faberun 0.26.3 → 0.28.0

package/src/contract/definition-of-done.mjs

@@ -1,4 +1,6 @@
 import { rejectUnknown, requireId, requireString } from "./assert.mjs";
+import { errorMessage, shellWords } from "../util.mjs";
+import { Script } from "node:vm";
 /**
  * Schema 2 Definition of Done items. Each item is an object that names an
  * observable outcome and declares how it is proven: mechanically through a
@@ -210,5 +212,112 @@ export function unquotedFilterValueWarnings(items, index) {
   return warnings;
 }
 
+/**
+ * The body of an inline `node -e`/`node --eval` script named by a command
+ * proof's shell command, or null when the command carries none. The proof runs
+ * through a shell, so the body is the next shell word with its quotes removed:
+ * `shellWords` expands and escapes nothing, which is also how the shell hands
+ * the body to node. `-e` belongs to other commands too (`grep -e` the common
+ * one), so a scan only starts at a token that names the node binary.
+ *
+ * @param {string} commandText
+ * @returns {string|null}
+ */
+export function inlineScriptBody(commandText) {
+  const tokens = shellWords(commandText);
+  for (let index = 0; index < tokens.length; index += 1) {
+    if (!isNodeExecutable(tokens[index])) continue;
+    for (let position = index + 1; position < tokens.length; position += 1) {
+      const token = tokens[position];
+      if (SHELL_SEPARATORS.has(token)) break;
+      if (token === "-e" || token === "--eval") {
+        const body = tokens[position + 1];
+        return body === undefined || SHELL_SEPARATORS.has(body) ? null : body;
+      }
+      if (token.startsWith("--eval=")) return token.slice("--eval=".length);
+      if (token.startsWith("-e=")) return token.slice("-e=".length);
+    }
+  }
+  return null;
+}
+
+/**
+ * The syntax error a `node -e`/`node --eval` body names, or null when the
+ * command is not an inline script or its body parses. `vm.Script` is node's
+ * own grammar for `-e`; the two shapes node's module wrapper accepts but a
+ * classic script does not -- top-level `await` and static ESM syntax -- are
+ * re-tried or allowed rather than refused, so a valid proof is never refused
+ * for a body this check cannot parse. A genuine error in the tail of an
+ * awaited body still surfaces through the async re-try.
+ *
+ * @param {string} commandText
+ * @returns {string|null}
+ */
+export function inlineScriptParseError(commandText) {
+  const body = inlineScriptBody(commandText);
+  return body === null ? null : scriptSyntaxError(body);
+}
+
+/**
+ * Refuse a contract whose command proof is an inline script that does not
+ * parse, naming the node and the Definition of Done item. The launch calls
+ * this before the first dispatch: a body the parser rejects can never exit 0,
+ * so every attempt would be spent on work no delivery could satisfy.
+ *
+ * @param {{id?: unknown, definitionOfDone?: {id?: unknown, proof?: {kind?: unknown, ref?: unknown}}[]}[]} nodes
+ * @returns {void}
+ */
+export function assertInlineScriptProofsParse(nodes) {
+  for (const node of nodes) {
+    for (const item of node.definitionOfDone ?? []) {
+      if (item.proof?.kind !== "command" || typeof item.proof.ref !== "string") continue;
+      const parseError = inlineScriptParseError(item.proof.ref);
+      if (parseError === null) continue;
+      const nodeName = node.id === undefined ? "a node" : `node ${node.id}`;
+      throw new TypeError(`${nodeName}, Definition of Done item "${item.id}": the proof command's inline script does not parse: ${parseError}`);
+    }
+  }
+}
+
+/** @param {string} token @returns {boolean} */
+function isNodeExecutable(token) {
+  const base = (token.split(/[\\/]/u).pop() ?? token).toLowerCase();
+  return base === "node" || base === "nodejs" || base === "node.exe";
+}
+
+/**
+ * @param {string} body
+ * @returns {string|null}
+ */
+function scriptSyntaxError(body) {
+  try {
+    void new Script(body);
+    return null;
+  } catch (error) {
+    const message = errorMessage(error);
+    if (AWAIT_OUTSIDE_ASYNC.test(message)) {
+      try {
+        // The rest of the body still has to parse, so an unparsable tail is
+        // refused even when the head needed the async wrapper to parse at all.
+        void new Script(`(async () => {\n${body}\n})`);
+        return null;
+      } catch (wrapped) {
+        const wrappedMessage = errorMessage(wrapped);
+        return MODULE_SYNTAX.test(wrappedMessage) ? null : wrappedMessage;
+      }
+    }
+    // node's `-e` accepts static imports, exports and `import.meta`; no stable
+    // API parses a module here, so a module-only diagnostic is not a syntax
+    // error this check can prove and the body is allowed.
+    return MODULE_SYNTAX.test(message) ? null : message;
+  }
+}
+
+/** vm.Script's diagnostics for syntax node's `-e` module wrapper accepts. */
+const AWAIT_OUTSIDE_ASYNC = /await is only valid in async functions|^Unexpected reserved word$/u;
+const MODULE_SYNTAX = /Cannot use import statement outside a module|Cannot use 'import\.meta' outside a module|Unexpected token 'export'/u;
+/** Shell tokens that end one command, so a later `-e` is not this node's. */
+const SHELL_SEPARATORS = new Set(["&&", "||", "|", ";", "&", ">", ">>", "<"]);
+
 /** The node:test filter flags a `kind: "command"` proof's shell can split on an unquoted value. */
 const TEST_FILTER_FLAGS = ["--test-name-pattern", "--test-skip-pattern"];

package/src/contract/index.mjs

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import { readFileSync, statSync } from "node:fs";
 import { dirname, resolve } from "node:path";
-import { loadTaskPacket, renderWorkerPrompt } from "./task-packet.mjs";
+import { loadTaskPacket, renderWorkerPrompt, validateEnvPassthrough } from "./task-packet.mjs";
 import { RESERVED_ARTICLES } from "./articles.mjs";
 import { judgmentReasonWarnings, unquotedFilterValueWarnings, validateDefinitionOfDone } from "./definition-of-done.mjs";
 import { validateFinalVerification, validateSharedVerification } from "./final-verification.mjs";
@@ -37,7 +37,7 @@ const CONTRACT_FIELDS = new Set([
   "schemaVersion", "contractVersion", "id", "campaignId", "goal", "cwd", "sourceIdentity",
   "maxParallel", "pollIntervalMs", "stallTimeoutSec", "timeoutSec", "maxTurns", "phaseSessionReuse",
   "runtimeDefaults", "runtimes", "nodes", "warnings", "finalVerification", "sharedVerification", "nodeAdvisory", "judges",
-  "judgeIndependence",
+  "judgeIndependence", "envPassthrough",
 ]);
 const DEFAULTS_FIELDS = new Set(["worker", "judge"]);
 const NODE_FIELDS = new Set([
@@ -68,13 +68,13 @@ const GATE_REVIEWS = new Set(["none", "advisory", "blocking"]);
 
 /** @typedef {{mode: "execution"|"discovery"|"autonomous", objective: string, instructions: string[], readFiles: string[], writeFiles?: string[], writeRoots?: string[], symbols: string[], scopeAcknowledged?: string[], decisions: string[], nonGoals: string[], verification: VerificationCommand[]}} TaskPacket */
 
-/** @typedef {{harness: "claude"|"codex"|"agy"|"dsh"|"zcode"|"exec-jsonl"|"replay", model: string, reasoning?: string, sandbox?: "read-only"|"workspace-write"|"danger-full-access", permissionMode?: string, config?: Record<string, unknown>, printTimeout?: string, tools?: string[], executable?: string, args?: string[], versionArgs?: string[], maxArgvPromptBytes?: number, requiredCapabilities?: CapabilityRequirements, costRank?: number, fallback?: string, vendor: string, tier?: number|string, stallTimeoutSec?: number, maxConcurrent?: number}} ValidatedRuntime */
+/** @typedef {{harness: "claude"|"codex"|"agy"|"dsh"|"fx"|"zcode"|"exec-jsonl"|"replay", model: string, reasoning?: string, sandbox?: "read-only"|"workspace-write"|"danger-full-access", permissionMode?: string, config?: Record<string, unknown>, printTimeout?: string, tools?: string[], executable?: string, args?: string[], versionArgs?: string[], maxArgvPromptBytes?: number, requiredCapabilities?: CapabilityRequirements, costRank?: number, fallback?: string, vendor: string, tier?: number|string, stallTimeoutSec?: number, maxConcurrent?: number, envPassthrough?: string[]}} ValidatedRuntime */
 
 /** @typedef {{enabled: boolean, review?: ("none"|"advisory"|"blocking"), runtime?: string, failOn?: ("minor"|"major"|"critical")[], maxRevisions?: number, requiredCapabilities?: CapabilityRequirements, skipWhen?: {verificationGreen: true, maxChangedPaths: number}}} ValidatedGate */
 
 /** @typedef {{id: string, type: string, phase: string, requirementIds?: string[], runtime?: string, dependsOn: string[], taskPacket: TaskPacket, taskPacketFile?: string, prompt: string, definitionOfDone: import("./definition-of-done.mjs").DefinitionOfDoneItem[], gate: ValidatedGate, timeoutSec?: number, maxTurns?: number, requiredCapabilities: CapabilityRequirements, packetHash: string, sourceIdentity: SourceIdentity, replayPolicy: "safe"|"reconcile"|"never", sameProviderReview: boolean, humanStep?: {step: string, command: string}}} ValidatedNode */
 
-/** @typedef {{schemaVersion: number, contractVersion: string, id: string, campaignId: string, goal: string, cwd: string, sourceIdentity: SourceIdentity, runtimes: Record<string, ValidatedRuntime>, runtimeDefaults: {worker?: string, judge?: string}, judges?: string[], judgeIndependence?: "same-vendor", nodes: ValidatedNode[], maxParallel: number, pollIntervalMs: number, stallTimeoutSec: number, timeoutSec: number, maxTurns: number, phaseSessionReuse: boolean, finalVerification?: VerificationCommand[], sharedVerification?: VerificationCommand[], nodeAdvisory?: NodeAdvisoryPolicy, warnings: string[]}} ValidatedContract */
+/** @typedef {{schemaVersion: number, contractVersion: string, id: string, campaignId: string, goal: string, cwd: string, sourceIdentity: SourceIdentity, runtimes: Record<string, ValidatedRuntime>, runtimeDefaults: {worker?: string, judge?: string}, judges?: string[], judgeIndependence?: "same-vendor", nodes: ValidatedNode[], maxParallel: number, pollIntervalMs: number, stallTimeoutSec: number, timeoutSec: number, maxTurns: number, phaseSessionReuse: boolean, finalVerification?: VerificationCommand[], sharedVerification?: VerificationCommand[], nodeAdvisory?: NodeAdvisoryPolicy, envPassthrough?: string[], warnings: string[]}} ValidatedContract */
 /** @typedef {{costUsd?: number, durationSec?: number}} NodeAdvisoryPolicy */
 
 /** @typedef {"pending"|"running"|"done"|"no-op"|"blocked"|"failed"|"exhausted"|"stalled"|"canceled"} NodeStatus */
@@ -134,6 +134,9 @@ export function validateContract(raw, contractPath, options = {}) {
   requireId(raw.id, "contract.id");
   requireId(raw.campaignId, "contract.campaignId");
   requireString(raw.goal, "contract.goal");
+  // The contract-wide passthrough, unioned with each runtime's own at spawn
+  // time. Absent keeps every contract authored before the field valid.
+  if (raw.envPassthrough !== undefined) validateEnvPassthrough(raw.envPassthrough, "contract.envPassthrough");
 
   const contractDir = dirname(resolve(contractPath));
   const cwd = resolve(contractDir, typeof raw.cwd === "string" ? raw.cwd : ".");

package/src/contract/judge-independence.mjs

@@ -25,6 +25,24 @@ export function validateJudgeIndependence(value, label) {
   return value;
 }
 
+/**
+ * The `judgeIndependence` in force for a launch (R36): the contract's own
+ * declaration wins, and a contract that declares none inherits the machine
+ * config's opt-in. Both sources are already validated to the single accepted
+ * value before they reach here -- the contract by `validateJudgeIndependence`,
+ * the config by `isUserConfig` -- so this is a plain precedence read, not a
+ * second validation. A value neither source names (or a malformed raw config a
+ * test hands in) reads as no opt-in, exactly as an absent field would.
+ *
+ * @param {{judgeIndependence?: string}|null|undefined} contract
+ * @param {{judgeIndependence?: string}|null|undefined} config
+ * @returns {"same-vendor"|undefined}
+ */
+export function effectiveJudgeIndependence(contract, config) {
+  const mode = contract?.judgeIndependence ?? config?.judgeIndependence;
+  return mode === SAME_VENDOR_REVIEW_MODE ? SAME_VENDOR_REVIEW_MODE : undefined;
+}
+
 /**
  * Same-vendor mode's own admissibility rule for a worker/judge pair that
  * share a vendor: a judge model absent from the declared tier table can never

package/src/contract/runtime.mjs

@@ -10,6 +10,7 @@
  * validator to reach it.
  */
 import { assertObject, nonNegativeNumber, positiveInteger, positiveNumber, rejectUnknown, requireId, requireString, requireStringArray, requireTimestamp } from "./assert.mjs";
+import { validateEnvPassthrough } from "./task-packet.mjs";
 import { composeAssignments } from "../engine/runtime-discovery.mjs";
 import { harnessCapabilities, readOnlyModeOf, resolvePermissionExecution, resolveVendor, validateCapabilityRequirements, writesWorkspace } from "../harnesses/index.mjs";
 import { canonicalProvider } from "./provider.mjs";
@@ -25,9 +26,9 @@ import { stableJson } from "../util.mjs";
 const RUNTIME_FIELDS = new Set([
   "harness", "model", "reasoning", "sandbox", "permissionMode", "config", "printTimeout", "tools",
   "executable", "args", "versionArgs", "maxArgvPromptBytes", "requiredCapabilities", "costRank",
-  "fallback", "vendor", "tier", "pricing", "stallTimeoutSec", "maxConcurrent",
+  "fallback", "vendor", "tier", "pricing", "stallTimeoutSec", "maxConcurrent", "envPassthrough",
 ]);
-const RUNTIME_HARNESSES = new Set(["claude", "codex", "agy", "dsh", "zcode", "exec-jsonl", "replay"]);
+const RUNTIME_HARNESSES = new Set(["claude", "codex", "agy", "dsh", "fx", "zcode", "exec-jsonl", "replay"]);
 
 /**
  * The strategies a routing rule may name: how a rule consumes its `prefer`
@@ -150,6 +151,9 @@ function validateRuntimeValues(runtime, label, executableRequired) {
   if (runtime.args !== undefined) requireStringArray(runtime.args, `${label}.args`);
   if (runtime.versionArgs !== undefined) requireStringArray(runtime.versionArgs, `${label}.versionArgs`);
   if (runtime.maxArgvPromptBytes !== undefined) positiveInteger(runtime.maxArgvPromptBytes, `${label}.maxArgvPromptBytes`);
+  // Names only, on the runtime descriptor directly or on the contract: either
+  // one asks the worker allowlist to carry the variable through by name.
+  if (runtime.envPassthrough !== undefined) validateEnvPassthrough(runtime.envPassthrough, `${label}.envPassthrough`);
   if (runtime.costRank !== undefined) nonNegativeNumber(runtime.costRank, `${label}.costRank`);
   if (runtime.stallTimeoutSec !== undefined) positiveNumber(runtime.stallTimeoutSec, `${label}.stallTimeoutSec`);
   if (runtime.pricing !== undefined) validatePricing(runtime.pricing, `${label}.pricing`);

package/src/contract/scope-findings.mjs

@@ -87,3 +87,123 @@ export function verificationFailureWithScope(verdict, scope) {
     }],
   };
 }
+
+/** The additions a reauthor discovery pass may propose to a refused packet. */
+/** @typedef {{readFiles?: string[], writeFiles?: string[], scopeAcknowledged?: string[], symbols?: string[]}} ReauthorAdditions */
+
+/** The bounded journal record a reauthor attempt leaves behind. */
+export const MAX_REAUTHOR_PATHS = 64;
+
+/**
+ * A widened packet may not take over a write another node's packet already
+ * owns. `validateContract` catches a packet that does not close its own scope
+ * and a pair whose test one node cannot touch, but two nodes declaring the
+ * same write are each individually closed, so no per-packet check sees the
+ * collision. This names the owner the discovery pass must leave alone.
+ *
+ * @param {import("../contract/index.mjs").ValidatedNode[]} nodes every node of the contract
+ * @param {string} nodeId the node being widened
+ * @param {string[]|undefined} addedWriteFiles the writes the discovery pass proposes to add
+ * @returns {{path: string, nodeId: string, reason: string}[]}
+ */
+export function reauthorWriteConflicts(nodes, nodeId, addedWriteFiles) {
+  const added = new Set(addedWriteFiles ?? []);
+  if (added.size === 0) return [];
+  /** @type {{path: string, nodeId: string, reason: string}[]} */
+  const conflicts = [];
+  for (const node of nodes) {
+    if (node.id === nodeId) continue;
+    for (const path of node.taskPacket.writeFiles ?? []) {
+      if (!added.has(path)) continue;
+      conflicts.push({
+        path,
+        nodeId: node.id,
+        reason: `${path} is already declared in writeFiles by node ${node.id}; a widened packet may not take over another node's write`,
+      });
+    }
+  }
+  return conflicts;
+}
+
+/**
+ * The bounded journal record a reauthor attempt leaves: the widened packet the
+ * discovery pass proposed (`reauthorProposal`) and the hard budget it spent
+ * (`reauthorRounds`). It lives in `reauthor.jsonl` beside the run's events
+ * rather than on the node snapshot, so a proposal never moves the authored
+ * packet hash or asks the snapshot schema to carry a transient shape.
+ *
+ * @param {{
+ *   nodeId: string,
+ *   outcome: "applied"|"approval_required"|"rounds_exhausted",
+ *   riskTier: string,
+ *   budget: number,
+ *   roundsUsed: number,
+ *   additions: ReauthorAdditions|null|undefined,
+ *   packet: import("./task-packet.mjs").TaskPacket|null|undefined,
+ *   findings: string[]|null|undefined,
+ *   history: {round: number, accepted: boolean, additions?: ReauthorAdditions, findings?: string[]}[],
+ * }} entry
+ * @returns {Record<string, unknown>}
+ */
+export function reauthorProposalRecord({ nodeId, outcome, riskTier, budget, roundsUsed, additions, packet, findings, history }) {
+  /** @param {string[]|undefined} paths @returns {string[]} */
+  const bounded = (paths) => [...new Set(paths ?? [])].slice(0, MAX_REAUTHOR_PATHS);
+  return {
+    at: new Date().toISOString(),
+    node: nodeId,
+    outcome,
+    riskTier,
+    reauthorProposal: {
+      packet: packet ?? null,
+      addedReadFiles: bounded(additions?.readFiles),
+      addedWriteFiles: bounded(additions?.writeFiles),
+      addedScopeAcknowledged: bounded(additions?.scopeAcknowledged),
+      findings: (findings ?? []).slice(0, 8),
+    },
+    reauthorRounds: {
+      budget,
+      used: roundsUsed,
+      exhausted: outcome === "rounds_exhausted",
+      history: history.map((item) => ({
+        round: item.round,
+        accepted: item.accepted,
+        addedReadFiles: bounded(item.additions?.readFiles),
+        addedWriteFiles: bounded(item.additions?.writeFiles),
+        findings: (item.findings ?? []).slice(0, 8),
+      })),
+    },
+  };
+}
+
+/**
+ * The risk tier a frozen node's gate encodes: a disabled gate is low risk, a
+ * blocking review is high, an advisory review is standard. A contract does not
+ * carry the plan's own riskTier, so the gate it froze into is the durable
+ * statement of how much a widening of its packet is trusted.
+ *
+ * @param {import("../contract/index.mjs").ValidatedNode} node
+ * @returns {"low"|"standard"|"high"}
+ */
+export function reauthorRiskTier(node) {
+  if (!node.gate.enabled) return "low";
+  return node.gate.review === "blocking" ? "high" : "standard";
+}
+
+/**
+ * Whether a validated widening may be applied without an explicit operator
+ * yes. Mirrors the planning pipeline's `--approve-below`: `high` approves
+ * everything, `none` approves nothing, and the default `standard` approves
+ * everything but a high-risk node. `approve` overrides the threshold.
+ *
+ * @param {import("../contract/index.mjs").ValidatedNode} node
+ * @param {{approve?: boolean, approveBelow?: string}} [options]
+ * @returns {boolean}
+ */
+export function reauthorApproved(node, options = {}) {
+  if (options.approve === true) return true;
+  const approveBelow = options.approveBelow ?? "standard";
+  if (approveBelow === "high") return true;
+  if (approveBelow === "none") return false;
+  if (approveBelow !== "standard") throw new TypeError(`approveBelow must be one of standard, high, none: ${approveBelow}`);
+  return reauthorRiskTier(node) !== "high";
+}

package/src/contract/snapshot.mjs

@@ -11,6 +11,7 @@
 import { Buffer } from "node:buffer";
 import { MAX_SCOPE_FINDING_PATHS } from "./scope-findings.mjs";
 import { REVIEW_MODES } from "./review-modes.mjs";
+import { SAME_VENDOR_REVIEW_MODE } from "./judge-independence.mjs";
 import { assertObject, boundedString, nonNegativeInteger, nonNegativeNumber, positiveInteger, positiveNumber, rejectUnknown, requireId, requireInteger, requirePacketHash, requireString, requireTimestamp } from "./assert.mjs";
 import { stableJson } from "../util.mjs";
 import { isAbsolute } from "node:path";
@@ -26,11 +27,17 @@ import { validateWorkerResult } from "./worker-result.mjs";
 /** @typedef {import("./index.mjs").RunMetadata} RunMetadata */
 /** @typedef {import("./index.mjs").ValidatedNode} ValidatedNode */
 
+/** Hard byte ceiling for an operator's answer text, enforced where it is accepted. */
+export const OPERATOR_ANSWER_MAX_BYTES = 8 * 1024;
+
+/** Hard ceiling for the failure evidence of a `Previous attempt` section, in bytes. */
+export const PREVIOUS_ATTEMPT_EVIDENCE_MAX_BYTES = 8 * 1024;
+
 /**
- * Hard byte ceiling for an operator's answer text, matching the bounded
- * `Previous attempt` section a retry in place already enforces (retry.mjs).
+ * The whole persisted `Previous attempt` section: the bounded evidence, then
+ * the operator's answer carried whole under its heading (engine/retry.mjs).
  */
-export const OPERATOR_ANSWER_MAX_BYTES = 8 * 1024;
+const PREVIOUS_ATTEMPT_MAX_BYTES = PREVIOUS_ATTEMPT_EVIDENCE_MAX_BYTES + OPERATOR_ANSWER_MAX_BYTES + 64;
 
 const GATE_VERDICTS = new Set(["pass", "fail", "invalid_judge_output"]);
 const NODE_STATUSES = new Set(["pending", "running", "done", "no-op", "blocked", "failed", "exhausted", "stalled", "canceled"]);
@@ -203,7 +210,7 @@ export function validateNodeSnapshot(value, expectedNode = null) {
     if (typeof value.previousAttempt !== "string" || !value.previousAttempt.trim()) {
       throw new TypeError("node snapshot.previousAttempt must be a non-empty string");
     }
-    if (Buffer.byteLength(value.previousAttempt, "utf8") > 8 * 1024) throw new TypeError("node snapshot.previousAttempt exceeds 8192 bytes");
+    if (Buffer.byteLength(value.previousAttempt, "utf8") > PREVIOUS_ATTEMPT_MAX_BYTES) throw new TypeError(`node snapshot.previousAttempt exceeds ${PREVIOUS_ATTEMPT_MAX_BYTES} bytes`);
   }
   if (expectedNode) validateSnapshotBinding(value, expectedNode);
   if (Buffer.byteLength(JSON.stringify(value), "utf8") > 128 * 1024) throw new TypeError("node snapshot exceeds 131072 bytes");
@@ -508,12 +515,19 @@ function validateRoutingState(value, label) {
   if (value.judgeList !== undefined) validateJudgeListState(value.judgeList, `${label}.judgeList`);
   if (value.assignments !== undefined) {
     assertObject(value.assignments, `${label}.assignments`);
-    rejectUnknown(value.assignments, new Set(["worker", "judge", "composedWorker", "composedJudge"]), `${label}.assignments`);
+    rejectUnknown(value.assignments, new Set(["worker", "judge", "composedWorker", "composedJudge", "judgeIndependence"]), `${label}.assignments`);
     requireId(value.assignments.worker, `${label}.assignments.worker`);
     requireId(value.assignments.judge, `${label}.assignments.judge`);
     for (const key of ["composedWorker", "composedJudge"]) {
       if (value.assignments[key] !== undefined && typeof value.assignments[key] !== "boolean") throw new TypeError(`${label}.assignments.${key} must be boolean`);
     }
+    // R36: the effective judge-independence mode the launch composed under,
+    // recorded so a resume, brief or report reads the decision back. Only the
+    // one accepted mode may be persisted; its absence is the cross-vendor
+    // default.
+    if (value.assignments.judgeIndependence !== undefined && value.assignments.judgeIndependence !== SAME_VENDOR_REVIEW_MODE) {
+      throw new TypeError(`${label}.assignments.judgeIndependence must be "${SAME_VENDOR_REVIEW_MODE}"`);
+    }
   }
   if (value.availability !== undefined) {
     assertObject(value.availability, `${label}.availability`);

package/src/contract/task-packet.mjs

@@ -2,6 +2,7 @@ import { existsSync, lstatSync, readFileSync, realpathSync, statSync } from "nod
 import { Buffer } from "node:buffer";
 import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { validateVerificationCommands } from "./verification.mjs";
+import { RESERVED_OWNER_DECISIONS, uncoveredReservedOwnerDecisions } from "./articles.mjs";
 import { errorCode } from "../util.mjs";
 import { requireString, requireStringArray } from "./assert.mjs";
 
@@ -101,6 +102,25 @@ export function loadTaskPacket(node, contractDir, cwd, index, options = {}) {
   return validateTaskPacket(packet, index, cwd, options);
 }
 
+/**
+ * The `## Reserved owner decisions` section every worker prompt carries: the
+ * same list the judge reads, with the packet's own coverage spelled out, so an
+ * uncovered owner decision is refused with `blocked_context` instead of being
+ * chosen by a worker.
+ *
+ * @param {string[]} decisions
+ * @returns {string[]}
+ */
+function reservedOwnerDecisionsLines(decisions) {
+  const uncovered = uncoveredReservedOwnerDecisions(decisions);
+  return [
+    "## Reserved owner decisions",
+    `These decisions belong to the repository owner, never to this node: ${RESERVED_OWNER_DECISIONS.join(", ")}.`,
+    `Reserved decisions with no coverage in "Decisions already made": ${uncovered.length ? uncovered.join(", ") : "(none)"}.`,
+    "If the task requires taking an uncovered decision, do not choose it: return the blocked_context worker-result object naming the decision.",
+  ];
+}
+
 /**
  * @param {TaskPacket} packet
  * @param {string} nodeId
@@ -133,6 +153,8 @@ export function renderWorkerPrompt(packet, nodeId) {
     "## Decisions already made",
     ...bulletOrNone(packet.decisions),
     "",
+    ...reservedOwnerDecisionsLines(packet.decisions),
+    "",
     "## Non-goals",
     ...bulletOrNone(packet.nonGoals),
     "",
@@ -266,6 +288,28 @@ export function validateTaskPacket(packet, index, cwd, options = {}) {
   };
 }
 
+/**
+ * The environment-variable names an operator allows through to a worker, the
+ * one validator both the runtime descriptor and the contract share. The list
+ * is names only -- never values -- so it selects from the controller's own
+ * environment without carrying a secret of its own. A name is the portable
+ * shell shape: a letter or underscore, then letters, digits, or underscores.
+ *
+ * @param {unknown} value
+ * @param {string} label
+ * @returns {string[]}
+ */
+export function validateEnvPassthrough(value, label) {
+  if (!Array.isArray(value)) throw new TypeError(`${label} must be an array of environment-variable names`);
+  const names = /** @type {unknown[]} */ (value);
+  names.forEach((name, index) => {
+    if (typeof name !== "string" || !/^[A-Za-z_][A-Za-z0-9_]*$/u.test(name)) {
+      throw new TypeError(`${label}[${index}] must be an environment-variable name`);
+    }
+  });
+  return /** @type {string[]} */ (names);
+}
+
 /**
  * @param {string} path
  * @param {string} label
@@ -456,6 +500,8 @@ function renderDiscoveryPrompt(packet, nodeId) {
     "## Decisions already made",
     ...bulletOrNone(packet.decisions),
     "",
+    ...reservedOwnerDecisionsLines(packet.decisions),
+    "",
     "## Non-goals",
     ...bulletOrNone(packet.nonGoals),
     "",
@@ -484,7 +530,7 @@ function renderAutonomousPrompt(packet, nodeId) {
     packet.objective,
     "",
     "## Closed context",
-    "This autonomous context may inspect the repository read-only as needed. Edit only files beneath the listed write roots, and do not write outside those directory boundaries. If required context is unavailable, return the blocked_context worker-result object below.",
+    "This autonomous context may inspect the repository read-only as needed. The write roots below are the expected boundary, not a hard wall: a write outside them is allowed when the task requires it, and the result must name the path and the reason. Return the blocked_context worker-result object below only for context that is genuinely missing.",
     "",
     "## Instructions",
     ...numbered(packet.instructions),
@@ -501,6 +547,8 @@ function renderAutonomousPrompt(packet, nodeId) {
     "## Decisions already made",
     ...bulletOrNone(packet.decisions),
     "",
+    ...reservedOwnerDecisionsLines(packet.decisions),
+    "",
     "## Non-goals",
     ...bulletOrNone(packet.nonGoals),
     "",

package/src/contract/worker-result.mjs

@@ -25,6 +25,16 @@ const RESULT_LIMITS = Object.freeze({
  */
 export const DERIVED_WORKER_RESULT_FIELDS = Object.freeze(["changedFiles"]);
 
+/**
+ * The named classification a `workspace-write` sandbox earns when a toolchain
+ * is refused a write outside the worktree. It is a classification of the
+ * failure, not a worker-result status: the controller derives it from the
+ * failed command's output (`src/engine/run-command.mjs`) and records it beside
+ * the attempt, carrying the mode and the denied path, so what the operator
+ * reads says "sandbox", not "filesystem".
+ */
+export const SANDBOX_BLOCKED_WRITE = "sandbox_blocked_write";
+
 /**
  * A worker result that is well-formed JSON but breaks one of the byte
  * ceilings above. Typed, not a plain TypeError, so the repair prompt can name

package/src/engine/assignment.mjs

@@ -40,6 +40,37 @@ export async function runtimeAssignments(contract) {
     (node.runtime === undefined && contract.runtimeDefaults?.worker === undefined)
     || (node.gate.enabled && node.gate.runtime === undefined && contract.runtimeDefaults?.judge === undefined));
   const availability = needsComposition ? await discoverRuntimes(contract.runtimes, { cwd: contract.cwd }) : {};
+  return composeRuntimeAssignments(contract, availability);
+}
+
+/**
+ * Every declared runtime marked available, the catalogue a dry-run assignment
+ * reads. `validate` composes over this so a contract no live probe could
+ * rescue -- an omitted judge with no cross-vendor candidate, a same-vendor
+ * pair below the admitted tier, an exhausted judge list -- is refused at
+ * authoring time. Modeling unavailability here would make a contract's
+ * validity depend on the machine that happens to read it, when the point is
+ * to refuse what the launch would refuse whatever is up.
+ *
+ * @param {ValidatedContract} contract
+ * @returns {Record<string, RuntimeAvailability>}
+ */
+export function allRuntimesAvailable(contract) {
+  return Object.fromEntries(Object.keys(contract.runtimes).map((id) => [id, { available: true, exhaustedUntil: null, reason: "ready" }]));
+}
+
+/**
+ * The launch-time assignment minus discovery: the same machine-config
+ * narrowing, judge-list selection, and `composeAssignments` call
+ * `runtimeAssignments` runs once the availability catalogue is in hand. Kept
+ * synchronous so `validate` can ask what a launch would assign without
+ * probing a provider.
+ *
+ * @param {ValidatedContract} contract
+ * @param {Record<string, RuntimeAvailability>} availability
+ * @returns {{assignments: Record<string, {worker: string, judge: string, composedWorker: boolean, composedJudge: boolean}>, decisions: Record<string, {worker: {strategy: string|null, reason: string}, judge: {strategy: string|null, reason: string}}>, availability: Record<string, RuntimeAvailability>, judgeListStates: Record<string, JudgeListState|undefined>}}
+ */
+export function composeRuntimeAssignments(contract, availability) {
   const config = readUserConfig(process.env);
   const list = resolveJudgeList(contract, config);
   /** @type {Record<string, JudgeListState|undefined>} */
@@ -101,6 +132,20 @@ export async function runtimeAssignments(contract) {
     judgeListStates,
   };
 }
+
+/**
+ * Throw the refusal a launch-time assignment would raise for this contract,
+ * with every runtime given as available. This is the check `faberun validate`
+ * runs (R35) so a contract the launch would refuse is refused at authoring
+ * time, before a run directory or a provider is touched. A persisted run's
+ * contract is never passed here: its assignment is already frozen.
+ *
+ * @param {ValidatedContract} contract
+ * @returns {void}
+ */
+export function assertRuntimeAssignment(contract) {
+  composeRuntimeAssignments(contract, allRuntimesAvailable(contract));
+}
 /**
  * @param {ValidatedContract} contract
  * @param {string} runDir

package/src/engine/detach.mjs

@@ -27,6 +27,8 @@ import { randomUUID } from "node:crypto";
 import { unlinkSync } from "node:fs";
 import { sameProcessStartToken, validBootstrapNonce } from "../run/lock.mjs";
 import { bootstrapAckPath, bootstrapAttemptPath, readJson } from "../run/store.mjs";
+import { removeRunDirectory } from "../run/paths.mjs";
+import { runNeverHeldNode } from "./run-identity.mjs";
 import { delay, errorCode } from "../util.mjs";
 
 /** How long a detached child waits for its launcher to acknowledge. */
@@ -99,3 +101,19 @@ export function cleanupBootstrapNonce(runDir, nonce) {
   }
 }
 
+/**
+ * Remove a run directory that died before it could hold a node, so the next
+ * launch is not refused with `run already exists` because of evidence that
+ * never became a run. A directory that already holds a node is left exactly
+ * where it is: that evidence is what a resume reads. Returns whether the
+ * directory was removed.
+ *
+ * @param {string} runDir
+ * @returns {boolean}
+ */
+export function discardNodeLessRunDirectory(runDir) {
+  if (!runNeverHeldNode(runDir)) return false;
+  removeRunDirectory(runDir);
+  return true;
+}
+

package/src/engine/gate.mjs

@@ -33,6 +33,7 @@ import { dirname } from "node:path";
 import { spawn } from "node:child_process";
 import { NOTIFY_ENV_NAMES } from "../notify/index.mjs";
 import { killTarget, spawnInvocation } from "../host/platform.mjs";
+import { baseEnvironment } from "./worker-env.mjs";
 
 /** @typedef {{executable: string, args: string[], cwd: string, promptTransport: "stdin"|"argv", harness: string, env: Record<string, string|null>|null, stdoutPath: string, stderrPath: string}} GateConfig */
 
@@ -164,10 +165,17 @@ function capLog(path, preservePrefix = false) {
 
 /** @returns {Record<string, string|undefined>} */
 function childEnv() {
-  const merged = { ...process.env };
+  // The worker/judge allowlist. The base operating-system names come from this
+  // process; the runtime-specific names (adapter-declared, `*.env_key`, and
+  // every explicit envPassthrough) travelled here in the gate config because
+  // only the controller knows the runtime. A controller variable nothing named
+  // is absent from `config.env`, so it never reaches the provider. Never start
+  // from `{ ...process.env }`: that was the leak (an exported `AWS_*` or
+  // `GITHUB_TOKEN` handed to a model that runs arbitrary commands).
+  const merged = baseEnvironment(process.env);
   for (const [key, value] of Object.entries(config.env ?? {})) {
     if (value === null) delete merged[key];
-    else merged[key] = value;
+    else if (value !== undefined) merged[key] = value;
   }
   // Worker providers are not a notification surface: strip every controller-only
   // transport after the harness overlay so no harness can reintroduce one. The