocation[], executionOverrides?: ExecutionOverride[], verification?: VerificationState|null, scope?: BoundedScope|null, scopeFindings?: ScopeFindings|null, verificationArtifacts?: string[], previousAttempt?: string, sessionPolicy?: {forceFresh?: boolean}|null, declaredReadBytes?: number|null}} NodeSnapshot */
 /** @typedef {{path: string, sha: string}} ControllerIdentity */
 /** @typedef {{schemaVersion: number, contractVersion: string, pid: number, processStartToken: string|null, startedAt: string, sourceIdentity: SourceIdentity, controllerIdentity?: ControllerIdentity, integrationRef?: string, identityWarnings?: string[], relaunchCount?: number, lastRelaunchProgressAt?: string|null, attention?: {code: string, message: string, at: string}|null, contractDigest?: string, scopeDecision?: ScopeDecision, autoRetries?: Record<string, {code: string, at: string}>}} RunMetadata */
 /** @typedef {{at: string, base: string|null, dirtyTreeFingerprint: string|null}} ScopeDecision */
@@ -380,8 +380,10 @@ export function validateContract(raw, contractPath, options = {}) {
       ...unquotedFilterValueWarnings(node.definitionOfDone ?? [], index),
       ...(persisted ? [] : mirrorCoverageWarnings(node, index, cwd, contractCommands, contractWrites)),
       ...(persisted ? [] : unsnapshottedWriteWarnings(node, index, cwd)),
+      ...(persisted ? [] : ignoreSourceWriteWarnings(node, index)),
       ...(persisted ? [] : writeFileLineBudgetWarnings(node, index, cwd)),
     ]),
+    ...judgeWriteWarnings(runtimes, defaults, nodes),
     // Cross-node by construction: a requirement proven in two nodes is only
     // visible when every node's commands are read together, which is the
     // whole point -- one copy repaired and six left behind is what a per-node

package/src/contract/runtime.mjs

@@ -11,7 +11,7 @@
  */
 import { assertObject, nonNegativeNumber, positiveInteger, positiveNumber, rejectUnknown, requireId, requireString, requireStringArray, requireTimestamp } from "./assert.mjs";
 import { composeAssignments } from "../engine/runtime-discovery.mjs";
-import { harnessCapabilities, resolvePermissionExecution, resolveVendor, validateCapabilityRequirements } from "../harnesses/index.mjs";
+import { harnessCapabilities, resolvePermissionExecution, resolveVendor, validateCapabilityRequirements, writesWorkspace } from "../harnesses/index.mjs";
 import { stableJson } from "../util.mjs";
 /** @typedef {import("./index.mjs").NodeStatus} NodeStatus */
 /** @typedef {import("../engine/runtime-discovery.mjs").RuntimeAvailability} RuntimeAvailability */
@@ -212,6 +212,27 @@ export function assertRuntimeExecutesCommands(runtimes, runtimeId, index, nodeId
     `nodes[${index}] (${nodeId}) has verification but ${label} ${runtimeId} uses ${execution.field}=${execution.mode}; ${runtime.harness} executes commands only in ${execution.executingModes.join(", ")}`,
   );
 }
+/**
+ * A judge runtime that declares a writing mode its harness offers a read-only
+ * alternative to. The verdict reaches the gate without a write (RM-058), and
+ * `judge_protocol` blocks a judge that writes anyway, so the grant buys
+ * nothing but the chance to write where the judge should not.
+ *
+ * @param {Record<string, ValidatedRuntime>} runtimes
+ * @param {{judge?: string}} defaults
+ * @param {{gate?: {runtime?: string}|false|null}[]} nodes
+ * @returns {string[]}
+ */
+export function judgeWriteWarnings(runtimes, defaults, nodes) {
+  const judges = new Set([defaults.judge, ...nodes.map((node) => (node.gate ? node.gate.runtime : undefined))].filter((id) => typeof id === "string"));
+  return [...judges].flatMap((id) => {
+    const runtime = runtimes[/** @type {string} */ (id)];
+    const execution = resolvePermissionExecution(runtime);
+    if (!execution.field || runtime[execution.field] === undefined || !writesWorkspace(runtime)) return [];
+    if (writesWorkspace({ ...runtime, [execution.field]: "read-only" })) return [];
+    return [`judge runtime ${id} declares ${execution.field} ${execution.mode}; a judge's verdict reaches the gate without writing, so declare ${execution.field} read-only`];
+  });
+}
 /**
  * @param {unknown} value
  * @param {string} label

package/src/contract/scope-findings.mjs

@@ -35,6 +35,18 @@ export function scopeFindingsNote(scopeFindings) {
   return `scope: ${count} unexpected path${count === 1 ? "" : "s"}`;
 }
 
+/**
+ * The `verification_artifact` finding: paths the controller's verification
+ * left untracked, which the seal kept out of the integration.
+ *
+ * @param {string[]|null|undefined} paths
+ * @returns {string|null}
+ */
+export function verificationArtifactsNote(paths) {
+  if (!paths?.length) return null;
+  return `verification_artifact: ${paths.length} path${paths.length === 1 ? "" : "s"} left unsealed (${paths.slice(0, 3).join(", ")})`;
+}
+
 /**
  * @param {{unexpectedPaths: string[]}|null|undefined} scopeFindings
  * @returns {string}

package/src/contract/snapshot.mjs

@@ -129,7 +129,7 @@ export function validateNodeSnapshot(value, expectedNode = null) {
     "schemaVersion", "contractVersion", "id", "type", "sourceIdentity", "packetHash", "status", "phase",
     "attempt", "revisions", "judgeFailures", "requirementIds", "runtime", "blockedBy", "startedAt", "updatedAt", "result", "gate", "error", "usage",
     "costUsd", "routing", "progress", "worktree", "invocations", "executionOverrides", "verification", "scope",
-    "scopeFindings", "review", "previousAttempt", "sessionPolicy", "integratedHead", "declaredReadBytes",
+    "scopeFindings", "verificationArtifacts", "review", "previousAttempt", "sessionPolicy", "integratedHead", "declaredReadBytes",
   ]), "node snapshot");
   validateMetadata(value, "node snapshot");
   requireId(value.id, "node snapshot.id");
@@ -184,6 +184,7 @@ export function validateNodeSnapshot(value, expectedNode = null) {
   if (value.verification !== undefined && value.verification !== null) validateVerificationSnapshot(value.verification);
   if (value.scope !== undefined && value.scope !== null) validateScopeSnapshot(value.scope);
   if (value.scopeFindings !== undefined && value.scopeFindings !== null) validateScopeFindings(value.scopeFindings);
+  if (value.verificationArtifacts !== undefined) validatePathList(value.verificationArtifacts, "node snapshot.verificationArtifacts");
   // The session policy a rejection decision leaves for the dispatch that will
   // run the retry. It is persisted because the decision can hand the node back
   // to the scheduler, whose own `startWorker` call carries no argument; without
@@ -611,12 +612,22 @@ function validateScopeSnapshot(value) {
 function validateScopeFindings(value) {
   assertObject(value, "node snapshot.scopeFindings");
   rejectUnknown(value, new Set(["unexpectedPaths"]), "node snapshot.scopeFindings");
-  const paths = /** @type {unknown[]} */ (value.unexpectedPaths);
-  if (!Array.isArray(value.unexpectedPaths) || paths.length > MAX_SCOPE_FINDING_PATHS || paths.some((path) => typeof path !== "string")) {
-    throw new TypeError("node snapshot.scopeFindings.unexpectedPaths is invalid");
+  validatePathList(value.unexpectedPaths, "node snapshot.scopeFindings.unexpectedPaths");
+}
+/**
+ * A bounded list of workspace paths: the shape of a scope finding and of the
+ * paths a verification left behind (`verificationArtifacts`).
+ *
+ * @param {unknown} value
+ * @param {string} label
+ */
+function validatePathList(value, label) {
+  const paths = /** @type {unknown[]} */ (value);
+  if (!Array.isArray(value) || paths.length > MAX_SCOPE_FINDING_PATHS || paths.some((path) => typeof path !== "string")) {
+    throw new TypeError(`${label} is invalid`);
   }
   if (paths.some((path) => Buffer.byteLength(/** @type {string} */ (path), "utf8") > 1024)) {
-    throw new TypeError("node snapshot.scopeFindings.unexpectedPaths contains an oversized path");
+    throw new TypeError(`${label} contains an oversized path`);
   }
 }
 /**

package/src/engine/dispatch.mjs

@@ -34,7 +34,7 @@ import { invocationCost, invocationUsage } from "../run/usage.mjs";
 import { logPaths, startProcess } from "./process.mjs";
 import { readBoundedTail } from "./transcript.mjs";
 import { mkdirSync, statSync } from "node:fs";
-import { READ_BYTE_LIMIT, READ_LINE_LIMIT, harnessCapabilities, normalizeProviderResult } from "../harnesses/index.mjs";
+import { READ_BYTE_LIMIT, READ_LINE_LIMIT, harnessCapabilities, normalizeProviderResult, writesWorkspace } from "../harnesses/index.mjs";
 import { writeJsonAtomic } from "../run/store.mjs";
 import { judgeReaskInstruction, reviewMode } from "../contract/review-modes.mjs";
 import { routeRuntimeForState, runtimeSnapshot } from "./failover.mjs";
@@ -194,6 +194,7 @@ function sealPreviousAttempt(contract, node, state) {
     runId: contract.id,
     nodeId: node.id,
     attempt,
+    exclude: state.verificationArtifacts,
   });
   return sealed.empty ? null : { sha: sealed.sha, attempt };
 }
@@ -269,7 +270,7 @@ export function startWorker(contract, node, state, runDir, running, prompt, lock
   // make sure the directory exists before the provider is asked to.
   const resultPath = attemptWorkerResultPath(runDir, node.id, workspace);
   mkdirSync(dirname(resultPath), { recursive: true });
-  const effectivePrompt = workerProtocolPrompt(phasePlan.prompt, resultPath);
+  const effectivePrompt = workerProtocolPrompt(phasePlan.prompt, resultPath, writesWorkspace(runtime));
   const paths = logPaths(runDir, node.id, "worker", state.attempt);
   if (Buffer.byteLength(effectivePrompt, "utf8") > 64 * 1024) {
     transition(runDir, state, "failed", { phase: "worker", error: { code: "worker_prompt_too_large", message: "worker prompt exceeds 65536 bytes" } }, lock);
@@ -390,8 +391,9 @@ export function startResultMaterialization(contract, node, state, runDir, runnin
   const resultPath = attemptWorkerResultPath(runDir, node.id, workspace);
   const prompt = appendSandboxNotice([
     `${RESULT_MATERIALIZATION_PROMPT_HEADER} Do not inspect, implement, verify, or invoke tools.`,
-    `Your only job in this single bounded turn is to write the required worker-result JSON object to: ${resultPath}`,
-    "Then return that same JSON object as the final message.",
+    ...(writesWorkspace(materializationRuntime)
+      ? [`Your only job in this single bounded turn is to write the required worker-result JSON object to: ${resultPath}`, "Then return that same JSON object as the final message."]
+      : ["Your sandbox is read-only, so write no file: your only job in this single bounded turn is to return the required worker-result JSON object as the final message."]),
   ].join("\n\n"), materializationRuntime);
   let baseline;
   try {

package/src/engine/process.mjs

@@ -396,6 +396,7 @@ export async function sealBeforeTerminate(job, timeout) {
       runId: job.contract.id,
       nodeId: job.node.id,
       attempt: job.state.attempt,
+      exclude: job.state.verificationArtifacts,
     });
     job.state.worktree = {
       ...job.state.worktree,

package/src/engine/result-file.mjs

@@ -143,11 +143,23 @@ export function resolveWorkerResult(runDir, node, providerResult) {
   return result;
 }
 /**
+ * A runtime that cannot write (`writable` false) is told its final message is
+ * the result, and `resolveWorkerResult` persists it: asking it to write the
+ * file is what stalled a read-only reviewer (RM-058).
+ *
  * @param {string} prompt
  * @param {string} resultPath
+ * @param {boolean} [writable]
  * @returns {string}
  */
-export function workerProtocolPrompt(prompt, resultPath) {
+export function workerProtocolPrompt(prompt, resultPath, writable = true) {
+  if (!writable) {
+    return [
+      prompt,
+      "Controller worker protocol:",
+      "Your sandbox is read-only, so write no file: your final response is the result, exactly the required worker-result JSON object, and the controller persists it.",
+    ].join("\n\n");
+  }
   return [
     prompt,
     "Controller worker protocol:",

package/src/engine/settle.mjs

@@ -166,6 +166,7 @@ export async function settleDone(contract, node, state, runDir, lock, states, ca
       runId: contract.id,
       nodeId: node.id,
       attempt: state.attempt,
+      exclude: state.verificationArtifacts,
     });
     state.worktree = { ...state.worktree, commit: sealed.sha, status: "ready" };
     writeNode(runDir, state, lock);

package/src/engine/verify.mjs

@@ -8,9 +8,10 @@
  * catch. `recoverVerificationAttempts` reads back what a crashed controller had
  * already proved, so a resume does not pay for the same suite twice.
  */
-import { attemptWorkspace } from "../repo/worktree.mjs";
+import { attemptWorkspace, untrackedPaths } from "../repo/worktree.mjs";
 import { boundedUtf8, errorMessage } from "../util.mjs";
 import { compactVerification } from "../contract/verification.mjs";
+import { MAX_SCOPE_FINDING_PATHS } from "../contract/scope-findings.mjs";
 import { finalVerificationCommands, phaseTerminalNode, sharedVerificationCommands } from "../contract/final-verification.mjs";
 import { join } from "node:path";
 import { listNodeSnapshots, readNodeSnapshot } from "../run/node-store.mjs";
@@ -137,7 +138,11 @@ export async function executeControllerVerification(contract, runDir, node, stat
     attempts: [...(state.verification?.attempts ?? [])],
   };
   writeNode(runDir, state, lock);
-  const workspace = attemptWorkspace(state) ?? contract.cwd;
+  const attempt = attemptWorkspace(state);
+  const workspace = attempt ?? contract.cwd;
+  // The mark between "worker finished" and "verification ran": what was
+  // already untracked is the worker's, what appears after is the suite's.
+  const untrackedBefore = attempt ? new Set(untrackedPaths(attempt)) : null;
   const commands = [...node.taskPacket.verification, ...sharedVerificationCommands(contract), ...finalVerificationCommands(contract, node, settledSiblingIds(runDir, contract, node))];
   /** @param {VerificationAttempt} attempt @returns {VerificationProgress} */
   const progressFor = (attempt) => verificationProgress(attempt.commandIndex + 1, commands.length, /** @type {VerificationCommand|undefined} */ (commands[attempt.commandIndex])?.argv);
@@ -169,9 +174,39 @@ export async function executeControllerVerification(contract, runDir, node, stat
       attempts: verificationAttemptRecords(state),
     };
   }
+  if (attempt && untrackedBefore) {
+    const artifacts = verificationArtifacts(node, state, untrackedBefore, untrackedPaths(attempt));
+    if (artifacts.length) state.verificationArtifacts = artifacts;
+    else delete state.verificationArtifacts;
+  }
   writeNode(runDir, state, lock);
   return state.verification;
 }
+
+/**
+ * RM-052, measured on `rec-audit-remediation`: the target's suite wrote
+ * `rec-wav-test-<pid>.*` into its working directory, and 14 of them crossed
+ * the seal into the remediation branch. A path the verification leaves
+ * untracked, outside the packet's declared writes, is recorded here and kept
+ * out of the seal. An earlier pass's artifact stays recorded while it is
+ * still on disk, since the next pass sees it as already there. Bounded like
+ * scope findings; an artifact past the bound would still be sealed.
+ *
+ * @param {ValidatedNode} node
+ * @param {NodeSnapshot} state
+ * @param {Set<string>} before
+ * @param {string[]} after
+ * @returns {string[]}
+ */
+function verificationArtifacts(node, state, before, after) {
+  const files = new Set(node.taskPacket.writeFiles ?? []);
+  const roots = (node.taskPacket.writeRoots ?? []).map((root) => root.replace(/\/+$/u, ""));
+  const previous = new Set(state.verificationArtifacts ?? []);
+  return after
+    .filter((path) => !before.has(path) || previous.has(path))
+    .filter((path) => !files.has(path) && !roots.some((root) => path === root || path.startsWith(`${root}/`)))
+    .slice(0, MAX_SCOPE_FINDING_PATHS);
+}
 /**
  * @param {string} runDir
  * @param {NodeSnapshot} state

package/src/harnesses/codex/index.mjs

@@ -51,6 +51,7 @@ export const codexHarness = {
     field: "sandbox",
     executingModes: ["read-only", "workspace-write", "danger-full-access"],
     defaultMode: "workspace-write",
+    readOnlyModes: ["read-only"],
   },
 
   /** @param {import("../index.mjs").HarnessRuntime} runtime @returns {string} */

package/src/harnesses/index.mjs

@@ -55,7 +55,10 @@ const CAPABILITY_NAMES = new Set([
  * the value used when the contract omits that field. `null` means the harness
  * has no permission mode that can deny command execution.
  *
- * @typedef {{field: "permissionMode"|"sandbox", executingModes: string[], defaultMode: string}|null} PermissionExecutionPolicy
+ * `readOnlyModes` names the modes in which the provider cannot write its
+ * workspace, so the controller must not ask it to.
+ *
+ * @typedef {{field: "permissionMode"|"sandbox", executingModes: string[], defaultMode: string, readOnlyModes?: string[]}|null} PermissionExecutionPolicy
  */
 
 /** @typedef {{status: "done"|"no-op"|"blocked"|"failed"|"exhausted"|"stalled"|"canceled", result: string|null, continuationId: string|null, usage: {inputTokens: number|null, outputTokens: number|null, cacheReadInputTokens: number|null}, costUsd: number|null, error: {code: string, message: string, resetAt?: string|null}|null, exhaustedUntil?: string|null, judgeCandidates?: number}} ProviderEnvelope */
@@ -154,6 +157,20 @@ export function resolvePermissionExecution(runtime) {
   return { executes: policy.executingModes.includes(mode), field: policy.field, mode, executingModes: policy.executingModes };
 }
 
+/**
+ * Whether a runtime can write its workspace. False only in a mode its adapter
+ * declares read-only; RM-058 measured a codex reviewer under `read-only`
+ * whose result-file write was rejected and which then stalled for 300s.
+ *
+ * @param {{harness: string, permissionMode?: string, sandbox?: string}} runtime
+ * @returns {boolean}
+ */
+export function writesWorkspace(runtime) {
+  const policy = getHarness(runtime.harness).permissionExecution;
+  if (!policy?.readOnlyModes) return true;
+  return !policy.readOnlyModes.includes(/** @type {string} */ (runtime[policy.field] ?? policy.defaultMode));
+}
+
 /**
  * The vendor a harness talks to when no provider configuration says
  * otherwise. `replay` and `exec-jsonl` stand in for whatever the recording or